JSUNPACK
A Generic JavaScript Unpacker
CAUTION: jsunpack was designed for security researchers and computer professionals
Enter a single URL (or paste JavaScript to decode):

Upload a PDF, pcap, HTML, or JavaScript file
Private? Help: privacy | uploads
Default Referer
Description

Submission permanent link 3cd4e61b86776e5fbafa301196dfd39acb163a3d (Received 2012-01-25 13:38:49, http://download.cnet.com/Nexus-Radio/3000-2168_4-10905740.html?part=dl-6285643&s ubj=dl&tag=button )

URLStatus
download.cnet.com/Nexus-Radio/3000-2168_4-10905740.html?part=dl-6285643&s saved 36104 bytes f644f007ca8f208d0aab3d88cedb36b225881641

dw.com.com/levt/ status: (referer=asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js)

asset0.cbsistatic.com/cnwk.1d/html/rb/js/tron/download/download.tron.title.detail2.compressed.js status: (referer=download.cnet.com/Nexus-Radio/3000-2168_4-10905740.html?part=dl-6285643&s)

ipublisher.cnet.com/preview/html/rb/js/ status: (referer=asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js)

asset3.cbsistatic.com/cnwk.1d/Ads/common/manta/ status: (referer=asset3.cbsistatic.com/cnwk.1d/Ads/common/manta/adFunctionsD-download.js)

i.i.com.com/cnwk.1d/html/rb/assets/global/waiter/ status: (referer=asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js)

connect.facebook.net/US/all.js status: (referer=asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js)

js.admeld.com/ status: (referer=js.admeld.com/meld120.js)

publish.cnet.com:8100/html/rb/js/tron/pers/pers.tron.promo.js?timeStamp= status: (referer=asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js)

tag.admeld.com/ad/iframe/ status: (referer=js.admeld.com/meld120.js)

mads./ status: (referer=asset3.cbsistatic.com/cnwk.1d/Ads/common/manta/adFunctionsD-download.js)

tag.admeld.com/ad/js/ status: (referer=js.admeld.com/meld120.js)

publish.cnet.com:8100/html/rb/js/~dev/ status: (referer=asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js)

dw.com.com/redir? status: (referer=asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js)

tag.admeld.com/ad/iframe/0/0/0/ros?t=1327516732378&tz=300&hu=&ht=js&hp=0&url=js.admeld.com/meld120.js&refer=undefined status: (referer=js.admeld.com/meld120.js)

i.i.com.com/cnwk.1d/i/tron/icon/fbSilhouette.gif status: (referer=asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js)

i.i.com.com/cnwk.1d/html/rb/js/tron/pers/pers.tron.promo.compressed.js?timeStamp= status: (referer=asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js)

Warning: reading file /storagefiles/5f26//968dc3a63cce645eb39c39632bfbb2c337b5 failed
Warning: reading file /storagefiles/084c//1510f9e80fcae683865879195f9372f8a3d1 failed
Warning: reading file /storagefiles/da39//00e8845e91db954d540f546c1cd92069efb9 failed
Warning: reading file /storagefiles/549c//d2dc50c4c9bff6ef888c0231e3763554ae65 failed

All Malicious or Suspicious Elements of Submission

suspicious: maxruntime exceeded 10 seconds (incomplete) 0 bytes
asset0.cbsistatic.com/cnwk.1d/html/pt/pt2.js benign
[nothing detected] (script) asset0.cbsistatic.com/cnwk.1d/html/pt/pt2.js
     status: (referer=download.cnet.com/Nexus-Radio/3000-2168_4-10905740.html?part=dl-6285643&s)saved 5938 bytes 6a3cf3acf49d8a30aa8199b15d1284e0c0a96700
     file: 6a3cf3acf49d8a30aa8199b15d1284e0c0a96700: 5938 bytes

