jsunpack - a generic JavaScript unpacker

www.google-analytics.com/urchin.js benign

[nothing detected] (script) www.google-analytics.com/urchin.js
status: (referer=hentaithat.com/)saved 22678 bytes 4b9441626e2173e09601eac91798337f11782583
info: [javascript variable] URL=www.google-analytics.com/__utm.gif
info: [decodingLevel=0] found JavaScript
info: [var _ugifpath2] URL=www.google-analytics.com/__utm.gif
info: [var newurl] URL=www.google-analytics.com/__utm.gif
info: [decodingLevel=1] found JavaScript
file: 4b9441626e2173e09601eac91798337f11782583: 22678 bytes
file: 81037fe4d1908d1ef58f7e3e7d923078b240e0cb: 146 bytes

Decoded Files

4b94/41626e2173e09601eac91798337f11782583 from www.google-analytics.com/urchin.js (22678 bytes, 191 hidden) download

//-- Google Analytics Urchin Module //-- Copyright 2007 Google, All Rights Reserved.  //-- Urchin On Demand Settings ONLY var _uacct="";// set up the Urchin Account var _userv=1;// service mode (0=local,1=remote,2=both)  //-- UTM User Settings var _ufsc=1;// set client info flag (1=on|0=off) var _udn="auto";// (auto|none|domain) set the domain name for cookies var _uhash="on";// (on|off) unique domain hash for cookies var _utimeout="1800";   // set the inactive session timeout in seconds var _ugifpath="/__utm.gif";// set the web path to the __utm.gif file var _utsp="|";// transaction field separator var _uflash=1;// set flash version detect option (1=on|0=off) var _utitle=1;// set the document title detect option (1=on|0=off) var _ulink=0;// enable linker functionality (1=on|0=off) var _uanchor=0;// enable use of anchors for campaign (1=on|0=off) var _utcp="/";// the cookie path for tracking var _usample=100;// The sampling % of visitors to track (1-100).  //-- UTM Campaign Tracking Settings var _uctm=1;// set campaign tracking module (1=on|0=off) var _ucto="15768000";// set timeout in seconds (6 month default) var _uccn="utm_campaign";// name var _ucmd="utm_medium";// medium (cpc|cpm|link|email|organic) var _ucsr="utm_source";// source var _uctr="utm_term";// term/keyword var _ucct="utm_content";// content var _ucid="utm_id";// id number var _ucno="utm_nooverride";// don't override  //-- Auto/Organic Sources and Keywords var _uOsr=new Array(); var _uOkw=new Array(); _uOsr[0]="google";_uOkw[0]="q"; _uOsr[1]="yahoo";_uOkw[1]="p"; _uOsr[2]="msn";_uOkw[2]="q"; _uOsr[3]="aol";_uOkw[3]="query"; _uOsr[4]="aol";_uOkw[4]="encquery"; _uOsr[5]="lycos";_uOkw[5]="query"; _uOsr[6]="ask";_uOkw[6]="q"; _uOsr[7]="altavista";_uOkw[7]="q"; _uOsr[8]="netscape";_uOkw[8]="query"; _uOsr[9]="cnn";_uOkw[9]="query"; _uOsr[10]="looksmart";_uOkw[10]="qt"; _uOsr[11]="about";_uOkw[11]="terms"; _uOsr[12]="mamma";_uOkw[12]="query"; _uOsr[13]="alltheweb";_uOkw[13]="q"; _uOsr[14]="gigablast";_uOkw[14]="q"; _uOsr[15]="voila";_uOkw[15]="rdata"; _uOsr[16]="virgilio";_uOkw[16]="qs"; _uOsr[17]="live";_uOkw[17]="q"; _uOsr[