js-confuser icon indicating copy to clipboard operation
js-confuser copied to clipboard

Published 20 hours ago • verified publisher icon MichaelXF

Windows Defender

Open MichaelXF opened this issue 3 years ago • 0 comments

Describe the bug:

image image

Config and Small code sample

Config:

{
  target: "node",
  preset: "high"
}

Code:

var affect = 0;
class MyClass{
  constructor(){
    affect = 1;
  }
}

var instance = new MyClass();
console.log(affect)

Sample of Trojan:JS/Foretype.A!ml

var gSLAwMP,e_Izy_w,T5fIY1h,PEagBXy,EddB3Qq,hCj_Dfk,lJFJ64f=[0,8,104,9,10,3,243,136,void 0,22,6,275,282,1,2,60,208,18,68,249,165,346,81,186,196,4,178,284,13,158,56,102,402,17,19,483,25,26,93,194,24,184,197,49,20,238,14,15,108,103,139,169,30,28,255,33,5,85,16,185,298,228,411,217,248,62,293,45];function LxVvRh(gSLAwMP){return lJFJ64f[gSLAwMP-49]}~(gSLAwMP=DKJuJH('\x3c\x7e\x3d\x26\x57\x2b\x22\x32\x67\x2d\x6d\x21\x46\x59\x63\x51\x5c\x7e\x3e\x31Ā\x32\x49\x70\x3b\x6a\x3a\x69\x6cđ\x31\x2b\x26\x2c\x35\x39\x3f\x24\x24\x2a\x3e\x26\x35\x3f\x31\x2e\x2a\x3d\x36\x27\x3b\x33\x28\x30\x26\x23\x28\x25\x3a\x3c\x38ē\x7e\x3a\x65\x22\x41\x5c\x35\x72\x45\x30ĝĀ\x37\x21\x4d\x30\x6c\x42\x34\x61\x61\x6f\x3b\x29\x55\x6d\x61\x33\x41\x43ĝħ\x29\x37\x35\x2d\x2c\x26\x2b\x25Ľ\x37\x3c\x33\x45\x65\x45\x57ň\x7e\x38\x6c\x4a\x4dĐĒ\x2d\x2e\x35\x27\x23\x3d\x33\x24\x2e\x3dĽ\x41\x37\x5c\x26\x4bŮ\x46\x2a\x29\x47\x3a\x44\x4a\x26Ů\x38\x54\x26\x5d\x5b\x43\x68\x5b\x45\x26Ɓ\x39\x51ĝ\x2d\x32\x33\x37\x29\x29\x22\x29\x2e\x3a\x38\x38Ƣ\x24\x35\x30ťĀ\x45\x2b\x4c\x2f\x35\x46\x45\x32\x29\x35\x42\x2e\x33ƏƑƓƕŭĒĀ\x41\x30\x3e\x44\x6b\x46\x43\x3eĝ\x2f\x2aƨ\x2d\x3b\x2c\x25\x2d\x35ĽƵ\x6fŋƵ\x2eŮ\x42\x6c\x37\x51\x34ĝ\x2e\x26\x3eŹ\x3eĦžĽ\x45\x5a\x65\x74\x34ǫ\x62Ůƚ\x52\x67\x2b\x3d\x40Ǣ\x32\x38\x37\x2f\x31\x64\x65\x41\x74\x31\x20\x6b\x65\x79\x20\x70Ǿ\x20\x28\x65\x6dȉ\x66\x72\x6f\x6dƕ\x61\x72\x43\x6fǿ\x31\x61\x70\x70\x6c\x79\x31\x6c\x65\x6e\x67\x74\x68\x31\x63\x68ȕȗǿȁ\x31\x73\x6c\x69\x63\x65\x31\x72\x65ȝ\x61Ȳ\x31\x21ȻȻ\x31\x75ȿȿ'),e_Izy_w=[],T5fIY1h=['\x3c\x7e\x42\x6a\x22\x4f\x6d\x3d\x5c\x31\x3b\x3f\x3d\x5f\x4c\x74\x6f\x3a\x5d\x7e\x3e',H7XykPx(LxVvRh(49)),H7XykPx(1),H7XykPx(LxVvRh(63)),'\x2d\x35\x3c\x34\x25\x3e\x34\x2e\x29\x2e\x2c\x37\x2f\x2d\x2c\x31\x2f\x22\x3a\x31',H7XykPx(LxVvRh(54)),H7XykPx(LxVvRh(74)),H7XykPx(LxVvRh(105)),H7XykPx(LxVvRh(59)),H7XykPx(7),'\u003c\u007e\u0047\u0041\u0031\u0072\u002a\u0044\u0067\u0029\u007e\u003e',H7XykPx(LxVvRh(50)),'\u002d\u002e\u0038\u0037\u003d\u003d\u003c\u0030\u002e\u0031',H7XykPx(LxVvRh(52)),H7XykPx(LxVvRh(53)),H7XykPx(11),H7XykPx(12),'\x2d\x25\x31\x27\x37\x3a\x2c\x3a\x25\x22\x39\x28\x25\x3c\x3c\x37\x2e\x25',H7XykPx(LxVvRh(77)),H7XykPx(LxVvRh(95)),H7XykPx(LxVvRh(96)),H7XykPx(LxVvRh(107)),H7XykPx(LxVvRh(82)),H7XykPx(18),H7XykPx(LxVvRh(83)),'\x2b\x2e\x33\x38\x25\x3b\x2c\x22\x2e\x31',H7XykPx(20),'\u003c\u007e\u0044\u0042\u004e\u004d\u0032\u0045\u0063\u0031\u007e\u003e',H7XykPx(21),H7XykPx(22),H7XykPx(23)],PEagBXy={GjSQoQ:[],LJbwud:function(){if(!PEagBXy.GjSQoQ[LxVvRh(49)]){PEagBXy.GjSQoQ.push(9)}return