caionorder

Análise Alfred detalhada — bmpinfogeo.js / ActView ActiveView

Script analisado: https://scr.actview.net/bmpinfogeo.js
Arquivo local formatado: /tmp/bmpinfogeo_deep/bmpinfogeo.pretty.js
SHA-256 do original: ddf7cb729e8bfa6b46bc88bfc0c4f33df1f6f1b2c7729249adc8993dc4b6b210
Gist técnico anterior: https://gist.github.com/caionorder/395642de34011ad0ea96e06ec399b772

---

1. Minha leitura executiva

caionorder

function kvp(network, land_uri) {
    var MAX_LENGTH = 255;
    var COOKIE_DURATION = 2 * 60 * 60; // 2 horas em segundos
    var LAND_URI_COOKIE = 'land_uri';

    var urlParams = new URLSearchParams(window.location.search);
    var query = [];

    var UTM_PARAMS = [
        'utm_source',

caionorder

Análise do Script Malicioso cdn.mini-fier.com/jquery-1.12.4.min.js

Resumo

O arquivo hospedado em cdn.mini-fier.com/jquery-1.12.4.min.js NÃO contém jQuery. É uma VM JavaScript ofuscada de 372KB que:

1. Desofusca e executa código malicioso em runtime
2. Busca configuração remota de cdn.mini-fier.com/assets/list.json
3. Exibe overlays/modais enganosos sobre o conteúdo real do site
4. Usa conteúdo adulto como isca para cliques ("Tap below to watch my full video 🙈👇🏻")

caionorder

<style type="text/css">
.tg  {border-collapse:collapse;border-spacing:0;}
.tg td{border-color:black;border-style:solid;border-width:1px;font-family:Arial, sans-serif;font-size:14px;
  overflow:hidden;padding:10px 5px;word-break:normal;}
.tg th{border-color:black;border-style:solid;border-width:1px;font-family:Arial, sans-serif;font-size:14px;
  font-weight:normal;overflow:hidden;padding:10px 5px;word-break:normal;}
.tg .tg-0pky{border-color:inherit;text-align:left;vertical-align:top}
</style>
<table class="tg">
<thead>

caionorder

<?php

function somar_horas($time1, $time2) {
    $times = array($time1, $time2);
    $seconds = 0;
    foreach ($times as $time)
    {
      list($hour,$minute,$second) = explode(':', $time);
      $seconds += $hour*3600;
      $seconds += $minute*60;

caionorder

<?php


function somar_horas($inicio,$fim){
    
    $final       = new DateTime();
    $inicio      = DateTime::createFromFormat('H:i:s', $inicio);    
    $fim         = DateTime::createFromFormat('H:i:s', $fim);

    $val01       = $inicio->getTimestamp();

caionorder

<IfModule mod_rewrite.c>
	RewriteEngine on
	RewriteRule ^$ webroot/ [L]
	RewriteRule (.*) webroot/$1 [L]
</IfModule>

caionorder

YTo5MTp7aToxO2E6NTp7czo0OiJjb2RlIjtzOjExNTc6Ijw/cGhwIAokZGF0YSA9ICcyMDIwMDczMCc7CiRkb21pbmlvID0gJ2VtcHJlZ2Fyai5jb20nOwokc3ViZG9taW5pbyA9ICdFbXByZWdhcmonOwokaWRnXzEgPSB1bmlxaWQoKTsgCiRpZGZfMSA9IHVuaXFpZCgpOyAKPz4KPHNjcmlwdD4KZ29vZ2xldGFnLmNtZC5wdXNoKGZ1bmN0aW9uKCkgeyAgICAgICAgICAKICBnb29nbGV0YWcuZGVmaW5lU2xvdCgiLzIxODEyNTEzNTAzLzw/cGhwIGVjaG8gJGRvbWluaW8gPz4vPD9waHAgZWNobyAkc3ViZG9taW5pbyA/Pl9XRUJfU3F1YXJlX0NvbnRlbnQxX1Bvc3RzXzw/cGhwIGVjaG8gJGRhdGEgPz4iLFtbMjUwLCAyNTBdLFszMDAsIDI1MF0sWzMzNiwgMjgwXV0sICI8P3BocCBlY2hvICRpZGdfMSA/PiIpLmFkZFNlcnZpY2UoZ29vZ2xldGFnLnB1YmFkcygpKTsKICBnb29nbGV0YWcuZGVmaW5lU2xvdCgiLzIxODEyNTEzNTAzLzw/cGhwIGVjaG8gJGRvbWluaW8gPz4vPD9waHAgZWNobyAkc3ViZG9taW5pbyA/Pl9NT0JJTEVfSG9yaXpvbnRhbF9GaXhlZDFfQ29udGVudF88P3BocCBlY2hvICRkYXRhID8+IixbWzMyMCwgNTBdXSwgIjw/cGhwIGVjaG8gJGlkZl8xID8+IikuYWRkU2VydmljZShnb29nbGV0YWcucHViYWRzKCkpOyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgZ29vZ2xldGFnLnB1YmFkcygpLmVuYWJsZUxhenlMb2FkKHsKICAgIGZldGNoTWFyZ2luUGVyY2VudDogMjAwLCAgCiAgICByZW5kZXJNYXJnaW5QZXJjZW50OiAx

caionorder

<?php

namespace CaioNorder;

class About extends Me
{
    public function getCurrentWorkplace()
    {
 return [

caionorder

<?php

use Google\AdsApi\Common\OAuth2TokenBuilder;
use Google\AdsApi\AdManager\AdManagerSession;
use Google\AdsApi\AdManager\AdManagerSessionBuilder;
use Google\AdsApi\AdManager\Util\v201905\StatementBuilder;
use Google\AdsApi\AdManager\Util\v201908\AdManagerDateTimes;
use Google\AdsApi\AdManager\v201905\ServiceFactory;
use Google\AdsApi\AdManager\v201905\AdUnit as AdUnitApi;
use Google\AdsApi\AdManager\v201905\ArchiveAdUnits as ArchiveAdUnitsAction;