jsunpack - a generic JavaScript unpacker

zonealarm.claro-search.com/ benign

[nothing detected] (jsvar) zonealarm.claro-search.com/
status: (referer=cnfg.montiera.com/appsCntrl/babylon/bbylnDef131.js)saved 11094 bytes ad87899b6a46b688f9094f759e9cab52adaadb31
info: [javascript variable] URL=act.babsrv.com/?f=1&cou=
info: [javascript variable] URL=ac.babsrv.com/?f=1&cou=
info: [javascript variable] URL=acx.babsrv.com/?f=1&cou=
info: [javascript variable] URL=acr.babsrv.com/?f=1&cou=
info: [javascript variable] URL=aci.babsrv.com/?f=1&&cou=
info: [javascript variable] URL=acy.babsrv.com/?f=1&cou=
info: [javascript variable] URL=acz.babsrv.com/?f=1&cou=
info: [javascript variable] URL=completr-v2.appspot.com/?q=
info: [javascript variable] URL=search.yahooapis.com/WebSearchService/V1/relatedSuggestion?appid=YahooDemo&output=json&callback=yahRel&query=
info: [img] usw.cdn-services.com/b/images/small9.jpg
info: [decodingLevel=0] found JavaScript
error: undefined variable node
info: [element] URL=www.googletagservices.com/tag/js/gpt.js
info: [1] no JavaScript
file: ad87899b6a46b688f9094f759e9cab52adaadb31: 11094 bytes
file: 8dc44cfcfd5c417ac7d6299f38c84ccc02a30c0a: 112 bytes

Decoded Files

ad87/899b6a46b688f9094f759e9cab52adaadb31 from zonealarm.claro-search.com/ (11094 bytes, 195 hidden) download

