JSUNPACK
A Generic JavaScript Unpacker
CAUTION: jsunpack was designed for security researchers and computer professionals
Enter a single URL (or paste JavaScript to decode):

Upload a PDF, pcap, HTML, or JavaScript file
Private? Help: privacy | uploads
Default Referer
Description

Submission permanent link 7399bd306f7d410d17bb151c72b9a7f4dcce08ff (Received 2017-03-16 23:17:50, script )

URLStatus
127.0.0.1/

127.0.0.1/undefined

xmlhttp NOW ELEM ALWAYS STARTtIME DURATION TWEENS RUN NOTIFYwITH RESOLVEwITH OPTS SPECIALeASING EASING REJECTwITH PROMISE PROPS START QUEUE TIMER FX FAIL DONE COMPLETE PROGRESS CSShOOKS EXPAND UNQUEUED FIRE EMPTY HEIGHT OVERFLOW OVERFLOWx OVERFLOWy INLINE status: (referer=http:/www.ask.com/web?q=puppies)failure: <urlopen error [Errno -2] Name or service not known>

http:/ status: (referer=http:/www.ask.com/web?q=puppies)failure: <urlopen error [Errno -3] Temporary failure in name resolution>

All Malicious or Suspicious Elements of Submission

suspicious: shellcode of length 10001/45883
malicious: shellcode URL=http:
malicious: XOR key [shellcode]: 32
malicious: shellcode [xor] URL=xmlhttp NOW ELEM ALWAYS STARTtIME DURATION TWEENS RUN NOTIFYwITH RESOLVEwITH OPTS SPECIALeASING EASING REJECTwITH PROMISE PROPS START QUEUE TIMER FX FAIL DONE COMPLETE PROGRESS CSShOOKS EXPAND UNQUEUED FIRE EMPTY HEIGHT OVERFLOW OVERFLOWx OVERFLOWy INLINE FLOAT INLINEbLOCKnEEDSlAYOUT ZOOM INLINE BLOCK HIDDEN SHRINKwRAPbLOCKS TOGGLE HIDE SHOW FXSHOW CREATEtWEEN END INIT PROTOTYPE OPACITY DEFAULTvIEW PARENTwINDOW LOCATION JqUERY
script malicious
[malicious:10] script
     info: ActiveXDataObjectsMDAC detected Microsoft.XMLHTTP
     info: [embed] 127.0.0.1/
     info: [decodingLevel=0] found JavaScript
     error: undefined function _0xc56fx19[_0x1579[54]]
     error: undefined variable _0xc56fx19
     error: undefined variable _0x1579
     info: DecodedGenericCLSID detected D27CDB6E-AE6D-11cf-96B8-444553540000
     suspicious: shellcode of length 10001/45883
     malicious: shellcode URL=http:
     malicious: XOR key [shellcode]: 32
     malicious: shellcode [xor] URL=xmlhttp NOW ELEM ALWAYS STARTtIME DURATION TWEENS RUN NOTIFYwITH RESOLVEwITH OPTS SPECIALeASING EASING REJECTwITH PROMISE PROPS START QUEUE TIMER FX FAIL DONE COMPLETE PROGRESS CSShOOKS EXPAND UNQUEUED FIRE EMPTY HEIGHT OVERFLOW OVERFLOWx OVERFLOWy INLINE FLOAT INLINEbLOCKnEEDSlAYOUT ZOOM INLINE BLOCK HIDDEN SHRINKwRAPbLOCKS TOGGLE HIDE SHOW FXSHOW CREATEtWEEN END INIT PROTOTYPE OPACITY DEFAULTvIEW PARENTwINDOW LOCATION JqUERY
     info: [element] URL=127.0.0.1/undefined
     info: [1] no JavaScript
     info: file: saved script to (53b531d9590b021f39eefb7f077c9dc95a3b26cc)
     file: 53b531d9590b021f39eefb7f077c9dc95a3b26cc: 641989 bytes
     file: 80db53de723f3335709293497a3840da56193ead: 13671 bytes
     file: 0a3e1fd2462645c3fb5985c33a230e44539dfcc4: 10001 bytes

Decoded Files
53b5/31d9590b021f39eefb7f077c9dc95a3b26cc from script (641989 bytes) download

80db/53de723f3335709293497a3840da56193ead from script (13671 bytes) download

0a3e/1fd2462645c3fb5985c33a230e44539dfcc4 from script (10001 bytes, 4 hidden) download