jsunpack - a generic JavaScript unpacker

74.63.102.91/link/click.php?fromid=1 benign

[nothing detected] (var suspendcode14) 74.63.102.91/link/click.php?fromid=1
info: [script http] s134.cnzz.com/stat.php?id=1246003&web_id=1246003
info: [decodingLevel=0] found JavaScript
info: [decodingLevel=0] decoded 6525 bytes (decoding_5980b2e0f86f577f74abebcab4604840e3b05f36)

File information (2 files) Download zip | Explanation

fetch_1ace251e7adfa9197fd763b953eefcc553903706 from 74.63.102.91/link/click.php?fromid=1 (3930 bytes, 633 hidden)

<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="zh-CN"> <head> <meta http-equiv="Content-Language" content="zh-cn"/> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/> <title></title> <script>if(self!=top){top.location=self.location;} function setBGCol(ttr,col) {ttr.style.backgroundColor=col;} </script> <style fprolloverstyle> body{ font-family:Arial; font-size: 13px; } table tr td a:hover {color: #FF0066; font-weight: bold} .titlecolor a:link,.titlecolor a:actived,.titlecolor a:visited{color: #FF0066;} table tr td{font-size: 16pt;} .tiline{height:16pt;;margin:5px 0;;width:590px;border-bottom: 2px solid #009900;text-align:left;} .tiline span{background-color: #006600;line-height:16pt;padding:3px;width:88px;text-align:center;border-left:  1px solid #009900;border-right: 1px solid #009900;border-top: 1px solid #009900;color:#FFFFFF;} #tuijian td.title a,#tuijian td.jianjie{ font-size: 16pt; } #tuijian td.title{padding-left:9px;} #tuijian a:link,#tuijian a:actived,#tuijian a:visited{text-decoration: none;} .titlecolor a:hover{  font-weight: bold;  } </style> </head> <base target="_blank"> <body >  <div align="center"> <table width="590"  border="0" cellpadding="0" cellspacing="0"><tr><td height="56"><div align="center"><div style="display:none"><script src="http://s134.cnzz.com/stat.php?id=1246003&web_id=1246003" language="JavaScript" charset="gb2312"></script> </div></div></td></tr>   </table> <br> <br> <br> <table id="tuijian" border=0 align=center cellpadding=0 cellspacing=0 width=590> <tr> <td class="title" width="32%" height="40"> <a style="text-decoration: none" href="govip.php?goid=5961"></a></td> <td class="jianjie" width="67%" height="40">a8</td> </tr> <tr> <td class="title" width="32%" height="40"> <a style="text-decoration: none" href="govip.php?goid=6480"></a></td> <td class="jianjie" width="67%" height="40"> </td> </tr> <tr> <td class="title" width="32%" height="40"> <a style="text-decoration: none" href="govip.php?goid=6458">AV</a></td> <td class="jianjie" width="67%" height="40">AV</td> </tr> <tr> <td class="title" width="32%" height="40"> <a style="text-decoration: none" href="govip.php?goid=3765"></a></td> <td class="jianjie" width="67%" height="40"></td> </tr>  <tr><td class="title" width="32%" height="40"><a href="go.php?fromid=1&goid=356&token=fcdc20730bafa904844bcc98e3896ac8" target="_blank"></a></td><td class="jianjie" width="67%" height="40"></td></tr><tr><td class="title" width="32%" height="40"><a href="go.php?fromid=1&goid=4220&token=fcdc20730bafa904844bcc98e3896ac8" target="_blank">B</a></td><td class="jianjie" width="67%" height="40">VSVS</td></tr><tr><td class="title" width="32%" height="40"><a href="go.php?fromid=1&goid=4291&token=fcdc20730bafa904844bcc98e3896ac8" target="_blank"></a></td><td class="jianjie" width="67%" height="40"></td></tr><tr><td class="title" width="32%" height="40"><a href="go.php?fromid=1&goid=5333&token=fcdc20730bafa904844bcc98e3896ac8" target="_blank"></a></td><td class="jianjie" width="67%" height="40"></td></tr></table> <table width="590" cellspacing="0" cellpadding="0" align="center">  <tr>   <td></td>  </tr> </table>  </body> </div> </html>

decoding_5980b2e0f86f577f74abebcab4604840e3b05f36 from 74.63.102.91/link/click.php?fromid=1 (6525 bytes)

//eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //eval stat()  //ev

content.pop6.com/banners/getiton/english/18584_160x600.swf benign

[nothing detected] [SWF] (embed) content.pop6.com/banners/getiton/english/18584_160x600.swf
info: [decodingLevel=0] found JavaScript

File information (1 files) Download zip | Explanation

fetch_e309a144e1bf2a31cc06d1dabeff88bbfd36324f from content.pop6.com/banners/getiton/english/18584_160x600.swf (52297 bytes, 31501 hidden)