<!doctype html><html> <head> <meta http-equiv="content-type" content="text/html; charset=UTF-8" /> <meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7" /> <meta name="robots" content="noindex,nofollow" /> <title>ZoneAlarm Search</title> <link rel="stylesheet" href="http://usw.cdn-services.com/b/css/gsrc-v.1.0.4.css" type="text/css" /> <script>var ac = 3;var hl = 'en';var cn = 'US';window.ssgObj={};isEnterTrue = 0;</script> </head> <body onLoad="SetFocus();" dir="ltr"> <div id="clTopbarltr"> <ul> <li><span class="gSTypeSel" sSearch="Search Web" sAction="web" id="lnkWeb" onClick="gSTypeSel(this);">Web</span></li> <li><span class="gSType" sSearch="Search Images" sAction="img" id="lnkImages" onClick="gSTypeSel(this);">Images</span></li> <li><span class="gSType" sSearch="Search Video" sAction="video" id="lnkVideo" onClick="gSTypeSel(this);">Videos</span></li> <li><span class="gSType" sSearch="Search Blogs" sAction="blog" id="lnkBlog" onClick="gSTypeSel(this);">Blogs</span></li> </ul> </div> <div id="gLogoltr"><img src="http://usw.cdn-services.com/b/images/logo_small9.jpg" /></div> <form method="get" name="gSearchForm" id="gSearchForm" onSubmit="return validateForm(this);"> <table border="0" align="center" cellpadding="0" cellspacing="0" id="Container" class="bisSearchLine">   <tr><td><input type="text" name="q" onKeyUp="window.ssgObj.ac.s(event,this);" autocomplete="off" maxlength="255" value="" id="q" class="qltr" /> <table class="bisSuggestltr" cellspacing="0" style="display:none;" id="suggest"><tbody id="suggestions"></tbody><tfoot><tr><th> <center><input type="button" class="bisIsb" value="Search" onClick="submitForm($('sBtn'));"/></center> </th></tr><tr><td>Powered by ZoneAlarm</td></tr></tfoot></table><input type="hidden" name="babsrc" value="home" id="sSrc" /><input type="hidden" name="s" value="web" id="sType" /> <input type="hidden" name="rlz" value="0" /> <input type="hidden" name="as" value="0" id="asVal" /> <input type="hidden" name="ac" value="0" id="acVal" /> </td><td class="bisBtntblltr"><input type="button" sAction="web" value="Search Web" class="bisIsb" id="sBtn" onClick="submitForm(this);"/></td>   </tr> </table> </form> <div id="clLangs">  <span>English</span> <a class="gMoreLangs" href="javascript: void(0);" onClick="toggleDisplay('gMoreLangs', 'inline', true)">More <small>&#9660;</small></a><div id="gMoreLangs" style="display: none;"><a href="/?s=web&babsrc=home&rlz=0&uil=ar"></a><a href="/?s=web&babsrc=home&rlz=0&uil=de">Deutsch</a><a href="/?s=web&babsrc=home&rlz=0&uil=es">Espaol</a><a href="/?s=web&babsrc=home&rlz=0&uil=fa"></a><a href="/?s=web&babsrc=home&rlz=0&uil=fr">Franais</a><a href="/?s=web&babsrc=home&rlz=0&uil=he"></a><a href="/?s=web&babsrc=home&rlz=0&uil=hi"></a><a href="/?s=web&babsrc=home&rlz=0&uil=it">Italiano</a><a href="/?s=web&babsrc=home&rlz=0&uil=ja"></a><a href="/?s=web&babsrc=home&rlz=0&uil=nl">Nederlands</a><a href="/?s=web&babsrc=home&rlz=0&uil=pl">Polski</a><a href="/?s=web&babsrc=home&rlz=0&uil=pt">Portugus</a><a href="/?s=web&babsrc=home&rlz=0&uil=ro">Romn</a><a href="/?s=web&babsrc=home&rlz=0&uil=ru"></a><a href="/?s=web&babsrc=home&rlz=0&uil=th"></a><a href="/?s=web&babsrc=home&rlz=0&uil=tr">Trke</a><a href="/?s=web&babsrc=home&rlz=0&uil=zhs"></a><a href="/?s=web&babsrc=home&rlz=0&uil=zht"></a></div></div>  <div id="gTerms"> <a href="http://www.claro-search.com/uninstall.htm" target="_blank">More info</a></div>  <div id="clPrivacy">ZoneAlarm Search  2012</div> <script type='text/javascript'> var googletag = googletag || {}; googletag.cmd = googletag.cmd || []; (function() { var gads = document.createElement('script'); gads.async = true; gads.type = 'text/javascript'; var useSSL = 'https:' == document.location.protocol; gads.src = (useSSL ? 'https:' : 'http:') + '//www.googletagservices.com/tag/js/gpt.js'; var node = document.getElementsByTagName('script')[0]; node.parentNode.insertBefore(gads, node); })(); </script> <script type='text/javascript'> googletag.cmd.push(function() { googletag.defineSlot('/7545/search-728x90', [728, 90], 'div-gpt-ad-1339330935794-0').addService(googletag.pubads()); googletag.pubads().enableSingleRequest(); googletag.enableServices(); }); </script> <div align="center">  <div id='div-gpt-ad-1339330935794-0' style='width:728px; height:90px;'> <script type='text/javascript'> googletag.cmd.push(function() { googletag.display('div-gpt-ad-1339330935794-0'); }); </script> </div> </div> <script>var isEnterTrue=0;var oRequest;function $(sId){return document.getElementById(sId);}function SetFocus(){$("q").focus();}function doPrventdouble(){isEnterTrue=0;}function validateForm(oForm) {var oQ=$("q");if (oQ.value.replace(/ /g, "") == "" || isEnterTrue == 1){oQ.focus();return false;}isEnterTrue=1;setTimeout ( "doPrventdouble()", 1500 );return true;}function gSTypeSel(oE){ var x=oE.parentNode.parentNode.getElementsByTagName("li"); for(var i=0;i<x.length;i++){ x[i].childNodes[0].className="gSType"; } oE.className="gSTypeS

8dc4/4cfcfd5c417ac7d6299f38c84ccc02a30c0a from zonealarm.claro-search.com/ (112 bytes) download

cnfg.montiera.com/appsCntrl/babylon/bbylnDef131.js benign

[nothing detected] (script) cnfg.montiera.com/appsCntrl/babylon/bbylnDef131.js
status: (referer=mntr.babcdn.com/mntr/apps/babylon/1.3.1/mnu.htm)saved 17607 bytes 665677aa0b61fd26ec0b8ea76c3256ba88d4b74d
info: [javascript variable] URL=zonealarm.claro-search.com
info: [decodingLevel=0] found JavaScript
file: 665677aa0b61fd26ec0b8ea76c3256ba88d4b74d: 17607 bytes

