JSUNPACK
A Generic JavaScript Unpacker
CAUTION: jsunpack was designed for security researchers and computer professionals
Enter a single URL (or paste JavaScript to decode):

Upload a PDF, pcap, HTML, or JavaScript file
Private? Help: privacy | uploads
Default Referer
Description

Submission permanent link 06a24b9b29175ded1d7385e0c99989a8e7019887 (Received 2013-03-19 12:49:33, http://dkiller.xp3.biz/log.php )

URLStatus
dkiller.xp3.biz/log.php saved 13905 bytes bbd46d465cc8621f513e5d2824e6df98cdd59f34

user99.freewebhostingarea.com/po/www/delivery/ status: (referer=user99.freewebhostingarea.com/po/www/delivery/ajs.php?zoneid=1&cb=57512830104&loc=[object Object])

user99.freewebhostingarea.com/ba/www/delivery/afr.php?zoneid=2&cb=SPOT2 status: (referer=a.freewebhostingarea.com/global/300x200.js)

ad.yieldmanager.com/st?type=iframe&size=728x90&section=2935256&url=${PUB_URL} status: (referer=user99.freewebhostingarea.com/ba/www/delivery/afr.php?zoneid=3&cb=ERR728)

ad.yieldmanager.com/st?type=pop&size=0x0&section=791110&types=29&times=1&frequency=0&nofreqcap=1 status: (referer=user99.freewebhostingarea.com/po/www/delivery/ajs.php?zoneid=1&cb=57512830104&loc=[object Object])

All Malicious or Suspicious Elements of Submission

None
a.freewebhostingarea.com/global/404-pop.js benign
[nothing detected] (script) a.freewebhostingarea.com/global/404-pop.js
     status: (referer=dkiller.xp3.biz/log.php)saved 938 bytes 757ce365cc938b52f78c2199a46a2c8041a61b33
     info: [decodingLevel=0] found JavaScript
     info: [var m3_u] URL=user99.freewebhostingarea.com/po/www/delivery/ajs.php
     info: [var newurl] URL=user99.freewebhostingarea.com/po/www/delivery/ajs.php
     info: [script] user99.freewebhostingarea.com/po/www/delivery/ajs.php?zoneid=1&cb=57512830104&loc=%5Bobject%20Object%5D
     info: [decodingLevel=1] found JavaScript
     file: 757ce365cc938b52f78c2199a46a2c8041a61b33: 938 bytes
     file: c76b498ee28f702fbe0bf70a3ee46f2412a392bb: 367 bytes

Decoded Files
757c/e365cc938b52f78c2199a46a2c8041a61b33 from a.freewebhostingarea.com/global/404-pop.js (938 bytes) download

c76b/498ee28f702fbe0bf70a3ee46f2412a392bb from a.freewebhostingarea.com/global/404-pop.js (367 bytes) download


a.freewebhostingarea.com/global/300x200.js benign
[nothing detected] (script) a.freewebhostingarea.com/global/300x200.js
     status: (referer=dkiller.xp3.biz/log.php)saved 481 bytes 8357dccf760321f2002ebeea36d709a66d5d6d2f
     info: [iframe] user99.freewebhostingarea.com/ba/www/delivery/afr.php?zoneid=2&cb=SPOT2
     info: [img] user99.freewebhostingarea.com/ba/www/delivery/avw.php?zoneid=2&cb=SPOT2&n=ae90d038
     info: [decodingLevel=0] found JavaScript
     info: DecodedIframe detected
     info: [decodingLevel=1] found JavaScript
     file: 8357dccf760321f2002ebeea36d709a66d5d6d2f: 481 bytes
     file: 55be13397059f10aa3f8f69cdd59b3206fa5f678: 485 bytes

Decoded Files
8357/dccf760321f2002ebeea36d709a66d5d6d2f from a.freewebhostingarea.com/global/300x200.js (481 bytes) download

55be/13397059f10aa3f8f69cdd59b3206fa5f678 from a.freewebhostingarea.com/global/300x200.js (485 bytes) download


user99.freewebhostingarea.com/po/www/delivery/ajs.php?zoneid=1&cb=57512830104&loc=[object Object] benign
[nothing detected] (script) user99.freewebhostingarea.com/po/www/delivery/ajs.php?zoneid=1&cb=57512830104&loc=[object Object]
     status: (referer=a.freewebhostingarea.com/global/404-pop.js)saved 772 bytes b93dcb53c134fd423118ac3e5727e41dff510d8c
     info: [decodingLevel=0] found JavaScript
     info: [var OX_fbf8b87b] URL=user99.freewebhostingarea.com/po/www/delivery/
     info: [var newurl] URL=user99.freewebhostingarea.com/po/www/delivery/
     info: [script] ad.yieldmanager.com/st?type=pop&size=0x0&section=791110&types=29&times=1&frequency=0&nofreqcap=1
     info: [img] user99.freewebhostingarea.com/po/www/delivery/lg.php?bannerid=45&campaignid=10&zoneid=1&OAZBLOCK=60&OAZCAP=1&OASZCAP=1&loc=http%3A%2F%2Fa.freewebhostingarea.com%2Fglobal%2F404-pop.js&cb=e5ec6977af
     info: [decodingLevel=1] found JavaScript
     error: line:6: SyntaxError: missing ; before statement:
          error: line:6: <SCRIPT TYPE="text/javascript" SRC="http:/ad.yieldmanager.com/st?type=pop&size=0x0&section=791110&types=29&times=1&frequency=0&nofreqcap=1"></SCRIPT><div id='e5ec6977af' style='position: absolute; left: 0px; top: 0px;
          error: line:6: ....................................................................................................................................................................................^
     file: b93dcb53c134fd423118ac3e5727e41dff510d8c: 772 bytes
     file: deb14497903dda18f8edf894640c66d6572434cd: 1257 bytes

Decoded Files
b93d/cb53c134fd423118ac3e5727e41dff510d8c from user99.freewebhostingarea.com/po/www/delivery/ajs.php?zoneid=1&amp;cb=57512830104&amp;loc=[object Object] (772 bytes) download

deb1/4497903dda18f8edf894640c66d6572434cd from user99.freewebhostingarea.com/po/www/delivery/ajs.php?zoneid=1&amp;cb=57512830104&amp;loc=[object Object] (1257 bytes) download


dkiller.xp3.biz/log.php benign
[nothing detected] dkiller.xp3.biz/log.php
     status: (referer=http:/www.ask.com/web?q=puppies)saved 13905 bytes bbd46d465cc8621f513e5d2824e6df98cdd59f34
     info: [img] www.freewebhostingarea.com/images/spacer.gif
     info: [img] www.freewebhostingarea.com/images/header.jpg
     info: [img] www.freewebhostingarea.com/images/b-home.gif
     info: [img] www.freewebhostingarea.com/images/b-members.gif
     info: [img] www.freewebhostingarea.com/images/b-forum.gif
     info: [img] www.freewebhostingarea.com/images/b-news.gif
     info: [img] www.freewebhostingarea.com/images/b-faq.gif
     info: [img] www.freewebhost