What is the reason for code obfuscation?

General discussion about the NoScript extension for Firefox
Post Reply
luntrus
Senior Member
Posts: 237
Joined: Sat Mar 21, 2009 6:29 pm

What is the reason for code obfuscation?

Post by luntrus »

Hi Giorgio Maone,

A lot of code to-day is so called obfuscated code. Sometimes coders do that to prevent others to hack their code, sometimes malcoders do it to make it harder for website owners etc. to see through their schemes. Could this be a reason to ban obfuscated code altogether, because if you have something to hide?!?
Example of obfuscated code, apparently not suspicious:

Code: Select all

//MooTools, My Object Oriented Javascript Tools. Copyright (c) 2006 Valerio Proietti, <hXtp://mad4milk.net>, MIT Style License.

eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('o 99={9a:\'1.11\'};k $4c(T){h(T!=6t)};k $r(T){m(!$4c(T))h R;m(T.3y)h\'F\';o r=4o T;m(r==\'2y\'&&T.98){1M(T.5o){W 1:h\'F\';W 3:h(/\\S/).1U(T.6C)?\'97\':\'94\'}}m(r==\'2y\'||r==\'k\'){1M(T.6x){W 1O:h\'1d\';W 61:h\'5w\';W 1r:h\'5C\'}m(4o T.O==\'4M\'){m(T.2o)h\'95\';m(T.77)h\'X\'}}h r};k $3G(){o 42={};B(o i=0;i<X.O;i++){B(o u 15 X[i]){o ap=X[i][u];o 4W=42[u];m(4W&&$r(ap)==\'2y\'&&$r(4W)==\'2y\')42[u]=$3G(4W,ap);12 42[u]=ap}}h 42};o $N=k(){o 17=X;m(!17[1])17=[c,17[0]];B(o u 15 17[1])17[0][u]=17[1][u];h 17[0]};o $3B=k(){B(o i=0,l=X.O;i<l;i++){X[i].N=k(1q){B(o 1w 15 1q){m(!c.1m[1w])c.1m[1w]=1q[1w];m(!c[1w])c[1w]=$3B.4g(1w)}}}};$3B.4g=k(1w){h k(Q){h c.1m[1w].3E(Q,1O.1m.6R.24(X,1))}};$3B(5f,1O,51,6J);k $2Q(T){h!!(T||T===0)};k $3J(T,6v){h $4c(T)?T:6v};k $54(3m,2b){h 1b.9h(1b.54()*(2b-3m+1)+3m)};k $2C(){h 14 9i().9g()};k $5N(1E){9f(1E);9d(1E);h 1n};o 3g=k(T){T=T||{};T.N=$N;h T};o 9e=14 3g(M);o 93=14 3g(P);P.6s=P.2a(\'6s\')[0];M.2R=!!(P.89);m(M.8R)M.1V=M[M.8S?\'8Q\':\'6q\']=18;12 m(P.75&&!P.8P&&!8M.8N)M.3p=M[M.2R?\'8O\':\'4H\']=18;12 m(P.8T!=1n)M.57=18;M.8U=M.3p;90.N=$N;m(4o 3Y==\'6t\'){o 3Y=k(){};m(M.3p)P.7c("91");3Y.1m=(M.3p)?M["[[8Z.1m]]"]:{}}3Y.1m.3y=k(){};m(M.6q)5q{P.8Y("8V",R,18)}5t(e){};o 1r=k(2t){o 48=k(){h(X[0]!==1n&&c.1H&&$r(c.1H)==\'k\')?c.1H.3E(c,X):c};$N(48,c);48.1m=2t;48.6x=1r;h 48};1r.2k=k(){};1r.1m={N:k(2t){o 4k=14 c(1n);B(o u 15 2t){o 72=4k[u];4k[u]=1r.76(72,2t[u])}h 14 1r(4k)},7w:k(){B(o i=0,l=X.O;i<l;i++)$N(c.1m,X[i])}};1r.76=k(28,1D){m(28&&28!=1D){o r=$r(1D);m(r!=$r(28))h 1D;1M(r){W\'k\':o 5x=k(){c.1h=X.77.1h;h 1D.3E(c,X)};5x.1h=28;h 5x;W\'2y\':h $3G(28,1D)}}h 1D};o 7v=14 1r({8X:k(J){c.3l=c.3l||[];c.3l.1a(J);h c},7S:k(){m(c.3l&&c.3l.O)c.3l.6M().1J(10,c)},9j:k(){c.3l=[]}});o 2l=14 1r({1Q:k(r,J){m(J!=1r.2k){c.$U=c.$U||{};c.$U[r]=c.$U[r]||[];c.$U[r].3H(J)}h c},2h:k(r,17,1J){m(c.$U&&c.$U[r]){c.$U[r].1o(k(J){J.29({\'Q\':c,\'1J\':1J,\'X\':17})()},c)}h c},4O:k(r,J){m(c.$U&&c.$U[r])c.$U[r].36(J);h c}});o 7O=14 1r({4U:k(){c.t=$3G.3E(1n,[c.t].N(X));m(c.1Q){B(o 2H 15 c.t){m($r(c.t[2H]==\'k\')&&(/^5m[A-Z]/).1U(2H))c.1Q(2H,c.t[2H])}}h c}});1O.N({4m:k(J,Q){B(o i=0,j=c.O;i<j;i++)J.24(Q,c[i],i,c)},2v:k(J,Q){o 3v=[];B(o i=0,j=c.O;i<j;i++){m(J.24(Q,c[i],i,c))3v.1a(c[i])}h 3v},2c:k(J,Q){o 3v=[];B(o i=0,j=c.O;i<j;i++)3v[i]=J.24(Q,c[i],i,c);h 3v},4X:k(J,Q){B(o i=0,j=c.O;i<j;i++){m(!J.24(Q,c[i],i,c))h R}h 18},9k:k(J,Q){B(o i=0,j=c.O;i<j;i++){m(J.24(Q,c[i],i,c))h 18}h R},2T:k(2o,L){o 2E=c.O;B(o i=(L<0)?1b.2b(0,2E+L):L||0;i<2E;i++){m(c[i]===2o)h i}h-1},6I:k(1p,O){1p=1p||0;m(1p<0)1p=c.O+1p;O=O||(c.O-1p);o 5y=[];B(o i=0;i<O;i++)5y[i]=c[1p++];h 5y},36:k(2o){o i=0;o 2E=c.O;5X(i<2E){m(c[i]===2o){c.4L(i,1);2E--}12{i++}}h c},19:k(2o,L){h c.2T(2o,L)!=-1},9I:k(1v){o T={},O=1b.3m(c.O,1v.O);B(o i=0;i<O;i++)T[1v[i]]=c[i];h T},N:k(1d){B(o i=0,j=1d.O;i<j;i++)c.1a(1d[i]);h c},3G:k(1d){B(o i=0,l=1d.O;i<l;i++)c.3H(1d[i]);h c},3H:k(2o){m(!c.19(2o))c.1a(2o);h c},9H:k(){h c[$54(0,c.O-1)]||1n},73:k(){h c[c.O-1]||1n}});1O.1m.1o=1O.1m.4m;1O.1o=1O.4m;k $A(1d){h 1O.6I(1d)};k $1o(2O,J,Q){m(2O&&4o 2O.O==\'4M\'&&$r(2O)!=\'2y\'){1O.4m(2O,J,Q)}12{B(o 1u 15 2O)J.24(Q||2O,2O[1u],1u)}};1O.1m.1U=1O.1m.19;51.N({1U:k(4q,1Z){h(($r(4q)==\'2s\')?14 61(4q,1Z):4q).1U(c)},2N:k(){h 3R(c,10)},6X:k(){h 3T(c)},5Q:k(){h c.2M(/-\\D/g,k(2r){h 2r.5e(1).6S()})},6m:k(){h c.2M(/\\w[A-Z]/g,k(2r){h(2r.5e(0)+\'-\'+2r.5e(1).47())})},6W:k(){h c.2M(/\\b[a-z]/g,k(2r){h 2r.6S()})},5v:k(){h c.2M(/^\\s+|\\s+$/g,\'\')},66:k(){h c.2M(/\\s{2,}/g,\' \').5v()},4y:k(1d){o 25=c.2r(/\\d{1,3}/g);h(25)?25.4y(1d):R},4V:k(1d){o 3n=c.2r(/^#?(\\w{1,2})(\\w{1,2})(\\w{1,2})$/);h(3n)?3n.6R(1).4V(1d):R},19:k(2s,s){h(s)?(s+c+s).2T(s+2s+s)>-1:c.2T(2s)>-1},9R:k(){h c.2M(/([.*+?^${}()|[\\]\\/\\\\])/g,\'\\\\$1\')}});1O.N({4y:k(1d){m(c.O<3)h R;m(c.O==4&&c[3]==0&&!1d)h\'9P\';o 3n=[];B(o i=0;i<3;i++){o 3A=(c[i]-0).9O(16);3n.1a((3A.O==1)?\'0\'+3A:3A)}h 1d?3n:\'#\'+3n.1R(\'\')},4V:k(1d){m(c.O!=3)h R;o 25=[];B(o i=0;i<3;i++){25.1a(3R((c[i].O==1)?c[i]+c[i]:c[i],16))}h 1d?25:\'25(\'+25.1R(\',\')+\')\'}});5f.N({29:k(t){o J=c;t=$3G({\'Q\':J,\'C\':R,\'X\':1n,\'1J\':R,\'30\':R,\'4n\':R},t);m($2Q(t.X)&&$r(t.X)!=\'1d\')t.X=[t.X];h k(C){o 17;m(t.C){C=C||M.C;17=[(t.C===18)?C:14 t.C(C)];m(t.X)17.N(t.X)}12 17=t.X||X;o 2J=k(){h J.3E($3J(t.Q,J),17)};m(t.1J)h 9C(2J,t.1J);m(t.30)h 9B(2J,t.30);m(t.4n)5q{h 2J()}5t(9q){h R};h 2J()}},9r:k(17,Q){h c.29({\'X\':17,\'Q\':Q})},4n:k(17,Q){h c.29({\'X\':17,\'Q\':Q,\'4n\':18})()},Q:k(Q,17){h c.29({\'Q\':Q,\'X\':17})},9o:k(Q,17){h c.29({\'Q\':Q,\'C\':18,\'X\':17})},1J:k(1J,Q,17){h c.29({\'1J\':1J,\'Q\':Q,\'X\':17})()},30:k(6E,Q,17){h c.29({\'30\':6E,\'Q\':Q,\'X\':17})()}});6J.N({2N:k(){h 3R(c)},6X:k(){h 3T(c)},7I:k(3m,2b){h 1b.3m(2b,1b.2b(3m,c))},3t:k(45){45=1b.3j(10,45||0);h 1b.3t(c*45)/45},9s:k(J){B(o i=0;i<c;i++)J(i)}});o H=14 1r({1H:k(q,1q){m($r(q)==\'2s\'){m(M.1V&&1q&&(1q.1u||1q.r)){o 1u=(1q.1u)?\' 1u="\'+1q.1u+\'"\':\'\';o r=(1q.r)?\' r="\'+1q.r+\'"\':\'\';5r 1q.1u;5r 1q.r;q=\'<\'+q+1u+r+\'>\'}q=P.7c(q)}q=$(q);h(!1q||!q)?q:q.2m(1q)}});o 1z=14 1r({1H:k(G){h(G)?