Windows Analysis Report
http://jooracces.com

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false
}

URL: http://jooracces.com

{
    "risk_score": 6,
    "reasoning": "The provided JavaScript snippet exhibits several behaviors that raise moderate security concerns. While it does not contain any high-risk indicators like dynamic code execution or data exfiltration, it includes several moderate-risk indicators such as external data transmission, fallback domains, and aggressive DOM manipulation. Additionally, the script interacts with potentially suspicious domains, which further increases the risk. Overall, the script requires further review due to its unclear or overly aggressive behavior, warranting a medium-risk score."
}

        window.showDownloadedTimeout = null;
        window.taskVerification = true;
        window.verificationVariant = 1;
        window.cfCaptchaVerification = false;
        window.cfCaptchaVerified = false;
        window.recaptchaVerification = false;
        window.recaptchaVerified = false;
        window.hintVariant = 1;
        window.content = null;
        window.verificationMinDelay = 8;
        window.verificationProgressOnClick = false;
        window.verificationProgress = 0;
        window.downloadProgress = 0;
        window.downloaded = false;

        function toggleDownloadStep(step) {
            let body = document.querySelector('body');

            body.classList.toggle('download-step-1', step === 1);
            body.classList.toggle('download-step-2', step === 2);
            body.classList.toggle('download-step-3', step === 3);
            body.classList.toggle('download-step-4', step === 4);
        }

        function downloadUrl() {
            let downloadUrl = 'https://red.stealth-guard.online/downloadproxy/intpgdirect/@CLICK_ID@/?ext_name=StealthGuard&cid=@CID@&tag=@OTID@&file=true';
            downloadUrl = downloadUrl.replace('@CLICK_ID@', uid());
            downloadUrl = downloadUrl.replace('@CID@', getParameterByName('cid', ''));
            downloadUrl = downloadUrl.replace('@OTID@', getParameterByName('otid', ''));

            return downloadUrl;
        }

        function triggerDownload() {
            download(downloadUrl());
        }

        function triggerPixel() {
            let pixelUrl = 'https://7proof.com/app/fr?type=l1&dp1=' + uid() + '&score=9';

            let img = document.createElement('img');
            img.src = pixelUrl;
            img.style.position = 'absolute';
            img.style.left = '-9999px';

            document.body.appendChild(img);
        }

        function triggerPixelDownload() {
            let pixelUrl = 'https://7proof.com/app/fr?type=l10&dp1=' + uid() + '&score=9';

            let img = document.createElement('img');
            img.src = pixelUrl;
            img.style.position = 'absolute';
            img.style.left = '-9999px';

            document.body.appendChild(img);
        }

        function showOverlay() {
            let overlay = document.querySelector('[data-part="overlay"]');
            overlay.addEventListener('click', () => overlay.classList.add('d-none'));
            overlay.classList.remove('d-none');
        }

        function hideOverlay() {
            document.querySelector('[data-part="overlay"]').classList.add('d-none');
        }

        function showPointer() {
            let overlay = document.querySelector('[data-part="overlay-pointer"]');
            overlay.addEventListener('click', () => overlay.classList.add('d-none'));
            overlay.classList.remove('d-none');
        }

        function showPointerArea() {
            let overlay = document.querySelector('[data-part="overlay-pointer-area"]');
            overlay.addEventListener('click', () => overlay.classList.add('d-none'));
            overlay.classList.remove('d-none');
        }

        function openDownloadedWindow() {
            showOverlay();

            let screenWidth = window.innerWidth;
            let screenHeight = window.innerHeight;
            let topMargin = 60;

            let height = 400,
                width = 450,
                left = (Math.ceil((screenWidth - width)/2) + window.screenLeft),
                top = (Math.ceil((screenHeight - height)/2) + topMargin + window.screenTop);

            const popup = window.open('', 'Downloading Window', 'width=' + width + ',height=' + height + ',left=' + left +
                ',top=' + top + ',menubar=no,toolbar=no,location=no');

            popup.document.write('\
                <!DOCTYPE html>\
                <html>\
                <head>\
                    <title>Download File</title>\
                    <style>\
                        body {\
          

