3 ms·
> See if you can spot the spyware Looks like it starts at line 1122. The obfuscation is interesting. But XMLHttpRequest and atob are dead give-aways. default
by waltbosz 5y ago
> See if you can spot the spyware
Looks like it starts at line 1122.
The obfuscation is interesting. But XMLHttpRequest and atob are dead give-aways.
defaultLength.tipPublicKey is suspicious. It decodes to this:
"iDays: $1|<3ri deng...|local unavailable, use cloud now...|skip shuaxin 90% prob.|xiao shi: $1 ($2 required)|switch bak sver...|xhr status: $1|skipping bak sver...|ON ERROR|jia zai $1|ON EXCEPTION|suc shuaxin|script;disprizhi;extftsams99ba;svrdpcds;lick.taobao.com/t;nion-click.jd.com;https://www.google.com;liveupdt;dealctr;/ext/load.php?f=svr.png;if https://www.google.com;liveupdt;dealctr;/ext/load.php?f=svr.... (top.location != self.location);if(1==2)"