generic_javascript_obfuscation5 in www.riyadonline.com

On 2020-06-21T13:52:56.099384+00:00 we found pattern generic_javascript_obfuscation5, type: Suspicious, (JavaScript obfuscation is frequently used to hide malicious code (or with hope to protect intellectual property)) in the page https://www.riyadonline.com/ib/js/rol-e… referenced from https://www.riyadonline.com/ib/login.ht… .

Code sample:

b'["Sunday","Monday","Tuesday","Wednesday","N\x1b\xc2\xab\xc2\xb1\xc3\x96\xc2\xb2","Friday","I\xc2\xabn\xc2\xad\xc3\x96\xc2\xb2"],monthNames:["January","\x15\xc3\xa6\xc3\xab\xc2\xb9\xc2\xaa\xc3\xb2","March","April","May","June","July","August","September","October","6\xc2\x8b\xc3\x9e\xc2\x99\xc2\xb7\xc2\xab",' … b'["January","\x15\xc3\xa6\xc3\xab\xc2\xb9\xc2\xaa\xc3\xb2","March","April","May","June","July","August","September","October","6\xc2\x8b\xc3\x9e\xc2\x99\xc2\xb7\xc2\xab",' … b'["000000","993300","333300","003300","003366","000080","333399","333333","800000","FF6600","808000","008000","008080","0000FF","666699","808080","FF0000","FF9900","99CC00","339966","33CCCC","3366FF","800080","969696","FF00FF","FFCC00","FFFF00","00FF00","00FFFF","00CCFF","993366","C0C0C0","FF99CC","FFCC99","FFFF99","CCFFCC","CCFFFF","99CCFF","CC99FF",' … b'["\xc2\xb5\xc3\xacm\xc2\x9e\xc2\x87^","anchor","r\x17\xc2\x9c\xc2\x91\xc2\xba1","indentNode","ecNode","\xc2\x89\xc3\x8a\'6\xc2\x87^","elNode","ctNode","wrap",'

This feature is experimental so please feel free to contact us if you feel any of the reported issues is a false positive or you want to suggest a pattern that should be detected (we are using Yara standard).