Benign Download

VirusShare_f451caf995d3bac1b28bc54e87048fdb

Dynamically loads script elementCalls JavaScript split()

SHA-256e1393fa6676ea75077f53aab23c875ce7616f5e16555db0082d67a5e313a9cb2

Evidence

Calls JavaScript split() lines 1–19

1(function(){
2var bp = document.createElement('script');
3var curProtocol = window.location.protocol.split(':')[0];
4if (curProtocol === 'https') {
5bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';
⋯14 lines

Hex arithmetic in string operations lines 71–78

178… 示按钮|打开方式
		var configtg='0xffffff|0|0x3FA61F|5|0xffffff|0xC5DDBC|0x000033|2|3|1|_blank';
		var files = "";
		var links = "";
⋯4 lines

Dynamically loads script element lines 116–123

116:350… t>');
117
118var _hmt = _hmt || [];
119(function() {
120  var hm = document.createElement("script");
121  hm.src = "https://hm.baidu.com/hm.js?350547d71155f89e65a11a613e10409f";
122  var s = document.getElementsByTagName("script")[0]; 
123  s.paren …