JSUNPACK
A Generic JavaScript Unpacker
CAUTION: jsunpack was designed for security researchers and computer professionals
Enter a single URL (or paste JavaScript to decode):

Upload a PDF, pcap, HTML, or JavaScript file
Private? Help: privacy | uploads
Default Referer
Description

Submission permanent link 7f2e331ce3fd5e6e85d832dd5ab6ff56627b6478 (Received 2014-02-13 22:17:34, http://whpa.im/my/61412501725 )

URLStatus
whpa.im/my/61412501725 saved 2664 bytes 7353c015d86903df389c5a30b7cd2a514532b029

pod.xxxconnect.com/libraries/AC_RunActiveContent.js status: (referer=affiliate.thedatingnetwork.com/tracking/click/v1?site=xxxconnect.com&afn=664397&afnPromoCode=437686&extra=k=ea896a350f3adf9020545a1bbfb0d6b6&tour=letmefuck)

ajax.cloudflare.com/cdn-cgi/se/javascripts/undefined status: (referer=ajax.cloudflare.com/cdn-cgi/se/javascripts/modernizr.js)

static.xxxconnect.com/de/res/site/default/js/jquery-1.4.1.min.js status: (referer=affiliate.thedatingnetwork.com/tracking/click/v1?site=xxxconnect.com&afn=664397&afnPromoCode=437686&extra=k=ea896a350f3adf9020545a1bbfb0d6b6&tour=letmefuck)

static.xxxconnect.com/tour/xxxconnect.com/letmefuck/index status: (referer=affiliate.thedatingnetwork.com/tracking/click/v1?site=xxxconnect.com&afn=664397&afnPromoCode=437686&extra=k=ea896a350f3adf9020545a1bbfb0d6b6&tour=letmefuck)

static.xxxconnect.com/de/res/site/default/js/utils.js status: (referer=affiliate.thedatingnetwork.com/tracking/click/v1?site=xxxconnect.com&afn=664397&afnPromoCode=437686&extra=k=ea896a350f3adf9020545a1bbfb0d6b6&tour=letmefuck)

static.xxxconnect.com/tour/xxxconnect.com/letmefuck/REQ.png status: (referer=affiliate.thedatingnetwork.com/tracking/click/v1?site=xxxconnect.com&afn=664397&afnPromoCode=437686&extra=k=ea896a350f3adf9020545a1bbfb0d6b6&tour=letmefuck)

static.xxxconnect.com/tour/xxxconnect.com/letmefuck/swfmacmousewheel.js status: (referer=affiliate.thedatingnetwork.com/tracking/click/v1?site=xxxconnect.com&afn=664397&afnPromoCode=437686&extra=k=ea896a350f3adf9020545a1bbfb0d6b6&tour=letmefuck)

static.xxxconnect.com/tour/xxxconnect.com/letmefuck/jquery.cookie.js status: (referer=affiliate.thedatingnetwork.com/tracking/click/v1?site=xxxconnect.com&afn=664397&afnPromoCode=437686&extra=k=ea896a350f3adf9020545a1bbfb0d6b6&tour=letmefuck)

static.xxxconnect.com/de/res/vendor/webtrends/tag.js status: (referer=affiliate.thedatingnetwork.com/tracking/click/v1?site=xxxconnect.com&afn=664397&afnPromoCode=437686&extra=k=ea896a350f3adf9020545a1bbfb0d6b6&tour=letmefuck)

