JSUNPACK
A Generic JavaScript Unpacker
CAUTION: jsunpack was designed for security researchers and computer professionals
Enter a single URL (or paste JavaScript to decode):

Upload a PDF, pcap, HTML, or JavaScript file
Private? Help: privacy | uploads
Default Referer
Description

Submission permanent link ab81c39158b3b2a1288fe823a212a08892288e28 (Received 2010-08-24 18:05:14, http://motherless.com/ABF9781 )

URLStatus
motherless.com/ABF9781 saved 24694 bytes fetch_8135afebbb9a3ecf40e83f73bec292ed56faa086

ero-advertising.com/ads/notify.php?id=15184 status: (referer=adspaces.ero-advertising.com/adspace/15184.js)

ero-advertising.com/ads/notify.php?id=36903 status: (referer=adspaces.ero-advertising.com/adspace/36903.js)

motherless.com/scripts/shadowbox/javascript:false;document.write( status: (referer=motherless.com/scripts/shadowbox/shadowbox.js)failure: HTTP Error 404: Not Found

bid.openx.net/ status: (referer=bid.openx.net/jstag)failure: HTTP Error 404: OK

www.ltassrv.com/ status: (referer=www.ltassrv.com/serve/api5.4.asp?d=11415&s=13640&c=10704&v=1)failure: HTTP Error 403: Forbidden

motherless.com/scripts/ status: (referer=motherless.com/scripts/swfobject.js)failure: HTTP Error 404: Not Found

adspaces.ero-advertising.com/adspace/ status: (referer=adspaces.ero-advertising.com/adspace/15184.js)failure: HTTP Error 404: Not Found

banners.ero-advertising.com/banads/bannerview.php?pid=8030&spaceid=15184&siteid=5091&data=DMUMWUqhosfSzq4ulccysKVmiYIOeiugxktiA26P8JLr+bTXSJYaCePslH1q3Ve+FvVmvVpNXJQOaD5FPN5gjcU7XzaZbxGreNX7nDM8W2vk4xwVTOHdlIej8BCSf5Pt4CyfC+CQK0O5EU0AzzvdxQp9Ez2IDenZ6lpb7 status: (referer=adspaces.ero-advertising.com/adspace/15184.js)

banners.ero-advertising.com/banads/bannerview.php?pid=8030&spaceid=36903&siteid=5091&data=63IYcRttFxBHiA3qDKay/qGn/vuLn7C4JteJGr3n9pL6LXa1WiiabXcNcjZl3LjL5bx4RLtjKeNnofuvbMSbiMw2B0fXAsIxXo4Gol5rgr6MBuDm2XYCkRxa5kywuEg5umMt30Q4199o86AKuhQ4VUdHnEmmfYQufUo5B status: (referer=adspaces.ero-advertising.com/adspace/36903.js)

Warning: reading file /storagefiles/c9ff/2f875aedeb7870c34e88c9799db15399c558 failed

All Malicious or Suspicious Elements of Submission

suspicious: Warning detected //warning CVE-NO-MATCH Shellcode Engine Binary Threshold
cachend.fling.com/projectm/js/jquery.cycle.all.min.js benign
[nothing detected] (script) cachend.fling.com/projectm/js/jquery.cycle.all.min.js
     status: (referer=br.fling.com/projectm/banner.htm?server=fe&bannerZoneid=1109&template=300x220_sixsigma4&size=300x250&thumbZoneid=456&bannerid=13315&target=_blank&prod=90&type=static&rating=r&debug=0&cmp=300x2502_300fling)saved 19107 bytes 95c638500151ecfc794fbe2736e4eacf8044210a
     info: [decodingLevel=0] found JavaScript
     error: undefined variable jQuery
     error: undefined variable F.browser
     error: line:1: SyntaxError: missing ; before statement:
          error: line:1: var F.browser = 1;
          error: line:1: ....^
     file: 95c638500151ecfc794fbe2736e4eacf8044210a: 19107 bytes

