11

I found a very strange javascript on a page. It was encoded in a large base64 string, then enclosed in atoi() and eval()d like this:

eval(atob("0aW9u...UuYWRkR"))

I decoded it and beautified the code. I admit it is quite a big script, but the code was not minified so it is readable, is someone able to point out what (more or less) this script is doing?

  • 3
    unfortunately, questions asking us to review random malware code is off topic - you can image that we would be flooded with pages of random code – schroeder Dec 13 '17 at 15:08
13

A few lines stick out, and somewhere down below there is this line:

var cryptonight = new CryptonightWASMWrapper

This seems to be a browserbased cryptominer called CryptoNight. It can use "your" browser to generate coins for the site's owner.

A few sites have been toying with this idea (and was tested on for instance The Pirate Bay) as opposed to the "normal" way of generating income via advertisement.

If you do not like your CPU being used:

  • you could try to block all javascript
  • or use an extension like NoCoin.

How does NoCoin work?

The extension is simply blocking a list of blacklisted domains in blacklist.txt.

| improve this answer | |
  • Hah, so cool. WASM being put to 'good' use – nicholaswmin Dec 13 '17 at 15:13

Not the answer you're looking for? Browse other questions tagged or ask your own question.