All Malicious or Suspicious Elements of Submission

None
affiliate.thedatingnetwork.com/tracking/click/v1?site=xxxconnect.com&afn=664397&afnPromoCode=437686&extra=k=ea896a350f3adf9020545a1bbfb0d6b6&tour=letmefuck benign
[nothing detected] (metarefresh) affiliate.thedatingnetwork.com/tracking/click/v1?site=xxxconnect.com&afn=664397&afnPromoCode=437686&extra=k=ea896a350f3adf9020545a1bbfb0d6b6&tour=letmefuck
     status: (referer=www.1trkclick.com/cpa.php?mt=437686&ofid=13284&tid=1&x1=2188.us.3g.fea)saved 12637 bytes edf613518a77bae3df29a36285b614ce3b897ca2
     info: [javascript variable] URL=
     info: [javascript variable] URL=static.xxxconnect.com/tour/xxxconnect.com/letmefuck/index
     info: [javascript variable] URL=static.xxxconnect.com/tour/xxxconnect.com/letmefuck/REQ.png
     info: [script] static.xxxconnect.com/de/res/site/default/js/jquery-1.4.1.min.js
     info: [script] static.xxxconnect.com/de/res/site/default/js/utils.js
     info: [script] static.xxxconnect.com/tour/xxxconnect.com/letmefuck/jquery.cookie.js
     info: [script] pod.xxxconnect.com/libraries/openEmail.js
     info: [script] pod.xxxconnect.com/libraries/AC_RunActiveContent.js
     info: [script] static.xxxconnect.com/tour/xxxconnect.com/letmefuck/swfmacmousewheel.js
     info: [img] affiliate.thedatingnetwork.com/tracking/click/
     info: [img] affiliate.thedatingnetwork.com/tracking/click/on.gif
     info: [img] affiliate.thedatingnetwork.com/tracking/click/tryMobile.png
     info: [img] affiliate.thedatingnetwork.com/tracking/click/tellFriends.png
     info: [img] affiliate.thedatingnetwork.com/tracking/click/toolbar.png
     info: [script] static.xxxconnect.com/de/res/vendor/webtrends/tag.js
     info: [img] wt.xxxconnect.com/dcskxxefe00000w8odsya5xg3_8j8y/njs.gif?dcsuri=/nojavascript&WT.js=No&WT.tv=8.0.0
     info: [decodingLevel=0] found JavaScript
     error: undefined variable window.location.protocol
     error: line:1: SyntaxError: missing ; before statement:
          error: line:1: var window.location.protocol = 1;
          error: line:1: ....^
     error: line:3: SyntaxError: missing = in XML attribute:
          error: line:3: <!DOCTYPE html PUBLIC "-/W3C/DTD XHTML 1.0 Transitional/EN" "http:/www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
          error: line:3: ...............^
     file: edf613518a77bae3df29a36285b614ce3b897ca2: 12637 bytes

Decoded Files
edf6/13518a77bae3df29a36285b614ce3b897ca2 from affiliate.thedatingnetwork.com/tracking/click/v1?site=xxxconnect.com&afn=664397&afnPromoCode=437686&extra=k=ea896a350f3adf9020545a1bbfb0d6b6&tour=letmefuck (12637 bytes, 779 hidden) download


ajax.cloudflare.com/cdn-cgi/nexp/dok8v=221574e73d/undefined benign
[nothing detected] (element) ajax.cloudflare.com/cdn-cgi/nexp/dok8v=221574e73d/undefined
     status: (referer=ajax.cloudflare.com/cdn-cgi/nexp/dok8v=221574e73d/cloudflare.min.js)saved 4830 bytes 7610bf340ee44f55708476c795e6e818aa8eda3c
     info: [script] ajax.cloudflare.com/cdn-cgi/se/javascripts/modernizr.js
     info: [img] ajax.cloudflare.com/cdn-cgi/ping?cf[action]=load&cf[location]=smarterror&cf[js]=0
     info: [decodingLevel=0] found JavaScript
     info: [element] URL=ajax.cloudflare.com/cdn-cgi/nexp/dok8v=221574e73d/cloudflare.min.js
     info: [1] no JavaScript
     file: 7610bf340ee44f55708476c795e6e818aa8eda3c: 4830 bytes
     file: f0204c9758e8b00be534cf6a4adf8e7d8ecb6c02: 135 bytes

Decoded Files
7610/bf340ee44f55708476c795e6e818aa8eda3c from ajax.cloudflare.com/cdn-cgi/nexp/dok8v=221574e73d/undefined (4830 bytes, 969 hidden) download

f020/4c9758e8b00be534cf6a4adf8e7d8ecb6c02 from ajax.cloudflare.com/cdn-cgi/nexp/dok8v=221574e73d/undefined (135 bytes) download


www.google-analytics.com/analytics.js benign
[nothing detected] (element) www.google-analytics.com/analytics.js
     status: (referer=whpa.im/my/61412501725)saved 22709 bytes e73ee69849e2752a9fa103da6831599918507cba
     info: [decodingLevel=0] found JavaScript
     file: e73ee69849e2752a9fa103da6831599918507cba: 22709 bytes