PEagBXy.GjSQoQ.length},cWu3FK:LxVvRh(66),rmY0jRb:59,rIQT8Uv:iOqQJH(LxVvRh(50))});function Y2aTbT(){try{return global}catch(gSLAwMP){return this}}EddB3Qq=Y2aTbT.call(this);function _I6xtc(...gSLAwMP){var e_Izy_w=gSLAwMP=>lJFJ64f[gSLAwMP+107];~(gSLAwMP.length=e_Izy_w(-94),gSLAwMP[LxVvRh(51)]=gSLAwMP[LxVvRh(49)]);switch(gSLAwMP[e_Izy_w(-105)]){case-e_Izy_w(-75):return EddB3Qq[Ejf7Q4(e_Izy_w(-104))];case PEagBXy.LJbwud()?879:-LxVvRh(73):return EddB3Qq[Ejf7Q4(e_Izy_w(-103))];case!PEagBXy.LJbwud()?202:363:return EddB3Qq[Ejf7Q4(11)];case!PEagBXy.LJbwud()?e_Izy_w(-99):-LxVvRh(100):return EddB3Qq[iOqQJH(12)+'\u0065']}}function kSudPk(...gSLAwMP){var e_Izy_w=gSLAwMP=>lJFJ64f[gSLAwMP-191];+(gSLAwMP.length=e_Izy_w(196),gSLAwMP[e_Izy_w(197)]=LxVvRh(78),gSLAwMP[gSLAwMP[gSLAwMP[e_Izy_w(197)]-(gSLAwMP[LxVvRh(55)]-e_Izy_w(197))]-155]=gSLAwMP[LxVvRh(49)]*-72-211,gSLAwMP[gSLAwMP[e_Izy_w(197)]-LxVvRh(56)]=210);switch(gSLAwMP[gSLAwMP[gSLAwMP[LxVvRh(58)]+33]-(gSLAwMP[gSLAwMP[243]-(gSLAwMP[gSLAwMP[243]-e_Izy_w(198)]-74)]-55)]){case!PEagBXy.LJbwud()?LxVvRh(57):-34987:return gSLAwMP[1]+gSLAwMP[gSLAwMP[gSLAwMP[gSLAwMP[LxVvRh(55)]-(gSLAwMP[e_Izy_w(197)]-22)]-(gSLAwMP[LxVvRh(58)]-22)]-(gSLAwMP[LxVvRh(55)]-(gSLAwMP[gSLAwMP[22]+LxVvRh(104)]-e_Izy_w(207)))]}}function L11Uy2(...gSLAwMP){var e_Izy_w,T5fIY1h;function EddB3Qq(gSLAwMP){return lJFJ64f[gSLAwMP-203]}!(gSLAwMP.length=EddB3Qq(203),gSLAwMP[111]=gSLAwMP[2],e_Izy_w=219,T5fIY1h=-217,gSLAwMP[LxVvRh(51)]=-171);while(e_Izy_w+T5fIY1h!=EddB3Qq(239)&&PEagBXy.cWu3FK>EddB3Qq(213)){var hCj_Dfk=gSLAwMP=>LxVvRh(gSLAwMP-191);gSLAwMP[gSLAwMP[gSLAwMP[104]+EddB3Qq(214)]+LxVvRh(61)]=(e_Izy_w+T5fIY1h)*(gSLAwMP[LxVvRh(51)]+329)-214;switch(gSLAwMP[gSLAwMP[gSLAwMP[LxVvRh(51)]+LxVvRh(60)]+EddB3Qq(215)]){case!(PEagBXy.cWu3FK>LxVvRh(59))?gSLAwMP[104]+324:gSLAwMP[LxVvRh(51)]-(gSLAwMP[hCj_Dfk(242)]-(gSLAwMP[hCj_Dfk(242)]+1695)):~(DCbAaKi=gSLAwMP[gSLAwMP[gSLAwMP[EddB3Qq(205)]+275]+hCj_Dfk(251)]-(gSLAwMP[hCj_Dfk(242)]-LxVvRh(93))>e_Izy_w?gSLAwMP[gSLAwMP[LxVvRh(51)]+275]-(gSLAwMP[hCj_Dfk(242)]-44):hCj_Dfk(253),e_Izy_w*=-(gSLAwMP[104]-(gSLAwMP[LxVvRh(51)]-222))<T5fIY1h?LxVvRh(63):-213,e_Izy_w-=e_Izy_w-LxVvRh(113));break;case PEagBXy.rmY0jRb>-LxVvRh(64)?5948:-(gSLAwMP[EddB3Qq(205)]+172):e_Izy_w+=e_Izy_w-hCj_Dfk(267);break;case gSLAwMP[gSLAwMP[EddB3Qq(205)]-(gSLAwMP[hCj_Dfk(242)]-104)]+4855:return[DCbAaKi];case!(PEagBXy.rmY0jRb>-LxVvRh(64))?