jsunpack - a generic JavaScript unpacker

ww90.centralpropertysales.net/?framerequest=1 benign

[nothing detected] (metarefresh) ww90.centralpropertysales.net/?framerequest=1
status: (referer=ww90.centralpropertysales.net/)saved 4398 bytes fb5483fb0f0b4b95f8dc4676ec60c04e32c36c6d
info: [meta refresh] URL=clicks.coolsearchnow.com/fly?q=Investment+In+Properties&enk=hslGmeaBZpGPiabjJuOmuUbBpuMmmYapB8HGsSbBj4GPoQ==
info: [script] ww90.centralpropertysales.net/
info: [decodingLevel=0] found JavaScript
error: line:3: SyntaxError: missing = in XML attribute:
error: line:3: <!DOCTYPE html PUBLIC "-/W3C/DTD XHTML 1.0 Transitional/EN" "http:/www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
error: line:3: ...............^
file: fb5483fb0f0b4b95f8dc4676ec60c04e32c36c6d: 4398 bytes

Decoded Files

fb54/83fb0f0b4b95f8dc4676ec60c04e32c36c6d from ww90.centralpropertysales.net/?framerequest=1 (4398 bytes, 32 hidden) download

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <meta http-equiv="content-type" content="text/html;charset=utf-8"/> <title>Centralpropertysales.net</title> <meta http-equiv="refresh" content="5;url=http://clicks.coolsearchnow.com/fly?q=Investment+In+Properties&enk=hslGmeaBZpGPiabjJuOmuUbBpuMmmYapB8HGsSbBj4GPoQ=="><script type="text/javascript"> StaticRequestInfo={IsRequestError:false,RequestErrorCode:null,RequestErrorMessage:null,RequestedURL:window.location.href,IndexRequestURL:"/",SearchRequestURL:"/s/",Referer:document.referrer};OutputRequestInfo={DomainName:"centralpropertysales.net",MySQLCurrentDatetime:"2012-08-25 03:23:25",EncryptionURL:"abea2bbf820e10624906eae208d29be9895de4ba4c2d19b0be71b2b07f347f3148cb716451105ecce0c54813260ba0de12f6dd9e8c6a1415dc22935cb3dc7448",SessionId:"ez7fhy7luvmmoiud",SessionReferer:"",CountryId:234,RelatedKeywordsList:"Investment In Properties|Property Sales Turkey|Properties Cyprus|Caribbean Property For Sale|Private Property|Property Guide|Distressed Property Spain|Properties Morocco|Cheap Spanish Properties|Majorca Property",BacklinkURLParameter:"",AdvertiserRedirectURL:"http://clicks.coolsearchnow.com/fly?q=Investment+In+Properties&enk=hslGmeaBZpGPiabjJuOmuUbBpuMmmYapB8HGsSbBj4GPoQ==",ZeroClickRedirectURL:null,IsLandingRedirect:null,RequestTrackingQueryString:"cmk9NjI2MjUzJmQ9Y2VudHJhbHByb3BlcnR5c2FsZXMubmV0JnM9ZXo3Zmh5N2x1dm1tb2l1ZCZzcj0mdGFnaWQ9JnpwaWQ9Jml1Zj1mYWxzZSZ1Zj0mc2k9NDUmc3Q9MTA3NyZ6cmk9c2V0NWUxMjhjYzhjOXJ4NSZwaWQ9NzgmcGI9MC4wMDgyMzU"};function RandomAlphanumerics(a){var b="";var c="";var d="";var e="";c="123456789abcdefghiklmnopqrstuvwxyz";for(d=0;d<a;d++){e=Math.floor(Math.random()*c.length);b+=c.substring(e,e+1)}return b}function URLEncodedFormat(a){var b="";var c="";try{c=encodeURIComponent(a)}catch(b){c=escape(a)}return c}function URLDecode(a){var b="";var c="";try{c=decodeURIComponent(a)}catch(b){c=unescape(a)}return c}function GetURLParameter(a){var b="";var c="";var d="";c=new RegExp("[\?&]"+a+"=([^&]*)","i");d=c.exec(location.search);if(d==null){b=null}else{b=URLDecode(d[1]);b=b.replace(/\+/g," ")}return b}function InitiateJavaScriptUsingDocumentWrite(a){document.write("<script src=\""+a+"\" type=\"text/javascript\"><\/script>")}function SetStaticRequestParameters(){if(typeof GlobalOutputRequestInfo=="undefined"){OutputRequestInfo.IsLandingRedirect=false}else{if(GlobalOutputRequestInfo.IsGlobalRequestCookie==true){OutputRequestInfo.IsLandingRedirect=true}else{OutputRequestInfo.IsLandingRedirect=false}}}function RequestError(){switch(StaticRequestInfo.RequestErrorCode){case"JavaScript":document.write(StaticRequestInfo.RequestErrorMessage);break;default:document.write(StaticRequestInfo.RequestErrorMessage)}}function ZeroClickRedirect(){var a="";var b="";var c="";if(typeof screen.width=="undefined"){a=""}else{a=screen.width}if(typeof screen.height=="undefined"){b=""}else{b=screen.height}c="/tracking?method=ZeroClickRequest";c+="&enc="+OutputRequestInfo.RequestTrackingQueryString;c+="&sw="+a;c+="&sh="+b;c+="&r="+URLEncodedFormat(OutputRequestInfo.AdvertiserRedirectURL);if(OutputRequestInfo.IsLandingRedirect==true){window.self.location.href="/?szc=1&suf=1&framerequest=1"}else{window.top.location.href=c}}function InitiateJavaScriptErrorTracking(a){var b="";var c="";var d="";var e="";var f="";if(typeof a.name!=="undefined"){c=a.name}if(typeof a.message!=="undefined"){d=a.message}if(typeof a.description!=="undefined"){e=a.description}b="/tracking?method=JavaScriptErrorTracking&ri="+RandomAlphanumerics(16);b+="&DomainName="+OutputRequestInfo.DomainName;b+="&ErrorName="+URLEncodedFormat(c);b+="&ErrorMessage="+URLEncodedFormat(d);b+="&ErrorDescription="+URLEncodedFormat(e);InitiateJavaScriptUsingDocumentWrite(b)}try{SetStaticRequestParameters();ZeroClickRedirect()}catch(Error){StaticRequestInfo.IsRequestError=true;StaticRequestInfo.RequestErrorCode="JavaScript";StaticRequestInfo.RequestErrorMessage="An unexpected JavaScript error has occured. Please contact the administrator.";InitiateJavaScriptErrorTracking(Error);RequestError()} </script> </head> <body>  <noscript> <meta http-equiv="refresh" content="0;url=http://clicks.coolsearchnow.com/fly?q=Investment+In+Properties&enk=hslGmeaBZpGPiabjJuOmuUbBpuMmmYapB8HGsSbBj4GPoQ=="> </noscript>  </body> </html>

