JSUNPACK
A Generic JavaScript Unpacker
CAUTION: jsunpack was designed for security researchers and computer professionals
Enter a single URL (or paste JavaScript to decode):

Upload a PDF, pcap, HTML, or JavaScript file
Private? Help: privacy | uploads
Default Referer
Description

Submission permanent link 3cd4e61b86776e5fbafa301196dfd39acb163a3d (Received 2012-01-25 13:38:49, http://download.cnet.com/Nexus-Radio/3000-2168_4-10905740.html?part=dl-6285643&s ubj=dl&tag=button )

URLStatus
download.cnet.com/Nexus-Radio/3000-2168_4-10905740.html?part=dl-6285643&s saved 36104 bytes f644f007ca8f208d0aab3d88cedb36b225881641

dw.com.com/levt/ status: (referer=asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js)

asset0.cbsistatic.com/cnwk.1d/html/rb/js/tron/download/download.tron.title.detail2.compressed.js status: (referer=download.cnet.com/Nexus-Radio/3000-2168_4-10905740.html?part=dl-6285643&s)

ipublisher.cnet.com/preview/html/rb/js/ status: (referer=asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js)

asset3.cbsistatic.com/cnwk.1d/Ads/common/manta/ status: (referer=asset3.cbsistatic.com/cnwk.1d/Ads/common/manta/adFunctionsD-download.js)

i.i.com.com/cnwk.1d/html/rb/assets/global/waiter/ status: (referer=asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js)

connect.facebook.net/US/all.js status: (referer=asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js)

js.admeld.com/ status: (referer=js.admeld.com/meld120.js)

publish.cnet.com:8100/html/rb/js/tron/pers/pers.tron.promo.js?timeStamp= status: (referer=asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js)

tag.admeld.com/ad/iframe/ status: (referer=js.admeld.com/meld120.js)

mads./ status: (referer=asset3.cbsistatic.com/cnwk.1d/Ads/common/manta/adFunctionsD-download.js)

tag.admeld.com/ad/js/ status: (referer=js.admeld.com/meld120.js)

publish.cnet.com:8100/html/rb/js/~dev/ status: (referer=asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js)

dw.com.com/redir? status: (referer=asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js)

tag.admeld.com/ad/iframe/0/0/0/ros?t=1327516732378&tz=300&hu=&ht=js&hp=0&url=js.admeld.com/meld120.js&refer=undefined status: (referer=js.admeld.com/meld120.js)

i.i.com.com/cnwk.1d/i/tron/icon/fbSilhouette.gif status: (referer=asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js)

i.i.com.com/cnwk.1d/html/rb/js/tron/pers/pers.tron.promo.compressed.js?timeStamp= status: (referer=asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js)

Warning: reading file /storagefiles/5f26//968dc3a63cce645eb39c39632bfbb2c337b5 failed
Warning: reading file /storagefiles/084c//1510f9e80fcae683865879195f9372f8a3d1 failed
Warning: reading file /storagefiles/da39//00e8845e91db954d540f546c1cd92069efb9 failed
Warning: reading file /storagefiles/549c//d2dc50c4c9bff6ef888c0231e3763554ae65 failed

All Malicious or Suspicious Elements of Submission

suspicious: maxruntime exceeded 10 seconds (incomplete) 0 bytes
asset0.cbsistatic.com/cnwk.1d/html/pt/pt2.js benign
[nothing detected] (script) asset0.cbsistatic.com/cnwk.1d/html/pt/pt2.js
     status: (referer=download.cnet.com/Nexus-Radio/3000-2168_4-10905740.html?part=dl-6285643&s)saved 5938 bytes 6a3cf3acf49d8a30aa8199b15d1284e0c0a96700
     file: 6a3cf3acf49d8a30aa8199b15d1284e0c0a96700: 5938 bytes

Decoded Files
6a3c/f3acf49d8a30aa8199b15d1284e0c0a96700 from asset0.cbsistatic.com/cnwk.1d/html/pt/pt2.js (5938 bytes, 64 hidden) download


asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js suspicious
[suspicious:2] (ipaddr:23.15.7.26) (script) asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js
     status: (referer=download.cnet.com/Nexus-Radio/3000-2168_4-10905740.html?part=dl-6285643&s)saved 214472 bytes 76630b96c298bafb3ea0473c47471b12add425ba
     info: [javascript variable] URL=ipublisher.cnet.com/preview/html/rb/js/
     info: [javascript variable] URL=i.i.com.com/cnwk.1d/html/rb/assets/global/waiter/
     info: [javascript variable] URL=dw.com.com/redir?
     info: [javascript variable] URL=dw.com.com/levt/
     info: [javascript variable] URL=connect.facebook.net/US/all.js
     info: [javascript variable] URL=i.i.com.com/cnwk.1d/i/tron/icon/fbSilhouette.gif
     info: [javascript variable] URL=publish.cnet.com:8100/html/rb/js/tron/pers/pers.tron.promo.js?timeStamp=
     info: [javascript variable] URL=publish.cnet.com:8100/html/rb/js/~dev/
     info: [javascript variable] URL=i.i.com.com/cnwk.1d/html/rb/js/tron/pers/pers.tron.promo.compressed.js?timeStamp=
     info: [script] asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/
     info: [img] asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/
     info: [decodingLevel=0] found JavaScript
     error: undefined variable document.location.search
     error: line:1: SyntaxError: missing ; before statement:
          error: line:1: var document.location.search = 1;
          error: line:1: ....^
     suspicious: maxruntime exceeded 10 seconds (incomplete) 0 bytes
     info: file: saved asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js to (76630b96c298bafb3ea0473c47471b12add425ba)
     file: 76630b96c298bafb3ea0473c47471b12add425ba: 214472 bytes
     file: 5f26968dc3a63cce645eb39c39632bfbb2c337b5: 214979 bytes
     file: 084c1510f9e80fcae683865879195f9372f8a3d1: 215171 bytes
     file: da3900e8845e91db954d540f546c1cd92069efb9: 214885 bytes
     file: 549cd2dc50c4c9bff6ef888c0231e3763554ae65: 215009 bytes

Decoded Files
7663/0b96c298bafb3ea0473c47471b12add425ba from asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js (214472 bytes, 15 hidden) download