Decoded Files
6a3c/f3acf49d8a30aa8199b15d1284e0c0a96700 from asset0.cbsistatic.com/cnwk.1d/html/pt/pt2.js (5938 bytes, 64 hidden) download


asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js suspicious
[suspicious:2] (ipaddr:23.15.7.26) (script) asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js
     status: (referer=download.cnet.com/Nexus-Radio/3000-2168_4-10905740.html?part=dl-6285643&s)saved 214472 bytes 76630b96c298bafb3ea0473c47471b12add425ba
     info: [javascript variable] URL=ipublisher.cnet.com/preview/html/rb/js/
     info: [javascript variable] URL=i.i.com.com/cnwk.1d/html/rb/assets/global/waiter/
     info: [javascript variable] URL=dw.com.com/redir?
     info: [javascript variable] URL=dw.com.com/levt/
     info: [javascript variable] URL=connect.facebook.net/US/all.js
     info: [javascript variable] URL=i.i.com.com/cnwk.1d/i/tron/icon/fbSilhouette.gif
     info: [javascript variable] URL=publish.cnet.com:8100/html/rb/js/tron/pers/pers.tron.promo.js?timeStamp=
     info: [javascript variable] URL=publish.cnet.com:8100/html/rb/js/~dev/
     info: [javascript variable] URL=i.i.com.com/cnwk.1d/html/rb/js/tron/pers/pers.tron.promo.compressed.js?timeStamp=
     info: [script] asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/
     info: [img] asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/
     info: [decodingLevel=0] found JavaScript
     error: undefined variable document.location.search
     error: line:1: SyntaxError: missing ; before statement:
          error: line:1: var document.location.search = 1;
          error: line:1: ....^
     suspicious: maxruntime exceeded 10 seconds (incomplete) 0 bytes
     info: file: saved asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js to (76630b96c298bafb3ea0473c47471b12add425ba)
     file: 76630b96c298bafb3ea0473c47471b12add425ba: 214472 bytes
     file: 5f26968dc3a63cce645eb39c39632bfbb2c337b5: 214979 bytes
     file: 084c1510f9e80fcae683865879195f9372f8a3d1: 215171 bytes
     file: da3900e8845e91db954d540f546c1cd92069efb9: 214885 bytes
     file: 549cd2dc50c4c9bff6ef888c0231e3763554ae65: 215009 bytes

Decoded Files
7663/0b96c298bafb3ea0473c47471b12add425ba from asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js (214472 bytes, 15 hidden) download

5f26/968dc3a63cce645eb39c39632bfbb2c337b5 from asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js 084c/1510f9e80fcae683865879195f9372f8a3d1 from asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js da39/00e8845e91db954d540f546c1cd92069efb9 from asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js 549c/d2dc50c4c9bff6ef888c0231e3763554ae65 from asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js

dw.com.com/js/dw.js benign
[nothing detected] (script) dw.com.com/js/dw.js
     status: (referer=download.cnet.com/Nexus-Radio/3000-2168_4-10905740.html?part=dl-6285643&s)saved 20414 bytes 84fcf9ca79c3ebd6bc5960663f51b7b1a8d88ad7
     info: [decodingLevel=0] found JavaScript
     file: 84fcf9ca79c3ebd6bc5960663f51b7b1a8d88ad7: 20414 bytes

Decoded Files
84fc/f9ca79c3ebd6bc5960663f51b7b1a8d88ad7 from dw.com.com/js/dw.js (20414 bytes) download


html5shim.googlecode.com/svn/trunk/html5.js benign
[nothing detected] (script) html5shim.googlecode.com/svn/trunk/html5.js
     status: (referer=download.cnet.com/Nexus-Radio/3000-2168_4-10905740.html?part=dl-6285643&s)saved 3459 bytes d74f0c84b30113b74b01fddeb47498527e84be73
     info: [decodingLevel=0] found JavaScript
     error: undefined variable a.childNodes
     error: line:1: SyntaxError: missing ; before statement:
          error: line:1: var a.childNodes = 1;
          error: line:1: ....^
     info: [1] no JavaScript
     file: d74f0c84b30113b74b01fddeb47498527e84be73: 3459 bytes
     file: 08d60b764fb36cf7f8417febe4e79b615c5e0f19: 60 bytes

