10

I found a very strange javascript on a page. It was encoded in a large base64 string, then enclosed in atoi() and eval()d like this:

eval(atob("0aW9u...UuYWRkR"))

I decoded it and beautified the code. I admit it is quite a big script, but the code was not minified so it is readable, is someone able to point out what (more or less) this script is doing?

1
  • 3
    unfortunately, questions asking us to review random malware code is off topic - you can image that we would be flooded with pages of random code
    – schroeder
    Dec 13, 2017 at 15:08

1 Answer 1

12

A few lines stick out, and somewhere down below there is this line:

var cryptonight = new CryptonightWASMWrapper

This seems to be a browserbased cryptominer called CryptoNight. It can use "your" browser to generate coins for the site's owner.

A few sites have been toying with this idea (and was tested on for instance The Pirate Bay) as opposed to the "normal" way of generating income via advertisement.

If you do not like your CPU being used:

  • you could try to block all javascript
  • or use an extension like NoCoin.

How does NoCoin work?

The extension is simply blocking a list of blacklisted domains in blacklist.txt.

1
  • Hah, so cool. WASM being put to 'good' use Dec 13, 2017 at 15:13

Not the answer you're looking for? Browse other questions tagged .