Benign Download

popularity.html

Loads external script elementEncoded payload detected: xor

SHA-2562ea36738760c7c9cecac5aa7497c893d7ebb41a937b9b932be220ecc07ec200f

URLhttps://web.archive.org/web/20080517011912/http://weblogs.mozillazine.org/roadmap/archives/2008/04/popularity.html

Evidence

Loads external script element lines 3–6

3<html xmlns="http://www.w3.org/1999/xhtml">
4<head><script type="text/javascript" src="https://web-static.archive.org/_static/js/bundle-playback.js?v=2N_sDSC0" charset="utf-8"></script>
5<script type="text/javascript" src="https://web-static.archive.org/_static/js/wombat.js?v=o9P2E1FK" charset="utf-8"></script>
6<script>window.RufflePlayer=window.RufflePlayer||{};window.RufflePlayer.config={"autoplay":"on","unmuteOverlay":"hidden","showSwfDownload":true};</script>

Accesses browser document.cookie property lines 46–50

46function getCookie (name) {
  var prefix = name + '=';
  var c = document.cookie;
  var nullstring = '';
  var cookieStartIndex = c.indexOf(prefix);

HTML contains a catalog of external hyperlinks lines 105–108

105<div id="banner">
106<h1><a href="https://web.archive.org/web/20080517011912/http://weblogs.mozillazine.org/roadmap/" accesskey="1">Brendan's Roadmap Updates</a></h1>
107<h2></h2>
108</div>

Regex component marker lines 159–162

159<p>Whether that language should be Scheme was an open question, but Scheme was
160the bait I went for in joining Netscape. Previously, at SGI,
161<a href="https://web.archive.org/web/20080517011912/http://mjtemplate.org/">Nick Thompson</a> had turned me on to
162<a href="https://web.archive.org/web/20080517011912/http://mitpress.mit.edu/sicp/">SICP</a>.</p>

Encoded payload detected: xor lines 237–239

237<p>Probably not, based both on theoretical soundness concerns about crypto-hash
238algorithms, and on well-known
239<a href="https://web.archive.org/web/20080517011912/http://th.informatik.uni-mannheim.de/people/lucks/HashCollisions/">poisoning attacks</a>.</p>