JSUNPACK
A Generic JavaScript Unpacker
CAUTION: jsunpack was designed for security researchers and computer professionals
Enter a single URL (or paste JavaScript to decode):

Upload a PDF, pcap, HTML, or JavaScript file
Private? Help: privacy | uploads
Default Referer
Description

Submission permanent link 7f2e331ce3fd5e6e85d832dd5ab6ff56627b6478 (Received 2014-02-13 22:17:34, http://whpa.im/my/61412501725 )

URLStatus
whpa.im/my/61412501725 saved 2664 bytes 7353c015d86903df389c5a30b7cd2a514532b029

pod.xxxconnect.com/libraries/AC_RunActiveContent.js status: (referer=affiliate.thedatingnetwork.com/tracking/click/v1?site=xxxconnect.com&afn=664397&afnPromoCode=437686&extra=k=ea896a350f3adf9020545a1bbfb0d6b6&tour=letmefuck)

ajax.cloudflare.com/cdn-cgi/se/javascripts/undefined status: (referer=ajax.cloudflare.com/cdn-cgi/se/javascripts/modernizr.js)

static.xxxconnect.com/de/res/site/default/js/jquery-1.4.1.min.js status: (referer=affiliate.thedatingnetwork.com/tracking/click/v1?site=xxxconnect.com&afn=664397&afnPromoCode=437686&extra=k=ea896a350f3adf9020545a1bbfb0d6b6&tour=letmefuck)

static.xxxconnect.com/tour/xxxconnect.com/letmefuck/index status: (referer=affiliate.thedatingnetwork.com/tracking/click/v1?site=xxxconnect.com&afn=664397&afnPromoCode=437686&extra=k=ea896a350f3adf9020545a1bbfb0d6b6&tour=letmefuck)

static.xxxconnect.com/de/res/site/default/js/utils.js status: (referer=affiliate.thedatingnetwork.com/tracking/click/v1?site=xxxconnect.com&afn=664397&afnPromoCode=437686&extra=k=ea896a350f3adf9020545a1bbfb0d6b6&tour=letmefuck)

static.xxxconnect.com/tour/xxxconnect.com/letmefuck/REQ.png status: (referer=affiliate.thedatingnetwork.com/tracking/click/v1?site=xxxconnect.com&afn=664397&afnPromoCode=437686&extra=k=ea896a350f3adf9020545a1bbfb0d6b6&tour=letmefuck)

static.xxxconnect.com/tour/xxxconnect.com/letmefuck/swfmacmousewheel.js status: (referer=affiliate.thedatingnetwork.com/tracking/click/v1?site=xxxconnect.com&afn=664397&afnPromoCode=437686&extra=k=ea896a350f3adf9020545a1bbfb0d6b6&tour=letmefuck)

static.xxxconnect.com/tour/xxxconnect.com/letmefuck/jquery.cookie.js status: (referer=affiliate.thedatingnetwork.com/tracking/click/v1?site=xxxconnect.com&afn=664397&afnPromoCode=437686&extra=k=ea896a350f3adf9020545a1bbfb0d6b6&tour=letmefuck)

static.xxxconnect.com/de/res/vendor/webtrends/tag.js status: (referer=affiliate.thedatingnetwork.com/tracking/click/v1?site=xxxconnect.com&afn=664397&afnPromoCode=437686&extra=k=ea896a350f3adf9020545a1bbfb0d6b6&tour=letmefuck)

