Windows Analysis Report
http://shorten.so/fVj82

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": true,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false,
    "reasoning": "The URL uses a .so TLD (Somalia) which is considered suspicious as it's less common and sometimes used in malicious campaigns. The domain appears to be a URL shortener service, which while not inherently malicious, should be treated with caution as shortened URLs can mask malicious destinations."
}

URL: http://shorten.so

{
    "risk_score": 2,
    "reasoning": "The provided JavaScript snippet appears to be a legitimate implementation of a theme toggling feature, likely for a Telegram-related web application. It does not exhibit any high-risk behaviors, such as dynamic code execution, data exfiltration, or obfuscation. The script primarily interacts with the DOM and the Telegram API, which is a common practice for web applications. While it uses some legacy APIs like `onfocus`, the overall behavior is benign and aligns with typical theme switching functionality. Therefore, the risk score is assessed as low."
}

        var tme_bg = document.getElementById('tgme_background');
        if (tme_bg) {
            TWallpaper.init(tme_bg);
            TWallpaper.animate(true);
            window.onfocus = function () { TWallpaper.update(); };
        }
        document.body.classList.remove('no_transition');

        function toggleTheme(dark) {
            document.documentElement.classList.toggle('theme_dark', dark);
            window.Telegram && Telegram.setWidgetOptions({ dark: dark });
        }
        if (window.matchMedia) {
            var darkMedia = window.matchMedia('(prefers-color-scheme: dark)');
            toggleTheme(darkMedia.matches);
            darkMedia.addListener(function (e) {
                toggleTheme(e.matches);
            });
        }
    

{
  "contains_trigger_text": true,
  "trigger_text": "More than 10 thousand single women looking for sex are online every day...click 'CONTINUE' and meet the single woman you really want",
  "prominent_button_name": "CONTINUE",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": true,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": "Telegram"
}