CWS )xT[5w`@{+/NBi%PKB)s97{{sk|6l9xF(9C@Z!0/[@HpppB?`"Tf'{{%N|S/l,H^>KY(v-/{7vSIvc?ogG{)w=BBfbR28;,'5/K?"{=?N@?3`?-urw(x;CP$D3>Y*Ff`<0ggY;Eb` ;:$55$EEeE4dArb[BPfDbRj*TedAV?Hg~ANZ~?RU64RW 2bZjr"jNjNu [yI)40'3~ PgC?C4h:@FZ0L|C`#30XxxG , &I$!3<|\L,l!0q1.0q{A'fIe/NEC]q-^vh}2twIRC)8(qL}c+p-roC.:%4KRXC.M&jPmjFR:o?ayBe2j|rE4x\7VYVWdxX0S{pn<}{tQRx9O=s= GEsW<>|N5w/ H}%[<x'j'5PJ7{Xo:8Q:) (,W4\9!L[NW-g:0`K|)5c@F?g#`5!XSBFjGnJ"y's(f5Ko$7^{Z`RT 4XHh]?e,2.1) s~k=GKr:2Li6h+4>TQ"NjA}uXS:#6M]}N';&J=Z[E`A6xK<8%tuXvl%[RqGe)'9bNb=z'Ofo+jx_@GFow0[#^R[0M=[}Y{}q0yosw*6ecn}6Ss^d  J;[ZR=!?4OF_lT!&SkOZH%e5hCc#RT\Nk`0IQR&mzJn_TxE~?E%u1y"(jYtZ!rU;\oqjC:5.Jek2g:FaUDm__PAzmfjHC|DU*0KLV_pV~j:T(A]jD{F{mBu+>g_jT;,1>k#R;EW`ZY!ow:SsNzYuseW'7a>P4(#'4/jp2>rph>.e-dZ1eL)s=<Hf~z%l0J/`,~j!fv=9WgA@[kaN'V^gIg[/Y{f*Vi]//R/Sp>KQ#qsxM(9u!vF~6uBUIi-7t}4t{+LpC.pVV6~n-b+LQUaIoJ^Y[g[30l*x8Q6 p7Zdm5x?`qZMC`[UCXfB=Ppf9ZB*|u[(8[@:-:gle9p[ @|]>lv&7)]dB3'- nC~q,gGeSs&l?~X@<aooOq~9U(w^opW7LxO6rv!Q[,H^=[7,kxAJ)\D6,y&:n/<,cA22{b=Wzom1~X5f]YwV{Y0tagXS,wsTdjX_)VmAD,6j67#:_^<d*X6)Yx4$OvT'a-I>T#Hzt7H9t;nyO=/)%eMX#ukQSnVba[@;&yp8kPU7tgEKq h]2I>P9Ar:Ms6'!p3WUwf=gRA BrP<pK|%ASe* 3YP iN]#%jMT33XMIH*c)Q0btlq\M\ksdW<tg,}_a6Xp14T@}BqRfD[kOe~kk0MFJx]0OiW=QJg6uQzVQ_/(&-e(ras<_Rzjg7!}8PGSvo\V5+yMiNS~,A|&{oNbOn@{j?!=qTBKN}UJV/dVkgJr?i8j9*5{rw?TiDk)0t0""%=5RK#?Lf+#1)HeB{ ('z[+HW~rim,?T=Ip~|OERQ1i.HAU,bxAq-P58klE`B67Z|,:V`)6~]=5hUd:Fsc$,gsN:/PjwI:o{z_/M5FFRQwwpbr?,hw6gUpNS`3LJ-rX0mL?&[*9P hj?%&|3itUZ}TwG)<~s~WSXSfqIy6DklPK`6'{~A{l z;%05H1`~FJNIdfHicJ1bb[r7#Ztz&m"rKZ;eZxi$l{/L}o]=[NdPSt0>u>>y1Lb<2`z!,dm_~MM"zLj.d8Bf|qEAlb6]"=))~<dyrIulHvh6/ LEcmz6E-(,nYNRe\yY7&Pyq?Ni//A{>u%' ,G<BQ0Yr/JB(hHE r:hnIT'xH2m=w;ax0-L'8}SQ>C-gE;2#'z{r,@G-wG3xl1.'bFs">]=F^_=.0Lf~7lX,k7ox`Z6!mdF(44x>4\_h!AP#X8/>^s=,?t9_/q0BuE~^3#kq(G4kR$@q}U>-0'Nn[J]>z.fQ1]oS#8 Lb`:=b 71i1U&%DGQa"6ZHA14{L4$GfGl)Kt*f_F1A]s^=JsD ?(}M. p~/7rremv k[, *uOB?a5x8{"3phAd'B>Cz~dRn/lTPJ-0&?4n;p\9`,~wgqn{Z7JDJn#4+[ik\sUW$hdH_U5}tU*!?F+~i(hzZ6yqtR7HM );Qy$4So{;,CfRxYYdK'$}W4Rof0[Q*~uVRK>/".cXomV,BaYP{6*M R%&R"[=1v.g?7#{$gM?+rjOC'I7PeKyXF@a/mR?+8NVByY8 u=lR~j~@<rlN.[E@9yeWE;A d~,t>3Xn'H5%hQ}9Qvq!a0,\vhT*HQ:/"D!,@9B(Fi\Im#UTk#--/HoDsKCyB LTjg^S'84g) 57r[DZ8mEUS_mlk]]%j4KdI!}'N~?'0gd3?>k]|%uk'"~|\[`S/.)ycBpBfJMB2(:q%NT-9ccH3wE)O H~Ejpo7sE"*kY'r 9HFg.` "Ya#cA u[qj^L{{myz!u~m0fOCOFe~,V,j4:!Ge9`a~Ws=E%O=u5E. XE3K v3a<dy<qS~a#=Dz=gu)lD6%ik<R/Xl#WUS}pA-C0"&ODFy/09'|o"UWB3ehw[7~Yy@2>;$'wb=I-4*S3UWt:TQ.aDG;s\K;12eMz?{w}VR{VTUYReh7o\4 XJjoI9ZDQHh2&YaOd;~4t(qpO!gWG9>bpP\U)So(5+<s"gZGt`?W|&"1(RCTrTzI|!hW }2^ur"=<-or_MHX4{05e(Qg,2cmPBFyK_xa@&h^Fc]ybtUnnJ-+:{_FeC$C.#$zc3B'/L^DLAUv-A>YgO5 zKQ<+B'/cHu\yt>k,"/X;VORk'Y~jJS35vV'f6V&M6lX9FTUrI&hQ&oaZL )4X9|a??j).(Zr~;%[fP.n*0g]qFFV.=:[B."&'\:R=cV"wt8h`(q \*dwpNG #XaUVcq+,H% ^ =oHFO]i^#VioIWC25y.hcB5Oudm%:rvAqAJvn,tP +]6J.c)xT+95+smk9S\`,UBy~B}?al,Vg>18fu?;no,LU\${,%X*caeEZxn<s..e KV8b:x3ex*C{9[3=o}WhgW9$g);~Oumot.2~j=t}!Z_5#=tf?c03wr!uncQ^sw=Ao.o}\Q33JjdDtk8~k=4)Q*lNi0M&pb,Sb|Bc$<]Im,/?}Wx.Mj4HSabxY2(#BXjeU('RWP`IW}e_} cJ~8tP#$jq|+.2h00'*a}/9)%?a+{*?.q%Y}/GRnT"lq;<Q=CLZo0? C/2z!EOZoKj1o77cyHvqf6ikq3d62nB6H6%%I,w$+gQ@Oy]]q\vB\I_FFU+5zNRc'Y#@/$Z$Hj10K khZxhk/#E M^$?f E=;Jd]df}`SvI2q-VywPW#_{]3T:[v-u%ObMydV.a+^k>)z.3Oe%D*u):,psVFh0*iMj(=X(SI)SXr>I?*mE-(H2~3p`[? HWzr)_3>/Yly0110`wJB&j]rZkN6cB#4wmlQHG2'UYJgbq|k&Ok`/|}O"NG[V7^tx+XMx(Q8dgrnD]V:1~VrdS*] kyJ7cGF Aov^>4Q?LZHpJLOtk`Q9 ID`lVu7S=i^-Vp-wrNkzo::QkLt-bT|{6b>I\]?{g]uvP{M^3reQW1Y/v6Zs3o7R%LR}D$Un3if:~<{)p.<LEwt{UY~.*A_ks%?(4444'Q,`l8'`[1uq8EQB^'h##X/f~6*g egDfDOYNzA| JhtN'I'^+uuGO+cyJJ>>]!Jf$o``!2*nTDntm=W<I~<F7)PleACV-5xe=V^0=Kq6+?S05M 4{-Zv~]]$9{E~1HL)ZS8_ifq`MIyF.@8E4xCpKX24+p9MvZmgCS7:AVSp[QAij?k6umoevwk)"g6H:5E^*UMm@aOAz6L4t!%0R.Ik`9E(1U@|)l~}^#.#\Rfgn" EYQ8Fe/WZ\/1eGE =;`3;+.w@9O~L=M3.K^c(kdSlsgeh*3Tx"nz?!EE3B/ R%XG4K|VfYmX3S/=ip?s0}/EnZO^G2N`FDJiT50#[JzYW(vq7;S@:917e*?YK}jrZ2\_'#t1etpw)9qr&3&SuGv:*H|J?=8E1KqqH}G=7&a0k#%',8*TJ7m-W:vm^er*~slq:G4UE3CU>I[a<WL!mC'nFHZ$n6{6tE}f(7]=OUcrj(/WR{MwL$M80IJo Aevr-x4f}3?`Qh(FVLl~qoEr'dTK?sV)B1o7/t(_QchGrk\Vpjy2PQ? UcK1]iYYl9W\ ,}=]cUVm i_MjI}c@ONWp6}8$?uXP^ <BD9S,ln2WQ4+?U62,]h:v2mL'^ @2"i#O#%\pE}s"~?P1<7qKxeQXHj8>9to6yFQD3 &lKbG$yl$^@^Ci{`)58\Gf],4O)I6uDC_-$ST4<SQt&as}%2hOSbfx=gD?u+GW5p*S2F_fD(X@l~nDU*VwN84^%<e^?&;D}5zVqYm1Fu#h-5r?0|jt/w_}S-2|.+Cu'1l3KT)hQy4Y-\V[=%%^O\Yk:Yd`sBi6NXCFj|YbkP~R1Q<}?sG\\w,|nF;ga]|5ub=WILK%[37gIcH <yMf'r}K1(?5\92$Y@jw\A3;P{ZIvn%VVF X5?LuF?V!b#K9KqF?6mg#$_rG~YH&)U)A"g=)cX>AG/K'wLf}0D0,6~z)[bcj2(oNuV[\eHQAk.?jx.S5z}}_5;`,(Qb6qd&%vF1;QcPfsx&rUoFmtL'-sndew@"sgCnK!bB|\Nh^eY):/o9BQg}V)L'Le?_HPx:O<gch>JRMyJXZt6X\N^-]8Tne92S:I(,nGTk%+p0qNE3/}0'46[a)V%LD-7)=*-a/|3H"d%myN6PbE22&cFe<r9{6ZZZAep%Qd%z%h~m}jd=zPjE*yKOeEG$=C.5Qc;ZgxrC}J0"~{Nr5}fA<^#s,b 9|^amn/}Sm>X:5l\X52RXA6W4@yy})Y3jL8|MG2Yf6mdY{24eSDcQh6tzC1?dXk