$N(G,c):c}});1z.N=k(1q){B(o 1w 15 1q){c.1m[1w]=1q[1w];c[1w]=$3B.4g(1w)}};k $(q){m(!q)h 1n;m(q.3y)h 1K.3s(q);m([M,P].19(q))h q;o r=$r(q);m(r==\'2s\'){q=P.4x(q);r=(q)?\'F\':R}m(r!=\'F\')h 1n;m(q.3y)h 1K.3s(q);m([\'2y\',\'9z\'].19(q.4E.47()))h q;$N(q,H.1m);q.3y=k(){};h 1K.3s(q)};P.4i=P.2a;k $$(){o G=[];B(o i=0,j=X.O;i<j;i++){o 1k=X[i];1M($r(1k)){W\'F\':G.1a(1k);W\'9A\':1l;W R:1l;W\'2s\':1k=P.4i(1k,18);4h:G.N(1k)}}h $$.3O(G)};$$.3O=k(1d){o G=[];B(o i=0,l=1d.O;i<l;i++){m(1d[i].$4b)6P;o F=$(1d[i]);m(F&&!F.$4b){F.$4b=18;G.1a(F)}}B(o n=0,d=G.O;n<d;n++)G[n].$4b=1n;h 14 1z(G)};1z.4J=k(u){h k(){o 17=X;o 1c=[];o G=18;B(o i=0,j=c.O,2J;i<j;i++){2J=c[i][u].3E(c[i],17);m($r(2J)!=\'F\')G=R;1c.1a(2J)};h(G)?$$.3O(1c):1c}};H.N=k(2t){B(o u 15 2t){3Y.1m[u]=2t[u];H.1m[u]=2t[u];H[u]=$3B.4g(u);o 6l=(1O.1m[u])?u+\'1z\':u;1z.1m[6l]=1z.4J(u)}};H.N({2m:k(1q){B(o 1w 15 1q){o 3h=1q[1w];1M(1w){W\'7D\':c.4w(3h);1l;W\'U\':m(c.5E)c.5E(3h);1l;W\'2t\':c.71(3h);1l;4h:c.4d(1w,3h)}}h c},2z:k(q,6n){q=$(q);1M(6n){W\'6B\':q.2n.5Z(c,q);1l;W\'6z\':o 3W=q.7g();m(!3W)q.2n.5O(c);12 q.2n.5Z(c,3W);1l;W\'21\':o 5L=q.60;m(5L){q.5Z(c,5L);1l}4h:q.5O(c)}h c},7k:k(q){h c.2z(q,\'6B\')},5J:k(q){h c.2z(q,\'6z\')},8m:k(q){h c.2z(q,\'3N\')},8q:k(q){h c.2z(q,\'21\')},7B:k(){o G=[];$1o(X,k(3c){G=G.5G(3c)});$$(G).2z(c);h c},36:k(){h c.2n.6Y(c)},8i:k(6A){o q=$(c.8c(6A!==R));m(!q.$U)h q;q.$U={};B(o r 15 c.$U)q.$U[r]={\'1v\':$A(c.$U[r].1v),\'1s\':$A(c.$U[r].1s)};h q.4R()},8f:k(q){q=$(q);c.2n.8h(q,c);h q},6Z:k(2e){c.5O(P.8p(2e));h c},6b:k(1i){h c.1i.19(1i,\' \')},6o:k(1i){m(!c.6b(1i))c.1i=(c.1i+\' \'+1i).66();h c},6w:k(1i){c.1i=c.1i.2M(14 61(\'(^|\\\\s)\'+1i+\'(?:\\\\s|$)\'),\'$1\').66();h c},8E:k(1i){h c.6b(1i)?c.6w(1i):c.6o(1i)},2i:k(u,I){1M(u){W\'1A\':h c.6h(3T(I));W\'8J\':u=(M.1V)?\'8C\':\'8v\'}u=u.5Q();1M($r(I)){W\'4M\':m(![\'8t\',\'6u\'].19(u))I+=\'3S\';1l;W\'1d\':I=\'25(\'+I.1R(\',\')+\')\'}c.1j[u]=I;h c},4w:k(2S){1M($r(2S)){W\'2y\':H.4Z(c,\'2i\',2S);1l;W\'2s\':c.1j.5S=2S}h c},6h:k(1A){m(1A==0){m(c.1j.4S!="3L")c.1j.4S="3L"}12{m(c.1j.4S!="6e")c.1j.4S="6e"}m(!c.4T||!c.4T.8A)c.1j.6u=1;m(M.1V)c.1j.2v=(1A==1)?\'\':"8y(1A="+1A*8F+")";c.1j.1A=c.$2Y.1A=1A;h c},26:k(u){u=u.5Q();o 1g=c.1j[u];m(!$2Q(1g)){m(u==\'1A\')h c.$2Y.1A;1g=[];B(o 1j 15 H.2V){m(u==1j){H.2V[1j].1o(k(s){o 1j=c.26(s);1g.1a(3R(1j)?1j:\'6L\')},c);m(u==\'1W\'){o 4X=1g.4X(k(3A){h(3A==1g[0])});h(4X)?1g[0]:R}h 1g.1R(\' \')}}m(u.19(\'1W\')){m(H.2V.1W.19(u)){h[\'6K\',\'5M\',\'5R\'].2c(k(p){h c.26(u+p)},c).1R(\' \')}12 m(H.6V.19(u)){h[\'6H\',\'6D\',\'6F\',\'6N\'].2c(k(p){h c.26(\'1W\'+p+u.2M(\'1W\',\'\'))},c).1R(\' \')}}m(P.6k)1g=P.6k.8H(c,1n).8G(u.6m());12 m(c.4T)1g=c.4T[u]}m(M.1V)1g=H.7a(u,1g,c);m(1g&&u.1U(/4Y/i)&&1g.19(\'25\')){h 1g.4K(\'25\').4L(1,4).2c(k(4Y){h 4Y.4y()}).1R(\' \')}h 1g},7E:k(){h H.67(c,\'26\',X)},3X:k(4e,1p){4e+=\'8r\';o q=(1p)?c[1p]:c[4e];5X(q&&$r(q)!=\'F\')q=q[4e];h $(q)},8n:k(){h c.3X(\'28\')},7g:k(){h c.3X(\'3W\')},8o:k(){h c.3X(\'3W\',\'60\')},73:k(){h c.3X(\'28\',\'8I\')},8B:k(){h $(c.2n)},8z:k(){h $$(c.75)},5A:k(q){h!!$A(c.2a(\'*\')).19(q)},4N:k(u){o 1t=H.4s[u];m(1t)h c[1t];o 5U=H.6O[u]||0;m(!M.1V||5U)h c.8w(u,5U);o 5W=c.8d[u];h(5W)?5W.6C:1n},8k:k(u){o 1t=H.4s[u];m(1t)c[1t]=\'\';12 c.8l(u);h c},9y:k(){h H.67(c,\'4N\',X)},4d:k(u,I){o 1t=H.4s[u];m(1t)c[1t]=I;12 c.9V(u,I);h c},71:k(2S){h H.4Z(c,\'4d\',2S)},79:k(){c.7e=$A(X).1R(\'\');h c},b7:k(2e){o 2w=c.3r();m([\'1j\',\'3F\'].19(2w)){m(M.1V){m(2w==\'1j\')c.70.5S=2e;12 m(2w==\'3F\')c.4d(\'2e\',2e);h c}12{c.6Y(c.60);h c.6Z(2e)}}c[$4c(c.5K)?\'5K\':\'78\']=2e;h c},b5:k(){o 2w=c.3r();m([\'1j\',\'3F\'].19(2w)){m(M.1V){m(2w==\'1j\')h c.70.5S;12 m(2w==\'3F\')h c.4N(\'2e\')}12{h c.7e}}h($3J(c.5K,c.78))},3r:k(){h c.4E.47()},2k:k(){1K.4p(c.2a(\'*\'));h c.79(\'\')}});H.7a=k(u,1g,F){m($2Q(3R(1g)))h 1g;m([\'2W\',\'2p\'].19(u)){o 1s=(u==\'2p\')?[\'2j\',\'3Q\']:[\'21\',\'3N\'];o 34=0;1s.1o(k(I){34+=F.26(\'1W-\'+I+\'-2p\').2N()+F.26(\'3i-\'+I).2N()});h F[\'2A\'+u.6W()]-34+\'3S\'}12 m(u.1U(/1W(.+)6K|2d|3i/)){h\'6L\'}h 1g};H.2V={\'1W\':[],\'3i\':[],\'2d\':[]};[\'6H\',\'6D\',\'6F\',\'6N\'].1o(k(6U){B(o 1j 15 H.2V)H.2V[1j].1a(1j+6U)});H.6V=[\'aU\',\'aV\',\'aT\'];H.67=k(q,3k,1v){o 1g={};$1o(1v,k(23){1g[23]=q[3k](23)});h 1g};H.4Z=k(q,3k,69){B(o 23 15 69)q[3k](23,69[23]);h q};H.4s=14 3g({\'5C\':\'1i\',\'B\':\'aX\',\'b2\':\'b1\',\'b0\':\'aZ\',\'bh\':\'bB\',\'bA\':\'bz\',\'bD\':\'bx\',\'by\':\'bC\',\'bF\':\'bH\',\'I\':\'I\',\'5i\':\'5i\',\'52\':\'52\',\'56\':\'56\',\'55\':\'55\'});H.6O={\'bE\':2,\'4u\':2};H.2f={4r:{3f:k(r,J){m(c.5u)c.5u(r,J,R);12 c.bv(\'5m\'+r,J);h c},6j:k(r,J){m(c.6Q)c.6Q(r,J,R);12 c.bw(\'5m\'+r,J);h c}}};M.N(H.2f.4r);P.N(H.2f.4r);H.N(H.2f.4r);o 1K={G:[],3s:k(q){m(!q.$2Y){1K.G.1a(q);q.$2Y={\'1A\':1}}h q},4p:k(G){B(o i=0,j=G.O,q;i<j;i++){m(!(q=G[i])||!q.$2Y)6P;m(q.$U)q.2h(\'4p\').4R();B(o p 15 q.$2Y)q.$2Y[p]=1n;B(o d 15 H.1m)q[d]=1n;1K.G[1K.G.2T(q)]=1n;q.3y=q.$2Y=q=1n}1K.G.36(1n)},2k:k(){1K.3s(M);1K.3s(P);1K.4p(1K.G)}};M.3f(\'74\',k(){M.3f(\'5b\',1K.2k);m(M.1V)M.3f(\'5b\',bq)});o 1X=14 1r({1H:k(C){m(C&&C.$6T)h C;c.$6T=18;C=C||M.C;c.C=C;c.r=C.r;c.2B=C.2B||C.br;m(c.2B.5o==3)c.2B=c.2B.2n;c.6M=C.aY;c.aO=C.ac;c.aP=C.ab;c.a9=C.aa;m([\'58\',\'3w\'].19(c.r)){c.ae=(C.6G)?C.6G/ak:-(C.aj||0)/3}12 m(c.r.19(\'23\')){c.4A=C.7d||C.ai;B(o 1u 15 1X.1v){m(1X.1v[1u]==c.4A){c.23=1u;1l}}m(c.r==\'7h\'){o 4v=c.4A-ag;m(4v>0&&4v<13)c.23=\'f\'+4v}c.23=c.23||51.9X(c.4A).47()}12 m(c.r.1U(/(5V|9W|9U)/)){c.a1={\'x\':C.5z||C.7b+P.1Y.3V,\'y\':C.5B||C.7f+P.1Y.3U};c.a6={\'x\':C.5z?C.5z-M.7R:C.7b,\'y\':C.5B?C.5B-M.7W:C.7f};c.a3=(C.7d==3)||(C.al==2);1M(c.r){W\'5g\':c.1C=C.1C||C.am;1l;W\'5h\':c.1C=C.1C||C.7q}c.6f()}h c},2I:k(){h c.4a().4j()},4a:k(){m(c.C.4a)c.C.4a();12 c.C.aG=18;h c},4j:k(){m(c.C.4j)c.C.4j();12 c.C.aE=R;h c}});1X.4f={1C:k(){m(c.1C&&c.1C.5o==3)c.1C=c.1C.2n},6g:k(){5q{1X.4f.1C.24(c)}5t(e){c.1C=c.2B}}};1X.1m.6f=(M.57)?1X.4f.6g:1X.4f.1C;1X.1v=14 3g({\'aK\':13,\'aA\':38,\'ar\':40,\'2j\':37,\'3Q\':39,\'au\':27,\'ax\':32,\'aw\':8,\'av\':9,\'5r\':46});H.2f.2l={1Q:k(r,J){c.