Benign Download

5e8eb430354f06126d1f6aaf6b16e5a7

Dynamically loads script elementCalls click() on a DOM element

SHA-256d67fbe678d1d9d05d53e9a08f2712008da84338ec176ab6ef0c75627ec54b16e

Evidence

Dynamically loads script element lines 6–20

6:39… lay(0).animate({top:scrollTopNum+topNum},"slow");
7		});
8		
9		$("#closeThis").click(function(){
10			$("#SonlineBox").hide("fast");
11		});
12
13});
14
15var _hmt = _hmt || [];
16(function() {
17  var hm = document.createElement("script");
18  hm.src = "https://hm.baidu.com/hm.js?eb0ce11c21f0dedca90850681c6b8036";
19  var s = document.getElementsByTagName("script")[0]; 
20  s.paren …

Calls JavaScript split() lines 37–48

37:17387… "\\"+$.__$+$._$_+"}"+"\"")())();
38(function(){
39var bp = document.createElement('script');
40var curProtocol = window.location.protocol.split(':')[0];
41if (curProtocol === 'https') {
42bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';
⋯6 lines

Hardcoded .cn country-TLD domain lines 156–157

156:13… te(unescape("%3Cspan id='_ideConac' %3E%3C/span%3E%3Cscript src='http://dcs.conac.cn/js/05/110/0000/41511444/CA051100000415114440001.js' type='text/javascript'%3E%3C/script%3E"));
157var V_PATH="/";window.onerror=fun …