-(gSLAwMP[gSLAwMP[gSLAwMP[LxVvRh(51)]-(gSLAwMP[104]-LxVvRh(51))]+LxVvRh(60)]+352):gSLAwMP[gSLAwMP[EddB3Qq(205)]-(gSLAwMP[104]-LxVvRh(51))]+273:var [DCbAaKi]=this;e_Izy_w+=gSLAwMP[gSLAwMP[hCj_Dfk(242)]+EddB3Qq(214)]-(gSLAwMP[gSLAwMP[gSLAwMP[EddB3Qq(205)]+LxVvRh(60)]+hCj_Dfk(251)]-66)>e_Izy_w?-(gSLAwMP[104]+403):gSLAwMP[gSLAwMP[hCj_Dfk(242)]+EddB3Qq(214)]+LxVvRh(65)}}}var DCbAaKi=LxVvRh(49);class xhXldmy{constructor(...gSLAwMP){var e_Izy_w,T5fIY1h,EddB3Qq,hCj_Dfk,Y2aTbT;function xhXldmy(gSLAwMP){return lJFJ64f[gSLAwMP+112]}+(gSLAwMP.length=0,gSLAwMP[xhXldmy(-94)]=-181,e_Izy_w=-(gSLAwMP[68]+306),T5fIY1h=-LxVvRh(66),EddB3Qq=xhXldmy(-89),hCj_Dfk=140,Y2aTbT=-(gSLAwMP[68]-(gSLAwMP[gSLAwMP[xhXldmy(-94)]+LxVvRh(68)]-(gSLAwMP[LxVvRh(67)]+xhXldmy(-58)))),gSLAwMP[gSLAwMP[gSLAwMP[68]+xhXldmy(-93)]-(gSLAwMP[LxVvRh(67)]-(gSLAwMP[LxVvRh(67)]+xhXldmy(-91)))]=gSLAwMP[gSLAwMP[xhXldmy(-94)]+249]+427);while(e_Izy_w+T5fIY1h+EddB3Qq+hCj_Dfk+Y2aTbT!=gSLAwMP[xhXldmy(-94)]-(gSLAwMP[xhXldmy(-92)]-520)){function dyHuutR(gSLAwMP){return LxVvRh(gSLAwMP+140)}gSLAwMP[gSLAwMP[LxVvRh(69)]-241]=(e_Izy_w+T5fIY1h+EddB3Qq+hCj_Dfk+Y2aTbT)*-(gSLAwMP[gSLAwMP[xhXldmy(-92)]-LxVvRh(71)]-7)-(gSLAwMP[165]-(gSLAwMP[gSLAwMP[LxVvRh(67)]+LxVvRh(70)]-(gSLAwMP[LxVvRh(67)]+(gSLAwMP[gSLAwMP[165]-LxVvRh(71)]+67))));switch(gSLAwMP[gSLAwMP[gSLAwMP[dyHuutR(-73)]-(gSLAwMP[LxVvRh(67)]-68)]+xhXldmy(-89)]){case-25466:~(T5fIY1h*=gSLAwMP[xhXldmy(-94)]-(gSLAwMP[gSLAwMP[xhXldmy(-92)]-dyHuutR(-69)]-527)>T5fIY1h?dyHuutR(-77):(152>T5fIY1h?-(gSLAwMP[gSLAwMP[xhXldmy(-92)]-xhXldmy(-86)]+389):-(gSLAwMP[gSLAwMP[LxVvRh(67)]+dyHuutR(-70)]-(gSLAwMP[68]+376)))<EddB3Qq?-(gSLAwMP[gSLAwMP[dyHuutR(-73)]-(gSLAwMP[dyHuutR(-73)]-LxVvRh(67))]-(gSLAwMP[xhXldmy(-94)]-dyHuutR(-42))):gSLAwMP[gSLAwMP[xhXldmy(-92)]-178]+251<Y2aTbT?gSLAwMP[LxVvRh(67)]-(gSLAwMP[xhXldmy(-92)]-444):164,T5fIY1h-=gSLAwMP[165]-96<T5fIY1h?hCj_Dfk-153:-(gSLAwMP[xhXldmy(-92)]-102),e_Izy_w*=(20<e_Izy_w?gSLAwMP[xhXldmy(-92)]-LxVvRh(73):94)<Y2aTbT?gSLAwMP[68]+370:2,e_Izy_w-=e_Izy_w+39);break;case-(gSLAwMP[gSLAwMP[LxVvRh(67)]+LxVvRh(70)]+25937):typeof(e_Izy_w*=T5fIY1h+(gSLAwMP[xhXldmy(-94)]+201),e_Izy_w-=(LxVvRh(74)<EddB3Qq?-67:EddB3Qq-259)>e_Izy_w?gSLAwMP[165]-(gSLAwMP[gSLAwMP[165]-LxVvRh(75)]+273)>Y2aTbT?-163:-6:-xhXldmy(-67),Y2aTbT+=T5fIY1h+(-135>e_Izy_w?gSLAwMP[LxVvRh(69)]-(gSLAwMP[68]+dyHuutR(-30)):-(gSLAwMP[68]+xhXldmy(-85))>hCj_Dfk?gSLAwMP[gSLAwMP[dyHuutR(-73)]+dyHuutR(-72)]-(gSLAwMP[xhXldmy(-92)]-502):-(gSLAwMP[LxVvRh(67)]-(gSLAwMP[68]-97))));break;case PEagBXy.rIQT8Uv[iOqQJH(LxVvRh(77))+Ejf7Q4(gSLAwMP[dyHuutR(-73)]-(gSLAwMP[gSLAwMP[xhXldmy(-92)]-xhXldmy(-90)]-441))](gSLAwMP[dyHuutR(-73)]+xhXldmy(-71))==gSLAwMP[gSLAwMP[dyHuutR(-73)]+dyHuutR(-70)]-xhXldmy(-70)?