generic_javascript_obfuscation5 in www.mude.pt

On 2020-05-23T19:26:01.359014+00:00 we found pattern generic_javascript_obfuscation5, type: Suspicious, (JavaScript obfuscation is frequently used to hide malicious code (or with hope to protect intellectual property)) in the page https://www.mude.pt/public/js/plugins.js referenced from https://mude.pt/ .

Code sample:

b'["Sunday","Monday","Tuesday","Wednesday","N\x1b\xc2\xab\xc2\xb1\xc3\x96\xc2\xb2","Friday","I\xc2\xabn\xc2\xad\xc3\x96\xc2\xb2","Sunday"],daysShort:["Sun","Mon","Tue","Wed","Thu","Fri","Sat","Sun"],daysMin:["Su","Mo","Tu","We","Th","Fr","Sa","Su"],months:["Jan","Fev","Mar","Abr",\r\n"Mai","Jun","Jul","Ago","Set","Out","Nov","Dez"],monthsShort:["Jan","Fev","Mar","Abr","Mai","Jun","Jul","Ago","Set","Out","Nov",' … b'["Sun","Mon","Tue","Wed","Thu","Fri","Sat","Sun"],daysMin:["Su","Mo","Tu","We","Th","Fr","Sa","Su"],months:["Jan","Fev","Mar","Abr",\r\n"Mai","Jun","Jul","Ago","Set","Out","Nov","Dez"],monthsShort:["Jan","Fev","Mar","Abr","Mai","Jun","Jul","Ago","Set","Out","Nov",' … b'["Su","Mo","Tu","We","Th","Fr","Sa","Su"],months:["Jan","Fev","Mar","Abr",\r\n"Mai","Jun","Jul","Ago","Set","Out","Nov","Dez"],monthsShort:["Jan","Fev","Mar","Abr","Mai","Jun","Jul","Ago","Set","Out","Nov",' … b'["Jan","Fev","Mar","Abr",\r\n"Mai","Jun","Jul","Ago","Set","Out","Nov","Dez"],monthsShort:["Jan","Fev","Mar","Abr","Mai","Jun","Jul","Ago","Set","Out","Nov",' … b'["Jan","Fev","Mar","Abr","Mai","Jun","Jul","Ago","Set","Out","Nov",'

This feature is experimental so please feel free to contact us if you feel any of the reported issues is a false positive or you want to suggest a pattern that should be detected (we are using Yara standard).