$U=c.$U||{};c.$U[r]=c.$U[r]||{\'1v\':[],\'1s\':[]};m(c.$U[r].1v.19(J))h c;c.$U[r].1v.1a(J);o 4F=r;o 1I=H.2l[r];m(1I){m(1I.5I)1I.5I.24(c,J);m(1I.2c)J=1I.2c;m(1I.r)4F=1I.r}m(!c.5u)J=J.29({\'Q\':c,\'C\':18});c.$U[r].1s.1a(J);h(H.5j.19(4F))?c.3f(4F,J):c},4O:k(r,J){m(!c.$U||!c.$U[r])h c;o 1B=c.$U[r].1v.2T(J);m(1B==-1)h c;o 23=c.$U[r].1v.4L(1B,1)[0];o I=c.$U[r].1s.4L(1B,1)[0];o 1I=H.2l[r];m(1I){m(1I.36)1I.36.24(c,J);m(1I.r)r=1I.r}h(H.5j.19(r))?c.6j(r,I):c},5E:k(2S){h H.4Z(c,\'1Q\',2S)},4R:k(r){m(!c.$U)h c;m(!r){B(o 4I 15 c.$U)c.4R(4I);c.$U=1n}12 m(c.$U[r]){c.$U[r].1v.1o(k(J){c.4O(r,J)},c);c.$U[r]=1n}h c},2h:k(r,17,1J){m(c.$U&&c.$U[r]){c.$U[r].1v.1o(k(J){J.29({\'Q\':c,\'1J\':1J,\'X\':17})()},c)}h c},6y:k(L,r){m(!L.$U)h c;m(!r){B(o 4I 15 L.$U)c.6y(L,4I)}12 m(L.$U[r]){L.$U[r].1v.1o(k(J){c.1Q(r,J)},c)}h c}};M.N(H.2f.2l);P.N(H.2f.2l);H.N(H.2f.2l);H.2l=14 3g({\'6p\':{r:\'5g\',2c:k(C){C=14 1X(C);m(C.1C!=c&&!c.5A(C.1C))c.2h(\'6p\',C)}},\'6r\':{r:\'5h\',2c:k(C){C=14 1X(C);m(C.1C!=c&&!c.5A(C.1C))c.2h(\'6r\',C)}},\'3w\':{r:(M.57)?\'58\':\'3w\'}});H.5j=[\'5V\',\'aF\',\'a2\',\'a4\',\'3w\',\'58\',\'5g\',\'5h\',\'ah\',\'7h\',\'bs\',\'bo\',\'8b\',\'5b\',\'74\',\'bd\',\'b8\',\'b9\',\'bi\',\'87\',\'bn\',\'ad\',\'2U\',\'a8\',\'a7\',\'a0\',\'3z\'];5f.N({aH:k(Q,17){h c.29({\'Q\':Q,\'X\':17,\'C\':1X})}});1z.N({aI:k(2w){h 14 1z(c.2v(k(q){h(H.3r(q)==2w)}))},7N:k(1i,1L){o G=c.2v(k(q){h(q.1i&&q.1i.19(1i,\' \'))});h(1L)?G:14 1z(G)},7T:k(3e,1L){o G=c.2v(k(q){h(q.3e==3e)});h(1L)?G:14 1z(G)},7s:k(1u,5H,I,1L){o G=c.2v(k(q){o 1D=H.4N(q,1u);m(!1D)h R;m(!5H)h 18;1M(5H){W\'=\':h(1D==I);W\'*=\':h(1D.19(I));W\'^=\':h(1D.7U(0,I.O)==I);W\'$=\':h(1D.7U(1D.O-I.O)==I);W\'!=\':h(1D!=I);W\'~=\':h 1D.19(I,\' \')}h R});h(1L)?G:14 1z(G)}});k $E(1k,2v){h($(2v)||P).7H(1k)};k $aL(1k,2v){h($(2v)||P).4i(1k)};$$.2K={\'5w\':/^(\\w*|\\*)(?:#([\\w-]+)|\\.([\\w-]+))?(?:\\[(\\w+)(?:([!*^$]?=)["\']?([^"\'\\]]*)["\']?)?])?$/,\'2R\':{5D:k(1c,2g,V,i){o 1G=[2g.aB?\'5p:\':\'\',V[1]];m(V[2])1G.1a(\'[@3e="\',V[2],\'"]\');m(V[3])1G.1a(\'[19(5G(" ", @5C, " "), " \',V[3],\' ")]\');m(V[4]){m(V[5]&&V[6]){1M(V[5]){W\'*=\':1G.1a(\'[19(@\',V[4],\', "\',V[6],\'")]\');1l;W\'^=\':1G.1a(\'[as-aq(@\',V[4],\', "\',V[6],\'")]\');1l;W\'$=\':1G.1a(\'[an(@\',V[4],\', 2s-O(@\',V[4],\') - \',V[6].O,\' + 1) = "\',V[6],\'"]\');1l;W\'=\':1G.1a(\'[@\',V[4],\'="\',V[6],\'"]\');1l;W\'!=\':1G.1a(\'[@\',V[4],\'!="\',V[6],\'"]\')}}12{1G.1a(\'[@\',V[4],\']\')}}1c.1a(1G.1R(\'\'));h 1c},5F:k(1c,2g,1L){o G=[];o 2R=P.89(\'.//\'+1c.1R(\'//\'),2g,$$.2K.7r,ao.at,1n);B(o i=0,j=2R.az;i<j;i++)G.1a(2R.ay(i));h(1L)?G:14 1z(G.2c($))}},\'7n\':{5D:k(1c,2g,V,i){m(i==0){m(V[2]){o q=2g.4x(V[2]);m(!q||((V[1]!=\'*\')&&(H.3r(q)!=V[1])))h R;1c=[q]}12{1c=$A(2g.2a(V[1]))}}12{1c=$$.2K.2a(1c,V[1]);m(V[2])1c=1z.7T(1c,V[2],18)}m(V[3])1c=1z.7N(1c,V[3],18);m(V[4])1c=1z.7s(1c,V[4],V[5],V[6],18);h 1c},5F:k(1c,2g,1L){h(1L)?1c:$$.3O(1c)}},7r:k(7i){h(7i==\'5p\')?\'aJ://aM.aN.aD/aC/5p\':R},2a:k(2g,4E){o 5n=[];B(o i=0,j=2g.O;i<j;i++)5n.N(2g[i].2a(4E));h 5n}};$$.2K.3k=(M.2R)?\'2R\':\'7n\';H.2f.53={4z:k(1k,1L){o 1c=[];1k=1k.5v().4K(\' \');B(o i=0,j=1k.O;i<j;i++){o 7x=1k[i];o V=7x.2r($$.2K.5w);m(!V)1l;V[1]=V[1]||\'*\';o 1G=$$.2K[$$.2K.3k].5D(1c,c,V,i);m(!1G)1l;1c=1G}h $$.2K[$$.2K.3k].5F(1c,c,1L)},7H:k(1k){h $(c.4z(1k,18)[0]||R)},4i:k(1k,1L){o G=[];1k=1k.4K(\',\');B(o i=0,j=1k.O;i<j;i++)G=G.5G(c.4z(1k[i],18));h(1L)?G:$$.3O(G)}};H.N({4x:k(3e){o q=P.4x(3e);m(!q)h R;B(o 1h=q.2n;1h!=c;1h=1h.2n){m(!1h)h R}h q},a5:k(1i){h c.4z(\'.\'+1i)}});P.N(H.2f.53);H.N(H.2f.53);H.N({2X:k(){1M(c.3r()){W\'2U\':o 1s=[];$1o(c.t,k(2H){m(2H.55)1s.1a($3J(2H.I,2H.2e))});h(c.56)?1s:1s[0];W\'7C\':m(!(c.52&&[\'9Z\',\'9Y\'].19(c.r))&&![\'3L\',\'2e\',\'af\'].19(c.r))1l;W\'7A\':h c.I}h R},7M:k(){h $$(c.2a(\'7C\'),c.2a(\'2U\'),c.2a(\'7A\'))},bt:k(){o 5a=[];c.7M().1o(k(q){o 1u=q.1u;o I=q.2X();m(I===R||!1u||q.5i)h;o 59=k(3h){5a.1a(1u+\'=\'+bu(3h))};m($r(I)==\'1d\')I.1o(59);12 59(I)});h 5a.1R(\'&\')}});H.N({2Z:k(x,y){c.3V=x;c.3U=y},64:k(){h{\'3z\':{\'x\':c.3V,\'y\':c.3U},\'34\':{\'x\':c.3C,\'y\':c.3x},\'68\':{\'x\':c.4l,\'y\':c.41}}},31:k(1S){1S=1S||[];o q=c,2j=0,21=0;bp{2j+=q.bk||0;21+=q.bj||0;q=q.bl}5X(q);1S.1o(k(F){2j-=F.3V||0;21-=F.3U||0});h{\'x\':2j,\'y\':21}},bm:k(1S){h c.31(1S).y},bG:k(1S){h c.31(1S).x},aW:k(1S){o 6a=c.31(1S);o T={\'2p\':c.3C,\'2W\':c.3x,\'2j\':6a.x,\'21\':6a.y};T.3Q=T.2j+T.2p;T.3N=T.21+T.2W;h T}});H.2l.62={5I:k(J){m(M.4t){J.24(c);h}o 3I=k(){m(M.4t)h;M.4t=18;M.1E=$5N(M.1E);c.2h(\'62\')}.Q(c);m(P.4B&&M.3p){M.1E=k(){m([\'4t\',\'86\'].19(P.4B))3I()}.30(50)}12 m(P.4B&&M.1V){m(!$(\'6d\')){o 4u=(M.aR.aQ==\'aS:\')?\'://0\':\'b3:b4(0)\';P.bc(\'<3F 3e="6d" be 4u="\'+4u+\'"><\\/3F>\');$(\'6d\').bf=k(){m(c.4B==\'86\')3I()}}}12{M.3f("8b",3I);P.3f("bg",3I)}}};M.bb=k(J){h c.1Q(\'62\',J)};M.N({7X:k(){m(c.4H)h c.ba;m(c.7P)h P.4D.7V;h P.1Y.7V},82:k(){m(c.4H)h c.b6;m(c.7P)h P.4D.7Q;h P.1Y.7Q},83:k(){m(c.1V)h 1b.2b(P.1Y.3C,P.1Y.4l);m(c.3p)h P.4D.4l;h P.1Y.4l},81:k(){m(c.1V)h 1b.2b(P.1Y.3x,P.1Y.41);m(c.3p)h P.4D.41;h P.1Y.41},80:k(){h c.7R||P.1Y.3V},7Y:k(){h c.7W||P.1Y.3U},64:k(){h{\'34\':{\'x\':c.7X(),\'y\':c.82()},\'68\':{\'x\':c.83(),\'y\':c.81()},\'3z\':{\'x\':c.80(),\'y\':c.7Y()}}},31:k(){h{\'x\':0,\'y\':0}}});o Y={};Y.35=14 1r({t:{65:1r.2k,43:1r.2k,7t:1r.2k,1y:k(p){h-(1b.7u(1b.5k*p)-1)/2},5T:9T,1P:\'3S\',2F:18,88:50},1H:k(t){c.F=c.F||1n;c.4U(t);m(c.t.1H)c.t.1H.24(c)},8a:k(){o 2C=$2C();m(2C<c.2C+c.t.5T){c.84=c.t.1y((2C-c.2C)/c.t.5T);c.3b();c.3d()}12{c.2I(18);c.2m(c.K);c.2h(\'43\',c.F,10);c.7S()}},2m:k(K){c.1e=K;c.3d();h c},3b:k(){c.1e=c.3a(c.L,c.K)},3a:k(L,K){h(K-L)*c.84+L},1p:k(L,K){m(!c.t.2F)c.2I();12 m(c.1E)h c;c.L=L;c.K=K;c.87=c.K-c.L;c.2C=$2C();c.1E=c.8a.30(1b.3t(8j/c.t.88),c);c.2h(\'65\',c.F);h c},2I:k(4G){m(!c.1E)h c;c.1E=$5N(c.1E);m(!4G)c.2h(\'7t\',c.F);h c},1I:k(L,K){h c.1p(L,K)},8e:k(4G){h c.2I(4G)}});Y.35.7w(14 7v,14 2l,14 7O);Y.2q={2U:k(u,K){m(u.1U(/4Y/i))h c.5R;o r=$r(K);m((r==\'1d\')||(r==\'2s\'&&K.19(\' \')))h c.4J;h c.7p},22:k(q,u,3D){m(!3D.1a)3D=[3D];o L=3D[0],K=3D[1];m(!