JSUNPACK
A Generic JavaScript Unpacker
CAUTION: jsunpack was designed for security researchers and computer professionals
Enter a single URL (or paste JavaScript to decode):

Upload a PDF, pcap, HTML, or JavaScript file
Private? Help: privacy | uploads
Default Referer
Description

Submission permanent link 55ab2e7279cb0e55c4950255a85d2d78d8e5c68c (Received 2011-03-01 20:31:37, www.brasilligado.org/parceiros/axn.html www.brasilligado.org)

URLStatus
www.brasilligado.org/parceiros/axn.html saved 4688 bytes 1f2ed11e07f420da12d4de8563ff1f6093c43849

ad.adserverplus.com/ status: (referer=ad.adserverplus.com/st?type=iframe&size=300x250&section=1752547&nofreqcap=1)failure: HTTP Error 404: Not Found

ad.harrenmedianetwork.com/ status: (referer=ad.harrenmedianetwork.com/st?type=iframe&size=300x250&section=1449946)failure: HTTP Error 404: Not Found

All Malicious or Suspicious Elements of Submission

None
www.tvthudinha.net/adxat.html benign
[nothing detected] (iframe) www.tvthudinha.net/adxat.html
     status: (referer=www.brasilligado.org/parceiros/axn.html)saved 894 bytes 315bb11061359b761e15cd637f84dade782ce30a
     info: [iframe] ad.adserverplus.com/st?type=iframe&size=300x250&section=1752547&nofreqcap=1
     info: [img] sstatic1.histats.com/0.gif?44511&101
     info: [decodingLevel=0] found JavaScript
     info: [script] s10.histats.com/js15.js
     info: [decodingLevel=1] found JavaScript
     file: 315bb11061359b761e15cd637f84dade782ce30a: 894 bytes
     file: 28e5d68ed50c164ecde5b32d67a6106e077d3eed: 101 bytes

Decoded Files
315b/b11061359b761e15cd637f84dade782ce30a from www.tvthudinha.net/adxat.html (894 bytes, 7 hidden) download

28e5/d68ed50c164ecde5b32d67a6106e077d3eed from www.tvthudinha.net/adxat.html (101 bytes) download


s10.histats.com/ benign
[nothing detected] (embed) s10.histats.com/
     status: (referer=s10.histats.com/js15.js)saved 2 bytes a5d5b61aa8a61b7d9d765e1daf971a9a578f1cfa
     info: [0] no JavaScript
     file: a5d5b61aa8a61b7d9d765e1daf971a9a578f1cfa: 2 bytes

Decoded Files
a5d5/b61aa8a61b7d9d765e1daf971a9a578f1cfa from s10.histats.com/ (2 bytes) download


ad.harrenmedianetwork.com/st?type=iframe&size=300x250&section=1449946 benign
[nothing detected] (iframe) ad.harrenmedianetwork.com/st?type=iframe&size=300x250&section=1449946
     status: (referer=www.brasilligado.org/parceiros/axn.html)saved 4614 bytes fb6620a0134dabafbff7f3dd7d33e914a379b196
     info: [script] ad.harrenmedianetwork.com/
     info: [img] ad.yieldmanager.com/imp?amp;size=300x250&section=1449946&t=2
     info: [img] content.yieldmanager.com/ak/q.gif
     info: [decodingLevel=0] found JavaScript
     info: [var url] URL=ad.yieldmanager.com/imp?amp;size=300x250&section=1449946&_salt=602056888&B=10&u=undefined&r=1
     info: [var src] URL=ad.harrenmedianetwork.com/
     info: [var newurl] URL=ad.harrenmedianetwork.com/
     info: [decodingLevel=1] found JavaScript
     file: fb6620a0134dabafbff7f3dd7d33e914a379b196: 4614 bytes
     file: 6c17af8b4d768ba9b8f51b01919deec7b93bd302: 687 bytes

