Base64 & URL-encoded document body

To evade static analysis, the document body can be wrapped in several JavaScript functions such as decodeURIComponent and atob in order to evade analysis. This helps defeat simple scanners which don't evaluate JavaScript.

References

IOK Rule (edit) 

title: Base64 & URL-encoded document body
description: |
  To evade static analysis, the document body can be wrapped in several
  JavaScript functions such as `decodeURIComponent` and `atob` in order
  to evade analysis.
  This helps defeat simple scanners which don't evaluate JavaScript.
related:
  - id: hex-encoded-body
references:
  - https://urlscan.io/result/f6387380-2258-4113-8375-0195ecd1e268
  
detection:

  documentWriteBase64AndURLDecode:
    html|contains: "document.write(decodeURIComponent(atob("

  condition: documentWriteBase64AndURLDecode

tags:
  - anti-analysis