$2Q(K)){K=L;L=q.26(u)}o 1f=c.2U(u,K);h{\'L\':1f.22(L),\'K\':1f.22(K),\'1f\':1f}}};Y.2q.7p={22:k(I){h 3T(I)},3q:k(L,K,1T){h 1T.3a(L,K)},2X:k(I,1P,u){m(1P==\'3S\'&&u!=\'1A\')I=1b.3t(I);h I+1P}};Y.2q.4J={22:k(I){h I.1a?I:I.4K(\' \').2c(k(v){h 3T(v)})},3q:k(L,K,1T){o 1e=[];B(o i=0;i<L.O;i++)1e[i]=1T.3a(L[i],K[i]);h 1e},2X:k(I,1P,u){m(1P==\'3S\'&&u!=\'1A\')I=I.2c(1b.3t);h I.1R(1P+\' \')+1P}};Y.2q.5R={22:k(I){h I.1a?I:I.4V(18)},3q:k(L,K,1T){o 1e=[];B(o i=0;i<L.O;i++)1e[i]=1b.3t(1T.3a(L[i],K[i]));h 1e},2X:k(I){h\'25(\'+I.1R(\',\')+\')\'}};Y.5M=Y.35.N({1H:k(q,u,t){c.F=$(q);c.u=u;c.1h(t)},3M:k(){h c.2m(0)},3b:k(){c.1e=c.1f.3q(c.L,c.K,c)},2m:k(K){c.1f=Y.2q.2U(c.u,K);h c.1h(c.1f.22(K))},1p:k(L,K){m(c.1E&&c.t.2F)h c;o 1x=Y.2q.22(c.F,c.u,[L,K]);c.1f=1x.1f;h c.1h(1x.L,1x.K)},3d:k(){c.F.2i(c.u,c.1f.2X(c.1e,c.t.1P,c.u))}});H.N({8u:k(u,t){h 14 Y.5M(c,u,t)}});Y.2V=Y.35.N({1H:k(q,t){c.F=$(q);c.1h(t)},3b:k(){B(o p 15 c.L)c.1e[p]=c.1f[p].3q(c.L[p],c.K[p],c)},2m:k(K){o 1x={};c.1f={};B(o p 15 K){c.1f[p]=Y.2q.2U(p,K[p]);1x[p]=c.1f[p].22(K[p])}h c.1h(1x)},1p:k(T){m(c.1E&&c.t.2F)h c;c.1e={};c.1f={};o L={},K={};B(o p 15 T){o 1x=Y.2q.22(c.F,p,T[p]);L[p]=1x.L;K[p]=1x.K;c.1f[p]=1x.1f}h c.1h(L,K)},3d:k(){B(o p 15 c.1e)c.F.2i(p,c.1f[p].2X(c.1e[p],c.t.1P,p))}});H.N({2D:k(t){h 14 Y.2V(c,t)}});Y.1z=Y.35.N({1H:k(G,t){c.G=$$(G);c.1h(t)},3b:k(){B(o i 15 c.L){o 3P=c.L[i],2P=c.K[i],2L=c.1f[i],3K=c.1e[i]={};B(o p 15 3P)3K[p]=2L[p].3q(3P[p],2P[p],c)}},2m:k(K){o 1x={};c.1f={};B(o i 15 K){o 2P=K[i],2L=c.1f[i]={},7l=1x[i]={};B(o p 15 2P){2L[p]=Y.2q.2U(p,2P[p]);7l[p]=2L[p].22(2P[p])}}h c.1h(1x)},1p:k(T){m(c.1E&&c.t.2F)h c;c.1e={};c.1f={};o L={},K={};B(o i 15 T){o 63=T[i],3P=L[i]={},2P=K[i]={},2L=c.1f[i]={};B(o p 15 63){o 1x=Y.2q.22(c.G[i],p,63[p]);3P[p]=1x.L;2P[p]=1x.K;2L[p]=1x.1f}}h c.1h(L,K)},3d:k(){B(o i 15 c.1e){o 3K=c.1e[i],2L=c.1f[i];B(o p 15 3K)c.G[i].2i(p,2L[p].2X(3K[p],c.t.1P,p))}}});Y.8x=Y.35.N({t:{1S:[],2A:{\'x\':0,\'y\':0},7m:18},1H:k(F,t){c.1e=[];c.F=$(F);c.6c={\'2I\':c.2I.Q(c,R)};c.1h(t);m(c.t.7m){c.1Q(\'65\',k(){P.1Q(\'3w\',c.6c.2I)}.Q(c));c.1Q(\'43\',k(){P.4O(\'3w\',c.6c.2I)}.Q(c))}},3b:k(){B(o i=0;i<2;i++)c.1e[i]=c.3a(c.L[i],c.K[i])},2Z:k(x,y){m(c.1E&&c.t.2F)h c;o q=c.F.64();o 1s={\'x\':x,\'y\':y};B(o z 15 q.34){o 2b=q.68[z]-q.34[z];m($2Q(1s[z]))1s[z]=($r(1s[z])==\'4M\')?1s[z].7I(0,2b):2b;12 1s[z]=q.3z[z];1s[z]+=c.t.2A[z]}h c.1p([q.3z.x,q.3z.y],[1s.x,1s.y])},8D:k(){h c.2Z(R,0)},8s:k(){h c.2Z(R,\'7L\')},8K:k(){h c.2Z(0,R)},8g:k(){h c.2Z(\'7L\',R)},7q:k(q){o 1h=c.F.31(c.t.1S);o 2B=$(q).31(c.t.1S);h c.2Z(2B.x-1h.x,2B.y-1h.y)},3d:k(){c.F.2Z(c.1e[0],c.1e[1])}});Y.9S=Y.35.N({t:{1F:\'7z\'},1H:k(q,t){c.F=$(q);c.3o=14 H(\'9w\',{\'7D\':$N(c.F.7E(\'2d\'),{\'85\':\'3L\'})}).5J(c.F).7B(c.F);c.F.2i(\'2d\',0);c.4U(t);c.1e=[];c.1h(c.t);c.44=18;c.1Q(\'43\',k(){c.44=(c.1e[0]===0)});m(M.4H)c.1Q(\'43\',k(){m(c.44)c.F.36().2z(c.3o)})},3b:k(){B(o i=0;i<2;i++)c.1e[i]=c.3a(c.L[i],c.K[i])},7z:k(){c.2d=\'2d-21\';c.3Z=\'2W\';c.2A=c.F.3x},9u:k(){c.2d=\'2d-2j\';c.3Z=\'2p\';c.2A=c.F.3C},7F:k(1F){c[1F||c.t.1F]();h c.1p([c.F.26(c.2d).2N(),c.3o.26(c.3Z).2N()],[0,c.2A])},7G:k(1F){c[1F||c.t.1F]();h c.1p([c.F.26(c.2d).2N(),c.3o.26(c.3Z).2N()],[-c.2A,0])},3M:k(1F){c[1F||c.t.1F]();c.44=R;h c.2m([-c.2A,0])},3u:k(1F){c[1F||c.t.1F]();c.44=18;h c.2m([0,c.2A])},9x:k(1F){m(c.3o.3x==0||c.3o.3C==0)h c.7F(1F);h c.7G(1F)},3d:k(){c.F.2i(c.2d,c.1e[0]+c.t.1P);c.3o.2i(c.3Z,c.1e[1]+c.t.1P)}});Y.5d=k(1y,1Z){1Z=1Z||[];m($r(1Z)!=\'1d\')1Z=[1Z];h $N(1y,{8L:k(1B){h 1y(1B,1Z)},9t:k(1B){h 1-1y(1-1B,1Z)},9n:k(1B){h(1B<=0.5)?1y(2*1B,1Z)/2:(2-1y(2*(1-1B),1Z))/2}})};Y.2u=14 3g({9m:k(p){h p}});Y.2u.N=k(5P){B(o 1y 15 5P){Y.2u[1y]=14 Y.5d(5P[1y]);Y.2u.5Y(1y)}};Y.2u.5Y=k(1y){[\'9l\',\'9p\',\'9N\'].1o(k(5c){Y.2u[1y.47()+5c]=Y.2u[1y][\'9M\'+5c]})};Y.2u.N({9Q:k(p,x){h 1b.3j(p,x[0]||6)},9L:k(p){h 1b.3j(2,8*(p-1))},9K:k(p){h 1-1b.7j(1b.9F(p))},9E:k(p){h 1-1b.7j((1-p)*1b.5k/2)},9D:k(p,x){x=x[0]||1.9G;h 1b.3j(p,2)*((x+1)*p-x)},9J:k(p){o I;B(o a=0,b=1;1;a+=b,b/=2){m(p>=(7-4*a)/11){I=-1b.3j((11-6*a-11*p)/4,2)+b*b;1l}}h I},8W:k(p,x){h 1b.3j(2,10*--p)*1b.7u(20*p*1b.5k*(x[0]||1)/3)}});[\'92\',\'9c\',\'9b\',\'96\'].1o(k(1y,i){Y.2u[1y]=14 Y.5d(k(p){h 1b.3j(p,[i+2])});Y.2u.5Y(1y)});o 5l=Y.1z.N({t:{5s:1r.2k,6i:1r.2k,2G:0,3u:R,2W:18,2p:R,1A:18,4Q:R,49:R,2F:R,4P:R},1H:k(){o t,1N,G,33;$1o(X,k(3c,i){1M($r(3c)){W\'2y\':t=3c;1l;W\'F\':33=$(3c);1l;4h:o 1G=$$(3c);m(!1N)1N=1G;12 G=1G}});c.1N=1N||[];c.G=G||[];c.33=$(33);c.4U(t);c.28=-1;m(c.t.4P)c.t.2F=18;m($2Q(c.t.3u)){c.t.2G=R;c.28=c.t.3u}m(c.t.1p){c.t.2G=R;c.t.3u=R}c.2D={};m(c.t.1A)c.2D.1A=\'7K\';m(c.t.2p)c.2D.2p=c.t.49?\'7J\':\'3C\';m(c.t.2W)c.2D.2W=c.t.4Q?\'7y\':\'41\';B(o i=0,l=c.1N.O;i<l;i++)c.7o(c.1N[i],c.G[i]);c.G.1o(k(q,i){m(c.t.3u===i){c.2h(\'5s\',[c.1N[i],q])}12{B(o 1T 15 c.2D)q.2i(1T,0)}},c);c.1h(c.G);m($2Q(c.t.2G))c.2G(c.t.2G)},7o:k(2x,F,1B){2x=$(2x);F=$(F);o 1U=c.1N.19(2x);o 2E=c.1N.O;c.1N.3H(2x);c.G.3H(F);m(2E&&(!1U||1B)){1B=$3J(1B,2E-1);2x.7k(c.1N[1B]);F.5J(2x)}12 m(c.33&&!1U){2x.2z(c.33);F.2z(c.33)}o 7Z=c.1N.2T(2x);2x.1Q(\'5V\',c.2G.Q(c,7Z));m(c.t.2W)F.4w({\'3i-21\':0,\'1W-21\':\'4C\',\'3i-3N\':0,\'1W-3N\':\'4C\'});m(c.t.2p)F.4w({\'3i-2j\':0,\'1W-2j\':\'4C\',\'3i-3Q\':0,\'1W-3Q\':\'4C\'});F.7K=1;m(c.t.49)F.7J=c.t.49;m(c.t.4Q)F.7y=c.t.4Q;F.2i(\'85\',\'3L\');m(!1U){B(o 1T 15 c.2D)F.2i(1T,0)}h c},2G:k(1t){1t=($r(1t)==\'F\')?c.G.2T(1t):1t;m((c.1E&&c.t.2F)||(1t===c.28&&!c.t.4P))h c;c.28=1t;o T={};c.G.1o(k(q,i){T[i]={};o 3M=(i!=1t)||(c.t.4P&&(q.3x>0));c.2h(3M?