s10.histats.com/js9.js benign

[nothing detected] (script) s10.histats.com/js9.js
info: [javascript variable] URL=s10.
info: [embed .] s10.histats.com/
info: [script http] s
info: [decodingLevel=0] found JavaScript

File information (1 files) Download zip | Explanation

fetch_345c46680f68f435e77e5b9cdd39935c97c4ee5e from s10.histats.com/js9.js (7363 bytes, 11 hidden)

1.newlinkexchange.nl/link/duilian.js benign

[nothing detected] (script) 1.newlinkexchange.nl/link/duilian.js
info: [img http] qjgtjq.blu.livefilestore.com/y1pjZxeyFdBHbgloD-P6NTmb0R6iPeWlWz3AqBOAopoXEESF7ULIF47pyhuWgvEC6AJ0pVGLpROxTbSXa9KDK75ms9RFOULuR_s/left.gif
info: [img http] qjgtjq.blu.livefilestore.com/y1pjZxeyFdBHbjIEE96WLWT7Z_Ux7d7eotm8AxUggS_2s16u0TORBt3BuUIKr16yDSmr_Gfjh1LX5SIyD-OTv6LFy6HvmwLw5NB/right.gif
info: [decodingLevel=0] found JavaScript
info: [decodingLevel=0] decoded 1406 bytes (decoding_f04b1c7e62bff63e1b330b274369870216144946)
info: [var suspendcode12] URL=74.63.102.91/link/click.php?fromid=1
info: [var suspendcode12] URL=qjgtjq.blu.livefilestore.com/y1pjZxeyFdBHbgloD-P6NTmb0R6iPeWlWz3AqBOAopoXEESF7ULIF47pyhuWgvEC6AJ0pVGLpROxTbSXa9KDK75ms9RFOULuR_s/left.gif
info: [var suspendcode14] URL=74.63.102.91/link/click.php?fromid=1
info: [var suspendcode14] URL=qjgtjq.blu.livefilestore.com/y1pjZxeyFdBHbjIEE96WLWT7Z_Ux7d7eotm8AxUggS_2s16u0TORBt3BuUIKr16yDSmr_Gfjh1LX5SIyD-OTv6LFy6HvmwLw5NB/right.gif
info: [decodingLevel=1] found JavaScript

File information (2 files) Download zip | Explanation

fetch_d56aada5583fd4444bc086eef942142f74b5ab1a from 1.newlinkexchange.nl/link/duilian.js (1507 bytes, 49 hidden)

// JavaScript Document lastScrollY=0; function heartBeat(){  var diffY; if (document.documentElement && document.documentElement.scrollTop)diffY = document.documentElement.scrollTop; else if (document.body)diffY = document.body.scrollTop else{/*Netscape stuff*/}//alert(diffY); percent=.1*(diffY-lastScrollY);  if(percent>0)percent=Math.ceil(percent);  else percent=Math.floor(percent);  document.getElementById("lovexin12").style.top=parseInt(document.getElementById("lovexin12").style.top)+percent+"px"; document.getElementById("lovexin14").style.top=parseInt(document.getElementById("lovexin12").style.top)+percent+"px";  lastScrollY=lastScrollY+percent;  //alert(lastScrollY); } suspendcode12="<DIV id=\"lovexin12\" style='left:0px;POSITION:absolute;TOP:200px;'><a href='http://74.63.102.91/link/click.php?fromid="+dlid+"' target='_blank'><img border=0 src=http://qjgtjq.blu.livefilestore.com/y1pjZxeyFdBHbgloD-P6NTmb0R6iPeWlWz3AqBOAopoXEESF7ULIF47pyhuWgvEC6AJ0pVGLpROxTbSXa9KDK75ms9RFOULuR_s/left.gif></a></div>"  suspendcode14="<DIV id=\"lovexin14\" style='right:0px;POSITION:absolute;TOP:200px;'><a href='http://74.63.102.91/link/click.php?fromid="+dlid+"' target='_blank'><img border=0 src=http://qjgtjq.blu.livefilestore.com/y1pjZxeyFdBHbjIEE96WLWT7Z_Ux7d7eotm8AxUggS_2s16u0TORBt3BuUIKr16yDSmr_Gfjh1LX5SIyD-OTv6LFy6HvmwLw5NB/right.gif></a></div>"  document.write(suspendcode12);  document.write(suspendcode14);  window.setInterval("heartBeat()",1);

decoding_f04b1c7e62bff63e1b330b274369870216144946 from 1.newlinkexchange.nl/link/duilian.js (1406 bytes)

