JSUNPACK
A Generic JavaScript Unpacker
CAUTION: jsunpack was designed for security researchers and computer professionals
Enter a single URL (or paste JavaScript to decode):

Upload a PDF, pcap, HTML, or JavaScript file
Private? Help: privacy | uploads
Default Referer
Description

Submission permanent link 513c2a474b8c2e98adb175e61c27fe87200ed992 (Received 2017-08-09 02:18:56, script )

URLStatus
a href='https:/www.google.com/maps/dir/Current status: (referer=http:/www.ask.com/web?q=puppies)failure: <urlopen error [Errno -3] Temporary failure in name resolution>

a class="id" href="https:/poketoolset.com/pokemon/ status: (referer=http:/www.ask.com/web?q=puppies)failure: <urlopen error [Errno -3] Temporary failure in name resolution>

/ status: (referer=http:/www.ask.com/web?q=puppies)failure: <urlopen error no host given>

(https?:/ status: (referer=http:/www.ask.com/web?q=puppies)failure: <urlopen error [Errno -3] Temporary failure in name resolution>

All Malicious or Suspicious Elements of Submission

suspicious: shellcode of length 9957/11103
malicious: shellcode URL=a class="id" href="https:/poketoolset.com/pokemon/
malicious: shellcode URL=a href='https:/www.google.com/maps/dir/Current
malicious: shellcode URL=https:/PokeHuntr.com/assets/img/icons
malicious: shellcode URL=https:/api.pokehuntr.com/api/
malicious: shellcode URL=https:/server.arcgisonline.com/ArcGIS/rest/services/WSMap/MapServer/tile/
malicious: shellcode URL=https:/
suspicious: shellcode of length 9960/13131
malicious: shellcode URL=(https?:
malicious: client download shellcode URL (non-executable) saved (9da1a99bd519bc1fdccd93c877386551dbf75420)
malicious: client download shellcode URL (non-executable) saved (d205cbd6783332a212c5ae92d73c77178c2d2f28)
malicious: client download shellcode URL (non-executable) saved (6b8e9ab8f363df658be25413ce6d3c3304e909ff)
script malicious
[malicious:8] script
     info: [decodingLevel=0] found JavaScript
     error: undefined variable jQuery
     error: undefined variable _0x4c38a9
     suspicious: shellcode of length 9957/11103
     malicious: shellcode URL=a class="id" href="https:/poketoolset.com/pokemon/
     malicious: shellcode URL=a href='https:/www.google.com/maps/dir/Current
     malicious: shellcode URL=https:/PokeHuntr.com/assets/img/icons
     malicious: shellcode URL=https:/api.pokehuntr.com/api/
     malicious: shellcode URL=https:/server.arcgisonline.com/ArcGIS/rest/services/WSMap/MapServer/tile/
     malicious: shellcode URL=https:/
     suspicious: shellcode of length 9960/13131
     malicious: shellcode URL=(https?:
     info: [1] no JavaScript
     info: file: saved script to (d5064dbead0e56c55b2fabaaa58dae6acf2327ef)
     file: d5064dbead0e56c55b2fabaaa58dae6acf2327ef: 288102 bytes
     file: fdb4b93310f79f326435380f9f0a7831fbb67649: 26435 bytes
     file: fd3233f1f70b3bc8c7f8c6e516ff24e6e7b03ac5: 9957 bytes
     file: 4664782e3b6abc09245a981c041f9a4a5260d102: 9960 bytes

Decoded Files
d506/4dbead0e56c55b2fabaaa58dae6acf2327ef from script (288102 bytes) download

fdb4/b93310f79f326435380f9f0a7831fbb67649 from script (26435 bytes) download

fd32/33f1f70b3bc8c7f8c6e516ff24e6e7b03ac5 from script (9957 bytes, 72 hidden) download

4664/782e3b6abc09245a981c041f9a4a5260d102 from script (9960 bytes, 79 hidden) download


server.arcgisonline.com/ArcGIS/rest/services/WSMap/MapServer/tile/ malicious
[malicious:6] (ipaddr:23.210.111.137) (shellcode) server.arcgisonline.com/ArcGIS/rest/services/WSMap/MapServer/tile/
     status: (referer=http:/www.ask.com/web?q=puppies)saved 251 bytes 9da1a99bd519bc1fdccd93c877386551dbf75420
     malicious: client download shellcode URL (non-executable) saved (9da1a99bd519bc1fdccd93c877386551dbf75420)
     info: file: saved server.arcgisonline.com/ArcGIS/rest/services/WSMap/MapServer/tile/ to (9da1a99bd519bc1fdccd93c877386551dbf75420)
     file: 9da1a99bd519bc1fdccd93c877386551dbf75420: 251 bytes

Decoded Files
9da1/a99bd519bc1fdccd93c877386551dbf75420 from server.arcgisonline.com/ArcGIS/rest/services/WSMap/MapServer/tile/ (251 bytes) download


api.pokehuntr.com/api/ malicious
[malicious:6] (ipaddr:104.25.219.28) (shellcode) api.pokehuntr.com/api/
     status: (referer=http:/www.ask.com/web?q=puppies)saved 9 bytes d205cbd6783332a212c5ae92d73c77178c2d2f28
     malicious: client download shellcode URL (non-executable) saved (d205cbd6783332a212c5ae92d73c77178c2d2f28)
     info: file: saved api.pokehuntr.com/api/ to (d205cbd6783332a212c5ae92d73c77178c2d2f28)
     file: d205cbd6783332a212c5ae92d73c77178c2d2f28: 9 bytes

Decoded Files
d205/cbd6783332a212c5ae92d73c77178c2d2f28 from api.pokehuntr.com/api/ (9 bytes) download


PokeHuntr.com/assets/img/icons malicious
[malicious:6] (ipaddr:104.25.219.28) (shellcode) PokeHuntr.com/assets/img/icons
     status: (referer=http:/www.ask.com/web?q=puppies)saved 580 bytes 6b8e9ab8f363df658be25413ce6d3c3304e909ff
     malicious: client download shellcode URL (non-executable) saved (6b8e9ab8f363df658be25413ce6d3c3304e909ff)
     info: file: saved PokeHuntr.com/assets/img/icons to (6b8e9ab8f363df658be25413ce6d3c3304e909ff)
     file: 6b8e9ab8f363df658be25413ce6d3c3304e909ff: 580 bytes

Decoded Files
6b8e/9ab8f363df658be25413ce6d3c3304e909ff from PokeHuntr.com/assets/img/icons (580 bytes, 13 hidden) download