\'6i\':\'5s\',[c.1N[i],q]);B(o 1T 15 c.2D)T[i][1T]=3M?0:q[c.2D[1T]]},c);h c.1p(T)},9v:k(1t){h c.2G(1t)}});Y.5l=5l;',62,726,'||||||||||||this|||||return|||function||if||var||el|type||options|property|||||||for|event|||element|elements|Element|value|fn|to|from|window|extend|length|document|bind|false||obj|events|param|case|arguments|Fx||||else||new|in||args|true|contains|push|Math|items|array|now|css|result|parent|className|style|selector|break|prototype|null|each|start|props|Class|values|index|name|keys|prop|parsed|transition|Elements|opacity|pos|relatedTarget|current|timer|mode|temp|initialize|custom|delay|Garbage|nocash|switch|togglers|Array|unit|addEvent|join|overflown|fx|test|ie|border|Event|documentElement|params||top|parse|key|call|rgb|getStyle||previous|create|getElementsByTagName|max|map|margin|text|Methods|context|fireEvent|setStyle|left|empty|Events|set|parentNode|item|width|CSS|match|string|properties|Transitions|filter|tag|toggler|object|inject|offset|target|time|effects|len|wait|display|option|stop|returns|shared|iCss|replace|toInt|iterable|iTo|chk|xpath|source|indexOf|select|Styles|height|getValue|tmp|scrollTo|periodical|getPosition||container|size|Base|remove||||compute|setNow|argument|increase|id|addListener|Abstract|val|padding|pow|method|chains|min|hex|wrapper|webkit|getNow|getTag|collect|round|show|results|mousewheel|offsetHeight|htmlElement|scroll|bit|native|offsetWidth|fromTo|apply|script|merge|include|domReady|pick|iNow|hidden|hide|bottom|unique|iFrom|right|parseInt|px|parseFloat|scrollTop|scrollLeft|next|walk|HTMLElement|layout||scrollHeight|mix|onComplete|open|precision||toLowerCase|klass|fixedWidth|stopPropagation|included|defined|setProperty|brother|fix|generic|default|getElementsBySelector|preventDefault|proto|scrollWidth|forEach|attempt|typeof|trash|regex|Listeners|Properties|loaded|src|fKey|setStyles|getElementById|rgbToHex|getElements|code|readyState|none|body|tagName|realType|end|webkit419|evType|Multi|split|splice|number|getProperty|removeEvent|alwaysHide|fixedHeight|removeEvents|visibility|currentStyle|setOptions|hexToRgb|mp|every|color|setMany||String|checked|Dom|random|selected|multiple|gecko|DOMMouseScroll|qs|queryString|unload|easeType|Transition|charAt|Function|mouseover|mouseout|disabled|NativeEvents|PI|Accordion|on|found|nodeType|xhtml|try|delete|onActive|catch|addEventListener|trim|regexp|merged|newArray|pageX|hasChild|pageY|class|getParam|addEvents|getItems|concat|operator|add|injectAfter|innerText|first|Style|clear|appendChild|transitions|camelCase|Color|cssText|duration|flag|click|node|while|compat|insertBefore|firstChild|RegExp|domready|iProps|getSize|onStart|clean|getMany|scrollSize|pairs|position|hasClass|bound|ie_ready|visible|fixRelatedTarget|relatedTargetGecko|setOpacity|onBackground|removeListener|defaultView|elementsProperty|hyphenate|where|addClass|mouseenter|ie6|mouseleave|head|undefined|zoom|picked|removeClass|constructor|cloneEvents|after|contents|before|nodeValue|Right|interval|Bottom|wheelDelta|Top|copy|Number|Width|0px|shift|Left|PropertiesIFlag|continue|removeEventListener|slice|toUpperCase|extended|direction|borderShort|capitalize|toFloat|removeChild|appendText|styleSheet|setProperties|pp|getLast|beforeunload|childNodes|Merge|callee|textContent|setHTML|fixStyle|clientX|createElement|which|innerHTML|clientY|getNext|keydown|prefix|sin|injectBefore|iParsed|wheelStops|normal|addSection|Single|toElement|resolver|filterByAttribute|onCancel|cos|Chain|implement|sel|fullHeight|vertical|textarea|adopt|input|styles|getStyles|slideIn|slideOut|getElement|limit|fullWidth|fullOpacity|full|getFormElements|filterByClass|Options|opera|clientHeight|pageXOffset|callChain|filterById|substr|clientWidth|pageYOffset|getWidth|getScrollTop|idx|getScrollLeft|getScrollHeight|getHeight|getScrollWidth|delta|overflow|complete|change|fps|evaluate|step|load|cloneNode|attributes|clearTimer|replaceWith|toRight|replaceChild|clone|1000|removeProperty|removeAttribute|injectInside|getPrevious|getFirst|createTextNode|injectTop|Sibling|toBottom|zIndex|effect|cssFloat|getAttribute|Scroll|alpha|getChildren|hasLayout|getParent|styleFloat|toTop|toggleClass|100|getPropertyValue|getComputedStyle|lastChild|float|toLeft|easeIn|navigator|taintEnabled|webkit420|all|ie7|ActiveXObject|XMLHttpRequest|getBoxObjectFor|khtml|BackgroundImageCache|Elastic|chain|execCommand|DOMElement|Object|iframe|Quad|Document|whitespace|collection|Quint|textnode|nodeName|MooTools|version|Quart|Cubic|clearInterval|Window|clearTimeout|getTime|floor|Date|clearChain|some|In|linear|easeInOut|bindAsEventListener|Out|err|pass|times|easeOut|horizontal|showThisHideOpen|div|toggle|getProperties|embed|boolean|setInterval|setTimeout|Back|Sine|acos|618|getRandom|associate|Bounce|Circ|Expo|ease|InOut|toString|transparent|Pow|escapeRegExp|Slide|500|menu|setAttribute|mouse|fromCharCode|radio|checkbox|contextmenu|page|mouseup|rightClick|mousedown|getElementsByClassName|client|abort|error|meta|metaKey|altKey|ctrlKey|reset|wheel|password|111|mousemove|keyCode|detail|120|button|fromElement|substring|XPathResult||with|down|starts|UNORDERED_NODE_SNAPSHOT_TYPE|esc|tab|backspace|space|snapshotItem|snapshotLength|up|namespaceURI|1999|org|returnValue|dblclick|cancelBubble|bindWithEvent|filterByTag|http|enter|ES|www|w3|control|alt|protocol|location|https|borderColor|borderWidth|borderStyle|getCoordinates|htmlFor|shiftKey|rowSpan|rowspan|colSpan|colspan|javascript|void|getText|innerHeight|setText|move|focus|innerWidth|onDomReady|write|resize|defer|onreadystatechange|DOMContentLoaded|accesskey|blur|offsetTop|offsetLeft|offsetParent|getTop|submit|keyup|do|CollectGarbage|srcElement|keypress|toQueryString|encodeURIComponent|attachEvent|detachEvent|maxLength|readonly|tabIndex|tabindex|accessKey|readOnly|maxlength|href|frameborder|getLeft|frameBorder'.split('|'),0,{}))
• File Info
Name Value
Size 28515
MD5 41f46ddbfe907e377b0b916c60ef2376
SHA1 12be52e5dee4e719a855e869c95c46a022991c69
SHA256 898cc70013f761380d37ef7de2cf74a6ac3b499bf57ae3ac9aa9bbcfffadc87b
Process Failed
• Verdict
Auto Analysis Verdict
Not Rated as Suspicious
File size: 28515 bytes

