JSUNPACK
A Generic JavaScript Unpacker
CAUTION: jsunpack was designed for security researchers and computer professionals
Enter a single URL (or paste JavaScript to decode):

Upload a PDF, pcap, HTML, or JavaScript file
Private? Help: privacy | uploads
Default Referer
Description

Submission permanent link ff84a624b3e1aa758879727ea310741fb567dd77 (Received 2013-08-07 18:41:38, http://cleanfiles.net/?sa7eNhD )

URLStatus
cleanfiles.net/?sa7eNhD saved 15122 bytes 689fb7235dc6f5b8dc8abd5fe9b10608498422e5

cleanfiles.net/js/ status: (referer=cleanfiles.net/js/dwn8.js?v=17)

sp.ask.com/sh/ui-assets/inc/js/jask/+BT.learnMoreVideoURL+ status: (referer=sp.ask.com/sh/ui-assets/inc/js/jask/c.r106559-02.js)

cleanfiles.net/js/postf.js status: (referer=cleanfiles.net/js/javascript:false)

sp.ask.com/sh/ui-assets/inc/js/lib/jquery/jquery-1.6.2-1.8.14.r86826-02.js status: (referer=www.ask.com/web?q=puppies)

sp.ask.com/sh/ui-assets/inc/js/jask/javascript:0 status: (referer=sp.ask.com/sh/ui-assets/inc/js/jask/c.r106559-02.js)

sp.ask.com/sh/i/a11/06.png status: (referer=www.ask.com/web?q=puppies)

sp.ask.com/sh/ui-assets/inc/js/jask/a14c.r105565-02.js status: (referer=www.ask.com/web?q=puppies)

www.ask.com/web?q=puppies&o=0&l=dir&jss=0 status: (referer=www.ask.com/web?q=puppies)

cleanfiles.net/js/undefined status: (referer=cleanfiles.net/js/jquery-1.7.2.min.js)

cleanfiles.net/js/jquery-ui-1.8.22.custom.min.js status: (referer=cleanfiles.net/js/javascript:false)

All Malicious or Suspicious Elements of Submission

suspicious: maxruntime exceeded 10 seconds (incomplete) 0 bytes
cleanfiles.net/js/qtip.js benign
[nothing detected] (script) cleanfiles.net/js/qtip.js
     status: (referer=cleanfiles.net/?sa7eNhD)saved 38411 bytes d8293f16a17eed7a8d9868321e335caf75751041
     info: [img] cleanfiles.net/js/
     info: [iframe] cleanfiles.net/js/javascript:false
     info: [decodingLevel=0] found JavaScript
     error: undefined variable jQuery
     error: undefined variable f.fn
     error: line:1: SyntaxError: missing ; before statement:
          error: line:1: var f.fn = 1;
          error: line:1: ....^
     suspicious: maxruntime exceeded 10 seconds (incomplete) 0 bytes
     file: d8293f16a17eed7a8d9868321e335caf75751041: 38411 bytes
     file: 1f1b30ad98cf40d55f88ce626ac39beaff4c57df: 39038 bytes
     file: ea8381695b9d2780bc1f3af969dd72966b784aad: 38736 bytes
     file: 8c17b771999173692b7e9c9456b7cbe842b7fb51: 38860 bytes

Decoded Files
d829/3f16a17eed7a8d9868321e335caf75751041 from cleanfiles.net/js/qtip.js (38411 bytes, 14 hidden) download

1f1b/30ad98cf40d55f88ce626ac39beaff4c57df from cleanfiles.net/js/qtip.js (39038 bytes, 15 hidden) download

ea83/81695b9d2780bc1f3af969dd72966b784aad from cleanfiles.net/js/qtip.js (38736 bytes, 15 hidden) download

8c17/b771999173692b7e9c9456b7cbe842b7fb51 from cleanfiles.net/js/qtip.js (38860 bytes, 15 hidden) download


