11

I found a very strange javascript on a page. It was encoded in a large base64 string, then enclosed in atoi() and eval()d like this:

eval(atob("0aW9u...UuYWRkR"))

I decoded it and beautified the code. I admit it is quite a big script, but the code was not minified so it is readable, is someone able to point out what (more or less) this script is doing?

closed as off-topic by schroeder Dec 13 '17 at 15:07

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    unfortunately, questions asking us to review random malware code is off topic - you can image that we would be flooded with pages of random code – schroeder Dec 13 '17 at 15:08
13

A few lines stick out, and somewhere down below there is this line:

var cryptonight = new CryptonightWASMWrapper

This seems to be a browserbased cryptominer called CryptoNight. It can use "your" browser to generate coins for the site's owner.

A few sites have been toying with this idea (and was tested on for instance The Pirate Bay) as opposed to the "normal" way of generating income via advertisement.

If you do not like your CPU being used:

  • you could try to block all javascript
  • or use an extension like NoCoin.

How does NoCoin work?

The extension is simply blocking a list of blacklisted domains in blacklist.txt.

  • Hah, so cool. WASM being put to 'good' use – Nik Kyriakides Dec 13 '17 at 15:13

Not the answer you're looking for? Browse other questions tagged or ask your own question.