TrID : File type identification
Digital Micrograph Script (100.0%)
ssdeep: 768:dWTaHjRr19RjWQ6LjVJgvtIiVwbvKzCF7VhbMCoqtJj:46jlRaQ+MIVjKuF7VdoqtJj
PEiD : -
RDS : NSRL Reference Data Set
Can anyone comment?

luntrus
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1pre) Gecko/20090526 Shiretoko/3.5pre
User avatar
Giorgio Maone
Site Admin
Posts: 9454
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy
Contact:

Re: What is the reason for code obfuscation?

Post by Giorgio Maone »

MooTools is a JavaScript extension library (similar to JQuery or Prototype).
In this case it's just packed with a standard packer, something you usually do to reduce bandwidth usage.
I actually prefer minification, which reduces sizes (slightly less efficiently) by stripping off redundant whitespaces but is still retains the code in an almost readable state.
Anyway most webserver today have built-in gzip resource compression, hence there's no compelling reason to keep stuff semi-obfuscated on the web.
You may recall this related thread, since you commented on that.
Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.0.10) Gecko/2009042316 Firefox/3.0.10 (.NET CLR 3.5.30729)
User avatar
GµårÐïåñ
Lieutenant Colonel
Posts: 3365
Joined: Fri Mar 20, 2009 5:19 am
Location: PST - USA
Contact:

Re: What is the reason for code obfuscation?

Post by GµårÐïåñ »

There are many reasons why you would obfuscate the code that has nothing to do with hiding anything. The fact is that the author has a right to protect their work from being ripped off and if that makes it slightly harder, then so be it. Also to reduce code size and speed up execution. So on and so forth, many legit reasons.
~.:[ Lï£ê ï§ å Lêmðñ åñÐ Ì Wåñ† M¥ Mðñê¥ ßå¢k ]:.~
________________ .: [ Major Mike's ] :. ________________
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.0.10) Gecko/2009042316 Firefox/3.0.10
User avatar
Foam Head
Senior Member
Posts: 57
Joined: Sun May 03, 2009 5:35 pm

Re: What is the reason for code obfuscation?

Post by Foam Head »

I think what luntrus was hinting at is would it be possible and appropriate for NoScript to detect/block obfuscated scripts? While there are plenty of valid reasons to obfuscate code, it'd seem a little silly for malware to *not* be obfuscated (hey, look at me! I'm doing bad stuff!). Anyway, while I don't know what the litmus test for obfuscated-ness would be, one thing that always seems suspicious is executing code via eval. Eval can be used for many legitimate reasons (tho IMHO it's generally a sign of poor design or lazy programming), but it's a favorite of malware. Maybe NoScript could be configured to inhibit all scripts with eval calls?

-Foam
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.10) Gecko/2009042316 Firefox/3.0.10 (.NET CLR 3.5.30729)
User avatar
GµårÐïåñ
Lieutenant Colonel
Posts: 3365
Joined: Fri Mar 20, 2009 5:19 am
Location: PST - USA
Contact:

Re: What is the reason for code obfuscation?

Post by GµårÐïåñ »

Foam Head wrote:I think what luntrus was hinting at is would it be possible and appropriate for NoScript to detect/block obfuscated scripts? While there are plenty of valid reasons to obfuscate code, it'd seem a little silly for malware to *not* be obfuscated (hey, look at me! I'm doing bad stuff!). Anyway, while I don't know what the litmus test for obfuscated-ness would be, one thing that always seems suspicious is executing code via eval. Eval can be used for many legitimate reasons (tho IMHO it's generally a sign of poor design or lazy programming), but it's a favorite of malware. Maybe NoScript could be configured to inhibit all scripts with eval calls?

-Foam
Ok, the title suggested something else, but if NS detection is what is being discussed, there are too many methods out there for NS to include all of them in decoding and detecting obfuscated code. Not to mention the lag and delays that would cause. He would have to build many JS evaluation and parsing engines to account for all possible obfuscation methods and even then there is little guarantee that without actually looking at it (a human) you can guess which method to use and there would be much hit and miss. It can be further complicated that if I am going to obfuscate code and spread it, I am not going to just use ONE tool, I would probably use one, run it through another and embedded it into another. Anyway, I am sure Giorgio can comment more on this, I am not as eloquent, I just know what I know.
~.:[ Lï£ê ï§ å Lêmðñ åñÐ Ì Wåñ† M¥ Mðñê¥ ßå¢k ]:.~
________________ .: [ Major Mike's ] :. ________________
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.0.10) Gecko/2009042316 Firefox/3.0.10
luntrus
Senior Member
Posts: 237
Joined: Sat Mar 21, 2009 6:29 pm

Re: What is the reason for code obfuscation?

Post by luntrus »

Hi Foam Head,

And a similar good thing would be if NoScript would alert us to eventual good and malcode Packers used, not only valuable information for browser users and malware fighters alike also for website owners. We know now that malcoders start to use specific packers and obfuscation to get under the radar and make extrapolation difficult.
Let me give you an example of this code used in the content folder of the SRWare Iron browser (a GoogleChrome clone without the Google privacy issues)