www.ask.com/web?q=puppies benign
[nothing detected] (var fileReferrer) www.ask.com/web?q=puppies
     status: (referer=cleanfiles.net/?sa7eNhD)saved 139650 bytes f677070647b4c41533ad09c064ad77604c562bc7
     info: [javascript variable] URL=sp.ask.com/sh/i/a11/06.png
     info: [javascript variable] URL=sp.ask.com/sh/i/a10f/shareskin.png
     info: [javascript variable] URL=
     info: [meta refresh] URL=www.ask.com/web?q=puppies&o=0&l=dir&jss=0
     info: [img] sp.ask.com/sh/i/a14/c/generic.png
     info: [img] wzus1.ask.com/i/i.gif?t=v&d=us&s=a&c=a&app=a16&dqi=&askid=&l=dir&o=0&oo=0&sv=0a5ca9d4&p=web&rf=cleanfiles.net%2F%3Fsa7eNhD&ord=5662858
     info: [img] sp.ask.com/sh/i/a14/spinner.gif
     info: [img] www.ask.com/
     info: [img] rpmedia.ask.com/ts?u=/wikipedia/commons/thumb/e/e8/GoldenRetrieverPuppyDaisyParker.JPG/65px-GoldenRetrieverPuppyDaisyParker.JPG
     info: [img] sa.aos.ask.com/us/an/tr/puppy-and-kitten.jpg
     info: [img] media2.picsearch.com/is?EI8xH4s-UDhDy-F1a5II7WvUe6IrxIl3YXw6XL2p83M
     info: [img] media5.picsearch.com/is?DIDxVvnVRUTtgMxP8zuwZfScfD5MCA_1sYLUVA7TI8I
     info: [img] media3.picsearch.com/is?vK666udHzuvEwSW0srf3vm-BrTVKEQMYCTknpCk94
     info: [img] media5.picsearch.com/is?_TFAEGhAXRDEgPr3OuoAkBzGa2kFLQtHMHhXIIjtNVI
     info: [img] media1.picsearch.com/is?pi1BmmYDzthyt6ZSDe9oDgA_gZQaZK_25hUFMqrrNn8
     info: [img] media3.picsearch.com/is?1CGhWJV6kzfJmn-RpH3fyh0mhfoCpFVqji-pv3ffJO4
     info: [img] media2.picsearch.com/is?z7tYTy-3AS5zufb4NW2SY-RFRm1SZgkE5LXmvxva2us
     info: [img] media4.picsearch.com/is?D57GnhIdHNMPk3tQl5eL-vGyc0IPLSeHnhqF7PqoIhw
     info: [img] b.scorecardresearch.com/p?c1=2&c2=6034776&c3=&c4=&c5=&c6=&c15=&cj=1
     info: [script] sp.ask.com/sh/ui-assets/inc/js/lib/jquery/jquery-1.6.2-1.8.14.r86826-02.js
     info: [script] sp.ask.com/sh/ui-assets/inc/js/jask/c.r106559-02.js
     info: [script] sp.ask.com/sh/ui-assets/inc/js/jask/a14c.r105565-02.js
     info: [decodingLevel=0] found JavaScript
     error: undefined variable Image
     error: line:142: TypeError: Image is not a constructor
     error: line:11: SyntaxError: missing = in XML attribute:
          error: line:11: <!DOCTYPE HTML PUBLIC "-/W3C/DTD HTML 4.01/EN" "http:/www.w3.org/TR/html4/strict.dtd">
          error: line:11: ...............^
     file: f677070647b4c41533ad09c064ad77604c562bc7: 139650 bytes

Decoded Files
f677/070647b4c41533ad09c064ad77604c562bc7 from www.ask.com/web?q=puppies (139650 bytes, 56144 hidden) download


cleanfiles.net/df.php?id=53581 benign
[nothing detected] (var downloadURL) cleanfiles.net/df.php?id=53581
     status: (referer=cleanfiles.net/?sa7eNhD)saved 36 bytes 7182b08fd33effe1f6b463f952cbfea2927ac79a
     file: 7182b08fd33effe1f6b463f952cbfea2927ac79a: 36 bytes

Decoded Files
7182/b08fd33effe1f6b463f952cbfea2927ac79a from cleanfiles.net/df.php?id=53581 (36 bytes) download


cleanfiles.net/js/dwn8.js?v=17 benign
[nothing detected] (script) cleanfiles.net/js/dwn8.js?v=17
     status: (referer=cleanfiles.net/?sa7eNhD)saved 3311 bytes 5b98410f84bbfbdc269825c303d49d5afe80a64b
     info: [javascript variable] URL=
     info: [iframe] cleanfiles.net/js/
     file: 5b98410f84bbfbdc269825c303d49d5afe80a64b: 3311 bytes

Decoded Files
5b98/410f84bbfbdc269825c303d49d5afe80a64b from cleanfiles.net/js/dwn8.js?v=17 (3311 bytes, 687 hidden) download


cleanfiles.net/js/javascript:false benign
[nothing detected] (iframe) cleanfiles.net/js/javascript:false
     status: (referer=cleanfiles.net/js/qtip.js)saved 4106 bytes a2de3c3bdd071c40409d3b73f6da63c2ca7e4522
     info: [script] cleanfiles.net/js/jquery-1.7.2.min.js
     info: [script] cleanfiles.net/js/postf.js
     info: [script] cleanfiles.net/js/jquery-ui-1.8.22.custom.min.js
     info: [script] cleanfiles.net/js/qtip.js
     info: [img] cleanfiles.net/images/fbg1_icon.png
     info: [img] cleanfiles.net/images/fbg2_icon.png
     info: [img] cleanfiles.net/images/fbg3_icon.png
     file: a2de3c3bdd071c40409d3b73f6da63c2ca7e4522: 4106 bytes

