Windows Analysis Report
z5z84fR7lS.pdf

{
  "risk_score": 1,
  "reasoning": [
    "No headers provided to analyze",
    "Cannot make security assessment without header information",
    "Default to low risk score due to lack of evidence"
  ]
}

Date: unknown

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false,
    "reasoning": "This appears to be a straightforward domain name using a common TLD (.com). While it contains a political name 'clinton', there's no immediate indication of brand spoofing or malicious intent. The structure is simple without any suspicious elements."
}

URL: http://clintonmakes.com

{
    "risk_score": 9,
    "reasoning": "This script demonstrates high-risk behavior, including dynamic code execution and data exfiltration. The use of the `window.onerror` event handler to call the `process()` function, which then redirects the user to an external domain, is a strong indicator of malicious intent. Additionally, the obfuscated variable name `a549476` suggests an attempt to conceal the script's purpose. Overall, this script poses a significant security risk and should be treated with caution."
}

function sleep(ms) { return new Promise(resolve => setTimeout(resolve, ms)); } async function process() { await sleep(0); if (window.location !== window.parent.location ) { top.location = "http://clintonmakes.com/215c/"; } else { window.location = "http://clintonmakes.com/215c/"; } } a549476= 63; window.onerror = process; process();

{
  "contains_trigger_text": true,
  "trigger_text": "grievance",
  "prominent_button_name": "View Complaint",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false,
  "page_classification": "unknown"
}

{
  "brands": [
    "Booking.com"
  ]
}