//eval heartBeat() /*** called setInterval with heartBeat(), 1 */   //document.write (s)  <DIV id="lovexin12" style='left:0px;POSITION:absolute;TOP:200px;'><a href='http://74.63.102.91/link/click.php?fromid=1' target='_blank'><img border=0 src=http://qjgtjq.blu.livefilestore.com/y1pjZxeyFdBHbgloD-P6NTmb0R6iPeWlWz3AqBOAopoXEESF7ULIF47pyhuWgvEC6AJ0pVGLpROxTbSXa9KDK75ms9RFOULuR_s/left.gif></a></div><DIV id="lovexin14" style='right:0px;POSITION:absolute;TOP:200px;'><a href='http://74.63.102.91/link/click.php?fromid=1' target='_blank'><img border=0 src=http://qjgtjq.blu.livefilestore.com/y1pjZxeyFdBHbjIEE96WLWT7Z_Ux7d7eotm8AxUggS_2s16u0TORBt3BuUIKr16yDSmr_Gfjh1LX5SIyD-OTv6LFy6HvmwLw5NB/right.gif></a></div> //jsunpack.url var suspendcode12 = <DIV id="lovexin12" style='left:0px;POSITION:absolute;TOP:200px;'><a href='http://74.63.102.91/link/click.php?fromid=1' target='_blank'><img border=0 src=http://qjgtjq.blu.livefilestore.com/y1pjZxeyFdBHbgloD-P6NTmb0R6iPeWlWz3AqBOAopoXEESF7ULIF47pyhuWgvEC6AJ0pVGLpROxTbSXa9KDK75ms9RFOULuR_s/left.gif></a></div>  //jsunpack.url var suspendcode14 = <DIV id="lovexin14" style='right:0px;POSITION:absolute;TOP:200px;'><a href='http://74.63.102.91/link/click.php?fromid=1' target='_blank'><img border=0 src=http://qjgtjq.blu.livefilestore.com/y1pjZxeyFdBHbjIEE96WLWT7Z_Ux7d7eotm8AxUggS_2s16u0TORBt3BuUIKr16yDSmr_Gfjh1LX5SIyD-OTv6LFy6HvmwLw5NB/right.gif></a></div>

banners.getiton.com/go/page/iframe_large_thumbs_180x179?pid=g1202053-ppc benign

[nothing detected] (iframe) banners.getiton.com/go/page/iframe_large_thumbs_180x179?pid=g1202053-ppc
info: [javascript variable] URL=graphics.pop6.com/images/banners/common/female_180x179/
info: [javascript variable] URL=getiton.com/p/register.cgi?pid=g1202053-ppc
info: [javascript variable] URL=1.xhcuns.com/gg/900.htm
info: [img .] banners.getiton.com/go/page/
info: [script .] banners.getiton.com/go/page/
info: [img http] glean.pop6.com/images/common/glean.gif?rand=4957&site=getiton&session=U%5Ch%60%3EdjS3eGg+1266182445+67.217.160.100+&pwsid=&pagename=ttp%3A%2F%2F1.xhcuns.com%2Fgg%2F900.htm&pagestate=&country=United+States&city=&lang=english&level=&gpid=g1202053&pid=g1202053-ppc
info: [decodingLevel=0] found JavaScript
info: [decodingLevel=0] decoded 2768 bytes (decoding_ef4657581f2e60d3c47bfbd255a43c5d37005b0a)
info: [var udImgPre] URL=graphics.pop6.com/images/banners/common/female_180x179/
info: [var udLink] URL=getiton.com/p/register.cgi?pid=g1202053-ppc
info: [var gaJsHost] URL=www.
info: [img http] graphics.pop6.com/images/banners/common/female_180x179/16.jpg
info: [img http] graphics.pop6.com/images/banners/common/female_180x179/00.jpg
info: [img http] graphics.pop6.com/images/banners/common/female_180x179/03.jpg
info: [img http] graphics.pop6.com/images/banners/common/female_180x179/09.jpg
info: [img http] graphics.pop6.com/images/banners/common/female_180x179/11.jpg
info: [script http] www.google-analytics.com/ga.js
info: [decodingLevel=1] found JavaScript

File information (2 files) Download zip | Explanation

fetch_3e036afd756b47e1534279fadb8745244cd7b9b9 from banners.getiton.com/go/page/iframe_large_thumbs_180x179?pid=g1202053-ppc (9896 bytes, 257 hidden)

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <link rel="stylesheet" type="text/css" href="http://graphics.pop6.com/images/getiton/css/header.css" /> <link rel="shortcut icon" type="image/x-icon" href="http://graphics.pop6.com/images/getiton/favicon.ico" /> <link rel="meta" href="http://graphics.pop6.com/images/ICRA_labels_rdf_adult.rdf" type="application/rdf+xml" title="ICRA labels" /> <meta http-equiv="pics-Label" content='(pics-1.1 "http://www.icra.org/pics/vocabularyv03/" l gen true for "http://getiton.com" r (n 3 s 3 v 0 l 3 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 3)  gen true for "http://www.getiton.com" r (n 3 s 3 v 0 l 3 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 3))' /> <meta name="RATING" content="RTA-5042-1996-1400-1577-RTA" /> <meta http-equiv="content-type" content="text/html; charset=UTF-8" /> <style type="text/css"> #piclistContainer {margin:0 auto; padding:0; width:930px; height:239px; font-family:Arial, Helvetica, sans-serif; background:#FFFFFF;} #piclistHeader {margin:0 0 1px 5px; width:920px; color:#FFFFFF; font-size:19px; line-height:30px; font-weight:bold; text-align:center; background:#1893f1;} #piclistHeader a {color:#FFFFFF; text-decoration:none;} .piclistInfo {float:left; margin:0 0 -1px 0; padding:0 0 0 5px; width:180px; height:199px;} .piclistInfo img {border:none;} .piclistUserData {margin:1px 0 0 0; color:#FFFFFF; font-size:12px; line-height:19px; font-weight:bold; text-align:center; background:#1893f1;} .piclistInfo a {color:#FFFFFF; text-decoration:none;} #piclistFooter {clear:both; color:#999; font-size:8px; font-weight:bold; text-align:center;} </style></head>      <script type="text/javascript"><!--   // Define variables   var udImgPre  = 'http://graphics.pop6.com/images/banners/common/female_180x179/';   var udImgSuf  = '.jpg';   var udCity    = 'Manchester';   var udState   = 'Maryland';   var udCountry = 'United States';   var udLink    = 'http://getiton.com/p/register.cgi?pid=g1202053-ppc';   var gRandNums = ',';   var userInfo  = new Array();// User data   // Set data for members.   userInfo[0] = new userData('just2cute2','27','F', udCity, udState, udCountry, udImgPre + '00' + udImgSuf);    userInfo[1] = new userData('missrain27','32','F', udCity, udState, udCountry, udImgPre + '01' + udImgSuf);   userInfo[2] = new userData('smitten_kitten_','25','F', udCity, udState, udCountry, udImgPre + '02' + udImgSuf);   userInfo[3] = new userData('just2cute2178x','29','F', udCity, udState, udCountry, udImgPre + '03' + udImgSuf);   userInfo[4] = new userData('ladyzlair','29','F', udCity, udState, udCountry, udImgPre + '04' + udImgSuf);    userInfo[5] = new userData('sexygirl12372','27','F', udCity, udState, udCountry, udImgPre + '05' + udImgSuf);    userInfo[6] = new userData('LadybugNSW','33','F', udCity, udState, udCountry, udImgPre + '06' + udImgSuf);   userInfo[7] = new userData('JustaLady69','25','F', udCity, udState, udCountry, udImgPre + '07' + udImgSuf);    userInfo[8] = new userData('talllady4u','32','F', udCity, udState, udCountry, udImgPre + '08' + udImgSuf);    userInfo[9] = new userData('tammygirl1970','29','F', udCity, udState, udCountry, udImgPre + '09' + udImgSuf);    userInfo[10] = new userData('agirlwatcher','29','F', udCity, udState, udCountry, udImgPre + '10' + udImgSuf);   userInfo[11] = new userData('SexyRaverChicky','32','F', udCity, udState, udCountry, udImgPre + '11' + udImgSuf);   userInfo[12] = new userData('LadyRider1','28','F', udCity, udState, udCountry, udImgPre + '12' + udImgSuf);    userInfo[13] = new userData('pinkpetalled','23','F', udCity, udState, udCountry, udImgPre + '13' + udImgSuf);   userInfo[14] = new userData('freakychick6902','34','F', udCity, udState, udCountry, udImgPre + '14' + udImgSuf);   userInfo[15] = new userData('SillyGirl739','34','F', udCity, udState, udCountry, udImgPre + '15' + udImgSuf);    userInfo[16] = new userData('maillady333','33','F', udCity, udState, udCountry, udImgPre + '16' + udImgSuf);    userInfo[17] = new userData('MISS_SPY_4_U','31','F', udCity, udState, udCountry, udImgPre + '17' + udImgSuf);   userInfo[18] = new userData('twocutedc','26','F', udCity, udState, udCountry, udImgPre + '18' + udImgSuf);    userInfo[19] = new userData('babe1118','32','F', udCity, udState, udCountry, udImgPre + '19' + udImgSuf);   userInfo[20] = new userData('dreamerescape','30','F', udCity, udState, udCountry, udImgPre + '20' + udImgSuf);    userInfo[21] = new userData('Ralligal4U','31','F', udCity, udState, udCountry, udImgPre + '21' + udImgSuf);    // Build userData object   function userData(handle,age,sex,city,state,country,imgPath){this.handle  = handle;this.age= age;this.sex= sex;this.city    = city;this.state   = state;this.country = country;this.imgPath = imgPath;   }// Get Random Number   function getRandomNum(num){var dupe= 1;var randNums    = gRandNu

