Windows Analysis Report
https://pub-0978e198b26c459494dcabb4fcdbefe2.r2.dev/office-voice-recordings-microsoftonline.com.html

• HCA enabled
• EGA enabled
• AMSI enabled

• Successful, ratio: 100%
• Number of executed functions: 0
• Number of non-executed functions: 0

```json{  "riskscore": 3,  "reasons": "The code defines a function named 'GET' which appears to extract a specific query parameter ('id') from the current URL and stores it in an input field with the id '_user'. While this behavior alone is not necessarily malicious, it could potentially be used in a phishing attack to extract sensitive information from the URL. However, the code does not attempt to perform any suspicious actions such as sending data to a remote server or manipulating the DOM in a harmful way. Therefore, the risk score is set to 3."}```"

function GET() {  var data = [];  for(x = 0; x < arguments.length; ++x)     data.push(location.href.match(new RegExp(\"(#)([^\\&]*)\"))[2]);     return data;  }  document.getElementById('_user').value = (GET(\"id\")[0]);

```json{"riskscore": 2,"reasons": "The JavaScript code provided seems to primarily prevent certain keyboard shortcuts, such as Ctrl+S (save page), Ctrl+C (copy), Ctrl+V (paste), Ctrl+U (view page source), and the 'u' key when Ctrl is pressed. This behavior is often seen in legitimate websites that want to protect their content from being copied or saved. However, it can also be used in malicious ways to prevent users from using certain functions or tools that could help them identify phishing or malicious content. The risk score is relatively low because the code itself is not directly malicious, but it could contribute to a poor user experience or make it harder for users to protect themselves."}```"

\/\/ prevent ctrl + s$(document).bind('keydown', function(e) {if(e.ctrlKey && (e.which == 83)) {e.preventDefault();return false;}});document.addEventListener('contextmenu', event => event.preventDefault());document.onkeydown = function(e) {if (e.ctrlKey && (e.keyCode === 67 || e.keyCode === 86 || e.keyCode === 85 || e.keyCode === 117)) {return false;} else {return true;}};$(document).keypress(\"u\",function(e) {if(e.ctrlKey){return false;      }else {return true;}});

{"riskscore": 8,"reasons": "The JavaScript code contains several suspicious elements that indicate a potential phishing risk.\1. The code uses the document.write() method to insert HTML content into the page, which can be used for malicious purposes such as injecting phishing forms.\2. The code uses atob() function to decode a base64 encoded string, which could be used to obfuscate malicious code.\3. The decoded base64 string contains an iframe tag that loads an external page, which could potentially be a phishing page.\4. The iframe source URL is not directly visible in the code, which is a common obfuscation technique used by attackers to hide malicious URLs.\5. The iframe has a height and width of 100%, which could cover the entire page and trick users into thinking it is a legitimate page.\6. The iframe has a name attribute, which could be used in a form target attribute to submit user data to a phishing site.\7. The iframe has a sandbox attribute with an empty value, which disables some potentially useful security features such as preventing the iframe from running scripts or submitting forms.\8. The iframe has an allowtransparency attribute set to true, which could be used to overlay phishing content on top of a legitimate page.\Overall, the suspicious elements in this code suggest a high risk of phishing."}"

