JSUNPACK
A Generic JavaScript Unpacker
CAUTION: jsunpack was designed for security researchers and computer professionals
Enter a single URL (or paste JavaScript to decode):

Upload a PDF, pcap, HTML, or JavaScript file
Private? Help: privacy | uploads
Default Referer
Description

Submission permanent link be14eea2aaac6dcffeed022309431afcb63f2d38 (Received 2017-11-14 15:27:57, https://www.neverclicks.com/ )

URLStatus
www.neverclicks.com/ saved 97265 bytes 90f3b54bc899e8084d6f7c0b6dccca5b73f7cd70

www.neverclicks.com/11619.js status: (referer=www.neverclicks.com/)

illiweb.com/rsc/16/frm/lang/en.js status: (referer=www.neverclicks.com/)

illiweb.com/rsc/16/frm/jquery/cookie/jquery.cookie.js status: (referer=www.neverclicks.com/)

static.criteo.net/js/ld/ status: (referer=static.criteo.net/js/ld/publishertag.js)

illiweb.com/rsc/16/frm/jquery/toolbar/FAToolbar.js status: (referer=www.neverclicks.com/)

ajax.googleapis.com/ajax/libs/jquery/1.7.2/undefined status: (referer=ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js)

&lt;script/ status: (referer=www.neverclicks.com/)failure: <urlopen error [Errno -3] Temporary failure in name resolution>

translate.google.com/a/undefined status: (referer=translate.google.com/a/element.js?cb=googleTranslateElementInit)

www.superadexchange.com/a/ status: (referer=www.superadexchange.com/a/display.php?r=968461)

All Malicious or Suspicious Elements of Submission

suspicious: maxruntime exceeded 10 seconds (incomplete) 0 bytes
static.criteo.net/js/ld/publishertag.js benign
[nothing detected] (script) static.criteo.net/js/ld/publishertag.js
     status: (referer=www.neverclicks.com/)saved 61202 bytes 18b42735466aaf735ffaff2326c9c31b4151b44b
     info: [script] static.criteo.net/js/ld/
     file: 18b42735466aaf735ffaff2326c9c31b4151b44b: 61202 bytes

Decoded Files
18b4/2735466aaf735ffaff2326c9c31b4151b44b from static.criteo.net/js/ld/publishertag.js (61202 bytes) download