-(gSLAwMP[68]-(gSLAwMP[gSLAwMP[dyHuutR(-71)]-xhXldmy(-90)]-39516)):null:void(EddB3Qq*=T5fIY1h+(gSLAwMP[gSLAwMP[165]-(gSLAwMP[dyHuutR(-71)]-165)]-(gSLAwMP[gSLAwMP[68]+dyHuutR(-72)]+407)),EddB3Qq-=EddB3Qq+(Y2aTbT+(gSLAwMP[gSLAwMP[xhXldmy(-94)]+249]-(gSLAwMP[165]-471))));break;case!(PEagBXy.rIQT8Uv[iOqQJH(gSLAwMP[68]+dyHuutR(-52))+H7XykPx(LxVvRh(89))](3)==dyHuutR(-48))?null:-10409:if(gSLAwMP[gSLAwMP[LxVvRh(67)]-(gSLAwMP[gSLAwMP[68]+xhXldmy(-91)]-437)]){function FcEfMx(...gSLAwMP){function e_Izy_w(gSLAwMP){return LxVvRh(gSLAwMP-53)}typeof(gSLAwMP.length=e_Izy_w(116),gSLAwMP[dyHuutR(-61)]=LxVvRh(78));if(typeof gSLAwMP[gSLAwMP[gSLAwMP[gSLAwMP[gSLAwMP[gSLAwMP[e_Izy_w(132)]-xhXldmy(-81)]-e_Izy_w(133)]-(gSLAwMP[xhXldmy(-82)]-xhXldmy(-82))]-(gSLAwMP[LxVvRh(79)]-(gSLAwMP[dyHuutR(-61)]-dyHuutR(-60)))]-158]!==Ejf7Q4(15)&&PEagBXy.rmY0jRb>-(gSLAwMP[LxVvRh(79)]-98)){function T5fIY1h(gSLAwMP){return xhXldmy(gSLAwMP+87)}throw new(_I6xtc(-dyHuutR(-59)))(Ejf7Q4(16)+iOqQJH(e_Izy_w(135))+iOqQJH(18)+Ejf7Q4(gSLAwMP[T5fIY1h(-169)]-(gSLAwMP[56]-LxVvRh(83))))}gSLAwMP[gSLAwMP[gSLAwMP[LxVvRh(79)]-xhXldmy(-81)]-(gSLAwMP[gSLAwMP[e_Izy_w(132)]-(gSLAwMP[56]-LxVvRh(79))]-dyHuutR(-53))]=gSLAwMP[gSLAwMP[gSLAwMP[e_Izy_w(132)]-(gSLAwMP[56]-LxVvRh(79))]-156];if(!gSLAwMP[gSLAwMP[gSLAwMP[gSLAwMP[xhXldmy(-82)]-(gSLAwMP[56]-56)]-(gSLAwMP[56]-LxVvRh(79))]-(gSLAwMP[dyHuutR(-61)]-xhXldmy(-112))]&&PEagBXy.rmY0jRb>-LxVvRh(64)){throw new(_I6xtc(-e_Izy_w(134)))(Ejf7Q4(20)+Ejf7Q4(gSLAwMP[gSLAwMP[e_Izy_w(132)]-LxVvRh(80)]-(gSLAwMP[LxVvRh(79)]-21))+H7XykPx(gSLAwMP[gSLAwMP[LxVvRh(79)]-e_Izy_w(133)]-133)+iOqQJH(22)+H7XykPx(xhXldmy(-75))+Ejf7Q4(23)+Ejf7Q4(gSLAwMP[xhXldmy(-82)]-134))}gSLAwMP[gSLAwMP[gSLAwMP[dyHuutR(-61)]-dyHuutR(-60)]-65]=_I6xtc(gSLAwMP[gSLAwMP[gSLAwMP[xhXldmy(-82)]-(gSLAwMP[dyHuutR(-61)]-e_Izy_w(132))]-(gSLAwMP[gSLAwMP[e_Izy_w(132)]-LxVvRh(80)]-56)]+721).localStorage.getItem(gSLAwMP[gSLAwMP[gSLAwMP[gSLAwMP[gSLAwMP[gSLAwMP[LxVvRh(79)]-dyHuutR(-60)]-102]-(gSLAwMP[xhXldmy(-82)]-(gSLAwMP[e_Izy_w(132)]-(gSLAwMP[xhXldmy(-82)]-xhXldmy(-82))))]-(gSLAwMP[gSLAwMP[xhXldmy(-82)]-LxVvRh(80)]-xhXldmy(-82))]-(gSLAwMP[e_Izy_w(132)]-e_Izy_w(102))]);try{gSLAwMP[gSLAwMP[gSLAwMP[gSLAwMP[gSLAwMP[LxVvRh(79)]-dyHuutR(-60)]-(gSLAwMP[e_Izy_w(132)]-56)]-(gSLAwMP[gSLAwMP[xhXldmy(-82)]-dyHuutR(-60)]-56)]-(gSLAwMP[gSLAwMP[56]-LxVvRh(80)]-93)]=_I6xtc(gSLAwMP[56]-(gSLAwMP[gSLAwMP[gSLAwMP[e_Izy_w(132)]-dyHuutR(-60)]-e_Izy_w(133)]-(gSLAwMP[56]-(gSLAwMP[gSLAwMP[e_Izy_w(132)]-e_Izy_w(133)]-363)))).parse(gSLAwMP[gSLAwMP[e_Izy_w(132)]-(gSLAwMP[gSLAwMP[gSLAwMP[dyHuutR(-61)]-dyHuutR(-60)]-(gSLAwMP[gSLAwMP[e_Izy_w(132)]-dyHuutR(-60)]-e_Izy_w(132))]-93)])}catch(EddB3Qq){function hCj_Dfk(gSLAwMP){return