Decoded Files

6656/77aa0b61fd26ec0b8ea76c3256ba88d4b74d from cnfg.montiera.com/appsCntrl/babylon/bbylnDef131.js (17607 bytes, 4622 hidden) download

/////////////////////////////////////////////////// // - keep this flag while developing // - set it to false on production var gDvlpMode = false; ///////////////////////////////////////////////////  if (typeof mntr131NS == "undefined") {var mntr131NS = {}; };  var bbylnAppCntrl = {appName: "BabylonToolbar",tlbrName: "bbylnTlbr",tlbrFullName: "BabylonToolbar",regFldrName: "BabylonToolbar",mntrVrsn: "1.3.1",vrsni: 0,ffxcssdivname: "bbylnTlbrCSS",// application buttonappMnu: {"hmpgMnu": "http://www.babylon.com/redirects/redir.cgi?type=mtb_hpbtn","hmpg": "http://www.babylon.com/redirects/redir.cgi?type=mtb_hpbtn","about": "http://www.babylon.com/redirects/redir.cgi?type=mtb_aboutbtn","terms": "http://www.babylon.com/redirects/redir.cgi?type=mtb_termofusebtn","help": "http://www.babylon.com/redirects/redir.cgi?type=mtb_helpbtn","cntct": "http://www.babylon.com/redirects/redir.cgi?type=mtb_contactbtn"},// search propertiessrchUrl: "",mgnfrSrch: "http://google.com/?q=",sgstPrtnr: "acplus",// dynamic toolbarbtnsStgngUrl: "http://partners.montiera.com/partners/getSatgingTlbr.srf",btnsUrl: "http://data.montiera.com/cnfg/data",// Firefox contract idffxCntrctId: "@bbylntlbr.com/escort;1",ffxExtId: "ffxtlbr@babylon.com",ffxExtName: "BabylonToolbar",ffxFldr: "babylon",// for the tlbr uninstl functionesrvPrgId: "srv.babylonSrvc.1",// widgetsradioStationsUrl: "http://widgets.montiera.com/widgets/radiosrv.srf?callback=?",// default wtherdefaultWthrCity: "New York",srchLocations: {"Web": ""},DNSErrUrlPrfx: "http://utils.babylon.com/abt/index.php?url=",DNSErrUrlSfx: "",mntrSmartAdsBtns: "http://smart.montiera.com/smart/bnrSrv.srf?noa=8",bbylnDLReportUrlNew: "http://utils.babylon.com/tbtrack/index.php",srchFeedPrfx: "http://search.babylon.com/?babsrc=toolbar2&q=",trnsltUrl: "http://www.babylon.com/definition/",dfltNamedProps: {"aflt": "orgnl","babExt": "babExt","BABTRACK": "babTrack",//"bbDpng": 0,"cntry": "us","dfltLng": "en","dfltSrch": "false","envrmnt": "production","hmpg": "false","hrdId": "0","id": "","instlDay": "","instlRef": "","isDcmntCmplt": "false","keyWordUrl": "","mntrvrsn": "1.3.1","newTab": "false","newTabUrl": "","prdct": "BabylonToolbar","prtnrId": "","sg": "free","smplGrp": "free","srch": "","srcExt": "","srchPrvdr": "","tlbrId": "base","tlbrSrchUrl": "","vrsn": "","vrsni": "","vrsnTs": ""},rprtMngrDmn: "reports.montiera.com",appndSrchUrl: "",ffxBtstrpLoaded: false,svrDmn: "mntr.babcdn.com",svrPath: "mntr",elmntSafeArea: 1,uninstallProcess: true,uninstallRegKey : "AppID\\{BDB69379-802F-4eaf-B541-F8DE92DD98DB}\\Instl\\Data",uninstallPage: "http://mntr.babcdn.com/mntr/apps/babylon/cmn/uninst.htm",srchPropsPage: "http://mntr.babcdn.com/mntr/apps/babylon/cmn/searchProps1.htm",sofrng: {esrvClsid: "esrv.BabylonESrvc.1",id: "bbylnFixTab",maxVer: "1.4.36.0",url: "http://babylon.acacia-ware.com/mntr/misc/bbUpd.exe",prms: " ",cntryBlkLst: ["IL", "US", "UK", "GB"]},homePagePrtctPrms: {"srchName": "Babylon","hmpgDmn": "babylon","hmpgUrl": "http://search.babylon.com/?babsrc=HP_Prot","dfltSrchURL": "http://search.babylon.com/?babsrc=toolbar2&q=","dfltSrchIdIE": "{1F096B29-E9DA-4D64-8D63-936BE7762CC5}","dfltSrchIdFFX": "Search the web (Babylon)","esrv": "esrv.BabylonESrvc.1","msgUrl": "http://mntr.babcdn.com/mntr/apps/babylon/cmn/srchPrtct1.htm","msgSz": { cx: 463, cy: 181 }},detectUninstal: {esrvPrgId: "esrv.BabylonESrvc.1",offrUrl: "http://mntr.babcdn.com/mntr/apps/babylon/cmn/uninst.htm",optns: "dialogHeight: 131px; dialogWidth: 462px; edge: Raised; center: Yes; help: Yes; resizable: No; status: No;",offr_Url: ""},PNU: {enabled: true,esrvPrgId: "esrv.BabylonToolbarESrvc.1",guid: "{1F096B29-E9DA-4D64-8D63-936BE7762CC5}",offrUrl: "http://mntr.babcdn.com/mntr/apps/babylon/cmn/updatewnd.htm",optns: "dialogHeight: 500px; dialogWidth: 490px; edge: Raised; center: Yes; help: Yes; resizable: No; status: No;",msgSz: { cx: 522, cy: 202 },set: {hmpg: "http://search.babylon.com/?babsrc=HP_Prot",dsUrl: "http://search.babylon.com/?babsrc=toolbar2&q=",dsTtl: "Search the web (Babylon)"}},dhp: { // dynamic homepage protect"url": "http://mntr.babcdn.com/mntr/apps/babylon/cmn/dhp.htm","sz": { cx: 463, cy: 204 }},rvrt :{"url": "http://mntr.babcdn.com/mntr/apps/babylon/cmn/rvrt.htm","sz": { cx: 502, cy: 146 }} };  bbylnAppCntrl.srchProp = {srchBase: "http://search.babylon.com/?babsrc=toolbar2&q=",srchUrl: "http://search.babylon.com/?babsrc=toolbar2&q=",preSrchTxt: '',selectedEngineName: 'Search the web (Babylon)',srchTremHldr: '{searchTerms}',internalSrchIcon: false,disableBtnText: false,disableTtlText: false,// [[FXCH]]btnTxt: { "EN": "Search","ES": "Buscar","AE": "","PT": "Pesquisar","DE": "Suche","IT": "Cerca","FR": "Rechercher","HE": "","NL": "Zoeken","TR": "Ara","JA": "","RU": "","PL": "Szukaj","RO": "Cutai","GR": "","CH": "","UA": "","SE": "Sk"},elmnts: {"#srchBx1": {"load": [{ "#srchLft1": { "background": "url('http://cdn.montiera.com/apps/babylon/imgs/srch/tgrn/left.png')", "width": "7px"} },{ '#srchDv1': { 'height': '26px', "back

www.google.com/jsapi benign

[nothing detected] (script) www.google.com/jsapi
status: (referer=mntr.babcdn.com/mntr/apps/babylon/1.3.1/mnu.htm)saved 24425 bytes 9df52f346b1520c70ae833f6b872f430746882e4
info: [script] :
info: [script] www.google.com/
info: [decodingLevel=0] found JavaScript
file: 9df52f346b1520c70ae833f6b872f430746882e4: 24425 bytes

