Benign Download

VirusShare_359a4d6c92fb627513f0c3f42e3f718c

Dynamically loads script elementCalls JavaScript split()

SHA-25661d4758238236b590efa22bca9f2822fe453fadd2f055bf1c729be3ae2275f26

Evidence

Calls JavaScript split() lines 1–19

1(function(){
2var bp = document.createElement('script');
3var curProtocol = window.location.protocol.split(':')[0];
4if (curProtocol === 'https') {
5bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';
⋯14 lines

Dynamically loads script element lines 39–46

39:3… //-->
40
41var _hmt = _hmt || [];
42(function() {
43  var hm = document.createElement("script");
44  hm.src = "https://hm.baidu.com/hm.js?350547d71155f89e65a11a613e10409f";
45  var s = document.getElementsByTagName("script")[0]; 
46  s.paren …

Hex arithmetic in string operations lines 61–68

178… 示按钮|打开方式
		var configtg='0xffffff|0|0x3FA61F|5|0xffffff|0xC5DDBC|0x000033|2|3|1|_blank';
		var files = "";
		var links = "";
⋯4 lines