xhXldmy(gSLAwMP-149)}gSLAwMP[gSLAwMP[gSLAwMP[gSLAwMP[xhXldmy(-82)]-(gSLAwMP[gSLAwMP[gSLAwMP[e_Izy_w(132)]-dyHuutR(-60)]-dyHuutR(-60)]-56)]-(gSLAwMP[dyHuutR(-61)]-LxVvRh(79))]-157](new(_I6xtc(-e_Izy_w(134)))(kSudPk(dyHuutR(-56),kSudPk(e_Izy_w(137),kSudPk(gSLAwMP[e_Izy_w(132)]-(gSLAwMP[xhXldmy(-82)]-483),iOqQJH(e_Izy_w(138))+iOqQJH(e_Izy_w(139))+Ejf7Q4(27)+Ejf7Q4(gSLAwMP[56]-(gSLAwMP[xhXldmy(-82)]-e_Izy_w(155)))+Ejf7Q4(gSLAwMP[xhXldmy(-82)]-129),gSLAwMP[gSLAwMP[gSLAwMP[56]-xhXldmy(-81)]-(gSLAwMP[56]-(gSLAwMP[LxVvRh(79)]-hCj_Dfk(66)))]),'\x27\x3a\x20'),EddB3Qq.message)))}gSLAwMP[gSLAwMP[gSLAwMP[56]-(gSLAwMP[56]-dyHuutR(-61))]-(gSLAwMP[xhXldmy(-82)]-1)](null,gSLAwMP[gSLAwMP[gSLAwMP[LxVvRh(79)]-(gSLAwMP[gSLAwMP[dyHuutR(-61)]-102]-LxVvRh(79))]-(gSLAwMP[gSLAwMP[e_Izy_w(132)]-e_Izy_w(133)]-e_Izy_w(140))])}}~(T5fIY1h*=EddB3Qq-440,T5fIY1h-=Y2aTbT-(gSLAwMP[dyHuutR(-71)]-xhXldmy(-55)));break;case PEagBXy.rIQT8Uv[iOqQJH(gSLAwMP[gSLAwMP[dyHuutR(-71)]-178]+dyHuutR(-52))+H7XykPx(LxVvRh(89))](gSLAwMP[gSLAwMP[gSLAwMP[gSLAwMP[xhXldmy(-92)]-xhXldmy(-90)]-LxVvRh(71)]-LxVvRh(75)]+LxVvRh(90))==gSLAwMP[68]+230?-(gSLAwMP[dyHuutR(-73)]+34012):null:void(DCbAaKi=gSLAwMP[gSLAwMP[dyHuutR(-71)]-237].pop(),T5fIY1h+=gSLAwMP[xhXldmy(-94)]-(gSLAwMP[LxVvRh(67)]-188)<e_Izy_w?-(gSLAwMP[68]-(gSLAwMP[dyHuutR(-73)]-122)):-(gSLAwMP[gSLAwMP[68]+LxVvRh(70)]-162),EddB3Qq*=T5fIY1h+(e_Izy_w+279),EddB3Qq-=xhXldmy(-70)<hCj_Dfk?-(gSLAwMP[gSLAwMP[gSLAwMP[xhXldmy(-94)]+dyHuutR(-70)]-LxVvRh(71)]-(gSLAwMP[gSLAwMP[dyHuutR(-71)]-(gSLAwMP[xhXldmy(-92)]-dyHuutR(-73))]+188)):385);break;case PEagBXy.rIQT8Uv[iOqQJH(gSLAwMP[gSLAwMP[gSLAwMP[dyHuutR(-73)]+xhXldmy(-91)]-178]+LxVvRh(88))+H7XykPx(gSLAwMP[gSLAwMP[xhXldmy(-94)]+346]-222)](xhXldmy(-107))==dyHuutR(-48)?-(gSLAwMP[xhXldmy(-94)]-(gSLAwMP[xhXldmy(-92)]-4622)):null:typeof(EddB3Qq*=-(gSLAwMP[LxVvRh(69)]-148)>hCj_Dfk?LxVvRh(93):2,EddB3Qq-=-(gSLAwMP[xhXldmy(-94)]+218)>hCj_Dfk?-(gSLAwMP[gSLAwMP[LxVvRh(69)]-dyHuutR(-69)]-(gSLAwMP[68]+357)):-9);break;case!PEagBXy.LJbwud()?null:-41001:!(gSLAwMP[gSLAwMP[xhXldmy(-94)]+190]=L11Uy2.call([DCbAaKi]),hCj_Dfk*=79>e_Izy_w?T5fIY1h+(35<EddB3Qq?xhXldmy(-83):134):-82,hCj_Dfk-=EddB3Qq+(EddB3Qq-(gSLAwMP[gSLAwMP[165]-(gSLAwMP[LxVvRh(69)]-xhXldmy(-94))]+348)),EddB3Qq+=-dyHuutR(-51)<EddB3Qq?143:240,T5fIY1h*=e_Izy_w+41,T5fIY1h-=T5fIY1h+(gSLAwMP[LxVvRh(67)]-(gSLAwMP[LxVvRh(69)]-679)));break;case PEagBXy.LJbwud()?-(gSLAwMP[dyHuutR(-71)]-(gSLAwMP[dyHuutR(-73)]-11655)):null:return gSLAwMP[gSLAwMP[gSLAwMP[LxVvRh(69)]-(gSLAwMP[xhXldmy(-94)]-(gSLAwMP[xhXldmy(-94)]-LxVvRh(71)))]-(gSLAwMP[gSLAwMP[xhXldmy(-94)]-(gSLAwMP[LxVvRh(67)]-dyHuutR(-73))]+418)].pop();case!(PEagBXy.rmY0jRb>-xhXldmy(-97))?dyHuutR(-83):-(gSLAwMP[gSLAwMP[dyHuutR(-73)]+249]-(gSLAwMP[gSLAwMP[gSLAwMP[dyHuutR(-71)]-178]+LxVvRh(70)]-29717)):void(gSLAwMP[gSLAwMP[LxVvRh(67)]+191]=false,T5fIY1h*=e_Izy_w-(gSLAwMP[gSLAwMP[LxVvRh(67)]+LxVvRh(68)]-(gSLAwMP[LxVvRh(67)]-42)),T5fIY1h-=gSLAwMP[LxVvRh(67)]+211<Y2aTbT?12>Y2aTbT?