ww90.centralpropertysales.net/ benign

[nothing detected] (var newurl) ww90.centralpropertysales.net/
status: (referer=quizingen.net/d/p/c4e2n30801)saved 1233 bytes 3ee84a5ba02249aacb7ae70013b6fc58f52953ea
info: [meta refresh] URL=ww90.centralpropertysales.net/?framerequest=1
info: [frame] ww90.centralpropertysales.net/
info: [decodingLevel=0] found JavaScript
error: undefined variable window.location.search
error: line:1: SyntaxError: missing ; before statement:
   error: line:1: var window.location.search = 1;
   error: line:1: ....^
error: line:3: SyntaxError: missing = in XML attribute:
   error: line:3: <!DOCTYPE html PUBLIC "-/W3C/DTD XHTML 1.0 Transitional/EN" "http:/www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
   error: line:3: ...............^
file: 3ee84a5ba02249aacb7ae70013b6fc58f52953ea: 1233 bytes

Decoded Files

3ee8/4a5ba02249aacb7ae70013b6fc58f52953ea from ww90.centralpropertysales.net/ (1233 bytes, 42 hidden) download

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <meta http-equiv="content-type" content="text/html;charset=utf-8"/> <title></title> <script type="text/javascript"> StaticRequestInfo={Referer:document.referrer};function EscapeBrowserFrame(){try{if(window.top.location==window.self.location){}else{window.top.location.href=document.location.href}}catch(Error){}}function SetRequestTitle(){document.title=document.domain}function InitiateFrameRequest(){var a="";var b="";if(window.location.search.indexOf("?")==0){b="&framerequest=1"}else{b="?framerequest=1"}b+="&refurl="+encodeURIComponent(StaticRequestInfo.Referer);a=window.location+b;document.write("<frameset rows=\"100%,*\" frameborder=\"no\" border=\"0\" framespacing=\"0\"><frame src=\""+a+"\" name=\"landingparent\"><\/frameset>")}SetRequestTitle();EscapeBrowserFrame(); </script> </head><script type="text/javascript"> InitiateFrameRequest(); </script>  <body> <noscript> <meta http-equiv="refresh" content="0;url=/?framerequest=1"> </noscript> <noframes> <meta http-equiv="refresh" content="0;url=/?framerequest=1"> </noframes> </body> </html>

