Benign Download

Trojan.JS.NoClose.c

HideMe controller routine

SHA-256a4069096c8ec30e5877c7a6cd743109310609001a4f197aeaba9f26b64cff267

MaleculeO(Er)

Evidence

HideMe controller routine lines 4–23

4:26… Type content="text/html; charset=windows-1252">
5<SCRIPT language=JavaScript> 
6<!--
7
8function HideMe(test){
9
10	if (test == 1) return;
⋯13 lines

English function-word token "the" lines 140–143

140:19… ;
141
142//unique[1]	= 43200;  if I remember right, the unique code is used to only display a page every 3 days, etc.
143//alt_url[1]	= 'http://adserv.inter …

English function-word token "that" lines 237–241

11… lose[count] == 1){ 		// not sure exactly what this does, so taking it out.  I think it closes the window previously opened or something like that.
windows[count] = open(url[count],"newWindow" + count,properties);
if (behind[count] == 1)
{
windows[count].blur();