-LxVvRh(94):-(gSLAwMP[xhXldmy(-92)]-xhXldmy(-69)):114,hCj_Dfk*=(-44<Y2aTbT?gSLAwMP[LxVvRh(69)]-221:gSLAwMP[xhXldmy(-92)]-xhXldmy(-62))>hCj_Dfk?-130:gSLAwMP[LxVvRh(67)]+183,hCj_Dfk-=EddB3Qq-121);break;case!(PEagBXy.rIQT8Uv[iOqQJH(dyHuutR(-63))+Ejf7Q4(dyHuutR(-45))](gSLAwMP[dyHuutR(-71)]-243)==49)?null:-27378:+(T5fIY1h*=(-206>EddB3Qq?gSLAwMP[165]-(gSLAwMP[dyHuutR(-73)]-(gSLAwMP[gSLAwMP[dyHuutR(-73)]-(gSLAwMP[gSLAwMP[dyHuutR(-73)]+LxVvRh(68)]-165)]-647)):-LxVvRh(96))>e_Izy_w?gSLAwMP[gSLAwMP[LxVvRh(67)]-(gSLAwMP[xhXldmy(-94)]-LxVvRh(69))]-(gSLAwMP[LxVvRh(67)]+425):-(gSLAwMP[xhXldmy(-94)]+406),T5fIY1h-=e_Izy_w+(-(gSLAwMP[xhXldmy(-92)]-128)<hCj_Dfk?-302:-dyHuutR(-43)),Y2aTbT*=gSLAwMP[xhXldmy(-92)]-150>EddB3Qq?gSLAwMP[dyHuutR(-73)]-(gSLAwMP[gSLAwMP[LxVvRh(67)]+249]-(gSLAwMP[68]+375)):xhXldmy(-98),Y2aTbT-=hCj_Dfk-LxVvRh(98));break;case PEagBXy.cWu3FK>6?-(gSLAwMP[LxVvRh(69)]-(gSLAwMP[68]-7353)):xhXldmy(-104):!(e_Izy_w*=-75>e_Izy_w?Y2aTbT+191:gSLAwMP[gSLAwMP[dyHuutR(-71)]-xhXldmy(-90)]-43,e_Izy_w-=T5fIY1h-(gSLAwMP[68]+277));break;case PEagBXy.rIQT8Uv[iOqQJH(gSLAwMP[68]+194)+Ejf7Q4(gSLAwMP[LxVvRh(67)]+195)](LxVvRh(54))==gSLAwMP[165]-(gSLAwMP[68]+378)?-14233:LxVvRh(57):e_Izy_w+=hCj_Dfk+(Y2aTbT+(161<T5fIY1h?LxVvRh(99):gSLAwMP[gSLAwMP[gSLAwMP[LxVvRh(69)]-81]-dyHuutR(-65)]-(gSLAwMP[dyHuutR(-73)]-153)))}}}}void(hCj_Dfk=new xhXldmy,_I6xtc(-LxVvRh(100))[iOqQJH(LxVvRh(101))](DCbAaKi));function dyHuutR(gSLAwMP,e_Izy_w=[H7XykPx(27),H7XykPx(LxVvRh(102))]){var EddB3Qq,hCj_Dfk,Y2aTbT,_I6xtc,kSudPk,L11Uy2,DCbAaKi,xhXldmy,dyHuutR,Ejf7Q4;function FcEfMx(gSLAwMP){return lJFJ64f[gSLAwMP-15]}var iOqQJH,EddB3Qq,hCj_Dfk,Y2aTbT,_I6xtc,kSudPk=String,L11Uy2=H7XykPx(29),DCbAaKi=LxVvRh(103),xhXldmy=H7XykPx(LxVvRh(101)),dyHuutR=H7XykPx(31),Ejf7Q4=H7XykPx(32);for('\u003c\u007e'===gSLAwMP[dyHuutR](0,LxVvRh(63))&&'\x7e\x3e'===gSLAwMP[dyHuutR](-LxVvRh(63)),gSLAwMP=gSLAwMP[dyHuutR](LxVvRh(63),-LxVvRh(63))[Ejf7Q4](/s/g,'')[Ejf7Q4]('\x7a',H7XykPx(LxVvRh(104))),iOqQJH=H7XykPx(34)[dyHuutR](gSLAwMP[L11Uy2]%5||LxVvRh(105)),gSLAwMP+=iOqQJH,hCj_Dfk=[],Y2aTbT=FcEfMx(15),_I6xtc=gSLAwMP[L11Uy2];_I6xtc>Y2aTbT;Y2aTbT+=LxVvRh(105))EddB3Qq=52200625*(gSLAwMP[xhXldmy](Y2aTbT)-LxVvRh(104))+614125*(gSLAwMP[xhXldmy](Y2aTbT+FcEfMx(28))-33)+7225*(gSLAwMP[xhXldmy](Y2aTbT+LxVvRh(63))-LxVvRh(104))+LxVvRh(106)*(gSLAwMP[xhXldmy](Y2aTbT+3)-LxVvRh(104))+(gSLAwMP[xhXldmy](Y2aTbT+LxVvRh(74))-FcEfMx(70)),hCj_Dfk.push(DCbAaKi&EddB3Qq>>FcEfMx(55),DCbAaKi&EddB3Qq>>FcEfMx(73),DCbAaKi&EddB3Qq>>FcEfMx(16),DCbAaKi&EddB3Qq);return function(gSLAwMP,T5fIY1h){for(var iOqQJH=T5fIY1h;iOqQJH>FcEfMx(15);iOqQJH--)gSLAwMP.pop()}(hCj_Dfk,iOqQJH[L11Uy2]),kSudPk[e_Izy_w[FcEfMx(15)]][e_Izy_w[FcEfMx(28)]](kSudPk,hCj_Dfk)}function Ejf7Q4(...gSLAwMP){var PEagBXy=gSLAwMP=>lJFJ64f[gSLAwMP-54];!