JavaScript_obfuscation in aadultlist.com

On 2019-08-07T03:55:25.880267+00:00 we found suspicious pattern JavaScript_obfuscation, type: Suspicious, (JavaScript obfuscation is frequently used to hide malicious code (or with hope to protect intellectual property)) in the page http://aadultlist.com/?x=4329.

The suspicious code sample:

b'var _0x54cfe6' … b'var _0x4c28e3' … b'var _0x45353b' … b'var _0x5129f7' … b'var _0x3f8f4d' … b'var _0x41e5e4' … b'var _0x4fa496' … b'var _0x2fd6a1' … b'var _0xe3490a' … b'var _0x47f081' … b'var _0x31aada' … b'var _0x3809c5' … b'var _0x3af8a7' … b'var _0x440616' … b'var _0x1eecd3' … b'var _0x30f3a9' … b'var _0x3d4ad1' … b'var _0x25c9a5' … b'var _0x511c3c' … b'var _0x55bdc9' … b'var _0xd87e1b' … b'var _0x4f2b50' … b'var _0x428e58' … b'var _0x20ed80' … b'var _0x3e2e62' … b'var _0x433ff0' … b'var _0x533a8d' … b'var _0x25c572' … b'var _0x259eee' … b'var _0x32d880' … b'var _0x2f06c9' … b'var _0x2bb9d7' … b'var _0x483076' … b'var _0x54af76' … b'var _0x2dc803' … b'var _0x31747b' … b'var _0x1a079c' … b'var _0x14ceda' … b'var _0x29d8a5' … b'var _0x547d1d' … b'var _0x12e194' … b'var _0x52e7a9' … b'var _0x285f96' … b'var _0x2cd9fe' … b'var _0x724273' … b'var _0x4ed59e' … b'var _0x29420e' … b'var _0x1e9e29' … b'var _0x1e9e29' … b'_0x117e5d=_0x117e5d' … b'_0x45353b=_0x487c1c' … b'_0x5129f7=_0x487c1c' … b'_0x3f8f4d=_0x487c1c' … b'_0x41e5e4=_0x487c1c' … b'_0x4fa496=_0x487c1c' … b'_0xe3490a=_0x511c3c' … b'_0xe3490a=_0x511c3c' … b'_0x2bb9d7=_0xe3490a' … b'_0xf7f1c5=_0x294413' … b'_0x114b6c=_0x294413' … b'_0xf7f1c5=_0xf7f1c5' … b'_0x14ceda=_0x14ceda' … b'_0x29d8a5=_0x14ceda' … b'_0x547d1d=_0x111c18' … b'_0x221b00=_0x221b00' … b'_0x54cfe6(' … b'_0x25992d(' … b'_0x2b2555(' … b'_0x1a6260(' … b'_0x25992d(' … b'_0x2b2555(' … b'_0x2dc803(' … b'_0x111c18(' … b'_0x1a6260(' … b'_0x25992d(' … b'_0x285f96(' … b'_0x111c18(' … b'_0x1a079c(' … b'_0x2b2555(' … b'_0x2cd9fe(' … b'_0x483076(' … b'_0x5c2d3a(' … b'_0x5c2d3a(' … b'_0x5c2d3a(' … b'function _0x25992d(' … b'function _0x2b2555(' … b'function _0x1a6260(' … b'function _0x111c18(' … b'return _0x4c28e3' … b'return _0x433ff0' … b'return _0xe3490a' … b'return _0xe3490a'

This feature is experimental so please feel free to contact us if you feel any of the reported issues is a false positive or you want to suggest a pattern that should be detected (we are using Yara standard).

Fully automated RESTful API is now available. Subscribe for your free trial today!