All Malicious or Suspicious Elements of Submission

None
affiliate.thedatingnetwork.com/tracking/click/v1?site=xxxconnect.com&afn=664397&afnPromoCode=437686&extra=k=ea896a350f3adf9020545a1bbfb0d6b6&tour=letmefuck benign
[nothing detected] (metarefresh) affiliate.thedatingnetwork.com/tracking/click/v1?site=xxxconnect.com&afn=664397&afnPromoCode=437686&extra=k=ea896a350f3adf9020545a1bbfb0d6b6&tour=letmefuck
     status: (referer=www.1trkclick.com/cpa.php?mt=437686&ofid=13284&tid=1&x1=2188.us.3g.fea)saved 12637 bytes edf613518a77bae3df29a36285b614ce3b897ca2
     info: [javascript variable] URL=
     info: [javascript variable] URL=static.xxxconnect.com/tour/xxxconnect.com/letmefuck/index
     info: [javascript variable] URL=static.xxxconnect.com/tour/xxxconnect.com/letmefuck/REQ.png
     info: [script] static.xxxconnect.com/de/res/site/default/js/jquery-1.4.1.min.js
     info: [script] static.xxxconnect.com/de/res/site/default/js/utils.js
     info: [script] static.xxxconnect.com/tour/xxxconnect.com/letmefuck/jquery.cookie.js
     info: [script] pod.xxxconnect.com/libraries/openEmail.js
     info: [script] pod.xxxconnect.com/libraries/AC_RunActiveContent.js
     info: [script] static.xxxconnect.com/tour/xxxconnect.com/letmefuck/swfmacmousewheel.js
     info: [img] affiliate.thedatingnetwork.com/tracking/click/
     info: [img] affiliate.thedatingnetwork.com/tracking/click/on.gif
     info: [img] affiliate.thedatingnetwork.com/tracking/click/tryMobile.png
     info: [img] affiliate.thedatingnetwork.com/tracking/click/tellFriends.png
     info: [img] affiliate.thedatingnetwork.com/tracking/click/toolbar.png
     info: [script] static.xxxconnect.com/de/res/vendor/webtrends/tag.js
     info: [img] wt.xxxconnect.com/dcskxxefe00000w8odsya5xg3_8j8y/njs.gif?dcsuri=/nojavascript&WT.js=No&WT.tv=8.0.0
     info: [decodingLevel=0] found JavaScript
     error: undefined variable window.location.protocol
     error: line:1: SyntaxError: missing ; before statement:
          error: line:1: var window.location.protocol = 1;
          error: line:1: ....^
     error: line:3: SyntaxError: missing = in XML attribute:
          error: line:3: <!DOCTYPE html PUBLIC "-/W3C/DTD XHTML 1.0 Transitional/EN" "http:/www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
          error: line:3: ...............^
     file: edf613518a77bae3df29a36285b614ce3b897ca2: 12637 bytes

Decoded Files
edf6/13518a77bae3df29a36285b614ce3b897ca2 from affiliate.thedatingnetwork.com/tracking/click/v1?site=xxxconnect.com&afn=664397&afnPromoCode=437686&extra=k=ea896a350f3adf9020545a1bbfb0d6b6&tour=letmefuck (12637 bytes, 779 hidden) download


ajax.cloudflare.com/cdn-cgi/nexp/dok8v=221574e73d/undefined benign
[nothing detected] (element) ajax.cloudflare.com/cdn-cgi/nexp/dok8v=221574e73d/undefined
     status: (referer=ajax.cloudflare.com/cdn-cgi/nexp/dok8v=221574e73d/cloudflare.min.js)saved 4830 bytes 7610bf340ee44f55708476c795e6e818aa8eda3c
     info: [script] ajax.cloudflare.com/cdn-cgi/se/javascripts/modernizr.js
     info: [img] ajax.cloudflare.com/cdn-cgi/ping?cf[action]=load&cf[location]=smarterror&cf[js]=0
     info: [decodingLevel=0] found JavaScript
     info: [element] URL=ajax.cloudflare.com/cdn-cgi/nexp/dok8v=221574e73d/cloudflare.min.js
     info: [1] no JavaScript
     file: 7610bf340ee44f55708476c795e6e818aa8eda3c: 4830 bytes
     file: f0204c9758e8b00be534cf6a4adf8e7d8ecb6c02: 135 bytes

Decoded Files
7610/bf340ee44f55708476c795e6e818aa8eda3c from ajax.cloudflare.com/cdn-cgi/nexp/dok8v=221574e73d/undefined (4830 bytes, 969 hidden) download