generic_javascript_obfuscation in www.thenightseries.com

On 2019-07-09T23:43:28.695985+00:00 we found suspicious pattern generic_javascript_obfuscation, type: Suspicious, (JavaScript obfuscation is frequently used to hide malicious code (or with hope to protect intellectual property)) in the page https://www.thenightseries.com/kingdom-…

The suspicious code sample:

b'atob' … b'atob' … b'atob' … b'atob' … b'atob' … b'atob' … b'atob' … b'atob' … b'atob' … b'atob' … b'atob' … b'atob' … b'atob' … b'atob' … b'atob' … b'"application/json+oembed"' … b"'clearTimeoutIGhhcyBub3QgYmVlbiBkZWZpbmVk'" … b"'getExtentionDialyUrl'" … b"'recoveryWindowFunctions'" … b"'getBoundingClientRect'" … b"'broadcastQ2FsbHNpZ24='" … b"'zfgloadedinterstitial'" … b"'prepareProxyRedirect'" … b"'getElementsByTagName'" … b"'stopImmediatePropagation'" … b"'returnIChmdW5jdGlvbigpIHt9LmNvbnN0cnVjdG9yKCJyZXR1cm4gdGhpcyIpKCApKTs='" … b"'ysbgxkhyV304wlvihMej52buyoEq8tifqzwEa0da94hsVzgr3wk6qSmwgm36bsXvbndyyo5S9rnhrzygRg615jrqw'" … b"'l2hYrezV8goE32zYk4oCfqzNwsoVrezLxqhHes6'" … b"'c8d4ouepC3fvm5ik8Pkrg8s2v7Dytij7w2rZx1xfuw05Ctxe9osinE9wxilwqwKb9wl2opfFokrbfi2fPh36tm12t'" … b"'7twC2f7O8rpKpteVv5wAqr7W7twG2f7HjhwQe37'"

This feature is experimental so please feel free to contact us if you feel any of the reported issues is a false positive or you want to suggest a pattern that should be detected (we are using Yara standard).

Fully automated RESTful API is now available. Subscribe for your free trial today!