quizingen.net/d/p/c4e2n30801 benign

[nothing detected] quizingen.net/d/p/c4e2n30801
status: (referer=http:/www.twitter.com/trends/)saved 470 bytes f727d94339e70b05257950cd176348ecd41d663f
info: [meta refresh] URL=ww90.centralpropertysales.net
info: [decodingLevel=0] found JavaScript
info: [var location] URL=ww90.centralpropertysales.net
info: [var newurl] URL=ww90.centralpropertysales.net
info: [decodingLevel=1] found JavaScript
file: f727d94339e70b05257950cd176348ecd41d663f: 470 bytes
file: abe3b72852c62ad373f6be0c6829f53f3db6f469: 362 bytes

Decoded Files

f727/d94339e70b05257950cd176348ecd41d663f from quizingen.net/d/p/c4e2n30801 (470 bytes) download

abe3/b72852c62ad373f6be0c6829f53f3db6f469 from quizingen.net/d/p/c4e2n30801 (362 bytes) download

clicks.coolsearchnow.com/fly?q=Investment+In+Properties&enk=hslGmeaBZpGPiabjJuOmuUbBpuMmmYapB8HGsSbBj4GPoQ== benign

[nothing detected] (metarefresh) clicks.coolsearchnow.com/fly?q=Investment+In+Properties&enk=hslGmeaBZpGPiabjJuOmuUbBpuMmmYapB8HGsSbBj4GPoQ==
status: (referer=ww90.centralpropertysales.net/?framerequest=1)saved 6412 bytes 103618cf885bea50602a678c4a7b2747056c184b
info: [javascript variable] URL=mysearchproperties.com/images/
info: [script] clicks.coolsearchnow.com/js/main.js?251208
info: [script] mysearchproperties.com/images/js/cs-mn.js?251208
info: [script] mysearchproperties.com/images/js/mmd5-mn.js?251208
info: [script] clicks.coolsearchnow.com/js/sk.js?251208
info: [script] clicks.coolsearchnow.com/js/sk-mn.js?251208
info: [decodingLevel=0] found JavaScript
info: [var IS] URL=mysearchproperties.com/images/
info: [var newurl] URL=mysearchproperties.com/images/
info: [decodingLevel=1] found JavaScript
file: 103618cf885bea50602a678c4a7b2747056c184b: 6412 bytes
file: 8574ede46807a89fce7cc3c07b12546f11c30d47: 130 bytes

Decoded Files

1036/18cf885bea50602a678c4a7b2747056c184b from clicks.coolsearchnow.com/fly?q=Investment+In+Properties&enk=hslGmeaBZpGPiabjJuOmuUbBpuMmmYapB8HGsSbBj4GPoQ== (6412 bytes, 31 hidden) download