www.neverclicks.com/ benign
[nothing detected] www.neverclicks.com/
     status: (referer=http:/www.ask.com/web?q=puppies)saved 97265 bytes 90f3b54bc899e8084d6f7c0b6dccca5b73f7cd70
     info: [script] &lt;script
     info: [script] ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js
     info: [script] illiweb.com/rsc/16/frm/lang/en.js
     info: [script] illiweb.com/rsc/16/frm/jquery/ticker/ticker.js
     info: [script] www.neverclicks.com/99897.js
     info: [script] www.neverclicks.com/11619.js
     info: [script] static.criteo.net/js/ld/publishertag.js
     info: [script] illiweb.com/rsc/16/frm/jquery/cookie/jquery.cookie.js
     info: [script] illiweb.com/rsc/16/frm/jquery/toolbar/FAToolbar.js
     info: [img] imgfast.net/users/1715/41/15/16/avatars/gallery/avatar10.png
     info: [img] illiweb.com/fa/empty.gif
     info: [img] i.servimg.com/u/f62/18/56/29/66/bc01_h11.png
     info: [img] i62.servimg.com/u/f62/18/56/29/66/bc02_p10.png
     info: [img] i62.servimg.com/u/f62/18/56/29/66/bc03_c10.png
     info: [img] i62.servimg.com/u/f62/18/56/29/66/bc04_g10.png
     info: [img] i62.servimg.com/u/f62/18/56/29/66/bc05_f10.png
     info: [img] i62.servimg.com/u/f62/18/56/29/66/bc06_s10.png
     info: [img] i62.servimg.com/u/f62/18/56/29/66/bc07_m10.png
     info: [img] i62.servimg.com/u/f62/18/56/29/66/bc11_r10.png
     info: [img] i62.servimg.com/u/f62/18/56/29/66/bc12_l10.png
     info: [script] www.superadexchange.com/a/display.php?r=968461
     info: [img] www.foro-ptc.com/images/foros/Noticias.png
     info: [img] imgfast.net/users/1715/41/15/16/avatars/1-79.jpg
     info: [img] illiweb.com/fa/m/reply1.gif
     info: [img] i37.servimg.com/u/f37/18/84/81/59/presen10.png
     info: [img] imgfast.net/users/1715/41/15/16/avatars/1252-84.png
     info: [img] www.foro-ptc.com/images/foros/Hyips.gif
     info: [img] i.servimg.com/u/f37/18/84/81/59/cripto10.png
     info: [img] www.foro-ptc.com/images/foros/Nuevas-PTC.png
     info: [img] i.servimg.com/u/f37/18/84/81/59/juegos11.png
     info: [img] i.servimg.com/u/f37/18/84/81/59/revsha10.png
     info: [img] i.servimg.com/u/f37/18/84/81/59/gpt11.png
     info: [img] i.servimg.com/u/f37/18/84/81/59/surf10.png
     info: [img] imgfast.net/users/1715/41/15/16/avatars/1118-72.jpg
     info: [img] i.servimg.com/u/f37/18/84/81/59/forex11.png
     info: [img] i.servimg.com/u/f37/18/84/81/59/apuest10.png
     info: [img] i37.servimg.com/u/f37/18/84/81/59/contab10.png
     info: [img] illiweb.com/fa/invision/pp-blank-thumb.png
     info: [img] i.servimg.com/u/f37/18/84/81/59/contab10.png
     info: [img] i37.servimg.com/u/f37/18/84/81/59/revsha10.png
     info: [img] i37.servimg.com/u/f37/18/84/81/59/ptc10.png
     info: [img] i37.servimg.com/u/f37/18/84/81/59/encues10.png
     info: [img] imgfast.net/users/1715/41/15/16/avatars/1026-92.jpg
     info: [img] i37.servimg.com/u/f37/18/84/81/59/transp12.png
     info: [img] i37.servimg.com/u/f37/18/84/81/59/moneti10.png
     info: [img] i37.servimg.com/u/f37/18/84/81/59/clasif10.png
     info: [img] i37.servimg.com/u/f37/18/84/81/59/promo10.png
     info: [img] i37.servimg.com/u/f37/18/84/81/59/charit10.png
     info: [img] pbs.twimg.com/images/1219901313/logo-normal.jpg
     info: [img] i37.servimg.com/u/f37/18/84/81/59/public10.png
     info: [img] imgfast.net/users/1715/41/15/16/avatars/1015-32.png
     info: [img] i37.servimg.com/u/f37/18/84/81/59/monede10.png
     info: [img] i37.servimg.com/u/f37/18/84/81/59/idioma12.png
     info: [img] i.servimg.com/u/f11/18/84/81/59/ams10.png
     info: [img] steamcdn-a.akamaihd.net/steamcommunity/public/images/avatars/6a/6a31f428245a74b10598680b4d3b1aa0e6db08d0_medium.jpg
     info: [img] illiweb.com/fa/m/whosonline2.gif
     info: [img] illiweb.com/fa/prosilver/unread.gif
     info: [img] illiweb.com/fa/prosilver/read.gif
     info: [img] illiweb.com/fa/prosilver/locked.gif
     info: [script] www.superadexchange.com/a/display.php?r=968463
     info: [script] translate.google.com/a/element.js?cb=googleTranslateElementInit
     info: [img] illiweb.com/fa/search.gif
     info: [script] illiweb.com/rsc/16/frm/jquery/marquee/jquery.marquee.min.js
     info: [img] illiweb.com/fa/m/minitime1.gif
     info: [img] illiweb.com/fa/prosilver/lcap.png
     info: [img] illiweb.com/fa/prosilver/bar.png
     info: [img] illiweb.com/fa/prosilver/rcap.png
     info: [decodingLevel=0] found JavaScript
     error: line:53: SyntaxError: invalid label:
          error: line:53: ;{"@context":"http:\/\/schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"http:\/\/www.neverclicks.com\/","name":"Forum NeverClick"}}]}
          error: line:53: ..^
     error: line:3: SyntaxError: missing = in XML attribute:
          error: line:3: <!DOCTYPE html PUBLIC "-/W3C/DTD XHTML 1.0 Transitional/EN" "http:/www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http:/www.w3.org/1999/xhtml" dir="ltr" id="min-width" lang="en" xml:lang="en" xmlns:og="http:/opengraphprotocol.org/sch
          error: line:3: ...............^
     file: 90f3b54bc899e8084d6f7c0b6dccca5b73f7cd70: 97265 bytes