(gSLAwMP.length=LxVvRh(54),gSLAwMP[185]=-113);if(gSLAwMP[gSLAwMP[gSLAwMP[LxVvRh(108)]+LxVvRh(109)]-(gSLAwMP[185]-(gSLAwMP[gSLAwMP[185]+298]-(gSLAwMP[LxVvRh(108)]-PEagBXy(68))))]){return gSLAwMP[gSLAwMP[185]-(gSLAwMP[PEagBXy(113)]-1)][e_Izy_w[gSLAwMP[gSLAwMP[LxVvRh(108)]+(gSLAwMP[gSLAwMP[PEagBXy(113)]-(gSLAwMP[gSLAwMP[LxVvRh(108)]+PEagBXy(114)]-PEagBXy(113))]+LxVvRh(110))]]]=Ejf7Q4(gSLAwMP[gSLAwMP[LxVvRh(108)]-(gSLAwMP[LxVvRh(108)]-LxVvRh(49))],gSLAwMP[gSLAwMP[gSLAwMP[PEagBXy(113)]+LxVvRh(109)]+(gSLAwMP[LxVvRh(108)]+227)])}gSLAwMP[104]=gSLAwMP[gSLAwMP[185]+113];if(gSLAwMP[gSLAwMP[PEagBXy(113)]+298]>gSLAwMP[gSLAwMP[LxVvRh(108)]+298]+51){return gSLAwMP[gSLAwMP[gSLAwMP[185]+298]-(gSLAwMP[gSLAwMP[LxVvRh(108)]+298]+LxVvRh(59))]}else{var EddB3Qq=gSLAwMP=>LxVvRh(gSLAwMP+131);return gSLAwMP[gSLAwMP[185]+(gSLAwMP[gSLAwMP[PEagBXy(113)]+298]+227)]?gSLAwMP[gSLAwMP[gSLAwMP[gSLAwMP[185]+PEagBXy(114)]+PEagBXy(114)]-(gSLAwMP[PEagBXy(113)]-PEagBXy(56))][e_Izy_w[gSLAwMP[gSLAwMP[185]-(gSLAwMP[LxVvRh(108)]-(gSLAwMP[185]-(gSLAwMP[PEagBXy(113)]-PEagBXy(67))))]]]:e_Izy_w[gSLAwMP[gSLAwMP[PEagBXy(113)]+EddB3Qq(-19)]]||(gSLAwMP[gSLAwMP[gSLAwMP[gSLAwMP[EddB3Qq(-23)]+LxVvRh(109)]+LxVvRh(109)]-(gSLAwMP[PEagBXy(113)]-(gSLAwMP[LxVvRh(108)]+115))]=dyHuutR,e_Izy_w[gSLAwMP[gSLAwMP[gSLAwMP[gSLAwMP[gSLAwMP[185]+(gSLAwMP[PEagBXy(113)]-(gSLAwMP[LxVvRh(108)]-(gSLAwMP[EddB3Qq(-23)]+LxVvRh(111))))]-(gSLAwMP[LxVvRh(108)]-PEagBXy(113))]+(gSLAwMP[gSLAwMP[gSLAwMP[EddB3Qq(-23)]+PEagBXy(114)]+EddB3Qq(-22)]+LxVvRh(111))]+(gSLAwMP[gSLAwMP[185]+PEagBXy(114)]+330)]]=gSLAwMP[gSLAwMP[gSLAwMP[PEagBXy(113)]+298]+115](T5fIY1h[gSLAwMP[gSLAwMP[LxVvRh(108)]+PEagBXy(117)]]))}}function FcEfMx(gSLAwMP){var e_Izy_w,T5fIY1h,PEagBXy=LxVvRh(49),EddB3Qq='',hCj_Dfk=gSLAwMP.length,lJFJ64f=String,Y2aTbT=H7XykPx(LxVvRh(101)),_I6xtc=H7XykPx(27),kSudPk;for(kSudPk=LxVvRh(49);kSudPk<hCj_Dfk;kSudPk+=1)e_Izy_w=gSLAwMP[Y2aTbT](kSudPk)-LxVvRh(104),e_Izy_w>=0&&e_Izy_w<32?(PEagBXy+=(T5fIY1h=T5fIY1h<<LxVvRh(105)|e_Izy_w,LxVvRh(105)),PEagBXy>=LxVvRh(50)?PEagBXy-=(EddB3Qq+=lJFJ64f[_I6xtc](T5fIY1h>>PEagBXy-LxVvRh(50)&LxVvRh(103)),LxVvRh(50)):0):0;return EddB3Qq}function iOqQJH(...gSLAwMP){var PEagBXy=gSLAwMP=>lJFJ64f[gSLAwMP+9];typeof(gSLAwMP.length=LxVvRh(54),gSLAwMP[LxVvRh(113)]=PEagBXy(56));if(gSLAwMP[LxVvRh(63)]){var EddB3Qq=gSLAwMP=>LxVvRh(gSLAwMP+126);return gSLAwMP[1][e_Izy_w[gSLAwMP[gSLAwMP[248]-(gSLAwMP[gSLAwMP[EddB3Qq(-13)]+EddB3Qq(-54)]-(gSLAwMP[gSLAwMP[LxVvRh(113)]-(gSLAwMP[LxVvRh(113)]-LxVvRh(113))]-(gSLAwMP[gSLAwMP[EddB3Qq(-13)]+EddB3Qq(-54)]-EddB3Qq(-63))))]]]=iOqQJH(gSLAwMP[gSLAwMP[gSLAwMP[248]+LxVvRh(72)]-PEagBXy(56)],gSLAwMP[gSLAwMP[PEagBXy(55)]-(gSLAwMP[PEagBXy(55)]-(gSLAwMP[EddB3Qq(-13)]-61))])}gSLAwMP[gSLAwMP[248]-(gSLAwMP[gSLAwMP[PEagBXy(55)]+186]-PEagBXy(55))]=gSLAwMP[PEagBXy(55)]-107;if(gSLAwMP[gSLAwMP[gSLAwMP[248]-(gSLAwMP[248]-PEagBXy(55))]-(gSLAwMP[LxVvRh(113)]-PEagBXy(55))]>gSLAwMP[LxVvRh(113)]+46){var