Decoded Files
fb66/20a0134dabafbff7f3dd7d33e914a379b196 from ad.harrenmedianetwork.com/st?type=iframe&size=300x250&section=1449946 (4614 bytes) download

6c17/af8b4d768ba9b8f51b01919deec7b93bd302 from ad.harrenmedianetwork.com/st?type=iframe&size=300x250&section=1449946 (687 bytes) download


s10.histats.com/js15.js benign
[nothing detected] (script) s10.histats.com/js15.js
     status: (referer=www.tvthudinha.net/adxat.html)saved 7663 bytes 8b311dda3f245e78a300e307ca50697e9359162f
     info: [script] s10.histats.com/js12.js?
     info: [embed] s10.histats.com/
     info: [script] s
     info: [decodingLevel=0] found JavaScript
     file: 8b311dda3f245e78a300e307ca50697e9359162f: 7663 bytes

Decoded Files
8b31/1dda3f245e78a300e307ca50697e9359162f from s10.histats.com/js15.js (7663 bytes) download


www.brasilligado.org/parceiros/axn.html benign
[nothing detected] www.brasilligado.org/parceiros/axn.html
     status: (referer=www.google.com/trends/hottrends)saved 4688 bytes 1f2ed11e07f420da12d4de8563ff1f6093c43849
     info: [img] www.brasilligado.org/imagem/twitter-icon.jpg
     info: [img] www.brasilligado.org/imagem/facebook-icon.jpg
     info: [iframe] ad.harrenmedianetwork.com/st?type=iframe&size=300x250&section=1449946
     info: [img] www.brasilligado.org/imagem/fecharvto.jpg
     info: [iframe] www.tvthudinha.net/adxat.html
     info: [decodingLevel=0] found JavaScript
     error: undefined variable dfgfdg
     info: [javascript variable] URL=www.serv-vto.com/player4.7.swf
     info: [decodingLevel=1] found JavaScript
     file: 1f2ed11e07f420da12d4de8563ff1f6093c43849: 4688 bytes
     file: 8e06cafe6596c9ba6a22e8781f5d9633f90c4019: 623 bytes

Decoded Files
1f2e/d11e07f420da12d4de8563ff1f6093c43849 from www.brasilligado.org/parceiros/axn.html (4688 bytes, 134 hidden) download

8e06/cafe6596c9ba6a22e8781f5d9633f90c4019 from www.brasilligado.org/parceiros/axn.html (623 bytes) download


ad.adserverplus.com/imp?Z=300x250&nofreqcap=1&s=1752547&_salt=1783451040&B=10&u=undefined&r=1 benign
[nothing detected] (var url) ad.adserverplus.com/imp?Z=300x250&nofreqcap=1&s=1752547&_salt=1783451040&B=10&u=undefined&r=1
     status: (referer=ad.adserverplus.com/st?type=iframe&size=300x250&section=1752547&nofreqcap=1)saved 1351 bytes 8696afc308a2a68310901eb323e326b26e03e1dc
     info: [decodingLevel=0] found JavaScript
     info: [decodingLevel=1] found JavaScript
     error: line:6: SyntaxError: XML tag name mismatch (expected param):
          error: line:6: AAAAAAIAAwAAAAAAHyU2dC4BAAAAAAAAADk2OGI1NTIyLTQ0NmQtMTFlMC1iODY5LTAwMWIyNDkzNjA1MgA4nyoAAAA%3D%2C%2Cundefined%2C" /></object>
          error: line:6: ......................................................................................................................^
     file: 8696afc308a2a68310901eb323e326b26e03e1dc: 1351 bytes
     file: 5e8b69ce3229e962be03d75e4a7be29b36652838: 1169 bytes

Decoded Files
8696/afc308a2a68310901eb323e326b26e03e1dc from ad.adserverplus.com/imp?Z=300x250&nofreqcap=1&s=1752547&_salt=1783451040&B=10&u=undefined&r=1 (1351 bytes) download