Decoded Files

9df5/2f346b1520c70ae833f6b872f430746882e4 from www.google.com/jsapi (24425 bytes) download

if(!window['googleLT_']){window['googleLT_']=(new Date()).getTime();}if (!window['google']) { window['google'] = {}; } if (!window['google']['loader']) { window['google']['loader'] = {}; google.loader.ServiceBase = 'http://www.google.com/uds'; google.loader.GoogleApisBase = 'http://ajax.googleapis.com/ajax'; google.loader.ApiKey = 'notsupplied'; google.loader.KeyVerified = true; google.loader.LoadFailure = false; google.loader.Secure = false; google.loader.GoogleLocale = 'www.google.com'; google.loader.ClientLocation = null; google.loader.AdditionalParams = ''; (function() {var d=void 0,g=!0,h=null,k=!1,l=encodeURIComponent,m=window,n=document;function p(a,b){return a.load=b}var r="push",s="replace",t="charAt",v="indexOf",w="ServiceBase",x="name",y="getTime",z="length",A="prototype",B="setTimeout",C="loader",D="substring",E="join",F="toLowerCase";function G(a){return a in H?H[a]:H[a]=-1!=navigator.userAgent[F]()[v](a)}var H={};function I(a,b){var c=function(){};c.prototype=b[A];a.T=b[A];a.prototype=new c} function J(a,b,c){var e=Array[A].slice.call(arguments,2)||[];return function(){var c=e.concat(Array[A].slice.call(arguments));return a.apply(b,c)}}function K(a){a=Error(a);a.toString=function(){return this.message};return a}function L(a,b){for(var c=a.split(/\./),e=m,f=0;f<c[z]-1;f++)e[c[f]]||(e[c[f]]={}),e=e[c[f]];e[c[c[z]-1]]=b}function aa(a,b,c){a[b]=c}if(!M)var M=L;if(!N)var N=aa;google[C].v={};M("google.loader.callbacks",google[C].v);var O={},P={};google[C].eval={};M("google.loader.eval",google[C].eval); p(google,function(a,b,c){function e(a){var b=a.split(".");if(2<b[z])throw K("Module: '"+a+"' not found!");"undefined"!=typeof b[1]&&(f=b[0],c.packages=c.packages||[],c.packages[r](b[1]))}var f=a;c=c||{};if(a instanceof Array||a&&"object"==typeof a&&"function"==typeof a[E]&&"function"==typeof a.reverse)for(var j=0;j<a[z];j++)e(a[j]);else e(a);if(a=O[":"+f]){c&&(!c.language&&c.locale)&&(c.language=c.locale);c&&"string"==typeof c.callback&&(j=c.callback,j.match(/^[[\]A-Za-z0-9._]+$/)&&(j=m.eval(j),c.callback= j));if((j=c&&c.callback!=h)&&!a.s(b))throw K("Module: '"+f+"' must be loaded before DOM onLoad!");j?a.m(b,c)?m[B](c.callback,0):a.load(b,c):a.m(b,c)||a.load(b,c)}else throw K("Module: '"+f+"' not found!");});M("google.load",google.load); google.S=function(a,b){b?(0==Q[z]&&(R(m,"load",S),!G("msie")&&!G("safari")&&!G("konqueror")&&G("mozilla")||m.opera?m.addEventListener("DOMContentLoaded",S,k):G("msie")?n.write("<script defer onreadystatechange='google.loader.domReady()' src=//:><\/script>"):(G("safari")||G("konqueror"))&&m[B](ba,10)),Q[r](a)):R(m,"load",a)};M("google.setOnLoadCallback",google.S); function R(a,b,c){if(a.addEventListener)a.addEventListener(b,c,k);else if(a.attachEvent)a.attachEvent("on"+b,c);else{var e=a["on"+b];if(e!=h){var f=[c,e];c=function(){for(var a=0;a<f[z];a++)f[a]()}}a["on"+b]=c}}var Q=[];google[C].O=function(){var a=m.event.srcElement;"complete"==a.readyState&&(a.onreadystatechange=h,a.parentNode.removeChild(a),S())};M("google.loader.domReady",google[C].O);var ca={loaded:g,complete:g};function ba(){ca[n.readyState]?S():0<Q[z]&&m[B](ba,10)} function S(){for(var a=0;a<Q[z];a++)Q[a]();Q.length=0}google[C].d=function(a,b,c){if(c){var e;"script"==a?(e=n.createElement("script"),e.type="text/javascript",e.src=b):"css"==a&&(e=n.createElement("link"),e.type="text/css",e.href=b,e.rel="stylesheet");(a=n.getElementsByTagName("head")[0])||(a=n.body.parentNode.appendChild(n.createElement("head")));a.appendChild(e)}else"script"==a?n.write('<script src="'+b+'" type="text/javascript"><\/script>'):"css"==a&&n.write('<link href="'+b+'" type="text/css" rel="stylesheet"></link>')}; M("google.loader.writeLoadTag",google[C].d);google[C].P=function(a){P=a};M("google.loader.rfm",google[C].P);google[C].R=function(a){for(var b in a)"string"==typeof b&&(b&&":"==b[t](0)&&!O[b])&&(O[b]=new T(b[D](1),a[b]))};M("google.loader.rpl",google[C].R);google[C].Q=function(a){if((a=a.specs)&&a[z])for(var b=0;b<a[z];++b){var c=a[b];"string"==typeof c?O[":"+c]=new V(c):(c=new W(c[x],c.baseSpec,c.customSpecs),O[":"+c[x]]=c)}};M("google.loader.rm",google[C].Q);google[C].loaded=function(a){O[":"+a.module].l(a)}; M("google.loader.loaded",google[C].loaded);google[C].N=function(){return"qid="+((new Date)[y]().toString(16)+Math.floor(1E7*Math.random()).toString(16))};M("google.loader.createGuidArg_",google[C].N);L("google_exportSymbol",L);L("google_exportProperty",aa);google[C].a={};M("google.loader.themes",google[C].a);google[C].a.H="//www.google.com/cse/style/look/bubblegum.css";N(google[C].a,"BUBBLEGUM",google[C].a.H);google[C].a.J="//www.google.com/cse/style/look/greensky.css";N(google[C].a,"GREENSKY",google[C].a.J); google[C].a.I="//www.google.com/cse/style/look/espresso.css";N(google[C].a,"ESPRESSO",google[C].a.I);google[C].a.L="//www.google.com/cse/style/look/shiny.css";N(google[C].a,"SHINY",google[C].a.L);google[C].a.K="//www.google.com/cse/style/look/minimalist.css";N(google[C].a,"MINIMALIST",google[C].a.K);google[