Decoded Files
95c6/38500151ecfc794fbe2736e4eacf8044210a from cachend.fling.com/projectm/js/jquery.cycle.all.min.js (19107 bytes) download


adspaces.ero-advertising.com/adspace/36903.js benign
[nothing detected] (script) adspaces.ero-advertising.com/adspace/36903.js
     status: (referer=motherless.com/)saved 2216 bytes 4f13d128cbf1c4f966806405a3a753a7e0e73e79
     info: [javascript variable] URL=banners.ero-advertising.com/banads/bannerview.php?pid=8030&spaceid=36903&siteid=5091&data=63IYcRttFxBHiA3qDKay%2FqGn%2FvuLn7C4JteJGr3n9pL6LXa1WiiabXcNcjZl3LjL5bx4RLtjKeNnofuvbMSbiMw2B0fXAsIxXo4Gol5rgr6MBuDm2XYCkRxa5kywuEg5umMt30Q4199o86AKuhQ4VUdHnEmmfYQufUo5BUZh78PwxA7u3jXrttyGSCvO0Vt%2F&rnd=7054
     info: [script] ero-advertising.com/ads/notify.php?id=36903
     info: [iframe] adspaces.ero-advertising.com/adspace/
     info: [decodingLevel=0] found JavaScript
     error: undefined variable erochk.parentNode
     error: line:1: SyntaxError: missing ; before statement:
          error: line:1: var erochk.parentNode = 1;
          error: line:1: ....^
     info: [decodingLevel=1] found JavaScript
     file: 4f13d128cbf1c4f966806405a3a753a7e0e73e79: 2216 bytes
     file: 8da15ae565530890a0f2893564a6869cb38e9408: 80 bytes

Decoded Files
4f13/d128cbf1c4f966806405a3a753a7e0e73e79 from adspaces.ero-advertising.com/adspace/36903.js (2216 bytes, 145 hidden) download

8da1/5ae565530890a0f2893564a6869cb38e9408 from adspaces.ero-advertising.com/adspace/36903.js (80 bytes) download


seekbang.com/cs/ads/300x250/300_rotator.php?kwd=300x2502 benign
[nothing detected] (iframe) seekbang.com/cs/ads/300x250/300_rotator.php?kwd=300x2502
     status: (referer=seekbang.com/cs/ads/iframe482.html)saved 729 bytes 0bf017897b3dd97df84cde699cbbad6e422ede9a
     info: [iframe] www.seekbang.com/cs/mediaman/demo/tpl/300x250_7sec2.php?kwd=300x2502_7sec2
     info: [iframe] seekbang.com/cs/ads/300x250/300fling.php?kwd=300x2502_300fling
     info: [decodingLevel=0] found JavaScript
     info: DecodedIframe detected
     info: [decodingLevel=1] found JavaScript
     file: 0bf017897b3dd97df84cde699cbbad6e422ede9a: 729 bytes
     file: 7db01a0b293ec52aec1aa020464cc1fe865f7648: 168 bytes

Decoded Files
0bf0/17897b3dd97df84cde699cbbad6e422ede9a from seekbang.com/cs/ads/300x250/300_rotator.php?kwd=300x2502 (729 bytes, 17 hidden) download

7db0/1a0b293ec52aec1aa020464cc1fe865f7648 from seekbang.com/cs/ads/300x250/300_rotator.php?kwd=300x2502 (168 bytes) download


edge.quantserve.com/quant.js benign
[nothing detected] (script) edge.quantserve.com/quant.js
     status: (referer=bid.openx.net/jstag)saved 5043 bytes 45cc0e03477de48f56c5804ceb69e7d028ec532e
     info: [javascript variable] URL=pixel.quantserve.com
     info: [decodingLevel=0] found JavaScript
     file: 45cc0e03477de48f56c5804ceb69e7d028ec532e: 5043 bytes

Decoded Files
45cc/0e03477de48f56c5804ceb69e7d028ec532e from edge.quantserve.com/quant.js (5043 bytes, 71 hidden) download