generic_javascript_obfuscation5 in cdn1.readspeaker.com

On 2020-05-12T14:59:21.550872+00:00 we found pattern generic_javascript_obfuscation5, type: Suspicious, (JavaScript obfuscation is frequently used to hide malicious code (or with hope to protect intellectual property)) in the page https://cdn1.readspeaker.com/script/112… referenced from https://lisboa.pt/ .

Code sample:

b'["pub.Config"]=!1,r.mobile?(D="-Mobile",E.push("rs_mobile"),e["Mobile-"+N().toLowerCase()]=["lib.Facade","Common","modmap","PlayerAPI","HL","Common.Settings","ui","ui.Slider","ui.Tools","ui.Lightbox","Mobile.Common"]):e.Core=["lib.Facade","Common","modmap","PlayerAPI","HL","Common.Settings","ui","ui.Slider","ui.Lightbox","ui.DragDrop","ui.Tools","ui.Detach","ui.ScrollControls","ui.Accessibility","ui.LoadIndicator"],A=r.autoplay,B=a.ReadSpeakerJIT="0"!==r.jit,r.notools&&"1"===r.notools||m.push(S.toggler.add)' … b'["Mobile-"+N().toLowerCase()]=["lib.Facade","Common","modmap","PlayerAPI","HL","Common.Settings","ui","ui.Slider","ui.Tools","ui.Lightbox","Mobile.Common"]):e.Core=["lib.Facade","Common","modmap","PlayerAPI","HL","Common.Settings","ui","ui.Slider","ui.Lightbox","ui.DragDrop","ui.Tools","ui.Detach","ui.ScrollControls","ui.Accessibility","ui.LoadIndicator"],A=r.autoplay,B=a.ReadSpeakerJIT="0"!==r.jit,r.notools&&"1"===r.notools||m.push(S.toggler.add),r.noDefaultSkin&&"1"===r.noDefaultSkin||$.load({id:"rsmod_St' … b'["lib.Facade","Common","modmap","PlayerAPI","HL","Common.Settings","ui","ui.Slider","ui.Tools","ui.Lightbox","Mobile.Common"]):e.Core=["lib.Facade","Common","modmap","PlayerAPI","HL","Common.Settings","ui","ui.Slider","ui.Lightbox","ui.DragDrop","ui.Tools","ui.Detach","ui.ScrollControls","ui.Accessibility","ui.LoadIndicator"],A=r.autoplay,B=a.ReadSpeakerJIT="0"!==r.jit,r.notools&&"1"===r.notools||m.push(S.toggler.add),r.noDefaultSkin&&"1"===r.noDefaultSkin||$.load({id:"rsmod_Styles",type:"\xc2\xb5\xc3\xacm\xc3\xbd\xc3\x8b,",src:d+' … b'["lib.Facade","Common","modmap","PlayerAPI","HL","Common.Settings","ui","ui.Slider","ui.Lightbox","ui.DragDrop","ui.Tools","ui.Detach","ui.ScrollControls","ui.Accessibility","ui.LoadIndicator"],A=r.autoplay,B=a.ReadSpeakerJIT="0"!==r.jit,r.notools&&"1"===r.notools||m.push(S.toggler.add),r.noDefaultSkin&&"1"===r.noDefaultSkin||$.load({id:"rsmod_Styles",type:"\xc2\xb5\xc3\xacm\xc3\xbd\xc3\x8b,",src:d+c+".Styles"+(B?"-Button":"")+".css",cb:null}),"default"!==s&&(m.push(R),$.load({id:"rsskin_"+s+"_style",type:"\xc2\xb5\xc3\xacm\xc3\xbd\xc3\x8b,",src:"skins/"' … b'["translation","dictionary","toggletoolbar","listen","listenwebreader"],d=["a","b","c","d",'

This feature is experimental so please feel free to contact us if you feel any of the reported issues is a false positive or you want to suggest a pattern that should be detected (we are using Yara standard).