Decoded Files
d74f/0c84b30113b74b01fddeb47498527e84be73 from html5shim.googlecode.com/svn/trunk/html5.js (3459 bytes) download

08d6/0b764fb36cf7f8417febe4e79b615c5e0f19 from html5shim.googlecode.com/svn/trunk/html5.js (60 bytes) download


asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/download/download.tron.modernizr.compressed.js benign
[nothing detected] (script) asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/download/download.tron.modernizr.compressed.js
     status: (referer=download.cnet.com/Nexus-Radio/3000-2168_4-10905740.html?part=dl-6285643&s)saved 11857 bytes ff59acb559339f76b14d3082c7172bfde3f68fb1
     info: [decodingLevel=0] found JavaScript
     error: undefined variable dbugScripts
     error: undefined function dbugScripts
     file: ff59acb559339f76b14d3082c7172bfde3f68fb1: 11857 bytes

Decoded Files
ff59/acb559339f76b14d3082c7172bfde3f68fb1 from asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/download/download.tron.modernizr.compressed.js (11857 bytes, 18 hidden) download


b.scorecardresearch.com/beacon.js benign
[nothing detected] (script) b.scorecardresearch.com/beacon.js
     status: (referer=download.cnet.com/Nexus-Radio/3000-2168_4-10905740.html?part=dl-6285643&s)saved 1900 bytes ad5d644fbff3e344ce4c4dd4bbbaa617141a57b3
     info: [decodingLevel=0] found JavaScript
     file: ad5d644fbff3e344ce4c4dd4bbbaa617141a57b3: 1900 bytes

Decoded Files
ad5d/644fbff3e344ce4c4dd4bbbaa617141a57b3 from b.scorecardresearch.com/beacon.js (1900 bytes, 8 hidden) download


asset3.cbsistatic.com/cnwk.1d/Ads/common/manta/adFunctionsD-download.js benign
[nothing detected] (script) asset3.cbsistatic.com/cnwk.1d/Ads/common/manta/adFunctionsD-download.js
     status: (referer=download.cnet.com/Nexus-Radio/3000-2168_4-10905740.html?part=dl-6285643&s)saved 23225 bytes 39043dc7cdf9aed9d97ed6b73e9c4af1d5a58b45
     info: [javascript variable] URL=mads.
     info: [iframe] asset3.cbsistatic.com/cnwk.1d/Ads/common/manta/
     info: [script] asset3.cbsistatic.com/cnwk.1d/Ads/common/manta/
     info: [decodingLevel=0] found JavaScript
     error: undefined variable AV[AV.length - 1]
     error: line:1: SyntaxError: missing ; before statement:
          error: line:1: var AV[AV.length - 1] = 1;
          error: line:1: ....^
     file: 39043dc7cdf9aed9d97ed6b73e9c4af1d5a58b45: 23225 bytes

Decoded Files
3904/3dc7cdf9aed9d97ed6b73e9c4af1d5a58b45 from asset3.cbsistatic.com/cnwk.1d/Ads/common/manta/adFunctionsD-download.js (23225 bytes, 15 hidden) download


fonts.cnet.com/mna1gzn.js benign
[nothing detected] (script) fonts.cnet.com/mna1gzn.js
     status: (referer=download.cnet.com/Nexus-Radio/3000-2168_4-10905740.html?part=dl-6285643&s)saved 26143 bytes e645b44cbc3ea0a8a152c98e13fbe461ee02ce71
     info: [decodingLevel=0] found JavaScript
     file: e645b44cbc3ea0a8a152c98e13fbe461ee02ce71: 26143 bytes