<html> <head>  <style type="text/css"> a.s_title1, a.nons_title1 { /*color:#255AA3;*/ color:#674024; font-family:arial; font-size:1em; font-weight:bold; margin:0px 2px 2px; text-decoration:underline; } span.s_desc1, span.nons_desc1 { color:#000000; font-family:arial,sans-serif; font-size:0.8em; font-weight:normal; margin:2px; }  #inner_sub_div{ padding: 18px 0px 0px 50px; margin: 0px 0px 10px 0px; background: url(http://mysearchproperties.com/images//BG_innerPage.gif) repeat; height: 50px; width: 96%; border: 0px solid #000000; text-align: middle; } #header_parent{ background: url(http://mysearchproperties.com/images//BG_result_headerCenter.jpg) repeat-x top left; height: 92px; border: 0px solid #000000; } #ph_header_first{ /*background: url(/IMG_result_headerLeft.jpg) no-repeat top left;*/ height: 92px; border: 0px solid #000000; } #ph_header_second{ /*background: url(/IMG_result_headerRight.jpg) no-repeat top right ;*/ height: 92px; border: 0px solid #000000; } #top_header_border{ background: url(http://mysearchproperties.com/images//BG_contentTop.gif) repeat-x top left; height: 10px; width: 100%; } #bottom_border{ background: url(http://mysearchproperties.com/images//BG_contentBot.gif) repeat-x top left; height: 8px; width: 100%; border: 0px solid #000000; overflow: hidden; } #footer{ background: url(http://mysearchproperties.com/images//BG_footerBack.gif) repeat-x top left; height: 65px; width: 100%; border: 0px solid #000000; text-align: center; padding-top: 22px; font-family: arial; font-size: 12px; color: #f6ff5f; } div.keyword_div li{ margin: 5px 0px; background: url(http://mysearchproperties.com/images//BLT_greenArrow.gif) no-repeat center left; padding-left: 10px; } #tab_baap{ background: url(http://mysearchproperties.com/images//IMG_result_headerCenterBott.jpg) repeat-x left top; width: 100%; padding: 0px; margin: 0px 0px -2px 0px; height: 23px; overflow: show; z-index: 9001; } #tab_first{ background: url(http://mysearchproperties.com/images//IMG_result_headerLeftBottom.jpg) no-repeat left top; height: 21px; z-index: 1; } #tab_second{ background: url(http://mysearchproperties.com/images//IMG_result_headerRightBotto.jpg) no-repeat right top; height: 21px; z-index: 1; margin-left: 2px; } #div_tab_bottom{ background: url(http://mysearchproperties.com/images//BG_contentTop_result.gif) repeat-x left top; height: 10px; border-bottom: 0px solid #000; border-top: 0px solid #5a7a2e; z-index: -1; width: 100%; }  #rel_kwrd_p1{ background: url(http://mysearchproperties.com/images//IMG_narExp_leftCorner.gif) no-repeat top left; width: 28px; height:28px; } #rel_kwrd_p2 { background: url(http://mysearchproperties.com/images//IMG_narExp_center.gif) repeat-x top left; height:28px; font-size:0.8em; } #rel_kwrd_p3{ /*background: url(http://mysearchproperties.com/images//IMG_narExp_rightCorner.gif) no-repeat top right;*/ width: 10px; height:28px; } .div_relt_kwd li a { background: url(http://mysearchproperties.com/images//BLT_narr_expa_rangeArrow_new.gif) no-repeat left center; display:block; text-decoration: none; font-weight: normal; font-family: arial; font-size: 13px; /*color: #605f5f;*/ color: #C96928; padding-top: 3px; padding-left: 10px; padding-bottom: 3px; } .div_relt_kwd li { height:auto; margin-left:2px; padding:0px; vertical-align:middle; } span.a_kewlink_more,span.a_kewlink_less { color: #ca5b01; cursor:pointer; display:block; overflow:hidden; padding-bottom:4px; padding-right:10px; padding-top:4px; text-align:right; text-decoration:none; vertical-align:middle; font-family: arial; font-size: 12px; margin-right: 10px; } span.a_kewlink_more {background: url(http://mysearchproperties.com/images//BLT_more_GreenArrow.gif) no-repeat right center;} span.a_kewlink_less {background: url(http://mysearchproperties.com/images//BLT_less_GreenArrow.gif) no-repeat right center;} div.content_header{ background: url(http://mysearchproperties.com/images//BG_webResult.gif) repeat-x left top; width:97%; height: 20px; padding: 3px 0px 0px 10px; margin: 0px 0px 2px 4px; } div.div_content { border:1px solid #E9E9E9; margin:1px 0px 0px 4px; padding:4px 0px; width:98.8%; } a.s_dom, a.nons_dom { /*color:#008000;*/ color:#C96928; font-family:Verdana,Arial,Helvetica,sans-serif; font-size:12px; font-weight:normal; margin:2px; text-decoration:none; } .div_relt_kwd ul { list-style-image:none; list-style-position:outside; list-style-type:none; margin:0; padding:0; } ul.ul_keyw { height:auto; overflow:hidden; } div.div_rel_kwrd_title { color:#5C5C5C; cursor:pointer; font-family:arial,sans-serif; } </style> <script type="text/javascript"> function handle_morekyw(obj,hght,ohght){var ul=obj.parentNode.parentNode;var li=obj.parentNode;var childN=ul.childNodes;if(obj.innerHTML.toLowerCase().indexOf("more")>=0){if(ul){for(var i=10;i<childN.length-1;i++){childN[i].style.display="block";}} obj.innerHTML=obj.innerHTML.r

8574/ede46807a89fce7cc3c07b12546f11c30d47 from clicks.coolsearchnow.com/fly?q=Investment+In+Properties&enk=hslGmeaBZpGPiabjJuOmuUbBpuMmmYapB8HGsSbBj4GPoQ== (130 bytes) download

Submission permanent link 2821587210332f6695d84a9fe20d5a5fad77ff5e (Received 2012-08-25 04:28:01, http://quizingen.net/d/p/c4e2n30801 )

All Malicious or Suspicious Elements of Submission

URL	Status
quizingen.net/d/p/c4e2n30801	saved 470 bytes f727d94339e70b05257950cd176348ecd41d663f