generic_javascript_obfuscation5 in is.traffic.gg

On 2020-05-23T00:38:12.166464+00:00 we found pattern generic_javascript_obfuscation5, type: Suspicious, (JavaScript obfuscation is frequently used to hide malicious code (or with hope to protect intellectual property)) in the page https://is.traffic.gg/piwik.js referenced from https://roiverticals.co/c_c?url=eurocur… .

Code sample:

b'["7z","aac","apk","arc","arj","asf","asx","avi","azw3","bin","csv","deb","dmg","doc","docx","epub","exe","flv","gif","gz","gzip","hqx","ibooks","jar","jpg","jpeg","js","mobi","mp2","mp3","mp4","mpg","mpeg","mov","movie","msi","msp","odb","odf","odg","ods","odt","ogg","ogv","pdf","phps","png","ppt","pptx","qt","qtm","ra","ram","rar","rpm","sea","sit","tar","tbz","tbz2","bz","bz2","tgz","torrent","txt","wav","wma","wmv","wpd","xls","xlsx","xml","z","zip"],ax=[cU],by=[],bK=[],a8=[],bI=500,cW=false,cH,a5,bQ,c7=' … b'["pk_campaign","piwik_campaign","utm_campaign","utm_source","utm_medium"],bF=["pk_kwd","piwik_kwd","utm_term"],bj="_pk_",av="pk_vid",aZ=180,cX,bo,bR=false,bk=false,cP,be,bu,cI=33955200000,co=1800000,c5=15768000000,a2=true,cm=0,bP=false,aQ=false,ca,bV={},cl={},bl={},bs=200,c0={},c8={},b9=[],ce=false,cA=false,ap=false,c9=false,cM=false,aN=false,bc=u(),cR=null,cY=null,cb,aR,bz,b6=am,bn,aK,cr=0,bt=["id","ses","cvar",' … b'["addTracker","disableCookies","setTrackerUrl","setAPIUrl","zv\xc2\x9b\xc2\x95\xc3\xa0\xc2\xab\xc2\xa2\xc3\x8b\x03\xc2\xa2f\xc2\xa2\xc2\x9c\xc2\xb8\xc2\xa7\xc2\x92)\xc3\xa0","\xc2\xb1\xc3\xabB\xc2\xae\xc2\x8b,\x0e\xc2\x89\xc2\x9a\xc2\x8ar\xc3\xa2\xc2\x9eH\xc2\xa7\xc2\x818\xc2\xa6z\xc2\x8b\xc2\xad","setSessionCookieTimeout","setVisitorCookieTimeout","setSecureCookie","setCookiePath","setCookieDomain","setDomains","setUserId","setSiteId","alwaysUseSendBeacon","enableLinkTracking","requireConsent",'

This feature is experimental so please feel free to contact us if you feel any of the reported issues is a false positive or you want to suggest a pattern that should be detected (we are using Yara standard).

Fully automated RESTful API is now available. Subscribe for your free trial today!