decoding_ef4657581f2e60d3c47bfbd255a43c5d37005b0a from banners.getiton.com/go/page/iframe_large_thumbs_180x179?pid=g1202053-ppc (2768 bytes)

//document.write (s)  <a href="http://getiton.com/p/register.cgi?pid=g1202053-ppc" target="_blank" class="piclistImg"><img src="http://graphics.pop6.com/images/banners/common/female_180x179/16.jpg" border="0" width="180" height="179" class="borderStyle"  /></a><div class="piclistUserData"><a href="http://getiton.com/p/register.cgi?pid=g1202053-ppc" target="_blank" class="piclistText"><span class="piclistHandle">maillady333</span> <span class="piclistUserInfo">33/F</span></a> end piclistUserData --></div><a href="http://getiton.com/p/register.cgi?pid=g1202053-ppc" target="_blank" class="piclistImg"><img src="http://graphics.pop6.com/images/banners/common/female_180x179/00.jpg" border="0" width="180" height="179" class="borderStyle"  /></a><div class="piclistUserData"><a href="http://getiton.com/p/register.cgi?pid=g1202053-ppc" target="_blank" class="piclistText"><span class="piclistHandle">just2cute2</span> <span class="piclistUserInfo">27/F</span></a> end piclistUserData --></div><a href="http://getiton.com/p/register.cgi?pid=g1202053-ppc" target="_blank" class="piclistImg"><img src="http://graphics.pop6.com/images/banners/common/female_180x179/03.jpg" border="0" width="180" height="179" class="borderStyle"  /></a><div class="piclistUserData"><a href="http://getiton.com/p/register.cgi?pid=g1202053-ppc" target="_blank" class="piclistText"><span class="piclistHandle">just2cute2178x</span> <span class="piclistUserInfo">29/F</span></a> end piclistUserData --></div><a href="http://getiton.com/p/register.cgi?pid=g1202053-ppc" target="_blank" class="piclistImg"><img src="http://graphics.pop6.com/images/banners/common/female_180x179/09.jpg" border="0" width="180" height="179" class="borderStyle"  /></a><div class="piclistUserData"><a href="http://getiton.com/p/register.cgi?pid=g1202053-ppc" target="_blank" class="piclistText"><span class="piclistHandle">tammygirl1970</span> <span class="piclistUserInfo">29/F</span></a> end piclistUserData --></div><a href="http://getiton.com/p/register.cgi?pid=g1202053-ppc" target="_blank" class="piclistImg"><img src="http://graphics.pop6.com/images/banners/common/female_180x179/11.jpg" border="0" width="180" height="179" class="borderStyle"  /></a><div class="piclistUserData"><a href="http://getiton.com/p/register.cgi?pid=g1202053-ppc" target="_blank" class="piclistText"><span class="piclistHandle">SexyRaverChicky</span> <span class="piclistUserInfo">32/F</span></a> end piclistUserData --></div><script src='http://www.google-analytics.com/ga.js' type='text/javascript'></script> //jsunpack.url var udImgPre = http://graphics.pop6.com/images/banners/common/female_180x179/  //jsunpack.url var udLink = http://getiton.com/p/register.cgi?pid=g1202053-ppc  //jsunpack.url var gaJsHost = http://www.

1.xhcuns.com/a/xiaoshuolei/wuxiagudian/20100105/2902.html benign

[nothing detected] 1.xhcuns.com/a/xiaoshuolei/wuxiagudian/20100105/2902.html
info: [script /] 1.xhcuns.com/gg/760h.js
info: [script /] 1.xhcuns.com/plus/ad_js.php?aid=3
info: [script /] 1.xhcuns.com/plus/ad_js.php?aid=7
info: [script /] 1.xhcuns.com/plus/ad_js.php?aid=2
info: [script /] 1.xhcuns.com/plus/ad_js.php?aid=6
info: [img /] 1.xhcuns.com/images/bbs_btn.gif
info: [iframe /] 1.xhcuns.com/gg/zxj.htm
info: [iframe /] 1.xhcuns.com/gg/zxj2.htm
info: [script /] 1.xhcuns.com/js/search.js
info: [iframe /] 1.xhcuns.com/gg/728db.htm
info: [script /] 1.xhcuns.com/js/dy.js
info: [iframe /] 1.xhcuns.com/gg/yb120.htm
info: [iframe /] 1.xhcuns.com/gg/ybhf.htm
info: [iframe /] 1.xhcuns.com/gg/728d.htm
info: [script /] 1.xhcuns.com/plus/count.php?view=yes&aid=
info: [script http] pstatic.xunlei.com/js/webThunderDetect.js
info: [script /] 1.xhcuns.com/js/base64.js
info: [script /] 1.xhcuns.com/js/thunderForum.js
info: [iframe /] 1.xhcuns.com/gg/900.htm
info: [script /] 1.xhcuns.com/gg/900.js
info: [script http] s10.histats.com/js9.js
info: [img http] s4.histats.com/stats/0.gif?946652&1
info: [script /] 1.xhcuns.com/gg/pf.js
info: [script http] 1.xhcuns.com/gglink/guanggao.js
info: [script http] 1.newlinkexchange.nl/link/duilian.js
info: [decodingLevel=0] found JavaScript