{
    "risk_score": 3,
    "reasoning": "The provided JavaScript code appears to be a set of utility functions for handling cookies, URL parameters, and user identification. While it includes some potentially sensitive operations, such as setting cookies and generating unique user IDs, the overall behavior seems to be focused on common web development practices rather than any malicious intent. The code does not exhibit any high-risk indicators like dynamic code execution, data exfiltration, or redirects to suspicious domains. Some moderate-risk indicators, such as external data transmission and aggressive DOM manipulation, are present, but the context suggests these are likely for legitimate purposes like analytics and user tracking. Overall, the code appears to be a well-intentioned, if somewhat outdated, set of utility functions."
}

function getCookie(name)
{
    let namePart = name + '=',
        decodedCookie = decodeURIComponent(document.cookie),
        cookies = decodedCookie.split(';');

    for(let index = 0; index < cookies.length; index++) {
        let cookie = cookies[index];

        while (cookie.charAt(0) === ' ') {
            cookie = cookie.substring(1);
        }

        if (cookie.indexOf(namePart) === 0) {
            return cookie.substring(namePart.length, cookie.length);
        }
    }

    return null;
}

function setCookie(name, value, expireDays = 0, domain = '')
{
    domain = domain ? domain : location.host;
    let expires = '';

    if (expireDays) {
        let date = new Date();
        date.setTime(date.getTime() + (expireDays * 24 * 60 * 60 * 1000));

        expires = 'expires=' + date.toUTCString();
    }

    document.cookie = name + '=' + value + ';domain=.' + domain + ';path=/;' + expires;
}

function getPOption(name, defaultValue = null) {
    if (window.poptions) {
        return window.poptions[name] ?? defaultValue;
    }

    return defaultValue;
}

function getParameterByName(name, defaultValue = null)
{
    let parameter = getQueryParameterByName(name);

    if (parameter) {
        return parameter;
    }

    parameter = getPOption(name) ?? getCookie(name);

    return parameter ? parameter : defaultValue;
}

function getQueryParameterByName(name, url = window.location.href)
{
    let urlObject = new URL(url),
        urlParameters = urlObject.searchParams;

    return urlParameters.has(name) ? decodeURIComponent(urlParameters.get(name)) : null;
}

function uidGenerate(length)
{
    let result = '',
        characters = 'abcdefghijklmnopqrstuvwxyz',
        charactersLength = characters.length;

    for (let i = 0; i < length; i++) {
        result += characters.charAt(Math.floor(Math.random() * charactersLength));
    }

    return result;
}

function uid()
{
    let clickIdValue = clickId();

    if (clickIdValue) {
        return clickIdValue;
    }

    let subIdValue = subId();

    if (subIdValue) {
        return subIdValue;
    }

    let userId = getCookie('uid');

    if (!userId) {
        userId = uidGenerate(8);
        setCookie('uid', userId);
    }

    return userId;
}

function clickId()
{
    let clickIdValue = getParameterByName('clickid');

    if (clickIdValue) {
        return clickIdValue;
    }

    clickIdValue = getParameterByName('click-id');

    if (!clickIdValue) {
        return getParameterByName('click_id');
    }

    return clickIdValue;
}

function subId()
{
    let subIdValue = getParameterByName('subid');

    if (subIdValue) {
        return subIdValue;
    }

    subIdValue = getParameterByName('sub-id');

    if (!subIdValue) {
        return getParameterByName('sub_id');
    }

    return subIdValue;
}

function executeOnReady(callback) {
    if (document.readyState !== 'loading') {
        callback();
    } else {
        document.addEventListener('DOMContentLoaded', callback);
    }
}

function mixPanelInit()
{
    let userId = uid();

    mixpanel.init('9d1f06337c788fcd584725b02fc2e601', {debug: false, track_pageview: false, ignore_dnt: true});
    mixpanel.register({distinct_id: userId, $user_id: userId});
    mixpanel.identify(userId);
}

function mixPanelEvent(eventName, options = {})
{
    mixpanel.identify(uid());
    mixpanel.people.set_once(options);
    mixpanel.track(eventName, options);
}

function yandexGoal(goalName)
{
    if ('ym' in window) {
        ym(96921485, 'reachGoal', goalName);
    }
}

function downloadFromUrl(url)
{
    let downloadIframe = document.querySelector('.download-kit-frame');

    if (!downloadIframe) {
        downloadIframe = document.createElement('iframe');
        downloadIframe.setAttribute('style', 'position:absolute;top:-9999px;left:-9999px;visibility:hidden;width:1px;height:1px;border:0;');
        downloadIframe.classList.add('download-kit-frame');

        document.body.appendChild(downloadIframe);
    }

    downloadI

{
  "contains_trigger_text": true,
  "trigger_text": "Security Check",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": true,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "contains_trigger_text": true,
  "trigger_text": "Security Check",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": true,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": "unknown"
}

{
  "contains_trigger_text": true,
  "trigger_text": "Security Check",
  "prominent_button_name": "Continue clicking...",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": true,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": true,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": "unknown"
}

{
  "brands": "unknown"
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": "unknown"
}

{
  "brands": "unknown"
}