Decoded Files
90f3/b54bc899e8084d6f7c0b6dccca5b73f7cd70 from www.neverclicks.com/ (97265 bytes, 1286 hidden) download


www.superadexchange.com/a/display.php?r=968463 benign
[nothing detected] (script) www.superadexchange.com/a/display.php?r=968463
     status: (referer=www.neverclicks.com/)saved 6407 bytes 382b43a7dcfbd8e6d771958aecee51172f35e91d
     info: [iframe] www.superadexchange.com/a/
     file: 382b43a7dcfbd8e6d771958aecee51172f35e91d: 6407 bytes

Decoded Files
382b/43a7dcfbd8e6d771958aecee51172f35e91d from www.superadexchange.com/a/display.php?r=968463 (6407 bytes, 1132 hidden) download


www.superadexchange.com/a/display.php?r=968461 benign
[nothing detected] (script) www.superadexchange.com/a/display.php?r=968461
     status: (referer=www.neverclicks.com/)saved 6406 bytes 4d81185bd1ac49e66f68f6c3ce402a9ebd042def
     info: [iframe] www.superadexchange.com/a/
     file: 4d81185bd1ac49e66f68f6c3ce402a9ebd042def: 6406 bytes

Decoded Files
4d81/185bd1ac49e66f68f6c3ce402a9ebd042def from www.superadexchange.com/a/display.php?r=968461 (6406 bytes, 1132 hidden) download


www.neverclicks.com/99897.js benign
[nothing detected] (script) www.neverclicks.com/99897.js
     status: (referer=www.neverclicks.com/)saved 4303 bytes 106aeb392002ae4fcf105d329afaf0bf26d0bc45
     info: [img] illiweb.com/fa/wysiwyg/separator.png
     info: [img] www.neverclicks.com/
     file: 106aeb392002ae4fcf105d329afaf0bf26d0bc45: 4303 bytes

Decoded Files
106a/eb392002ae4fcf105d329afaf0bf26d0bc45 from www.neverclicks.com/99897.js (4303 bytes, 2 hidden) download


illiweb.com/rsc/16/frm/jquery/marquee/jquery.marquee.min.js benign
[nothing detected] (script) illiweb.com/rsc/16/frm/jquery/marquee/jquery.marquee.min.js
     status: (referer=www.neverclicks.com/)saved 4467 bytes 41ae2993e980ca121d94f7803e83cdf1c0cdc4e5
     file: 41ae2993e980ca121d94f7803e83cdf1c0cdc4e5: 4467 bytes

Decoded Files
41ae/2993e980ca121d94f7803e83cdf1c0cdc4e5 from illiweb.com/rsc/16/frm/jquery/marquee/jquery.marquee.min.js (4467 bytes) download


ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js benign
[nothing detected] (script) ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js
     status: (referer=www.neverclicks.com/)saved 94840 bytes abcd2ba13348f178b17141b445bc99f1917d47af
     info: ActiveXDataObjectsMDAC detected Microsoft.XMLHTTP
     info: [decodingLevel=0] found JavaScript
     error: undefined function p.getElementsByTagName
     error: undefined variable p
     suspicious: maxruntime exceeded 10 seconds (incomplete) 0 bytes
     info: Decoding option browser=IE7/XP and browser=IE8/Vista and browser=Opera and browser=Firefox,      0 bytes
     info: Decoding option navigator.systemLanguage=en and navigator.systemLanguage=zh-cn,      72 bytes
     info: [element] URL=ajax.googleapis.com/ajax/libs/jquery/1.7.2/undefined
     file: abcd2ba13348f178b17141b445bc99f1917d47af: 94840 bytes
     file: 235ef940896a24db4d70e8b3f56981281d9949b5: 95203 bytes
     file: 7dd9fc079dbf8a10c92947864ba744cad732ecb0: 95321 bytes
     file: fb710a4e9b87c6700d85b36204eef97d5d2baa98: 95513 bytes
     file: 23d83f12a9ea3091c5f9a998b7bd3375492b2adb: 95227 bytes
     file: b6512eab8369b4c0b913df344e53ee3c46c0ab30: 95351 bytes
     file: d5dba94a76a67a54f2b98b16227da20414542fd9: 72 bytes

Decoded Files
abcd/2ba13348f178b17141b445bc99f1917d47af from ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js (94840 bytes, 2 hidden) download

235e/f940896a24db4d70e8b3f56981281d9949b5 from ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js (95203 bytes, 2 hidden) download

7dd9/fc079dbf8a10c92947864ba744cad732ecb0 from ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js (95321 bytes, 2 hidden) download

fb71/0a4e9b87c6700d85b36204eef97d5d2baa98 from ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js (95513 bytes, 2 hidden) download

23d8/3f12a9ea3091c5f9a998b7bd3375492b2adb from ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js (95227 bytes, 2 hidden) download

b651/2eab8369b4c0b913df344e53ee3c46c0ab30 from ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js (95351 bytes, 2 hidden) download

d5db/a94a76a67a54f2b98b16227da20414542fd9 from ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js (72 bytes) download


translate.google.com/a/element.js?cb=googleTranslateElementInit benign
[nothing detected] (script) translate.google.com/a/element.js?cb=googleTranslateElementInit
     status: (referer=www.neverclicks.com/)saved 1718 bytes c999ba31e27f138a10d0b294d40436026b416409
     info: [decodingLevel=0] found JavaScript
     error: undefined variable document.body.parentNode
     error: line:1: SyntaxError: missing ; before statement:
          error: line:1: var document.body.parentNode = 1;
          error: line:1: ....^
     info: [element] URL=translate.google.com/a/undefined
     info: [decodingLevel=1] found JavaScript
     file: c999ba31e27f138a10d0b294d40436026b416409: 1718 bytes
     file: 4b29dc380cb3e509a94b9308d7ead4e8e526058b: 158 bytes

Decoded Files
c999/ba31e27f138a10d0b294d40436026b416409 from translate.google.com/a/element.js?cb=googleTranslateElementInit (1718 bytes) download

4b29/dc380cb3e509a94b9308d7ead4e8e526058b from translate.google.com/a/element.js?cb=googleTranslateElementInit (158 bytes) download


illiweb.com/rsc/16/frm/jquery/ticker/ticker.js benign
[nothing detected] (script) illiweb.com/rsc/16/frm/jquery/ticker/ticker.js
     status: (referer=www.neverclicks.com/)saved 7173 bytes 9e493d1dbe9f231e69f1b160e3b50d2be6cd8a1e
     info: [decodingLevel=0] found JavaScript
     file: 9e493d1dbe9f231e69f1b160e3b50d2be6cd8a1e: 7173 bytes

Decoded Files
9e49/3d1dbe9f231e69f1b160e3b50d2be6cd8a1e from illiweb.com/rsc/16/frm/jquery/ticker/ticker.js (7173 bytes) download