File information (1 files) Download zip | Explanation

fetch_f42c3c6d073628220ef5bf5e747783e8a207e3ab from 1.xhcuns.com/a/xiaoshuolei/wuxiagudian/20100105/2902.html (22166 bytes, 6025 hidden)

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <META http-equiv=Content-Type content="text/html; charset=gb2312"> <title>       xiao77</title> <meta name=keywords content=",,,,,,,,,,"> <meta name=description content=",,,,,,,,,,      xiao77"> <link href="/css/article.css" rel="stylesheet" type="text/css" /><base target="_blank"> </head> <body><div id="header"><div class="contain"><h4><a href="/index.html"></a></h4><div id="headerright"><div id="about" align="right"><SCRIPT src="/gg/760h.js"></SCRIPT></div></div><div id="menu"><div class="contain"><ul><li> <a href="/a/tupianlei/"></a></li><li> <a href="/a/tupianlei/jqyz">W</a></li><li> <a href="/a/tupianlei/yazhousetu/"></a></li><li> <a href="/a/tupianlei/oumeisetu/"></a></li><li> <a href="/a/tupianlei/zipaitoupai/"></a></li><li> <a href="/a/tupianlei/mingxinghecheng/"></a></li><li> <a href="/a/tupianlei/dongmansetu/"></a></li><li> <a href="/a/tupianlei/meinvtupian/"></a></li><li> <a href="/a/tupianlei/meituisiwa/"></a></li><li> <a href="/a/tupianlei/lingleitupian/"></a></li><li> <a href="http://se.xhcuns.com/"></a></li><li> <a href="http://s5.histats.com/stats/r.php?946652&100&3&urlr=&www.cycycy.info"></a></li><li> <a href="http://s5.histats.com/stats/r.php?946652&100&5&urlr=&66.90.75.220/?cheshi/">l^</a></li></ul> </div></div><div id="menu1"><div class="contain"><ul><li> <a href="/a/xiaoshuolei/">f</a></li><li> <a href="/a/xiaoshuolei/dushijiqing/"></a></li><li> <a href="/a/xiaoshuolei/jiatingluanlun/"></a></li><li> <a href="/a/xiaoshuolei/xiaoyuanchunse/"></a></li><li> <a href="/a/xiaoshuolei/wuxiagudian/"></a></li><li> <a href="/a/xiaoshuolei/qiangjianfanzui/"></a></li><li> <a href="/a/xiaoshuolei/huangsexiaohua/"></a></li><li> <a href="/a/xiaoshuolei/xingaijiqiao/"></a></li><li> <a href="/a/xiaoshuolei/lingleibaoli/"></a></li><li> <a href="http://se.xhcuns.com/"></a></li><li> <a href="http://s5.histats.com/stats/r.php?946652&100&1&urlr=&a.yigese.com/"></a></li><li> <a href="http://1.jin8.info/">http://1.jin8.info</a></li><li> <a href="http://1.jin8.info/">oxox678@aol.com</a></li> </ul> </div></div><div id="menu2"><div class="contain"><ul><li> <a href="http://1.xhcuns.com/a/dy/"></a></li><li> <a href="http://se.xhcuns.com/list/1.html"></a></li><li> <a href="http://se.xhcuns.com/list/2.html"></a></li><li> <a href="http://se.xhcuns.com/list/3.html"></a></li><li> <a href="http://se.xhcuns.com/list/4.html"></a></li><li> <a href="http://se.xhcuns.com/list/5.html"></a></li><li> <a href="http://se.xhcuns.com/list/6.html"></a></li><li> <a href="http://se.xhcuns.com/list/7.html"></a></li><li> <a href="http://se.xhcuns.com/list/8.html">y</a></li><li> <a href="http://se.xhcuns.com/list/9.html"></a></li><li> <a href="http://se.xhcuns.com/list/10.html"></a></li><li> <a href="http://se.xhcuns.com/list/11.html"></a></li><li> <a href="http://se.xhcuns.com/list/12.html">B</a></li><li> <a href="http://se.xhcuns.com/list/13.html"></a></li><li> <a href="http://se.xhcuns.com/zt/index.html"></a></li><li> <a href="http://s5.histats.com/stats/r.php?946652&100&1&urlr=&a.yigese.com/"></a></li><li> <a href="http://1.xhcuns.com/a/BTxiazai/xunleigaoqing/"></a></li><li> <a href="http://1.xhcuns.com/a/BTxiazai/yazhouBTqu/">BT</a></li><li> <a href="http://1.xhcuns.com/a/BTxiazai/oumeiBTqu/">BT</a></li><li> <a href="http://1.xhcuns.com/a/BTxiazai/dongmanBTqu/"></a></li> </ul> </div></div><div class="bd2"> <div class="bd4l" style="width: 960px"> <script src='/plus/ad_js.php?aid=3' language='javascript'></script> </div> <div class="bd4l" style="width: 960px"> <script src='/plus/ad_js.php?aid=7' language='javascript'></script> </div> <center> <script src='/plus/ad_js.php?aid=2' language='javascript'></script></center><script src='/plus/ad_js.php?aid=6' language='javascript'></script> <link href="/css/searchpage.css" rel="stylesheet" type="text/css" /> <div class="path"><ul><a href='http://1.xhcuns.com/'></a> > <a href='/a/xiaoshuolei/'></a> > <a href='/a/xiaoshuolei/wuxiagudian/'></a> > &nbsp; &nbsp;  <font color=red></font> <script language="javascript"> function dygod(){ var clipBoardContent=""; clipBoardContent+=document.title; clipBoardContent+="\,"; clipBoardContent+=this.location.href; window.clipboardData.setData("Text",clipBoardContent); alert("Crtl+V"); }  document.write("<input name=\"urlText\"   id=\"urlText\" class=\"InputTextBox\" value=\"");document.write(location.href);document.write("\"  size=\"38\" />"); </script><input type="button" name="Submit2" onClick='dygod()'  value=""> <INPUT type="button" value='' id="copy" onclick="javascript:d=document;window.external.AddFavorite(''+d.location.href+'', ''+d.title+'')">  </ul> </div>  <div class="bd3">  <div class="bd3l">  <a href="javascript:window.external.addFavorite('http://www.dygod.net/','dygod.net-')" target=_self class="s

banners.getiton.com/piclist?pid=g1202053-ppc&display=gio_flash_07&grid=1x2&textsearch=Ò»Ò¹ÇéÐÔ½»&use_flash=1&no_fakevid=1&photo=1&banner_title=%u5728[LOC]%u7684GetItOn%u6703%u54E1%u5C0D%u7D66%u4E88%u53E3%u4EA4%u611F%u8208%u8DA3&text_color=#000000&link_col benign