Decoded Files
e645/b44cbc3ea0a8a152c98e13fbe461ee02ce71 from fonts.cnet.com/mna1gzn.js (26143 bytes) download


download.cnet.com/Nexus-Radio/3000-2168_4-10905740.html?part=dl-6285643&s benign
[nothing detected] download.cnet.com/Nexus-Radio/3000-2168_4-10905740.html?part=dl-6285643&s
     status: (referer=www.google.com/trends/hottrends)saved 36104 bytes f644f007ca8f208d0aab3d88cedb36b225881641
     info: [javascript variable] URL=html5shim.googlecode.com/svn/trunk/html5.js
     info: [script] asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/oreo.moo.rb.combined.js
     info: [script] fonts.cnet.com/mna1gzn.js
     info: [script] asset3.cbsistatic.com/cnwk.1d/html/rb/js/tron/download/download.tron.modernizr.compressed.js
     info: [script] asset0.cbsistatic.com/cnwk.1d/html/rb/js/tron/download/download.tron.title.detail2.compressed.js
     info: [script] dw.com.com/js/dw.js
     info: [script] asset3.cbsistatic.com/cnwk.1d/Ads/common/manta/adFunctionsD-download.js
     info: [script] html5shim.googlecode.com/svn/trunk/html5.js
     info: [img] adlog.com.com/adlog/i/r=11648&sg=1815&o=20%253a2025%253a2168%253a&h=cn&p=2&b=6&l=US&site=4&pt=3000&nd=2168&pid=&cid=12323154&pp=300&e=3&rqid=01phx1-ad-e20:4F1FFFE56882D6&orh=google.com&ort=&oepartner=&epartner=&ppartner=&pdom=www.google.com&cpnmodule=&count=&ra=67%2e217%2e160%2e100&dvar=dvar%255fdlpsid%253d10905740%2523dvar%255flb%255fmpu%253d1%2523dvar%255fplatform%253dwindows%2523dvar%255fuser%255fgroup%253dcons%255ftech%255fopt%2523dvar%255fversion%253d2011&rsi=%2526&pg=TyBLBwoOYJEAAAjU8jcAAAAB&t=2012.01.25.18.33.43/http:/i.i.com.com/cnwk.1d/Ads/common/dotclear.gif
     info: [script] js.admeld.com/meld120.js
     info: [img] adlog.com.com/adlog/i/r=18700&sg=484710&o=20%253a2025%253a2168%253a&h=cn&p=2&b=6&l=US&site=4&pt=3000&nd=2168&pid=&cid=12323154&pp=100&e=3&rqid=01phx1-ad-e20:4F1FFFE56882D8&orh=google.com&ort=&oepartner=&epartner=&ppartner=&pdom=www.google.com&cpnmodule=&count=&ra=67%2e217%2e160%2e100&dvar=dvar%255fdlpsid%253d10905740%2523dvar%255flb%255fmpu%253d1%2523dvar%255fplatform%253dwindows%2523dvar%255fuser%255fgroup%253dcons%255ftech%255fopt%2523dvar%255fversion%253d2011&rsi=%2526&pg=TyBLBwoOYJEAAAjU8jcAAAAB&t=2012.01.25.18.33.43/http:/i.i.com.com/cnwk.1d/Ads/common/dotclear.gif
     info: [img] adlog.com.com/adlog/i/r=18699&sg=484709&o=20%253a2025%253a2168%253a&h=cn&p=2&b=6&l=US&site=4&pt=3000&nd=2168&pid=&cid=12323154&pp=100&e=3&rqid=01phx1-ad-e16:4F20184F499263&orh=google.com&ort=&oepartner=&epartner=&ppartner=&pdom=www.google.com&cpnmodule=&count=&ra=67%2e217%2e160%2e100&dvar=dvar%255fdlpsid%253d10905740%2523dvar%255flb%255fmpu%253d1%2523dvar%255fplatform%253dwindows%2523dvar%255fuser%255fgroup%253dcons%255ftech%255fopt%2523dvar%255fversion%253d2011&rsi=%2526&pg=TyBLBwoOYJEAAAjU8jcAAAAB&t=2012.01.25.18.33.43/http:/i.i.com.com/cnwk.1d/Ads/common/dotclear.gif
     info: [img] adlog.com.com/adlog/i/r=19386&sg=1815&o=20%253a2025%253a2168%253a&h=cn&p=2&b=6&l=US&site=4&pt=3000&nd=2168&pid=&cid=12323154&pp=400&e=3&rqid=01phx1-ad-e17:4F20304D265BFA&orh=google.com&ort=&oepartner=&epartner=&ppartner=&pdom=www.google.com&cpnmodule=&count=&ra=67%2e217%2e160%2e100&dvar=dvar%255fdlpsid%253d10905740%2523dvar%255fplatform%253dwindows%2523dvar%255fuser%255fgroup%253dcons%255ftech%255fopt%2523dvar%255fversion%253d2011&rsi=%2526&pg=TyBLBwoOYJEAAAjU8jcAAAAB&t=2012.01.25.18.33.43/http:/i.i.com.com/cnwk.1d/Ads/common/dotclear.gif
     info: [img] dw.com.com/clear/c.gif?ts=1327516423&im=mii1.4&edId=3&ptId=3000&onId=2168&sId=4&asId=12323154&astId=2&pgnbr=1&oid=3000-2168_4-10905740&pguid=TyBLBwoOYJEAAAjU8jcAAAAB&ld=download.cnet.com&tcset=ISO-8859-1&title=Nexus%20Radio%20-%20Reviews%20and%20free%20Nexus%20Radio%20downloads%20at%20CNET%20Download.com&srcUrl=http:/download.cnet.com/Nexus-Radio/3000-2168_4-10905740.html?part%3Ddl-6285643%26s&breadcrumb=20:2025:2168&bkts=MAD:opt&xref=http:/www.google.com/trends/hottrends
     info: [img] secure-us.imrworldwide.com/cgi-bin/m?ci=us-304254h&cg=0&cc=1&ts=noscript
     info: [script] b.scorecardresearch.com/beacon.js
     info: [img] b.scorecardresearch.com/b?c1=2&c2=3000023&c3=&c4=&c5=&c6=&c15=&cv=1.3&cj=1
     info: [script] asset0.cbsistatic.com/cnwk.1d/html/pt/pt2.js
     info: [decodingLevel=0] found JavaScript
     error: undefined variable LocalVars
     error: line:42: TypeError: LocalVars.UserVars is not a constructor
     error: line:3: SyntaxError: missing = in XML attribute:
          error: line:3: <!DOCTYPE html> <html lang="en" class="no-js" xmlns:og="http:/opengraphprotocol.org/schema/" xmlns:fb="http:/www.facebook.com/2008/fbml"> <!-- Chewie loves you --> <head> <!-- NR header --> <!--[if IE]><![endif]--> <title>Nexus Radio - Reviews and free
          error: line:3: ..............^
     file: f644f007ca8f208d0aab3d88cedb36b225881641: 36104 bytes