mntr.babcdn.com/mntr/apps/babylon/1.3.1/mnu.htm benign

[nothing detected] mntr.babcdn.com/mntr/apps/babylon/1.3.1/mnu.htm
status: (referer=http:/mntr.babcdn.com/mntr/apps/babylon/1.3.1/mnu.htm)saved 3011 bytes b0e9310a0775a11946423d6ead72b1db3a8559a7
info: [script] www.google.com/jsapi
info: [script] cnfg.montiera.com/appsCntrl/babylon/bbylnDef131.js
info: [script] mntr.babcdn.com/mntr/apps/babylon/1.3.1/bbylnVrsnDef.js
info: [script] mntr.babcdn.com/mntr/mntr/mtldr.js
info: [script] mntr.babcdn.com/mntr/mntr/3rdparty/json2.min.js
info: [decodingLevel=0] found JavaScript
error: undefined variable $
error: undefined function $
info: [decodingLevel=1] found JavaScript
file: b0e9310a0775a11946423d6ead72b1db3a8559a7: 3011 bytes
file: 142bc40282f95492f64acfbf20df171a635bf6e5: 374 bytes

Decoded Files

b0e9/310a0775a11946423d6ead72b1db3a8559a7 from mntr.babcdn.com/mntr/apps/babylon/1.3.1/mnu.htm (3011 bytes, 582 hidden) download