Decoded Files
e73e/e69849e2752a9fa103da6831599918507cba from www.google-analytics.com/analytics.js (22709 bytes) download


whpa.im/my/click.php?cid=179&phone=61412501725 benign
[nothing detected] (metarefresh) whpa.im/my/click.php?cid=179&phone=61412501725
     status: (referer=whpa.im/my/61412501725)saved 331 bytes 63e922efe1d0c619d3e24ade0f2f94a9113bc157
     info: [meta refresh] URL=www.1trkclick.com/cpa.php?mt=437686&ofid=13284&tid=1&x1=2188.us.3g.fea
     info: [0] no JavaScript
     file: 63e922efe1d0c619d3e24ade0f2f94a9113bc157: 331 bytes

Decoded Files
63e9/22efe1d0c619d3e24ade0f2f94a9113bc157 from whpa.im/my/click.php?cid=179&phone=61412501725 (331 bytes, 133 hidden) download


whpa.im/my/61412501725 benign
[nothing detected] whpa.im/my/61412501725
     status: (referer=http:/www.ask.com/web?q=puppies)saved 2664 bytes 7353c015d86903df389c5a30b7cd2a514532b029
     info: [meta refresh] URL=whpa.im/my/click.php?cid=179&phone=61412501725
     info: [img] whpa.im/my/coles.png
     info: [decodingLevel=0] found JavaScript
     error: undefined variable m
     info: [element] URL=ajax.cloudflare.com/cdn-cgi/nexp/dok8v=221574e73d/cloudflare.min.js
     info: [element] URL=www.google-analytics.com/analytics.js
     info: [1] no JavaScript
     file: 7353c015d86903df389c5a30b7cd2a514532b029: 2664 bytes
     file: b81c62a0e35ab1a126ac36df5db3aab60305047d: 240 bytes

Decoded Files
7353/c015d86903df389c5a30b7cd2a514532b029 from whpa.im/my/61412501725 (2664 bytes, 117 hidden) download

b81c/62a0e35ab1a126ac36df5db3aab60305047d from whpa.im/my/61412501725 (240 bytes) download


ajax.cloudflare.com/cdn-cgi/nexp/dok8v=221574e73d/cloudflare.min.js benign
[nothing detected] (element) ajax.cloudflare.com/cdn-cgi/nexp/dok8v=221574e73d/cloudflare.min.js
     status: (referer=whpa.im/my/61412501725)saved 49238 bytes c8961f796a99d155e844613f7401dd8cf2d951af
     info: ActiveXDataObjectsMDAC detected Microsoft.XMLHTTP
     info: [script] ajax.cloudflare.com/cdn-cgi/nexp/dok8v=221574e73d/
     info: [decodingLevel=0] found JavaScript
     error: undefined function b.createTextNode
     error: undefined variable b
     info: Decoding option navigator.systemLanguage=en and navigator.systemLanguage=zh-cn and browser=IE7/XP and browser=IE8/Vista and browser=Opera and browser=Firefox,      0 bytes
     info: Decoding option navigator.systemLanguage=en and navigator.systemLanguage=zh-cn and browser=IE7/XP and browser=IE8/Vista and browser=Opera and browser=Firefox,      74 bytes
     info: [element] URL=ajax.cloudflare.com/cdn-cgi/nexp/dok8v=221574e73d/undefined
     info: [1] no JavaScript
     file: c8961f796a99d155e844613f7401dd8cf2d951af: 49238 bytes
     file: 13532b7da4041b6f071fa13e0d5fbc64ccfa6e40: 74 bytes

Decoded Files
c896/1f796a99d155e844613f7401dd8cf2d951af from ajax.cloudflare.com/cdn-cgi/nexp/dok8v=221574e73d/cloudflare.min.js (49238 bytes) download

1353/2b7da4041b6f071fa13e0d5fbc64ccfa6e40 from ajax.cloudflare.com/cdn-cgi/nexp/dok8v=221574e73d/cloudflare.min.js (74 bytes) download