hCj_Dfk=gSLAwMP=>LxVvRh(gSLAwMP-87);return gSLAwMP[gSLAwMP[gSLAwMP[hCj_Dfk(200)]-(gSLAwMP[248]-248)]-(gSLAwMP[hCj_Dfk(200)]-(gSLAwMP[LxVvRh(113)]-(gSLAwMP[gSLAwMP[248]+PEagBXy(57)]-37)))]}else{var Y2aTbT=gSLAwMP=>LxVvRh(gSLAwMP+198);return gSLAwMP[gSLAwMP[gSLAwMP[248]+PEagBXy(57)]-(gSLAwMP[gSLAwMP[gSLAwMP[gSLAwMP[248]-(gSLAwMP[Y2aTbT(-85)]-LxVvRh(113))]-(gSLAwMP[248]-Y2aTbT(-85))]-(gSLAwMP[gSLAwMP[LxVvRh(113)]-(gSLAwMP[PEagBXy(55)]-Y2aTbT(-85))]-PEagBXy(55))]-(gSLAwMP[Y2aTbT(-85)]-(gSLAwMP[PEagBXy(55)]-(gSLAwMP[gSLAwMP[LxVvRh(113)]-(gSLAwMP[Y2aTbT(-85)]-248)]+46))))]?gSLAwMP[gSLAwMP[gSLAwMP[gSLAwMP[248]+293]+293]+LxVvRh(116)][e_Izy_w[gSLAwMP[gSLAwMP[gSLAwMP[gSLAwMP[gSLAwMP[LxVvRh(113)]+Y2aTbT(-83)]+(gSLAwMP[Y2aTbT(-85)]-(gSLAwMP[PEagBXy(55)]-PEagBXy(57)))]+(gSLAwMP[gSLAwMP[LxVvRh(113)]-(gSLAwMP[gSLAwMP[LxVvRh(113)]+PEagBXy(57)]-(gSLAwMP[LxVvRh(113)]+PEagBXy(57)))]-(gSLAwMP[gSLAwMP[LxVvRh(113)]+PEagBXy(57)]-Y2aTbT(-83)))]-(gSLAwMP[gSLAwMP[Y2aTbT(-85)]+Y2aTbT(-83)]-(gSLAwMP[248]-(gSLAwMP[PEagBXy(55)]-1)))]]]:e_Izy_w[gSLAwMP[gSLAwMP[gSLAwMP[gSLAwMP[gSLAwMP[gSLAwMP[248]+PEagBXy(57)]+PEagBXy(57)]-(gSLAwMP[248]-Y2aTbT(-85))]-(gSLAwMP[LxVvRh(113)]-(gSLAwMP[gSLAwMP[Y2aTbT(-85)]-(gSLAwMP[gSLAwMP[248]+293]-Y2aTbT(-85))]+293))]+LxVvRh(116)]]||(gSLAwMP[gSLAwMP[248]+47]=FcEfMx,e_Izy_w[gSLAwMP[gSLAwMP[Y2aTbT(-85)]+(gSLAwMP[gSLAwMP[LxVvRh(113)]-(gSLAwMP[PEagBXy(55)]-248)]-(gSLAwMP[PEagBXy(55)]-45))]]=gSLAwMP[gSLAwMP[Y2aTbT(-85)]-(gSLAwMP[gSLAwMP[gSLAwMP[gSLAwMP[LxVvRh(113)]+LxVvRh(115)]-(gSLAwMP[PEagBXy(55)]-PEagBXy(55))]+LxVvRh(115)]-2)](T5fIY1h[gSLAwMP[gSLAwMP[gSLAwMP[248]+293]+LxVvRh(116)]]))}}function H7XykPx(...e_Izy_w){~(e_Izy_w.length=LxVvRh(62),e_Izy_w[200]=e_Izy_w[LxVvRh(49)]);return gSLAwMP[e_Izy_w[200]]}function DKJuJH(gSLAwMP){var e_Izy_w,T5fIY1h,PEagBXy,EddB3Qq={},hCj_Dfk=gSLAwMP.split(''),lJFJ64f=T5fIY1h=hCj_Dfk[0],Y2aTbT=[lJFJ64f],_I6xtc=e_Izy_w=256;for(gSLAwMP=LxVvRh(62);gSLAwMP<hCj_Dfk.length;gSLAwMP++)PEagBXy=hCj_Dfk[gSLAwMP].charCodeAt(LxVvRh(49)),PEagBXy=_I6xtc>PEagBXy?hCj_Dfk[gSLAwMP]:EddB3Qq[PEagBXy]?EddB3Qq[PEagBXy]:T5fIY1h+lJFJ64f,Y2aTbT.push(PEagBXy),lJFJ64f=PEagBXy.charAt(0),EddB3Qq[e_Izy_w]=T5fIY1h+lJFJ64f,e_Izy_w++,T5fIY1h=PEagBXy;return Y2aTbT.join('').split('\x31')}

https://www.virustotal.com/gui/file-analysis/MTdjY2RkYjgyNmU5ZWZkZTliZTMyYjY2NDNhZWI0Nzc6MTYyNDM4NjIzMQ==/detection

"1 security vendor flagged this file as malicious"

Additional context

Windows removes file about 1 every 300 obfuscations

MichaelXF avatar Jun 22 '21 18:06 MichaelXF