18]="baidu";_uOkw[18]="wd"; _uOsr[19]="alice";_uOkw[19]="qs"; _uOsr[20]="yandex";_uOkw[20]="text"; _uOsr[21]="najdi";_uOkw[21]="q"; _uOsr[22]="aol";_uOkw[22]="q"; _uOsr[23]="club-internet"; _uOkw[23]="query"; _uOsr[24]="mama";_uOkw[24]="query"; _uOsr[25]="seznam";_uOkw[25]="q"; _uOsr[26]="search";_uOkw[26]="q"; _uOsr[27]="wp";_uOkw[27]="szukaj"; _uOsr[28]="onet";_uOkw[28]="qt"; _uOsr[29]="netsprint";_uOkw[29]="q"; _uOsr[30]="google.interia";_uOkw[30]="q"; _uOsr[31]="szukacz";_uOkw[31]="q"; _uOsr[32]="yam";_uOkw[32]="k"; _uOsr[33]="pchome";_uOkw[33]="q"; _uOsr[34]="kvasir";_uOkw[34]="searchExpr"; _uOsr[35]="sesam";_uOkw[35]="q"; _uOsr[36]="ozu"; _uOkw[36]="q"; _uOsr[37]="terra"; _uOkw[37]="query"; _uOsr[38]="nostrum"; _uOkw[38]="query"; _uOsr[39]="mynet"; _uOkw[39]="q"; _uOsr[40]="ekolay"; _uOkw[40]="q"; _uOsr[41]="search.ilse"; _uOkw[41]="search_for"; _uOsr[42]="bing"; _uOkw[42]="q";  //-- Auto/Organic Keywords to Ignore var _uOno=new Array(); //_uOno[0]="urchin"; //_uOno[1]="urchin.com"; //_uOno[2]="www.urchin.com";  //-- Referral domains to Ignore var _uRno=new Array(); //_uRno[0]=".urchin.com";  //-- **** Don't modify below this point *** var _uff,_udh,_udt,_ubl=0,_udo="",_uu,_ufns=0,_uns=0,_ur="-",_ufno=0,_ust=0,_ubd=document,_udl=_ubd.location,_udlh="",_uwv="1.4"; var _ugifpath2="http://www.google-analytics.com/__utm.gif"; if (_udl.hash) _udlh=_udl.href.substring(_udl.href.indexOf('#')); if (_udl.protocol=="https:") _ugifpath2="https://ssl.google-analytics.com/__utm.gif"; if (!_utcp || _utcp=="") _utcp="/"; function urchinTracker(page) {  if (_udl.protocol=="file:") return;  if (_uff && (!page || page=="")) return;  var a,b,c,xx,v,z,k,x="",s="",f=0,nv=0;  var nx=" expires="+_uNx()+";";  var dc=_ubd.cookie;  _udh=_uDomain();  if (!_uVG()) return;  _uu=Math.round(Math.random()*2147483647);  _udt=new Date();  _ust=Math.round(_udt.getTime()/1000);  a=dc.indexOf("__utma="+_udh+".");  b=dc.indexOf("__utmb="+_udh);  c=dc.indexOf("__utmc="+_udh);  if (_udn && _udn!="") { _udo=" domain="+_udn+";"; }  if (_utimeout && _utimeout!="") {   x=new Date(_udt.getTime()+(_utimeout*1000));   x=" expires="+x.toGMTString()+";";  }  if (_ulink) {   if (_uanchor && _udlh && _udlh!="") s=_udlh+"&";   s+=_udl.search;   if(s && s!="" && s.indexOf("__utma=")>=0) {    if (!(_uIN(a=_uGC(s,"__utma=","&")))) a="-";    if (!(_uIN(b=_uGC(s,"__utmb=","&")))) b="-";    if (!(_uIN(c=_uGC(s,"__utmc=","&")))) c="-";    v=_uGC(s,"__utmv=","&");    z=_uGC(s,"__utmz=","&");    k=_uGC(s,"__utmk=","&");    xx=_uGC(s,"__utmx=","&");    if ((k*1) != ((_uHash(a+b+c+xx+z+v)*1)+(_udh*1))) {_ubl=1;a="-";b="-";c="-";xx="-";z="-";v="-";}    if (a!="-" && b!="-" && c!="-") f=1;    else if(a!="-") f=2;   }  }  if(f==1) {   _ubd.cookie="__utma="+a+"; path="+_utcp+";"+nx+_udo;   _ubd.cookie="__utmb="+b+"; path="+_utcp+";"+x+_udo;   _ubd.cookie="__utmc="+c+"; path="+_utcp+";"+_