ajax.cloudflare.com/cdn-cgi/nexp/dok8v=221574e73d/ benign
[nothing detected] (script) ajax.cloudflare.com/cdn-cgi/nexp/dok8v=221574e73d/
     status: (referer=ajax.cloudflare.com/cdn-cgi/nexp/dok8v=221574e73d/cloudflare.min.js)saved 4830 bytes 1fc031d777c6f9dcc255fa1d7ee53e7057d34558
     info: [script] ajax.cloudflare.com/cdn-cgi/se/javascripts/modernizr.js
     info: [img] ajax.cloudflare.com/cdn-cgi/ping?cf[action]=load&cf[location]=smarterror&cf[js]=0
     info: [decodingLevel=0] found JavaScript
     info: [element] URL=ajax.cloudflare.com/cdn-cgi/nexp/dok8v=221574e73d/cloudflare.min.js
     info: [1] no JavaScript
     file: 1fc031d777c6f9dcc255fa1d7ee53e7057d34558: 4830 bytes
     file: f0204c9758e8b00be534cf6a4adf8e7d8ecb6c02: 135 bytes

Decoded Files
1fc0/31d777c6f9dcc255fa1d7ee53e7057d34558 from ajax.cloudflare.com/cdn-cgi/nexp/dok8v=221574e73d/ (4830 bytes, 969 hidden) download

f020/4c9758e8b00be534cf6a4adf8e7d8ecb6c02 from ajax.cloudflare.com/cdn-cgi/nexp/dok8v=221574e73d/ (135 bytes) download


ajax.cloudflare.com/cdn-cgi/se/javascripts/modernizr.js benign
[nothing detected] (script) ajax.cloudflare.com/cdn-cgi/se/javascripts/modernizr.js
     status: (referer=ajax.cloudflare.com/cdn-cgi/nexp/dok8v=221574e73d/undefined)saved 7305 bytes 2a815684a4e4d185c13bd1c8be1e7874b95c54fe
     info: [decodingLevel=0] found JavaScript
     error: undefined variable b.styleSheets
     error: line:1: SyntaxError: missing ; before statement:
          error: line:1: var b.styleSheets = 1;
          error: line:1: ....^
     info: [element] URL=ajax.cloudflare.com/cdn-cgi/se/javascripts/undefined
     info: [1] no JavaScript
     file: 2a815684a4e4d185c13bd1c8be1e7874b95c54fe: 7305 bytes
     file: 2a32da1be66b499b14b4d8965014a4856be03449: 366 bytes

Decoded Files
2a81/5684a4e4d185c13bd1c8be1e7874b95c54fe from ajax.cloudflare.com/cdn-cgi/se/javascripts/modernizr.js (7305 bytes) download

2a32/da1be66b499b14b4d8965014a4856be03449 from ajax.cloudflare.com/cdn-cgi/se/javascripts/modernizr.js (366 bytes) download


pod.xxxconnect.com/libraries/openEmail.js benign
[nothing detected] (script) pod.xxxconnect.com/libraries/openEmail.js
     status: (referer=affiliate.thedatingnetwork.com/tracking/click/v1?site=xxxconnect.com&afn=664397&afnPromoCode=437686&extra=k=ea896a350f3adf9020545a1bbfb0d6b6&tour=letmefuck)saved 1402 bytes b02e4798101cfd05845ab89a4711ebaf8795fd15
     info: [decodingLevel=0] found JavaScript
     file: b02e4798101cfd05845ab89a4711ebaf8795fd15: 1402 bytes

Decoded Files
b02e/4798101cfd05845ab89a4711ebaf8795fd15 from pod.xxxconnect.com/libraries/openEmail.js (1402 bytes, 46 hidden) download


www.1trkclick.com/cpa.php?mt=437686&ofid=13284&tid=1&x1=2188.us.3g.fea benign
[nothing detected] (metarefresh) www.1trkclick.com/cpa.php?mt=437686&ofid=13284&tid=1&x1=2188.us.3g.fea
     status: (referer=whpa.im/my/click.php?cid=179&phone=61412501725)saved 209 bytes 1209f9520544621fe83c04a8abe0eb70b55e2a78
     info: [meta refresh] URL=affiliate.thedatingnetwork.com/tracking/click/v1?site=xxxconnect.com&afn=664397&afnPromoCode=437686&extra=k%3Dea896a350f3adf9020545a1bbfb0d6b6&tour=letmefuck
     info: [0] no JavaScript
     file: 1209f9520544621fe83c04a8abe0eb70b55e2a78: 209 bytes

Decoded Files
1209/f9520544621fe83c04a8abe0eb70b55e2a78 from www.1trkclick.com/cpa.php?mt=437686&ofid=13284&tid=1&x1=2188.us.3g.fea (209 bytes) download