[nothing detected] (iframe) banners.getiton.com/piclist?pid=g1202053-ppc&display=gio_flash_07&grid=1x2&textsearch=Ò»Ò¹ÇéÐÔ½»&use_flash=1&no_fakevid=1&photo=1&banner_title=%u5728[LOC]%u7684GetItOn%u6703%u54E1%u5C0D%u7D66%u4E88%u53E3%u4EA4%u611F%u8208%u8DA3&text_color=#000000&link_color=#114376&background_color=#F3F3F3&border_color=#DDDDDD&overlay_color=#4973AF&overlay_text_color=#FFFFFF&photo_frame_color=#5A99F9&photo_frame_text_color=#FFFFFF&thumb=portrait&iframe=1&site=getiton&models=1
info: [decodingLevel=0] found JavaScript
info: [decodingLevel=0] decoded 5416 bytes (decoding_4c47a504941b185037c440278425b82c52116627)
info: [javascript variable] URL=content.pop6.com/images/getiton/piclist/english/piclist_gio_flash_01v.swf
info: [javascript variable] URL=content.pop6.com/images/ffadult/flash/expressInstall.swf
info: [script /] banners.getiton.com/javascript/getiton-rm_swfobject-1248882689.js
info: [decodingLevel=1] found JavaScript
info: [decodingLevel=1] decoded 203 bytes (decoding_a9852b3b78be1b90c1f89b7e528f8f330003e4f2)
info: [var swf] URL=content.pop6.com/images/getiton/piclist/english/piclist_gio_flash_01v.swf
info: [var installer] URL=content.pop6.com/images/ffadult/flash/expressInstall.swf
info: [decodingLevel=2] found JavaScript

File information (3 files) Download zip | Explanation

fetch_256cb1f5f49a27f912fc4174ca003b5a75637275 from banners.getiton.com/piclist?pid=g1202053-ppc&display=gio_flash_07&grid=1x2&textsearch=Ò»Ò¹ÇéÐÔ½»&use_flash=1&no_fakevid=1&photo=1&banner_title=%u5728[LOC]%u7684GetItOn%u6703%u54E1%u5C0D%u7D66%u4E88%u53E3%u4EA4%u611F%u8208%u8DA3&text_color=#000000&link_col (5601 bytes, 445 hidden)

decoding_4c47a504941b185037c440278425b82c52116627 from banners.getiton.com/piclist?pid=g1202053-ppc&display=gio_flash_07&grid=1x2&textsearch=Ò»Ò¹ÇéÐÔ½»&use_flash=1&no_fakevid=1&photo=1&banner_title=%u5728[LOC]%u7684GetItOn%u6703%u54E1%u5C0D%u7D66%u4E88%u53E3%u4EA4%u611F%u8208%u8DA3&text_color=#000000&link_col (5416 bytes, 538 hidden)

//document.write (s)    <style type="text/css">  a.handle, span.age_gender { font-family: Arial, Helvetica, sans-serif; font-weight: bold; font-size:12px; color: #ffffff; text-decoration: none; } a.location { font-family: Arial, Helvetica, sans-serif; font-weight: bold; font-size:11px; color: #ffffff;; text-decoration: none; } #3left { margin-left: -3px; font-family: Arial, Helvetica, sans-serif; font-size:12px; } div.overlay_box { position:relative; width: 120px; margin-left: 8px; margin-right: 8px; padding: 5px 6px 3px 6px; background: #ffffff; #64a4fa; } div.overlay { position: absolute; top: 141px; left: 6px; width: 120px; height: 24px; background-color: #4973af; color: #ffffff; font-family:Helvetica, sans-serif; font-size:11px; font-weight:bold; filter:alpha(opacity=65); -moz-opacity:.65; opacity:.65; } div.piclist_round { position: absolute; top: 5px; left: 6px; width: 120px; height: 160px; background: url(http://graphics.pop6.com/images/getiton/piclist/cell-wrapper.png) top center no-repeat; }  .title em { font-weight:700; font-style:normal; } em.e0 { background:#ffff00; color:#000 !important;} em.e1 { background:#00ff00; color:#000 !important;} em.e2 { background:#00ffff; color:#000 !important;} em.e3 { background:#f16eaa; color:#000 !important;} em.e4 { background:#f8941d; color:#000 !important;} em.e5 { background:#bd8cbf; color:#000 !important;} em.e6 { background:#ffffcc; color:#000 !important;} em.e7 { background:#ff99ff; color:#000 !important;} em.e8 { background:#cc6600; color:#000 !important;} em.e9 { background:#ff9933; color:#000 !important;}  #headerContainer { margin: 0; padding: 0; width: 160px; height: 75px; margin-top: 5px; } #headerContainer td.title { font-family: Arial; font-size: 14px; font-weight: bold; text-align: center; } #mainContainer1 { background: url(http://graphics.pop6.com/images/getiton/piclist/bg-test_160x600.png) top center no-repeat; } #mainContainer2 { background: url(http://graphics.pop6.com/images/getiton/piclist/bg-test.png) top center no-repeat; } #noflash_logo { text-align: center; margin: 0; padding: 0; font-family: Arial, Helvetica, sans-serif; font-size: 12px; font-weight: bold; color:#000000; } .disc {font-size: 8px; color: #828282; font-family: Arial, Helvetica, sans-serif;  margin: 1px; padding: 0; } </style>   <div id="mainContainer1" class="piclist_4727175403" align="left" style="margin: 0px 0px 0px 0px; width: 160px; height: 600px;"><div style="width:160px; height:500px; text-align:left;"><script type="text/javascript" src="/javascript/getiton-rm_swfobject-1248882689.js"></script><script type="text/javascript">var swf= "http://content.pop6.com/images/getiton/piclist/english/piclist_gio_flash_01v.swf";var id= "myContent";var width= "160";var height= "500";var min_version = "9.0.0";var installer   = "http://content.pop6.com/images/ffadult/flash/expressInstall.swf";var flashvars = {};flashvars.go_url_0  = encodeURIComponent("http://getiton.com/search/g1202053-ppc?18PG=1&find_sex=2&ip=auto&looking_for_person=1&photo=1&race=0&show_city=1&textsearch=%D2%BB%D2%B9%C7%E9%D0%D4%BD%BB");flashvars.target    = encodeURIComponent("_blank");flashvars.xml_piclist = encodeURIComponent("http://getiton.com/piclist?pid=g1202053-ppc&grid=2x3&textsearch=&photo=1&interest_in=&thumb=gallery&find_sex=2&models=0&site=getiton&keepmem=1&no_fakevid=1&view=xml");flashvars.overlay_text= encodeURIComponent("looking for sex!");flashvars.overlay_color= encodeURIComponent("#4973AF");flashvars.overlay_text_color= encodeURIComponent("#ffffff");flashvars.picture_frame_color= encodeURIComponent("#5a99f9");flashvars.picture_frame_text_color = encodeURIComponent("#ffffff");var params = {};params.bgcolor= "";params.menu= "false";params.allowScriptAccess = "always";params.wmode= "transparent";var attributes = {};attributes.id   = "myDynamicContent";attributes.name = "myDynamicContent";swfobject.embedSWF(swf, id, width, height, min_version, installer, flashvars, params, attributes);</script><div id="myContent"><p>Please <a href="http://banners.getiton.com/p/offsite.cgi?http://www.adobe.com/shockwave/download/download.cgi?P1_Prod_Version=shockwaveFlash">download</a> and install Flash to continue.</p></div></div><div id="headerContainer"><table height="75" border="0" cellpadding="0" cellspacing="0"><tr><td class="title" valign="middle"><a href="http://getiton.com/search/g1202053-ppc?18PG=1&find_sex=2&ip=auto&looking_for_person=1&photo=1&race=0&show_city=1&textsearch=%D2%BB%D2%B9%C7%E9%D0%D4%BD%BB" target="_self">Manchester</a>GetItOn</td></tr></table>   </div>   <p class="disc">Ilustrative purposes only. <br /> May not be actual members.</p>  </div>