8103/7fe4d1908d1ef58f7e3e7d923078b240e0cb from www.google-analytics.com/urchin.js (146 bytes) download

hentaithat.com/ benign

[nothing detected] hentaithat.com/
status: (referer=http:/www.ask.com/web?q=puppies)saved 19294 bytes 1641bf023ad59c3d758e540ccfdeceb0413f4ba9
info: [img] www.hentaithat.com/images/logo.jpg
info: [img] hentaikey.com/images/banners/468x60b.gif
info: [img] www.hentaithat.com/images/star.png
info: [img] www.hentaithat.com/images/facebook.png
info: [img] www.hentaithat.com/images/twitter.png
info: [img] www.hentaithat.com/images/google-buzz.png
info: [img] www.hentaithat.com/images/rss.png
info: [img] www.hentaithat.com/videos/XCEp2/flv/p1.jpg
info: [img] www.hentaithat.com/images/heart.jpg
info: [img] www.hentaithat.com/videos/XCEp1/flv/p1.jpg
info: [img] www.hentaithat.com/videos/XTC_Ep2/flv/p1.jpg
info: [img] www.hentaithat.com/images/right-banner-one.jpg
info: [img] www.hentaithat.com/videos/XTC_Ep1/flv/p1.jpg
info: [img] www.hentaithat.com/videos/WLEp2/flv/WLEp2_1.jpg
info: [img] www.hentaithat.com/videos/WLEp1/flv/WLEp1_1.jpg
info: [img] www.hentaithat.com/images/right-banner-two.jpg
info: [img] www.hentaithat.com/videos/VF02/flv/VF02_1.jpg
info: [img] www.hentaithat.com/videos/VF01/flv/VF01_1.jpg
info: [img] www.hentaithat.com/videos/VGNEp3/flv/VGNEp3_1.jpg
info: [img] www.hentaithat.com/videos/VGNEp2/flv/VGNEp2_1.jpg
info: [img] www.hentaithat.com/videos/VGNEp1/flv/VGNeo01_1.jpg
info: [img] image.cecash.com/stats/img3/banners/13217.gif
info: [img] www.hentaithat.com/videos/UNSC_Ep3/flv/p1.jpg
info: [img] www.hentaithat.com/videos/UNSC_Ep2/flv/p1.jpg
info: [img] www.hentaithat.com/videos/UNSC_Ep1/flv/p1.jpg
info: [img] www.hentaithat.com/videos/ULOTOEp2/flv/p1.jpg
info: [img] www.hentaithat.com/videos/ULOTOEp1/flv/p1.jpg
info: [script] www.google-analytics.com/urchin.js
info: [decodingLevel=0] found JavaScript
error: line:3: SyntaxError: missing = in XML attribute:
error: line:3: <!DOCTYPE html PUBLIC "-/W3C/DTD XHTML 1.0 Transitional/EN" "http:/www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
error: line:3: ...............^
file: 1641bf023ad59c3d758e540ccfdeceb0413f4ba9: 19294 bytes

Decoded Files

1641/bf023ad59c3d758e540ccfdeceb0413f4ba9 from hentaithat.com/ (19294 bytes, 2053 hidden) download