Code: Select all

 It is found in C:\Program Files\SRWare Iron\resources\content\Security.JS
<script language=javascript>document.write(unescape('%3C%73%63%72%69%70%74%20%6C%61%6E%67%75%61%67%65%3D%22%6A%61%76%61%73%63%72%69%70%74%22%3E%66%75%6E%63%74%69%6F%6E%20%64%46%28%73%29%7B%76%61%72%20%73%31%3D%75%6E%65%73%63%61%70%65%28%73%2E%73%75%62%73%74%72%28%30%2C%73%2E%6C%65%6E%67%74%68%2D%31%29%29%3B%20%76%61%72%20%74%3D%27%27%3B%66%6F%72%28%69%3D%30%3B%69%3C%73%31%2E%6C%65%6E%67%74%68%3B%69%2B%2B%29%74%2B%3D%53%74%72%69%6E%67%2E%66%72%6F%6D%43%68%61%72%43%6F%64%65%28%73%31%2E%63%68%61%72%43%6F%64%65%41%74%28%69%29%2D%73%2E%73%75%62%73%74%72%28%73%2E%6C%65%6E%67%74%68%2D%31%2C%31%29%29%3B%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%75%6E%65%73%63%61%70%65%28%74%29%29%3B%7D%3C%2F%73%63%72%69%70%74%3E'));dF('0+%2631+++++%2631CFHJO%2631MJDFOTF%2631CMPDL%2631+++++%261B%2631+%2631Wfstjpo%264B%2631NQM%26312/20HQM%26313/10MHQM%26313/2%261B%2631+%261B%2631+%2631Uif%2631dpoufout%2631pg%2631uijt%2631gjmf%2631bsf%2631tvckfdu%2631up%2631uif%2631Np%7Bjmmb%2631Qvcmjd%2631Mjdfotf%2631Wfstjpo%261B%2631+%26312/2%2631%2639uif%2631%2633Mjdfotf%2633%263%3A%264C%2631zpv%2631nbz%2631opu%2631vtf%2631uijt%2631gjmf%2631fydfqu%2631jo%2631dpnqmjbodf%2631xjui%261B%2631+%2631uif%2631Mjdfotf/%2631Zpv%2631nbz%2631pcubjo%2631b%2631dpqz%2631pg%2631uif%2631Mjdfotf%2631bu%261B%2631+%2631iuuq%264B00xxx/np%7Bjmmb/psh0NQM0%261B%2631+%261B%2631+%2631Tpguxbsf%2631ejtusjcvufe%2631voefs%2631uif%2631Mjdfotf%2631jt%2631ejtusjcvufe%2631po%2631bo%2631%2633BT%2631JT%2633%2631cbtjt%263D%261B%2631+%2631XJUIPVU%2631XBSSBOUZ%2631PG%2631BOZ%2631LJOE%263D%2631fjuifs%2631fyqsftt%2631ps%2631jnqmjfe/%2631Tff%2631uif%2631Mjdfotf%261B%2631+%2631gps%2631uif%2631tqfdjgjd%2631mbohvbhf%2631hpwfsojoh%2631sjhiut%2631boe%2631mjnjubujpot%2631voefs%2631uif%261B%2631+%2631Mjdfotf/%261B%2631+%261B%2631+%2631Uif%2631Psjhjobm%2631Dpef%2631jt%2631Np%7Bjmmb/%261B%2631+%261B%2631+%2631Uif%2631Jojujbm%2631Efwfmpqfs%2631pg%2631uif%2631Psjhjobm%2631Dpef%2631jt%261B%2631+%2631CU%2631Hmpcbm%2631Tfswjdft%26310%2631Fubu%2631gsbodbjt%2631Njojtufsf%2631ef%2631mb%2631Efgfotf/%261B%2631+%2631Qpsujpot%2631dsfbufe%2631cz%2631uif%2631Jojujbm%2631Efwfmpqfs%2631bsf%2631Dpqzsjhiu%2631%2639D%263%3A%26313119%261B%2631+%2631uif%2631Jojujbm%2631Efwfmpqfs/%2631Bmm%2631Sjhiut%2631Sftfswfe/%261B%2631+%261B%2631+%2631Dpousjcvups%2639t%263%3A%264B%261B%2631+%2631Sbqibfm%2631Gbjsjtf%26310%2631CU%2631Hmpcbm%2631Tfswjdft%26310%2631Fubu%2631gsbodbjt%2631.%2631Njojtufsf%2631ef%2631mb%2631Efgfotf%261B%2631+%261B%2631+%2631Bmufsobujwfmz%263D%2631uif%2631dpoufout%2631pg%2631uijt%2631gjmf%2631nbz%2631cf%2631vtfe%2631voefs%2631uif%2631ufsnt%2631pg%261B%2631+%2631fjuifs%2631uif%2631HOV%2631Hfofsbm%2631Qvcmjd%2631Mjdfotf%2631Wfstjpo%26313%2631ps%2631mbufs%2631%2639uif%2631%2633HQM%2633%263%3A%263D%2631ps%261B%2631+%2631uif%2631HOV%2631Mfttfs%2631Hfofsbm%2631Qvcmjd%2631Mjdfotf%2631Wfstjpo%26313/2%2631ps%2631mbufs%2631%2639uif%2631%2633MHQM%2633%263%3A%263D%261B%2631+%2631jo%2631xijdi%2631dbtf%2631uif%2631qspwjtjpot%2631pg%2631uif%2631HQM%2631ps%2631uif%2631MHQM%2631bsf%2631bqqmjdbcmf%2631jotufbe%261B%2631+%2631pg%2631uiptf%2631bcpwf/%2631Jg%2631zpv%2631xjti%2631up%2631bmmpx%2631vtf%2631pg%2631zpvs%2631wfstjpo%2631pg%2631uijt%2631gjmf%2631pomz%261B%2631+%2631voefs%2631uif%2631ufsnt%2631pg%2631fjuifs%2631uif%2631HQM%2631ps%2631uif%2631MHQM%263D%2631boe%2631opu%2631up%2631bmmpx%2631puifst%2631up%261B%2631+%2631vtf%2631zpvs%2631wfstjpo%2631pg%2631uijt%2631gjmf%2631voefs%2631uif%2631ufsnt%2631pg%2631uif%2631NQM%263D%2631joejdbuf%2631zpvs%261B%2631+%2631efdjtjpo%2631cz%2631efmfujoh%2631uif%2631qspwjtjpot%2631bcpwf%2631boe%2631sfqmbdf%2631uifn%2631xjui%2631uif%2631opujdf%261B%2631+%2631boe%2631puifs%2631qspwjtjpot%2631sfrvjsfe%2631cz%2631uif%2631HQM%2631ps%2631uif%2631MHQM/%2631Jg%2631zpv%2631ep%2631opu%2631efmfuf%261B%2631+%2631uif%2631qspwjtjpot%2631bcpwf%263D%2631b%2631sfdjqjfou%2631nbz%2631vtf%2631zpvs%2631wfstjpo%2631pg%2631uijt%2631gjmf%2631voefs%261B%2631+%2631uif%2631ufsnt%2631pg%2631boz%2631pof%2631pg%2631uif%2631NQM%263D%2631uif%2631HQM%2631ps%2631uif%2631MHQM/%261B%2631+%261B%2631+%2631+++++%2631FOE%2631MJDFOTF%2631CMPDL%2631+++++%2631+0%261B%261Bwbs%2631tfdvsjuzMbcfmTfdvsjuzQpmjdzMjtu%2631%264E%2631%266C%266E%264C%261Bwbs%2631tfdvsjuzMbcfmTfdvsjuzDmbttjgjdbujpoMjtu%2631%264E%2631%266C%266E%264C%261Bwbs%2631tfdvsjuzMbcfmQsjwbdzNbslMjtu%2631%264E%2631%266C%266E%264C%261Bwbs%2631tfdvsjuzMbcfmTfdvsjuzDbufhpsjftMjtu%2631%264E%2631%266C%266E%264C%261B%261Bwbs%2631ktMpbefs%2631%264E%2631%2631Dpnqpofout/dmbttft%266C%2633Anp%7Bjmmb/psh0np%7B0kttvctdsjqu.mpbefs%264C2%2633%266E/hfuTfswjdf%2639Dpnqpofout/joufsgbdft/np%7BJKTTvcTdsjquMpbefs%263%3A%264C%261BktMpbefs/mpbeTvcTdsjqu%2639%2633dispnf%264B00nfttfohfs0dpoufou0jp/kt%2633%263%3A%264C%261B%261Bwbs%2631tusjohCvoemfTfswjdf%2631%264E%2631Dpnqpofout/dmbttft%266C%2633Anp%7Bjmmb/psh0joum0tusjohcvoemf%264C2%2633%266E/hfuTfswjdf%2639Dpnqpofout/joufsgbdft/otJTusjohCvoemfTfswjdf%263%3A%264C%261Bwbs%2631hTusjohCvoemf%2631%264E%2631tusjohCvoemfTfswjdf/dsfbufCvoemf%2639%2633dispnf%264B00nfttfohfs.tnjnf0mpdbmf0tfdvsjuzMbcfm/qspqfsujft%2633%263%3A%264C%261B%261B%261B0++%261B%2631+%2631Hfu%2631Ivnbo.sfbebcmf%2631Tfdvsjuz%2631Qpmjdz%2631Jefoujgjfs%261B%2631+%2631Aqbsbn%2631tfdvsjuzQpmjdzJefoujgjfs%2631Tusjoh%2631xjui%2631Qpmjdz%2631Jefoujgjfs%2631PJE%261B%2631+%2631Asfuvso%2631Tusjoh%2631xjui%2631uif%2631obnf%2631pg%2631uif%2631Qpmjdz%2631Jefoujgjfs%261B%2631+0%261Bgvodujpo%2631tfdvsjuzMbcfmHfuTfdvsjuzQpmjdzJefoujgjfsObnf%2639tfdvsjuzQpmjdzJefoujgjfs%263%3A%2631%268C%261B%261%3Ajg%2631%2639tfdvsjuzQpmjdzJefoujgjfs%2631%264E%264E%2631voefgjofe%2631%268D%268D%2631tfdvsjuzQpmjdzJefoujgjfs%2631%264E%264E%2631%2633%2633%263%3A%2631sfuvso%2631%2633%2633%264C%261B%261B%261%3AtfdvsjuzMbcfmSfbeQspgjmft%2639%263%3A%264C%261B%261%3A%261B%261%3Agps%2631%2639qpmjdzObnf%2631jo%2631tfdvsjuzMbcfmTfdvsjuzQpmjdzMjtu%263%3A%2631%268C%261B%261%3A%261%3Ajg%2631%2639tfdvsjuzMbcfmTfdvsjuzQpmjdzMjtu%266CqpmjdzObnf%266E%2631%264E%264E%2631tfdvsjuzQpmjdzJefoujgjfs%263%3A%2631sfuvso%2631qpmjdzObnf%264C%261B%261%3A%268E%261B%261%3A%261B%261%3Asfuvso%2631hTusjohCvoemf/HfuTusjohGspnObnf%2639%2633volopxoTfdvsjuzQpmjdzJefoujgjfs%2633%263%3A%2631%2C%2633%2631%2639%2633%2631%2C%2631tfdvsjuzQpmjdzJefoujgjfs%2631%2C%2631%2633%263%3A%2633%264C%261B%268E%261B%261B%261B0++%261B%2631+%2631%2631Hfu%2631Ivnbo.sfbebcmf%2631Tfdvsjuz%2631Dmbttjgjdbujpo%2631wbmvf%261B%2631+%2631%2631Aqbsbn%2631tfdvsjuzQpmjdzJefoujgjfs%2631Tusjoh%2631xjui%2631Qpmjdz%2631Jefoujgjfs%2631PJE%261B%2631+%2631%2631Aqbsbn%2631tfdvsjuzDmbttjgjdbujpo%2631Dmbttjgjdbujpo%2631wbmvf%261B%2631+%2631%2631Asfuvso%2631Tusjoh%2631xjui%2631uif%2631obnf%2631boe%2631wbmvf%2631pg%2631uif%2631Tfdvsjuz%2631Dmbttjgjdbujpo%261B%2631+0%261Bgvodujpo%2631tfdvsjuzMbcfmHfuTfdvsjuzDmbttjgjdbujpoObnf%2639tfdvsjuzQpmjdzJefoujgjfs%263D%2631tfdvsjuzDmbttjgjdbujpo%263%3A%2631%268C%261B%261%3Ajg%2631%2639tfdvsjuzQpmjdzJefoujgjfs%2631%264E%264E%2631voefgjofe%2631%268D%268D%2631tfdvsjuzDmbttjgjdbujpo%2631%264E%264E%2631voefgjofe%263%3A%2631sfuvso%2631%2633%2633%264C%261B%261%3A%261B%261%3Awbs%2631tfdvsjuzQpmjdzJefoujgjfsObnf%2631%264E%2631tfdvsjuzMbcfmHfuTfdvsjuzQpmjdzJefoujgjfsObnf%2639tfdvsjuzQpmjdzJefoujgjfs%263%3A%264C%261B%261B%261%3Ajg%2631%2639tfdvsjuzMbcfmTfdvsjuzDmbttjgjdbujpoMjtu%266CtfdvsjuzQpmjdzJefoujgjfsObnf%266E%2631%2632%264E%2631voefgjofe%263