Decoded Files
f644/f007ca8f208d0aab3d88cedb36b225881641 from download.cnet.com/Nexus-Radio/3000-2168_4-10905740.html?part=dl-6285643&s (36104 bytes, 1307 hidden) download


js.admeld.com/meld120.js benign
[nothing detected] (script) js.admeld.com/meld120.js
     status: (referer=download.cnet.com/Nexus-Radio/3000-2168_4-10905740.html?part=dl-6285643&s)saved 3257 bytes 92bc1ecd5901428177db361f799abd2f354d9932
     info: [javascript variable] URL=tag.admeld.com/ad/js/
     info: [javascript variable] URL=tag.admeld.com/ad/iframe/
     info: [iframe] js.admeld.com/
     info: [decodingLevel=0] found JavaScript
     info: DecodedIframe detected
     info: [iframe] tag.admeld.com/ad/iframe/0/0/0/ros?t=1327516732378&tz=300&hu=&ht=js&hp=0&url=js.admeld.com%2Fmeld120.js&refer=undefined
     info: [decodingLevel=1] found JavaScript
     file: 92bc1ecd5901428177db361f799abd2f354d9932: 3257 bytes
     file: 04b7f56193031ca59383c8efbe2483ee73ca7be9: 257 bytes

Decoded Files
92bc/1ecd5901428177db361f799abd2f354d9932 from js.admeld.com/meld120.js (3257 bytes, 177 hidden) download

04b7/f56193031ca59383c8efbe2483ee73ca7be9 from js.admeld.com/meld120.js (257 bytes) download