generic_javascript_obfuscation in pagead2.googlesyndication.com

On 2020-03-24T21:56:16.092977+00:00 we found pattern generic_javascript_obfuscation, type: Suspicious, (JavaScript obfuscation is frequently used to hide malicious code (or with hope to protect intellectual property)) in the page https://pagead2.googlesyndication.com... referenced from http://meupdf.com/ .

Code sample:

b'var bn=[15];~\xc3\xa9\xc3\x9c\xc2\xb6*\' cn(a){G(this,a,null,null)}C(cn,F);~\xc3\xa9\xc3\x9c\xc2\xb6*\' dn(a){G(this,a,null,null)}C(dn,F);var en=parseInt("2012",10),fn=isNaN(en)?2012:en;~\xc3\xa9\xc3\x9c\xc2\xb6*\' gn(a,b,c){if("\xc2\xad\xc3\xa9Z\xc2\xb6+\xc3\x9e"===a)return b;c||(c=Nh?"https":"http");z.location&&"https:"==z.location.protocol&&"http"==c&&(c="https");return[c,"://",a,b].join("")}~\xc3\xa9\xc3\x9c\xc2\xb6*\' hn(a,b,c){a=gn(a,b,c);O(182)&&2012<fn&&(a=a.replace(new RegExp(".js".replace(/([-()\\[\\]{}+?*.$\\^|,:#<!\\])/g,"\\$1").replace(/\x08/g,"\\x08' … b'\\x0B' … b'\\x08' … b'atob' … b'"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"' … b'"application/xhtml+xml"' … b'"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"'

This feature is experimental so please feel free to contact us if you feel any of the reported issues is a false positive or you want to suggest a pattern that should be detected (we are using Yara standard).

Fully automated RESTful API is now available. Subscribe for your free trial today!