JSUNPACK
A Generic JavaScript Unpacker
CAUTION: jsunpack was designed for security researchers and computer professionals
Enter a single URL (or paste JavaScript to decode):

Upload a PDF, pcap, HTML, or JavaScript file
Private? Help: privacy | uploads
Default Referer
Description

Submission permanent link 6da71aa56bb846bbb46773f00f67305da6d2dbe7 (Received 2013-01-10 15:54:07, http://delivery.trafficbroker.com/ck.php?oaparams=2__bannerid=20296__zoneid=150820__cb={random}__r=0480f8cf26f59f167db887eb3428488b367394c991155b494517de6fb0e0eb23feaa9150a1aa__il=1138335844__vt=31333537383531323136__pil=5ac3a28d2ded9e503cff87bd6b77__hsh=)

URLStatus
delivery.trafficbroker.com/ck.php?oaparams=2__bannerid=20296__zoneid=150820__cb={random}__r=0480f8cf26f59f167db887eb3428488b367394c991155b494517de6fb0e0eb23feaa9150a1_il=1138335844__vt=31333537383531323136__pil=5ac3a28d2ded9e503cff87bd6b77__hsh=ddf3ce2 saved 332 bytes 025a95b13ab3e80cace8c463633d25da0cc2d23a

All Malicious or Suspicious Elements of Submission

None
www.trafficholder.com/in/in.php?ace benign
[nothing detected] (var newurl) www.trafficholder.com/in/in.php?ace
     status: (referer=delivery.trafficbroker.com/ck.php?oaparams=2__bannerid=20296__zoneid=150820__cb={random}__r=0480f8cf26f59f167db887eb3428488b367394c991155b494517de6fb0e0eb23feaa9150a1_il=1138335844__vt=31333537383531323136__pil=5ac3a28d2ded9e503cff87bd6b77__hsh=ddf3ce23960fa810f3d353b35fbe8a97)saved 100 bytes 5717a095bb1054b4ef43968ea65028a761caff1a
     info: [decodingLevel=0] found JavaScript
     error: line:3: TypeError: unknown XML entity n=nocookie&r='+escape(''):
          error: line:3: <parent xmlns=""><script>document.location = '/cgi-bin/traffic/process.fcgi?a=ace&n=nocookie&r='+escape('');</script></parent>
          error: line:3: .........................^
     file: 5717a095bb1054b4ef43968ea65028a761caff1a: 100 bytes

Decoded Files
5717/a095bb1054b4ef43968ea65028a761caff1a from www.trafficholder.com/in/in.php?ace (100 bytes) download


delivery.trafficbroker.com/ck.php?oaparams=2__bannerid=20296__zoneid=150820__cb={random}__r=0480f8cf26f59f167db887eb3428488b367394c991155b494517de6fb0e0eb23feaa9150a1_il=1138335844__vt=31333537383531323136__pil=5ac3a28d2ded9e503cff87bd6b77__hsh=ddf3ce2 benign
[nothing detected] delivery.trafficbroker.com/ck.php?oaparams=2__bannerid=20296__zoneid=150820__cb={random}__r=0480f8cf26f59f167db887eb3428488b367394c991155b494517de6fb0e0eb23feaa9150a1_il=1138335844__vt=31333537383531323136__pil=5ac3a28d2ded9e503cff87bd6b77__hsh=ddf3ce23960fa810f3d353b35fbe8a97
     status: (referer=http:/www.ask.com/web?q=puppies)saved 332 bytes 025a95b13ab3e80cace8c463633d25da0cc2d23a
     info: [decodingLevel=0] found JavaScript
     info: [windowlocation] URL=www.trafficholder.com/in/in.php?ace
     info: [var location] URL=www.trafficholder.com/in/in.php?ace
     info: [var newurl] URL=www.trafficholder.com/in/in.php?ace
     info: [decodingLevel=1] found JavaScript
     file: 025a95b13ab3e80cace8c463633d25da0cc2d23a: 332 bytes
     file: 25b308f63d9749f6e99da6bfa0e50a3eb26248c1: 222 bytes

Decoded Files
025a/95b13ab3e80cace8c463633d25da0cc2d23a from delivery.trafficbroker.com/ck.php?oaparams=2__bannerid=20296__zoneid=150820__cb={random}__r=0480f8cf26f59f167db887eb3428488b367394c991155b494517de6fb0e0eb23feaa9150a1_il=1138335844__vt=31333537383531323136__pil=5ac3a28d2ded9e503cff87bd6b77__hsh=ddf3ce2 (332 bytes) download

25b3/08f63d9749f6e99da6bfa0e50a3eb26248c1 from delivery.trafficbroker.com/ck.php?oaparams=2__bannerid=20296__zoneid=150820__cb={random}__r=0480f8cf26f59f167db887eb3428488b367394c991155b494517de6fb0e0eb23feaa9150a1_il=1138335844__vt=31333537383531323136__pil=5ac3a28d2ded9e503cff87bd6b77__hsh=ddf3ce2 (222 bytes) download