Decoded Files
a2de/3c3bdd071c40409d3b73f6da63c2ca7e4522 from cleanfiles.net/js/javascript:false (4106 bytes, 355 hidden) download


cleanfiles.net/?sa7eNhD benign
[nothing detected] cleanfiles.net/?sa7eNhD
     status: (referer=http:/www.ask.com/web?q=puppies)saved 15122 bytes 689fb7235dc6f5b8dc8abd5fe9b10608498422e5
     info: [script] cleanfiles.net/js/jquery-1.7.2.min.js
     info: [script] cleanfiles.net/js/dlmin2.js
     info: [script] cleanfiles.net/js/qtip.js
     info: [script] cleanfiles.net/js/dwn8.js?v=17
     info: [img] cleanfiles.net/images/text.png
     info: [img] cleanfiles.net/images/soc.png
     info: [img] cleanfiles.net/images/fbg1_icon.png
     info: [img] cleanfiles.net/images/fbg2_icon.png
     info: [img] cleanfiles.net/images/fbg3_icon.png
     info: [img] cleanfiles.net/images/loading.gif
     info: [decodingLevel=0] found JavaScript
     error: undefined variable $
     error: undefined function $
     info: [var fileReferrer] URL=http:/www.ask.com/web?q=puppies
     info: [var downloadURL] URL=cleanfiles.net/df.php?id=53581
     info: [var facebookShareURL] URL=cleanfiles.net/?sa7eNhD
     info: [var newurl] URL=cleanfiles.net/?sa7eNhD
     info: [decodingLevel=1] found JavaScript
     file: 689fb7235dc6f5b8dc8abd5fe9b10608498422e5: 15122 bytes
     file: 3070d5fd6564d4fa97211ac19fd326747b9661ef: 277 bytes

Decoded Files
689f/b7235dc6f5b8dc8abd5fe9b10608498422e5 from cleanfiles.net/?sa7eNhD (15122 bytes, 1642 hidden) download

3070/d5fd6564d4fa97211ac19fd326747b9661ef from cleanfiles.net/?sa7eNhD (277 bytes) download


sp.ask.com/sh/ui-assets/inc/js/jask/c.r106559-02.js benign
[nothing detected] (script) sp.ask.com/sh/ui-assets/inc/js/jask/c.r106559-02.js
     status: (referer=www.ask.com/web?q=puppies)saved 224457 bytes 11d7aa6edf32ac82e0f063de08ad72db93eef9c5
     info: [javascript variable] URL=
     info: [iframe] sp.ask.com/sh/ui-assets/inc/js/jask/javascript:0
     info: [iframe] sp.ask.com/sh/ui-assets/inc/js/jask/+BT.learnMoreVideoURL+
     info: [img]
     file: 11d7aa6edf32ac82e0f063de08ad72db93eef9c5: 224457 bytes

Decoded Files
11d7/aa6edf32ac82e0f063de08ad72db93eef9c5 from sp.ask.com/sh/ui-assets/inc/js/jask/c.r106559-02.js (224457 bytes, 7 hidden) download


cleanfiles.net/js/jquery-1.7.2.min.js benign
[nothing detected] (script) cleanfiles.net/js/jquery-1.7.2.min.js
     status: (referer=cleanfiles.net/?sa7eNhD)saved 94847 bytes d10284c274eb76443d3fd444e293b5de36fe0a2e
     info: ActiveXDataObjectsMDAC detected Microsoft.XMLHTTP
     info: [decodingLevel=0] found JavaScript
     error: undefined function p.getElementsByTagName
     error: undefined variable p
     info: [element] URL=cleanfiles.net/js/undefined
     info: [1] no JavaScript
     file: d10284c274eb76443d3fd444e293b5de36fe0a2e: 94847 bytes
     file: d5dba94a76a67a54f2b98b16227da20414542fd9: 72 bytes

Decoded Files
d102/84c274eb76443d3fd444e293b5de36fe0a2e from cleanfiles.net/js/jquery-1.7.2.min.js (94847 bytes, 10 hidden) download

d5db/a94a76a67a54f2b98b16227da20414542fd9 from cleanfiles.net/js/jquery-1.7.2.min.js (72 bytes) download


sp.ask.com/sh/i/a10f/shareskin.png benign
[nothing detected] (jsvar) sp.ask.com/sh/i/a10f/shareskin.png
     status: (referer=www.ask.com/web?q=puppies)saved 4384 bytes 76f40a9afb6b91fde971a8057a7fda5db8887589
     file: 76f40a9afb6b91fde971a8057a7fda5db8887589: 4384 bytes

Decoded Files
76f4/0a9afb6b91fde971a8057a7fda5db8887589 from sp.ask.com/sh/i/a10f/shareskin.png (4384 bytes, 2643 hidden) download


cleanfiles.net/js/dlmin2.js benign
[nothing detected] (script) cleanfiles.net/js/dlmin2.js
     status: (referer=cleanfiles.net/?sa7eNhD)saved 159384 bytes 5f84879b9b32be1779fc673408f230fc761e147b
     info: [decodingLevel=0] found JavaScript
     error: undefined variable jQuery
     error: undefined function e.extend
     error: undefined variable e
     file: 5f84879b9b32be1779fc673408f230fc761e147b: 159384 bytes

Decoded Files
5f84/879b9b32be1779fc673408f230fc761e147b from cleanfiles.net/js/dlmin2.js (159384 bytes) download