Benign Download

VirusShare_9b0cd170f077d46923bf8dc6ad4082f8

Dynamically loads script elementCalls JavaScript split()

SHA-256046814ffb26c87bd2a5f61c23dea1c7df60f293947104d060797a1af0824ab04

Evidence

Calls JavaScript split() lines 1–19

1(function(){
2var bp = document.createElement('script');
3var curProtocol = window.location.protocol.split(':')[0];
4if (curProtocol === 'https') {
5bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';
⋯14 lines

Dynamically loads script element lines 65–72

65    }
66
67var _hmt = _hmt || [];
68(function() {
69  var hm = document.createElement("script");
70  hm.src = "https://hm.baidu.com/hm.js?350547d71155f89e65a11a613e10409f";
71  var s = document.getElementsByTagName("script")[0]; 
72  s.paren …

Hex arithmetic in string operations lines 86–93

178… 示按钮|打开方式
		var configtg='0xffffff|0|0x3FA61F|5|0xffffff|0xC5DDBC|0x000033|2|3|1|_blank';
		var files = "";
		var links = "";
⋯4 lines