Windows Analysis Report
https://file-exchange.doc-extension.com/HXxGM/

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": true,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": true,
    "reasoning": "The URL contains potentially suspicious keywords like 'file-exchange' and 'doc-extension' which are commonly used in malicious file sharing schemes. The domain appears to be a third-party hosting service rather than a well-known legitimate file sharing platform."
}

URL: https://file-exchange.doc-extension.com

{
    "risk_score": 3,
    "reasoning": "The provided JavaScript snippet appears to be a simple function that submits the first form on the page. This behavior is relatively low-risk, as it does not exhibit any high-risk indicators like dynamic code execution, data exfiltration, or obfuscation. However, the lack of context around the purpose and usage of this function warrants a moderate risk score due to the potential for abuse or unintended consequences."
}

            function EchoTwilight() {
                document.forms[0].submit();
            }
        

{
    "risk_score": 7,
    "reasoning": "The script demonstrates several high-risk behaviors, including dynamic code execution through the use of `atob()` to decode a potentially malicious string, and the use of obfuscated query strings to retrieve data. While the script may have a legitimate purpose, the combination of these factors suggests a medium to high risk of malicious intent."
}

        
        const away = (name) => {
            name = name.replace(/[\[]/, '\\[').replace(/[\]]/, '\\]');
            var regex = new RegExp('[\\?&]' + name + '=([^&#]*)');
            var results = regex.exec(location.search); // Id excepteur laboris do flank turducken enim chicken, velit aliquip pastrami shank. Exercitation fatback incididunt, ex pancetta voluptate tri-tip tail. Ullamco elit ham hock adipisicing t-bone. Ham hock t-bone irure, excepteur fatback porchetta sunt occaecat laboris in ex corned beef. Brisket et esse cupim dolor pork chop meatball chislic pastrami bacon adipisicing. Porchetta shankle qui bresaola. Short ribs ea filet mignon, kielbasa turducken do est quis ground round. Turkey jerky consequat eu prosciutto short ribs picanha deserunt ipsum ex landjaeger. Nostrud strip steak consequat andouille. Hamburger tenderloin pancetta meatball aute et brisket reprehenderit shoulder laborum andouille. Aute frankfurter incididunt, aliqua strip steak do cupidatat. Landjaeger corned beef adipisicing, sed exercitation capicola sirloin pariatur cillum pancetta minim turkey rump. Jowl dolore burgdoggen, ut deserunt spare ribs shank short loin laborum meatball ham hock non alcatra quis ex. Tenderloin beef nulla, prosciutto dolore do ham hock lorem. Filet mignon pig shankle, nisi bresaola turducken ex lorem ea dolore.
            return results === null ? '' : decodeURIComponent(results[1].replace(/\+/g, ' '));
        } // Mollit boudin kevin ullamco picanha landjaeger qui, hamburger short ribs chislic filet mignon laboris jowl jerky voluptate. Laborum salami fatback in ex filet mignon pig chicken bacon aute velit meatloaf. Aliqua swine ham hock nostrud, filet mignon duis occaecat. Dolore leberkas brisket eiusmod aute spare ribs. Et labore meatloaf sed swine chuck buffalo ullamco qui alcatra pig bacon deserunt. Meatloaf chicken in consectetur fatback flank adipisicing consequat. Mollit sausage aliqua lorem exercitation jowl ullamco in occaecat. Andouille eu ex elit consequat adipisicing, frankfurter pariatur meatloaf ad. In laborum kielbasa, cow pastrami non aute alcatra cupidatat laboris drumstick. Swine porchetta beef, chuck dolore jowl biltong tenderloin. Boudin tenderloin dolore capicola magna hamburger laborum veniam mollit anim biltong deserunt frankfurter. Brisket alcatra ham hock, cupim commodo cupidatat tempor excepteur. Tenderloin est pariatur alcatra sausage t-bone. Pancetta voluptate pork chop pig rump doner eu alcatra frankfurter short loin. Chicken ut do pariatur excepteur.

        rh13z8jemt = away('e') == '' ? rh13z8jemt : away('e');
        rh13z8jemt = atob(rh13z8jemt);
    

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Cloudflare"
  ]
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "Next",
  "text_input_field_labels": [
    "Email, phone, or Skype"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Microsoft"
  ]
}

```json{  "legit_domain": "microsoft.com",  "classification": "wellknown",  "reasons": [    "The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'.",    "The URL 'file-exchange.doc-extension.com' does not match the legitimate domain 'microsoft.com'.",    "The URL contains multiple hyphens and an unusual domain structure, which is often indicative of phishing.",    "The domain 'doc-extension.com' is not commonly associated with Microsoft services.",    "The presence of input fields for 'Email, phone, or Skype' suggests an attempt to collect sensitive information, which is a common phishing tactic."  ],  "riskscore": 9}
Google indexed: False