generic_javascript_obfuscation in lingdownsitat.pro

On 2019-10-04T20:02:05.792157+00:00 we found suspicious pattern generic_javascript_obfuscation, type: Suspicious, (JavaScript obfuscation is frequently used to hide malicious code (or with hope to protect intellectual property)) in the page https://lingdownsitat.pro/HCY?tag_id=69…

The suspicious code sample:

b'atob' … b'"eU5uY1UibFdNZ1tiTFVsTnlfUXdVbExPd0F8W1ZlSXpdVGRPelxQZkF8W1N3VWxeAG1AeFdbM1QqDAViVHoLAWVUdlkAYlR7WgFiTn5XUGYdKApBeVsMLSYwHyEKNg8/fTgHOikJLQshHDtWC2E9PyYBORZ/LSQ/Dj8oL2EjGAABZkkKWTU9LhYGVQc1ISoGYjURNCImQSsBFQ88IAUgBT5jAQsUHAo/DRkhditBeVs8Cwc8CysNF3dVbBwGMRA8CwAhW2JMETAdJxwGNg1sQlN5WyYaFyUKa10icEsIS1ETCzsDCjgWPAcEIFcnAAU6XHwoRmY/OgcHcEoKWFpiTn9cRmdPIAEMNglrXSdkW2JMDjoPJwtONBUiARR4SmxCQXdVbExPd1tiCAI5CitCBTQVPQtPDls+X0F5Wz5cQXlbPl1BeVs+WkF5Wz5bQXlbPlhBeVs+WUF5Wz5WQXlbPldBeVs+X1N3JGJZT3dbYggCOQorQg0gFSJCDSAVIkJ'

This feature is experimental so please feel free to contact us if you feel any of the reported issues is a false positive or you want to suggest a pattern that should be detected (we are using Yara standard).

Fully automated RESTful API is now available. Subscribe for your free trial today!