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Watch Hentai Video Streaming Tube - Read Hentai Manga</title>  <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta name="keywords" content="hentai, watch hentai, hentai stream, hentai streaming, hentai tube, hentai manga, read hentai manga, hentai mangas" /> <meta name="description" content="Hentai that! - #1 Hentai Tube to Watch Hentai video streams online. Read Hentai manga"/>  <link href="http://www.hentaithat.com/css/style.css" rel="stylesheet" type="text/css" /> <link href="http://www.hentaithat.com/css/reset.css" rel="stylesheet" type="text/css" />    </head> <body>  <div id="container">      <div id="header"><div class="logo"><h1><a href="http://www.hentaithat.com/" rel="home" title="Go to homepage"><img alt="Hentai That!" src="http://www.hentaithat.com/images/logo.jpg" /></a></h1></div><div id="banner"><h1><a href="http://www.hentaithat.com/" rel="home" title="Go to homepage"><a href="http://hentaikey.com/sys/members/signup.php?wid=3116&bid=59&at=2&tid=164"><img src="http://hentaikey.com/images/banners/468x60hentai_b.gif"  border="0"></a>  </a></h1></div> <div id="navigation"><ul><li><a href="http://www.hentaithat.com/">Home</a></li><li><a href="http://www.hentaithat.com/categories">Hentai Video Categories</a></li><li><a href="http://www.hentaithat.com/manga">Hentai Manga</a></li><li><a href="http://www.hentaithat.com/premium">Hentai Premium</a></li></ul></div></div><div id="search-form" class="clearfix"><form method="post" action="http://www.hentaithat.com/search.php"><ul><li class="clearfix"><input class="textbox" type="text" value="Search for hentai..." onblur="if(this.value=='') this.value='Search for hentai...';" onfocus="if(this.value=='Search for hentai...') this.value='';"/><input type="submit" class="submit" value="" /></li></ul></form>   </div>      <div id="innercontainer"><div id="subnavigation"><div id="navigation"><ul><li class="text">Sort By:</li><li><a class="active" href="http://www.hentaithat.com/">View All</a></li><li><a href="http://www.hentaithat.com/index.php?srt=watched">Being Watched</a></li><li><a href="http://www.hentaithat.com/index.php?srt=recent">Most Recent</a></li><li><a href="http://www.hentaithat.com/index.php?srt=views">Most Viewed</a></li><li><a href="http://www.hentaithat.com/index.php?srt=rating">Top Rated</a></li></ul></div></div><div id="sociallinks"><img src="http://www.hentaithat.com/images/star.png" alt="BookMark Us" width="16" height="16" /> &nbsp;BookMark Us <span>Follow Us: </span> <img src="http://www.hentaithat.com/images/facebook.png" alt="Facebook" width="16" height="16" /> <img src="http://www.hentaithat.com/images/twitter.png" width="16" height="16" alt="Twitter" /> <img src="http://www.hentaithat.com/images/google-buzz.png" width="16"height="16" alt="Google Buzz" /> <img src="http://www.hentaithat.com/images/rss.png" width="16" height="16" alt="RSS Feed" /></div><div id="videoscontainer"><div id="videobox"><img src="http://www.hentaithat.com/videos/Xtra_Credit_Ep2/flv/p1.jpg" width="160" height="120" /><div id="videotitle"><a href="http://www.hentaithat.com/watch/1-xtra-credit-ep2">Xtra Credit Ep2</a></div><div id="textleft">8:25<br> <span>36556 views</span></div><div id="textright">78% <img src="http://www.hentaithat.com/images/heart.jpg" width="15" height="14" alt="Rating" /><br><span>2 hours ago</span></div></div><div id="videobox"><img src="http://www.hentaithat.com/videos/Xtra_Credit_Ep1/flv/p1.jpg" width="160" height="120" /><div id="videotitle"><a href="http://www.hentaithat.com/watch/2-xtra-credit-ep1">Xtra Credit Ep1</a></div><div id="textleft">8:25<br> <span>54891 views</span></div><div id="textright">78% <img src="http://www.hentaithat.com/images/heart.jpg" width="15" height="14" alt="Rating" /><br><span>2 hours ago</span></div></div><div id="videobox"><img src="http://www.hentaithat.com/videos/Xpress_Train_C_Ep2/flv/p1.jpg" width="160" height="120" /><div id="videotitle"><a href="http://www.hentaithat.com/watch/3-xpress-train-c-ep2">Xpress Train C Ep2</a></div><div id="textleft">8:25<br> <span>33868 vie

Submission permanent link efeb09307c70f6fc1e2a26c8f8a3e5feda226194 (Received 2012-09-21 05:42:11, http://hentaithat.com/ )

All Malicious or Suspicious Elements of Submission

URL	Status
hentaithat.com/	saved 19294 bytes 1641bf023ad59c3d758e540ccfdeceb0413f4ba9