5e8b/69ce3229e962be03d75e4a7be29b36652838 from ad.adserverplus.com/imp?Z=300x250&nofreqcap=1&s=1752547&_salt=1783451040&B=10&u=undefined&r=1 (1169 bytes) download


ad.yieldmanager.com/imp?amp;size=300x250&amp;section=1449946&_salt=602056888&B=10&u=undefined&r=1 benign
[nothing detected] (var url) ad.yieldmanager.com/imp?amp;size=300x250&amp;section=1449946&_salt=602056888&B=10&u=undefined&r=1
     status: (referer=ad.harrenmedianetwork.com/st?type=iframe&amp;size=300x250&amp;section=1449946)saved 48 bytes 7c2fef09a83a101f222db60b5d263a1f314b8a9f
     info: [0] no JavaScript
     file: 7c2fef09a83a101f222db60b5d263a1f314b8a9f: 48 bytes

Decoded Files
7c2f/ef09a83a101f222db60b5d263a1f314b8a9f from ad.yieldmanager.com/imp?amp;size=300x250&amp;section=1449946&_salt=602056888&B=10&u=undefined&r=1 (48 bytes) download


ad.adserverplus.com/st?type=iframe&size=300x250&section=1752547&nofreqcap=1 benign
[nothing detected] (iframe) ad.adserverplus.com/st?type=iframe&size=300x250&section=1752547&nofreqcap=1
     status: (referer=www.tvthudinha.net/adxat.html)saved 4603 bytes 3ae11d93c2bacc6ed1c1235240a7aca1307a65e7
     info: [script] ad.adserverplus.com/
     info: [img] ad.adserverplus.com/imp?Z=300x250&nofreqcap=1&s=1752547&t=2
     info: [img] content.yieldmanager.com/ak/q.gif
     info: [decodingLevel=0] found JavaScript
     info: [var url] URL=ad.adserverplus.com/imp?Z=300x250&nofreqcap=1&s=1752547&_salt=1783451040&B=10&u=undefined&r=1
     info: [var src] URL=ad.adserverplus.com/
     info: [var newurl] URL=ad.adserverplus.com/
     info: [decodingLevel=1] found JavaScript
     file: 3ae11d93c2bacc6ed1c1235240a7aca1307a65e7: 4603 bytes
     file: 94f318709d99951cead279a199b696e7de36f3a0: 675 bytes

Decoded Files
3ae1/1d93c2bacc6ed1c1235240a7aca1307a65e7 from ad.adserverplus.com/st?type=iframe&size=300x250&section=1752547&nofreqcap=1 (4603 bytes) download

94f3/18709d99951cead279a199b696e7de36f3a0 from ad.adserverplus.com/st?type=iframe&size=300x250&section=1752547&nofreqcap=1 (675 bytes) download


s10.histats.com/js12.js? benign
[nothing detected] (script) s10.histats.com/js12.js?
     status: (referer=s10.histats.com/js15.js)saved 1 bytes 2d14ab97cc3dc294c51c0d6814f4ea45f4b4e312
     info: [0] no JavaScript
     file: 2d14ab97cc3dc294c51c0d6814f4ea45f4b4e312: 1 bytes

Decoded Files
2d14/ab97cc3dc294c51c0d6814f4ea45f4b4e312 from s10.histats.com/js12.js? (1 bytes) download


www.serv-vto.com/player4.7.swf benign
[nothing detected] [SWF] (jsvar) www.serv-vto.com/player4.7.swf
     status: (referer=www.brasilligado.org/parceiros/axn.html)saved 49766 bytes 89d513b08a74d35994d04fe2398ce5f86060156f
     info: [0] no JavaScript
     file: 89d513b08a74d35994d04fe2398ce5f86060156f: 49766 bytes

Decoded Files
89d5/13b08a74d35994d04fe2398ce5f86060156f from www.serv-vto.com/player4.7.swf (49766 bytes, 30114 hidden) download