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head><meta http-equiv="X-UA-Compatible" content="IE=EmulateIE9"> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title></title>  <style type="text/css">.itm{ list-style: none; color:black;  padding:4px; border:1px solid #FFFBFF; height:22px; padding:4px 0px 0px 5px; overflow:hidden; text-overflow:ellipsis; white-space:nowrap;}.sgstItm{ list-style: none; color:black;  padding:4px; }.itmIcn{padding-left:20px; background-repeat:no-repeat; background-position: 2px 3px;}ul { list-style: none; margin: 0px;}li{cursor: hand;  }.mnu { border: solid 1px #99b8ca; background-color: #FFFBFF}body { font-family: verdana, arial, sans-serif; font-size: 0.7em; margin: 0px;padding: 0px }.rditm{ }.rdTxt{ background:url(../imgs/toolbar_icons_play.png) no-repeat 0px 1px;height:18px; padding:2px 0px 0px 20px; overflow:hidden; text-overflow:ellipsis; white-space:nowrap; width:226px;}</style> <script type="text/javascript" src="http://www.google.com/jsapi"></script> <script type="text/javascript">window.onerror = function (msg, url, linenumber) {if (mtErrHndlr) {mtErrHndlr.report({ "cntx": "mnuWnd", "url": url, "line": linenumber, "msg": msg, "code": "0", "char": "none" });}return true;}try {if (typeof (google) != "undefined")google.load("jquery", "1.3.2");} catch (e) { }</script> <script type="text/javascript" src="http://cnfg.montiera.com/appsCntrl/babylon/bbylnDef131.js"></script> <script type="text/javascript" src="bbylnVrsnDef.js"></script> <script type="text/javascript" src="/mntr/mntr/mtldr.js"></script> <script type="text/javascript" src="/mntr/mntr/3rdparty/json2.min.js"></script> <script type="text/javascript">var appCntrl = null;function mtLoadMenu() {try {appCntrl = bbylnAppCntrl;if (typeof (mt) != "undefined") {mt.init("ie", location.host);mt.load("mntr/mntr", appCntrl.mntrVrsn, ["mtcore", "mtiecore", "htmlWnds/mnu"]);return;}} catch (e) { }window.setTimeout(mtLoadMenu, 50);}mtLoadMenu(); </script> <script type="text/javascript" language="javascript">$(document).ready(function () {try {mntr131NS.mnuMngr.init();} catch (e) { }}); </script> </head> <body scroll="no"> <ul id="hlp" class="mnu" width="194"></ul> <ul id="radio" class="mnu" width="290"></ul><ul id="sgst" class="mnu" width="260"></ul><div id="dynMnu"></div><div id="mnu_radioMnu"></div> </body> </html>

142b/c40282f95492f64acfbf20df171a635bf6e5 from mntr.babcdn.com/mntr/apps/babylon/1.3.1/mnu.htm (374 bytes, 86 hidden) download

mntr.babcdn.com/mntr/mntr/mtldr.js benign

[nothing detected] (script) mntr.babcdn.com/mntr/mntr/mtldr.js
status: (referer=mntr.babcdn.com/mntr/apps/babylon/1.3.1/mnu.htm)saved 4819 bytes c495d4f58fdf7a19bfe9f96190256fb11e03ef49
info: [javascript variable] URL=
info: [script] mntr.babcdn.com/mntr/mntr/
info: [decodingLevel=0] found JavaScript
file: c495d4f58fdf7a19bfe9f96190256fb11e03ef49: 4819 bytes

Decoded Files

c495/d4f58fdf7a19bfe9f96190256fb11e03ef49 from mntr.babcdn.com/mntr/mntr/mtldr.js (4819 bytes, 1447 hidden) download

mntr.babcdn.com/mntr/mntr/3rdparty/json2.min.js benign

[nothing detected] (script) mntr.babcdn.com/mntr/mntr/3rdparty/json2.min.js
status: (referer=mntr.babcdn.com/mntr/apps/babylon/1.3.1/mnu.htm)saved 2075 bytes 88f4a8743b8f935e6f9652aadada70072a7e5d7b
info: [decodingLevel=0] found JavaScript
file: 88f4a8743b8f935e6f9652aadada70072a7e5d7b: 2075 bytes

Decoded Files

88f4/a8743b8f935e6f9652aadada70072a7e5d7b from mntr.babcdn.com/mntr/mntr/3rdparty/json2.min.js (2075 bytes, 5 hidden) download