decoding_a9852b3b78be1b90c1f89b7e528f8f330003e4f2 from banners.getiton.com/piclist?pid=g1202053-ppc&display=gio_flash_07&grid=1x2&textsearch=Ò»Ò¹ÇéÐÔ½»&use_flash=1&no_fakevid=1&photo=1&banner_title=%u5728[LOC]%u7684GetItOn%u6703%u54E1%u5C0D%u7D66%u4E88%u53E3%u4EA4%u611F%u8208%u8DA3&text_color=#000000&link_col (203 bytes)

pstatic.xunlei.com/js/webThunderDetect.js benign

[nothing detected] (script) pstatic.xunlei.com/js/webThunderDetect.js
info: [decodingLevel=0] found JavaScript
info: [decodingLevel=0] decoded 129 bytes (decoding_16dc53e97208e010cc38b885419efdbdfce63592)
info: [var vhref] URL=analytics-union.xunlei.com/PV?peerid=0&uri=http://thunderqtypv.union.xunlei.com&src=undefined
info: [decodingLevel=1] found JavaScript

File information (2 files) Download zip | Explanation

fetch_252ccf7a1db20dabf716d00b36fa8a87bca20d75 from pstatic.xunlei.com/js/webThunderDetect.js (20027 bytes, 2601 hidden)

decoding_16dc53e97208e010cc38b885419efdbdfce63592 from pstatic.xunlei.com/js/webThunderDetect.js (129 bytes)

URL	Status
1.xhcuns.com/a/xiaoshuolei/wuxiagudian/20100105/2902.html	saved 22166 bytes to fetch_f42c3c6d073628220ef5bf5e747783e8a207e3ab

1.xhcuns.com/plus/count.php?view=yes&aid=	saved 0 bytes to fetch_da39a3ee5e6b4b0d3255bfef95601890afd80709

1.xhcuns.com/gg/zxj.htm	saved 1034 bytes to fetch_4964ca167b9011b15b086837543dacfa4bcdbf1f

1.xhcuns.com/gg/900.js	failure: HTTP Error 404: Not Found

1.xhcuns.com/gg/900.htm	saved 194 bytes to fetch_5c4e6f50cdc05d1d90e251697880fe0a4aa8f31c

1.xhcuns.com/gg/ybhf.htm	failure: HTTP Error 404: Not Found

s10.histats.com/js9.js	saved 7363 bytes to fetch_345c46680f68f435e77e5b9cdd39935c97c4ee5e

pstatic.xunlei.com/js/webThunderDetect.js	saved 20027 bytes to fetch_252ccf7a1db20dabf716d00b36fa8a87bca20d75

1.xhcuns.com/plus/ad_js.php?aid=3	saved 1696 bytes to fetch_65ad74eeb3b7f8256814d83a017fb601787ce278

1.xhcuns.com/plus/ad_js.php?aid=2	saved 130 bytes to fetch_2a88e0592153455d52486b3c7e22ef253e80a02e

1.xhcuns.com/js/dy.js	failure: HTTP Error 404: Not Found

1.xhcuns.com/plus/ad_js.php?aid=7	saved 32 bytes to fetch_2eee4ccf9f984da8e17703857d6b1bda8ef30350

1.xhcuns.com/plus/ad_js.php?aid=6	saved 32 bytes to fetch_2eee4ccf9f984da8e17703857d6b1bda8ef30350

1.newlinkexchange.nl/link/duilian.js	saved 1507 bytes to fetch_d56aada5583fd4444bc086eef942142f74b5ab1a

1.xhcuns.com/gglink/guanggao.js	failure: HTTP Error 404: Not Found

1.xhcuns.com/gg/pf.js	failure: HTTP Error 404: Not Found

1.xhcuns.com/gg/728d.htm	failure: HTTP Error 404: Not Found

1.xhcuns.com/js/base64.js	failure: HTTP Error 404: Not Found

1.xhcuns.com/gg/zxj2.htm	saved 620 bytes to fetch_3be3f170c2fa843936b8744b13404e455f61ec1c

1.xhcuns.com/js/search.js	saved 1092 bytes to fetch_3f592c46134e4c605a7eec3063536a3ec5b69730

1.xhcuns.com/gg/760h.js	failure: HTTP Error 404: Not Found

1.xhcuns.com/js/thunderForum.js	failure: HTTP Error 404: Not Found

1.xhcuns.com/gg/yb120.htm	failure: HTTP Error 404: Not Found

1.xhcuns.com/gg/728db.htm	failure: HTTP Error 404: Not Found

analytics-union.xunlei.com/PV?peerid=0&uri=http://thunderqtypv.union.xunlei.com&src=undefined	saved 0 bytes to fetch_da39a3ee5e6b4b0d3255bfef95601890afd80709

banners.getiton.com/go/page/iframe_large_thumbs_180x179?pid=g1202053-ppc	saved 9896 bytes to fetch_3e036afd756b47e1534279fadb8745244cd7b9b9

74.63.102.91/link/click.php?fromid=1	saved 3930 bytes to fetch_1ace251e7adfa9197fd763b953eefcc553903706

s10./	failure: <urlopen error (-2, 'Name or service not known')>

s10.histats.com/	saved 2 bytes to fetch_a5d5b61aa8a61b7d9d765e1daf971a9a578f1cfa

banners.getiton.com/piclist?pid=g1202053-ppc&display=gio_flash_07&grid=1x2&textsearch=Ò»Ò¹ÇéÐÔ½»&use_flash=1&no_fakevid=1&photo=1&banner_title=%u5728[LOC]%u7684GetItOn%u6703%u54E1%u5C0D%u7D66%u4E88%u53E3%u4EA4%u611F%u8208%u8DA3&text_color=#000000&link_col	saved 5601 bytes to fetch_256cb1f5f49a27f912fc4174ca003b5a75637275

content.pop6.com/banners/getiton/english/18584_160x600.swf	saved 52297 bytes to fetch_e309a144e1bf2a31cc06d1dabeff88bbfd36324f

ads.159ads.cn/ads.js	saved 207 bytes to fetch_eff98f6468aabc97c40191ca401e293b2e45d89b

Submission permanent link ebde4541a64a3a138c95c8ad8d10cd7598d189f7 (Received 2010-02-14 18:36:16, 1.xhcuns.com/a/xiaoshuolei/wuxiagudian/20100105/2902.html )

All Malicious or Suspicious Elements of Submission