Windows Analysis Report
http://pomservicing.co.uk/pomservicing/Smtb/dGVzdF9tYWlsQGVtYWlsLmpw==%C3%A3%E2%82%AC%E2%80%9A$$%C3%A3%E2%82%AC%E2%80%9A/1/010001943914714a-a13d10fa-2f31-4a50-b2fa-f3854398d733-000000/CAe7zeJgIBBw_nSVrUkbbcG65_c=407

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: http://pomservicing.co.uk

{
    "risk_score": 8,
    "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution (via `atob()` function) and potential data exfiltration (extracting data from the URL query string). The use of obfuscated code and the presence of suspicious variable names further increase the risk. Overall, this script demonstrates a high likelihood of malicious intent and should be investigated thoroughly."
}

        
        const actress = (name) => {
            name = name.replace(/[\[]/, '\\[').replace(/[\]]/, '\\]');
            var regex = new RegExp('[\\?&]' + name + '=([^&#]*)');
            var results = regex.exec(location.search); // Turducken non fugiat labore est jerky laborum landjaeger short ribs filet mignon ipsum. Ball tip capicola esse pig, culpa velit laborum cow pastrami consequat laboris bacon. Ground round sed qui cillum picanha. Ut bresaola cupidatat pancetta, meatloaf voluptate sint. Id leberkas nostrud, shankle fugiat meatball consectetur aute rump buffalo chicken pork chop in est. Sausage corned beef prosciutto swine eu biltong rump. Veniam ball tip reprehenderit kielbasa culpa consequat incididunt tempor short loin chicken brisket minim. Pariatur shank turkey in burgdoggen sirloin velit ipsum bacon ball tip. Ut turducken porchetta ut bacon rump. Biltong culpa pastrami picanha cupim prosciutto labore landjaeger. Qui biltong boudin laboris culpa flank elit porchetta excepteur ut. Landjaeger sirloin ullamco shoulder labore pork loin pastrami rump exercitation fugiat. Deserunt burgdoggen ut, strip steak magna short loin cupim tail id commodo fatback in beef ribs occaecat nulla. Adipisicing shankle anim, pork loin pancetta t-bone duis short loin labore chicken venison meatloaf landjaeger aliqua. Dolore in occaecat sunt fatback velit.
            return results === null ? '' : decodeURIComponent(results[1].replace(/\+/g, ' '));
        } // Ut alcatra mollit officia tail dolore beef flank. Prosciutto turducken alcatra consectetur, in ham hock voluptate pariatur strip steak nisi consequat ribeye in et. Landjaeger pork fugiat brisket eiusmod incididunt do quis meatloaf shoulder veniam filet mignon id turducken. Leberkas fugiat ground round velit beef, et short ribs aute drumstick. Bacon porchetta nostrud dolore dolor aliqua short ribs est. Officia reprehenderit occaecat, fatback spare ribs beef filet mignon buffalo labore short loin turkey aliquip bresaola swine in. Cow swine prosciutto kevin pig lorem strip steak nisi. Hamburger turkey est ribeye esse, proident aliquip. Aliquip exercitation ipsum, laboris ham hock consequat reprehenderit. Kevin ball tip in ham id dolore. Picanha sint capicola, short loin turducken reprehenderit quis ground round laboris aliqua chicken doner. Ground round brisket ut pork belly nostrud cow magna pig ex elit ham shankle kielbasa esse picanha. Leberkas ham hock ut venison, chicken ut sint eiusmod voluptate. Doner bacon cupidatat, sunt ham hock laborum sed magna deserunt pariatur chuck ribeye. Short loin ham quis, voluptate jerky tenderloin consequat veniam non pariatur mollit chislic kielbasa.

        rh13z8jemt = actress('e') == '' ? rh13z8jemt : actress('e');
        rh13z8jemt = atob(rh13z8jemt);
    

{
    "risk_score": 2,
    "reasoning": "The provided JavaScript snippet appears to be a simple function that submits the first form on the page. This behavior is relatively low-risk and is likely part of legitimate website functionality, such as a form submission process. There are no indicators of high-risk activities like dynamic code execution, data exfiltration, or suspicious redirects. Therefore, the risk score is assessed as low."
}

            function BlazingPetal() {
                document.forms[0].submit();
            }
        

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Cloudflare"
  ]
}

{
  "brands": [
    "Cloudflare"
  ]
}

{
  "contains_trigger_text": true,
  "trigger_text": "We couldn't find an account with that username. Try another account.",
  "prominent_button_name": "Next",
  "text_input_field_labels": [
    "jnoe7q@dkb.org"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Microsoft"
  ]
}

{
"contains_trigger_text": false,
"trigger_text": "unknown",
"prominent_button_name": "next",
"text_input_field_labels": [
"jnoe7q@dkb.org"
],
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

```json{  "legit_domain": "docusign.com",  "classification": "wellknown",  "reasons": [    "The URL 'docusign.llra.ltd' does not match the legitimate domain 'docusign.com'.",    "The domain uses an unusual extension '.ltd' which is not associated with DocuSign.",    "The brand 'Microsoft' is not associated with the URL 'docusign.llra.ltd'.",    "The presence of a subdomain 'llra' is suspicious and not typical for DocuSign.",    "The email domain 'dkb.org' in the input fields does not match the brand or URL context."  ],  "riskscore": 9}
Google indexed: False

{
  "brands": [
    "Microsoft"
  ]
}

```json{  "legit_domain": "docusign.com",  "classification": "wellknown",  "reasons": [    "The URL 'docusign.llra.ltd' does not match the legitimate domain 'docusign.com'.",    "The domain 'llra.ltd' is unusual and not associated with Microsoft or DocuSign.",    "The brand 'Microsoft' is well-known, but the URL does not relate to Microsoft.",    "The presence of a well-known brand name like 'Microsoft' with an unrelated URL is a common phishing tactic.",    "The URL uses a less common domain extension '.ltd', which can be suspicious."  ],  "riskscore": 9}
Google indexed: False