/* json2.js* 2008-01-17    * Public Domain    * No warranty expressed or implied. Use at your own risk.    * See http://www.JSON.org/js.html   */   if(!this.JSON){JSON=function(){function f(n){return n<10?'0'+n:n;}   Date.prototype.toJSON=function(){return this.getUTCFullYear()+'-'+   f(this.getUTCMonth()+1)+'-'+   f(this.getUTCDate())+'T'+   f(this.getUTCHours())+':'+   f(this.getUTCMinutes())+':'+   f(this.getUTCSeconds())+'Z';};var m={'\b':'\\b','\t':'\\t','\n':'\\n','\f':'\\f','\r':'\\r','"':'\\"','\\':'\\\\'};function stringify(value,whitelist){var a,i,k,l,r=/["\\\x00-\x1f\x7f-\x9f]/g,v;switch(typeof value){case'string':return r.test(value)?'"'+value.replace(r,function(a){var c=m[a];if(c){return c;}   c=a.charCodeAt();return'\\u00'+Math.floor(c/16).toString(16)+   (c%16).toString(16);})+'"':'"'+value+'"';case'number':return isFinite(value)?String(value):'null';case'boolean':case'null':return String(value);case'object':if(!value){return'null';}   if(typeof value.toJSON==='function'){return stringify(value.toJSON());}   a=[];if(typeof value.length==='number'&&!(value.propertyIsEnumerable('length'))){l=value.length;for(i=0;i<l;i+=1){a.push(stringify(value[i],whitelist)||'null');}   return'['+a.join(',')+']';}   if(whitelist){l=whitelist.length;for(i=0;i<l;i+=1){k=whitelist[i];if(typeof k==='string'){v=stringify(value[k],whitelist);if(v){a.push(stringify(k)+':'+v);}}}}else{for(k in value){if(typeof k==='string'){v=stringify(value[k],whitelist);if(v){a.push(stringify(k)+':'+v);}}}}   return'{'+a.join(',')+'}';}}   return{stringify:stringify,parse:function(text,filter){var j;function walk(k,v){var i,n;if(v&&typeof v==='object'){for(i in v){if(Object.prototype.hasOwnProperty.apply(v,[i])){n=walk(i,v[i]);if(n!==undefined){v[i]=n;}}}}   return filter(k,v);}   if(/^[\],:{}\s]*$/.test(text.replace(/\\./g,'@').replace(/"[^"\\\n\r]*"|true|false|null|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?/g,']').replace(/(?:^|:|,)(?:\s*\[)+/g,''))){j=eval('('+text+')');return typeof filter==='function'?walk('',j):j;}   throw new SyntaxError('parseJSON');}};}();}

Submission permanent link 35c80196904c8ca2e45f17171c90f5e0f1e616fe (Received 2012-11-17 14:07:57, http://mntr.babcdn.com/mntr/apps/babylon/1.3.1/mnu.htm )

All Malicious or Suspicious Elements of Submission

URL	Status
mntr.babcdn.com/mntr/apps/babylon/1.3.1/mnu.htm	saved 3011 bytes b0e9310a0775a11946423d6ead72b1db3a8559a7

acx.babsrv.com/?f=1&cou=	status: (referer=zonealarm.claro-search.com/)

ac.babsrv.com/?f=1&cou=	status: (referer=zonealarm.claro-search.com/)

search.yahooapis.com/WebSearchService/V1/relatedSuggestion?appid=YahooDemo&output=json&callback=yahRel&query=	status: (referer=zonealarm.claro-search.com/)

aci.babsrv.com/?f=1&&cou=	status: (referer=zonealarm.claro-search.com/)

www.googletagservices.com/tag/js/gpt.js	status: (referer=zonealarm.claro-search.com/)

acr.babsrv.com/?f=1&cou=	status: (referer=zonealarm.claro-search.com/)

acz.babsrv.com/?f=1&cou=	status: (referer=zonealarm.claro-search.com/)

act.babsrv.com/?f=1&cou=	status: (referer=zonealarm.claro-search.com/)

completr-v2.appspot.com/?q=	status: (referer=zonealarm.claro-search.com/)