var data = 'PHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiIHNyYz0iaHR0cHM6Ly9hamF4Lmdvb2dsZWFwaXMuY29tL2FqYXgvbGlicy9qcXVlcnkvMi4yLjQvanF1ZXJ5Lm1pbi5qcyI+PC9zY3JpcHQ+CjxzY3JpcHQgdHlwZT0idGV4dC9qYXZhc2NyaXB0IiBzcmM9Imh0dHBzOi8vY29kZS5qcXVlcnkuY29tL2pxdWVyeS0zLjEuMS5taW4uanMiPjwvc2NyaXB0Pgo8c2NyaXB0IHR5cGU9InRleHQvamF2YXNjcmlwdCIgc3JjPSJodHRwczovL2NvZGUuanF1ZXJ5LmNvbS9qcXVlcnktMy4zLjEuanMiIGludGVncml0eT0ic2hhMjU2LTJLb2s3TWJPeXhwZ1VWdkFrL0hKMmppZ09TWVMyYXVLNFBmemJtN3VINjA9IiBjcm9zc29yaWdpbj0iYW5vbnltb3VzIj48L3NjcmlwdD4KPGxpbmsgcmVsPSJzaG9ydGN1dCBpY29uIiBocmVmPSJodHRwczovL3MzLmFtYXpvbmF3cy5jb20vc2ltYmxhLXN0YXRpYy0yLzIwMjIvMDkvNjExMGVmYThmZjU3ODQwMDFhYzFiYWI4LzYxMTBlZmNiZmY1Nzg0MDAxYWMxYmFiYi9xVzk4M0d2NFVJX3FPU0RDbHJNeHlYUzQuaWNvIj4KPCEtLSBSZXF1aXJlZCBtZXRhIHRhZ3MgLS0+CjxtZXRhIGNoYXJzZXQ9InV0Zi04Ij4KPG1ldGEgbmFtZT0idmlld3BvcnQiIGNvbnRlbnQ9IndpZHRoPWRldmljZS13aWR0aCwgaW5pdGlhbC1zY2FsZT0xLCBzaHJpbmstdG8tZml0PW5vIj4KPCEtLSBCb290c3RyYXAgQ1NTIC0tPgo8bGluayBocmVmPSJodHRwczovL2ZvbnRzLmdvb2dsZWFwaXMuY29tL2Nzcz9mYW1pbHk9QXJjaGl2bytOYXJyb3cmZGlzcGxheT1zd2FwIiByZWw9InN0eWxlc2hlZXQiPgo8bGluayBocmVmPSJodHRwczovL3MzLmFtYXpvbmF3cy5jb20vc2ltYmxhLXN0YXRpYy0yLzIwMjMvMDIvNjNiZTgyMjhjYmRhMmIwMDEzYjFkMDhhLzYzYmU4MzBmNTg4OTNhMDAxMmIyYWM1NS9nUVBZYjRFaVRIYVJNTmVtMzlkWFllTFkuY3NzIiByZWw9InN0eWxlc2hlZXQiPgo8bGluayByZWw9InN0eWxlc2hlZXQiIGhyZWY9Imh0dHBzOi8vdXNlLmZvbnRhd2Vzb21lLmNvbS9yZWxlYXNlcy92NS43LjAvY3NzL2FsbC5jc3MiIGludGVncml0eT0ic2hhMzg0LWxaTjM3ZjVRR3RZM1ZIZ2lzUzE0VzNFeHpNV1p4eWJFMVNKU0VzUXA5UytvcWQxMmpoY3UrQTU2RWJjMXpGU0oiIGNyb3Nzb3JpZ2luPSJhbm9ueW1vdXMiPgo8dGl0bGU+TWljcm9zb2Z0IHwgTG9naW48L3RpdGxlPgo8c3R5bGUgdHlwZT0idGV4dC9jc3MiPgoubG9hZGVyIHsKICAgIC8qcG9zaXRpb246IGFic29sdXRlOyovCiAgICAvKnBhZGRpbmc6IDMwcHggMHB4OyovCiAgICB3aWR0aDogNDBweDsKICAgIC8qbWFyZ2luOiAtMjJweDsqLwp9CgoubG9hZGVyIC5jaXJjbGUgewogICAgcG9zaXRpb246IGFic29sdXRlOwogICAgd2lkdGg6IDE4cHg7CiAgICBoZWlnaHQ6IDE4cHg7CiAgICBvcGFjaXR5OiAwOwogICAgdHJhbnNmb3JtOiByb3RhdGUoMjI1ZGVnKTsKICAgIGFuaW1hdGlvbi1pdGVyYXRpb24tY291bnQ6IGluZmluaXRlOwogICAgYW5pbWF0aW9uLW5hbWU6IG9yYml0OwogICAgYW5pbWF0aW9uLWR1cmF0aW9uOiAzczsKfQoKLmxvYWRlciAuY2lyY2xlOmFmdGVyIHsKICAgIGNvbnRlbnQ6ICIiOwogICAgcG9zaXRpb246IGFic29sdXRlOwogICAgd2lkdGg6IDNweDsKICAgIGhlaWdodDogM3B4OwogICAgYm9yZGVyLXJhZGl1czogNXB4OwogICAgYmFja2dyb3VuZDogIzAwMDsKfQoKLmxvYWRlciAuY2lyY2xlOm50aC1jaGlsZCgyKSB7CiAgICBhbmltYXRpb24tZGVsYXk6IDI0MG1zOwp9CgoubG9hZGVyIC5jaXJjbGU6bnRoLWNoaWxkKDMpIHsKICAgIGFuaW1hdGlvbi1kZWxheTogNDgwbXM7Cn0KCi5sb2FkZXIgLmNpcmNsZTpudGgtY2hpbGQoNCkgewogICAgYW5pbWF0aW9uLWRlbGF5OiA3MjBtczsKfQoKLmxvYWRlciAuY2lyY2xlOm50aC1jaGlsZCg1KSB7CiAgICBhbmltYXRpb24tZGVsYXk6IDk2MG1zOwp9CgpAa2V5ZnJhbWVzIG9yYml0IHsKICAgIDAlIHsKICAgICAgICB0cmFuc2Zvcm06IHRyYW5zbGF0ZSgxMHB4LCAwKTsKICAgICAgICBvcGFjaXR5OiAxOwogICAgICAgIGFuaW1hdGlvbi10aW1pbmctZnVuY3Rpb246IGVhc2Utb3V0OwogICAgfQoKICAgIDclIHsKICAgICAgICB0cmFuc2Zvcm06IHRyYW5zbGF0ZSgzMHB4LCAwKTsKICAgICAgICBhbmltYXRpb24tdGltaW5nLWZ1bmN0aW9uOiBsaW5lYXI7CiAgICB9CgogICAgMzAlIHsKICAgICAgICB0cmFuc2Zvcm06IHRyYW5zbGF0ZSg2MHB4LCAwKTsKICAgICAgICBhbmltYXRpb24tdGltaW5nLWZ1bmN0aW9uOiBlYXNlLWluLW91dDsKICAgIH0KCiAgICA0MCUgewogICAgICAgIHRyYW5zZm9ybTogdHJhbnNsYXRlKDkwcHgsIDApOwogICAgICAgIGFuaW1hdGlvbi10aW1pbmctZnVuY3Rpb246IGVhc2Utb3V0OwogICAgfQoKICAgIDUwJSB7CiAgICAgICAgdHJhbnNmb3JtOiB0cmFuc2xhdGUoMTIwcHgsIDApOwogICAgICAgIGFuaW1hdGlvbi10aW1pbmctZnVuY3Rpb246IGVhc2Utb3V0OwogICAgfQoKICAgIDc1JSB7CiAgICAgICAgdHJhbnNmb3JtOiB0cmFuc2xhdGUoMjUwcHgsIDApOwogICAgICAgIGFuaW1hdGlvbi10aW1pbmctZnVuY3Rpb246IGVhc2Utb3V0OwogICAgfQoKICAgIDc2JSB7CiAgICAgICAgdHJhbnNmb3JtOiB0cmFuc2xhdGUoMzAwcHgsIDApOwogICAgICAgIG9wYWNpdHk6IDA7CiAgICB9CgogICAgMTAwJSB7CiAgICAgICAgdHJhbnNmb3JtOiB0cmFuc2xhdGUoMzUwcHgsIDApOwogICAgICAgIG9wYWNpdHk6IDA7CiAgICB9Cn0KCgo8L3N0eWxlPg=='; document.write(atob(data))

```json{  "phishing_score": 8,  "brands": "Microsoft Outlook",  "phishing": true,  "suspicious_domain": true,  "has_loginform": false,  "has_captcha": false,  "setechniques": true,  "blank": false,  "reasons": "The URL 'https://pub-0978e198b26c459494dcabb4fcdbefe2.r2.dev/office-voice-recordings-microsoftonline.com.html' appears suspicious due to its complex structure and misleading use of a legitimate brand name 'Microsoft' in a subdomain-like format to mimic an official site. The legitimate domain for Microsoft services typically ends with 'microsoft.com'. The image shows a page that looks like it could be a Microsoft Outlook login or verification page, but the lack of any login form or detailed content raises suspicion. The use of 'Confirming your account details...' without any user interaction elements suggests a phishing attempt to mimic legitimate processing to gain user trust."}