%3A%2631%268C%261B%261%3A%261%3Agps%2631%2639dmbttjgjdbujpoObnf%2631jo%2631tfdvsjuzMbcfmTfdvsjuzDmbttjgjdbujpoMjtu%266CtfdvsjuzQpmjdzJefoujgjfsObnf%266E%263%3A%2631%268C%261B%261%3A%261%3A%261%3Ajg%2631%2639tfdvsjuzMbcfmTfdvsjuzDmbttjgjdbujpoMjtu%266CtfdvsjuzQpmjdzJefoujgjfsObnf%266E%266CdmbttjgjdbujpoObnf%266E%2631%264E%264E%2631tfdvsjuzDmbttjgjdbujpo%263%3A%2631sfuvso%2631dmbttjgjdbujpoObnf%264C%261B%261%3A%261%3A%268E%261B%261%3A%268E%261B%261%3A%261B%261%3Asfuvso%2631hTusjohCvoemf/HfuTusjohGspnObnf%2639%2633volopxoTfdvsjuzDmbttjgjdbujpo%2633%263%3A%2631%2C%2631%2633%2631%2639%2633%2631%2C%2631tfdvsjuzDmbttjgjdbujpo%2631%2C%2631%2633%263%3A%2633%264C%261B%268E%261B%261B%261B0++%261B%2631+%2631%2631Hfu%2631Ivnbo.sfbebcmf%2631Tfdvsjuz%2631Dbufhpsz%2631wbmvf%261B%2631+%2631%2631Aqbsbn%2631tfdvsjuzQpmjdzJefoujgjfs%2631Tusjoh%2631xjui%2631Qpmjdz%2631Jefoujgjfs%2631PJE%261B%2631+%2631%2631Aqbsbn%2631tfdvsjuzDmbttjgjdbujpo%2631Dmbttjgjdbujpo%2631wbmvf%261B%2631+%2631%2631Aqbsbn%2631tfdvsjuzDbufhpszUzqf%2631Dbufhpsz%2631uzqf%261B%2631+%2631%2631Aqbsbn%2631tfdvsjuzDbufhpszWbmvf%2631Dbufhpsz%2631wbmvf%261B%2631+%2631%2631Asfuvso%2631Tusjoh%2631xjui%2631uif%2631obnf%2631pg%2631uif%2631Tfdvsjuz%2631Dbufhpsz%261B%2631+0%261Bgvodujpo%2631tfdvsjuzMbcfmHfuTfdvsjuzDbufhpszObnf%2639tfdvsjuzQpmjdzJefoujgjfs%263D%2631tfdvsjuzDmbttjgjdbujpo%263D%2631tfdvsjuzDbufhpszPje%263D%2631tfdvsjuzDbufhpszUzqf%263D%2631tfdvsjuzDbufhpszWbmvf%263%3A%2631%268C%261B%261%3Ajg%2631%2639tfdvsjuzQpmjdzJefoujgjfs%2631%264E%264E%2631voefgjofe%2631%268D%268D%2631tfdvsjuzDmbttjgjdbujpo%2631%264E%264E%2631voefgjofe%2631%268D%268D%2631tfdvsjuzDbufhpszPje%2631%264E%264E%2631voefgjofe%2631%268D%268D%2631tfdvsjuzDbufhpszUzqf%2631%264E%264E%2631voefgjofe%2631%268D%268D%2631tfdvsjuzDbufhpszWbmvf%2631%264E%264E%2631voefgjofe%263%3A%2631sfuvso%2631%2633%2633%264C%261B%261%3A%261B%261%3Awbs%2631tfdvsjuzQpmjdzJefoujgjfsObnf%2631%264E%2631tfdvsjuzMbcfmHfuTfdvsjuzQpmjdzJefoujgjfsObnf%2639tfdvsjuzQpmjdzJefoujgjfs%263%3A%264C%261B%261B%261%3Ajg%2631%2639tfdvsjuzMbcfmTfdvsjuzDbufhpsjftMjtu%266CtfdvsjuzQpmjdzJefoujgjfsObnf%266E%2631%2632%264E%2631voefgjofe%263%3A%2631%268C%261B%261%3A%261%3Agps%2631%2639wbs%2631j%2631%264E%26311%264C%2631j%2631%264D%26313%264C%2631j%2C%2C%263%3A%2631%268C%261B%261%3A%261%3A%261%3Awbs%2631mjtu%264C%261B%261%3A%261%3A%261%3A0+%2631Tfdvsjuz%2631Dbufhpsjft%2631gps%2631bmm%2631dmbttjgjdbujpot%2631+0%261B%261%3A%261%3A%261%3Ajg%2631%2639j%2631%264E%264E%26311%263%3A%2631mjtu%2631%264E%2631tfdvsjuzMbcfmTfdvsjuzDbufhpsjftMjtu%266CtfdvsjuzQpmjdzJefoujgjfsObnf%266E%266C%2633bmm%2633%266E%264C%261B%261%3A%261%3A%261%3A0+%2631Tfdvsjuz%2631Dbufhpsjft%2631gps%2631tfmfdufe%2631dmbttjgjdbujpo%2631+0%261B%261%3A%261%3A%261%3Ajg%2631%2639j%2631%264E%264E%26312%263%3A%2631mjtu%2631%264E%2631tfdvsjuzMbcfmTfdvsjuzDbufhpsjftMjtu%266CtfdvsjuzQpmjdzJefoujgjfsObnf%266E%266CtfdvsjuzDmbttjgjdbujpo/upTusjoh%2639%263%3A%266E%264C%261B%261%3A%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%261B%261%3A%261%3A%261%3Agps%2631%2639tfdvsjuzDbufhpszObnf%2631jo%2631mjtu%263%3A%2631%268C%261B%261%3A%261%3A%261%3A%261%3Ajg%2631%2639mjtu%266CtfdvsjuzDbufhpszObnf%266E%266C1%266E%2631%264E%264E%2631tfdvsjuzDbufhpszPje%2631%2637%2637%2631mjtu%266CtfdvsjuzDbufhpszObnf%266E%266C2%266E%2631%264E%264E%2631tfdvsjuzDbufhpszUzqf%2631%2637%2637%2631mjtu%266CtfdvsjuzDbufhpszObnf%266E%266C3%266E%2631%264E%264E%2631tfdvsjuzDbufhpszWbmvf%263%3A%2631%268C%261B%261%3A%261%3A%261%3A%261%3A%261%3Asfuvso%2631tfdvsjuzDbufhpszObnf%264C%261B%261%3A%261%3A%261%3A%261%3A%268E%261B%261%3A%261%3A%261%3A%268E%261B%261%3A%261%3A%268E%261B%261%3A%268E%261B%261%3A%261B%261%3Asfuvso%2631hTusjohCvoemf/HfuTusjohGspnObnf%2639%2633volopxoTfdvsjuzDbufhpsz%2633%263%3A%2631%2C%2631%2633%2631%2639%2633%2631%2C%2631tfdvsjuzDbufhpszPje%2631%2C%2631%2633%2631%268D%2631%2633%2631%2C%2631tfdvsjuzDbufhpszWbmvf%2631%2C%2631%2633%263%3A%2633%264C%261B%268E%261B%261B%261B%261Bwbs%2631%60tfdvsjuzMbcfmSfbeQspgjmftEpof%2631%264E%2631gbmtf%264C%261B%261B0++%261B%2631+%2631Sfbe%2631Tfdvsjuz%2631Mbcfm%2631qspgjmft%2631jo%2631%2636qspgjmf%26360tfdvsjuzMbcfm0%2631ejsfdupsz%261B%2631+0%261Bgvodujpo%2631tfdvsjuzMbcfmSfbeQspgjmft%2639%263%3A%2631%268C%261B%261%3Ajg%2631%2639%2632%60tfdvsjuzMbcfmSfbeQspgjmftEpof%263%3A%2631%268C%261B%261B%261%3A%261%3A0+%2631Sftfu%2631mjtut%2631+0%261B%261%3A%261%3AtfdvsjuzMbcfmTfdvsjuzQpmjdzMjtu%2631%264E%2631%266C%266E%264C%261B%261%3A%261%3AtfdvsjuzMbcfmTfdvsjuzDmbttjgjdbujpoMjtu%2631%264E%2631%266C%266E%264C%261B%261%3A%261%3AtfdvsjuzMbcfmQsjwbdzNbslMjtu%2631%264E%2631%266C%266E%264C%261B%261%3A%261%3AtfdvsjuzMbcfmTfdvsjuzDbufhpsjftMjtu%2631%264E%2631%266C%266E%264C%261B%261%3A%261%3A%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%2631%261B%261%3A%261%3Awbs%2631ejs%2631%264E%2631EjsJP/hfu%2639%2633QspgE%2633%263%3A%264C%26310+%2631Qspgjmf%2631ejsfdupsz%2631+0%261B%261%3A%261%3Aejs/bqqfoe%2639%2633tfdvsjuzMbcfm%2633%263%3A%264C%261B%261%3A%261%3Awbs%2631ejsMjtu%2631%264E%2631EjsJP/sfbe%2639ejs%263%3A%264C%261B%261%3A%261%3Agps%2631%2639j%2631jo%2631ejsMjtu%263%3A%2631%268C%261B%261%3A%261%3A%261%3Awbs%2631gjmfDpoufout%2631%264E%2631GjmfJP/sfbe%2639ejsMjtu%266Cj%266E%263D%2631%2633VUG.9%2633%263%3A%264C%261B%261%3A%261%3A%261%3Ajg%2631%2639gjmfDpoufout%2631%2632%264E%2631gbmtf%263%3A%2631%268C%261B%261%3A%261%3A%261%3A%261%3Ausz%2631%268C%261B%261%3A%261%3A%261%3A%261%3A%261%3Awbs%2631epnQbstfs%2631%264E%2631ofx%2631EPNQbstfs%2639%263%3A%264C%261B%261%3A%261%3A%261%3A%261%3A%261%3Awbs%2631epn%2631%264E%2631epnQbstfs/qbstfGspnTusjoh%2639gjmfDpoufout%263D%2631%2633ufyu0ynm%2633%263%3A%264C%261B%261%3A%261%3A%261%3A%261%3A%261%3Ajg%2631%2639epn/epdvnfouFmfnfou/opefObnf%2631%264E%264E%2631%2633tfdvsjuzMbcfm%2633%263%3A%2631%268C%261B%261%3A%261%3A%261%3A%261%3A%261%3A%261%3Awbs%2631qpmjdz%2631%264E%2631%60qbstfTfdvsjuzQpmjdzJefoujgjfs%2639epn%263%3A%264C%261B%261%3A%261%3A%261%3A%261%3A%261%3A%261%3Ajg%2631%2639qpmjdz%2631%2632%264E%2631gbmtf%263%3A%2631%268C%261B%261%3A%261%3A%261%3A%261%3A%261%3A%261%3A%261%3AtfdvsjuzMbcfmTfdvsjuzQpmjdzMjtu%266Cqpmjdz%266C1%266E%266E%2631%264E%2631qpmjdz%266C2%266E%264C%261B%261%3A%261%3A%261%3A%261%3A%261%3A%261%3A%261%3AtfdvsjuzMbcfmTfdvsjuzDmbttjgjdbujpoMjtu%266Cqpmjdz%266C1%266E%266E%2631%264E%2631%60qbstfTfdvsjuzDmbttjgjdbujpo%2639epn%263%3A%264C%261B%261%3A%261%3A%261%3A%261%3A%261%3A%261%3A%261%3AtfdvsjuzMbcfmQsjwbdzNbslMjtu%266Cqpmjdz%266C1%266E%266E%2631%264E%2631%60qbstfQsjwbdzNbsl%2639epn%263%3A%264C%261B%261%3A%261%3A%261%3A%261%3A%261%3A%261%3A%261%3AtfdvsjuzMbcfmTfdvsjuzDbufhpsjftMjtu%266Cqpmjdz%266C1%266E%266E%2631%264E%2631%60qbstfTfdvsjuzDbufhpsjft%2639epn%263%3A%264C%261B%261%3A%261%3A%261%3A%261%3A%261%3A%261%3A%268E%261B%261%3A%261%3A%261%3A%261%3A%261%3A%268E%261B%261%3A%261%3A%261%3A%261%3A%268E%2631dbudi%2631%2639f%263%3A%2631%268C%261B%261%3A%261%3A%261%3A%261%3A%261%3Aevnq%2639%2633T0NJNF%2631Tfdvsjuz%2631Mbcfm%264B%2631fssps%2631xijmf%2631sfbejoh%2631qspgjmf%266Do%2633%263%3A%264C%261B%261%3A%261%3A%261%3A%261%3A%268E%261B%261%3A%261%3A%261%3A%268E%261B%261%3A%261%3A%268E%261B%261%3A%261%3A%261B%261%3A%261%3A%60tfdvsjuzMbcfmSfbeQspgjmftEpof%2631%264E%2631usvf%264C%261B%261%3A%268E%261B%268E%261B%261B%261Bgvodujpo%2631%60qbstfTfdvsjuzQpmjdzJefoujgjfs%2639epn%263%3A%2631%268C%261B%261%3Awbs%2631opefMjtu%2631%264E%2631epn/hfuFmfnfoutCzUbhObnf%2639%2633tfdvsjuzQpmjdzJefoujgjfs%2633%263%3A%264C%261B%261%3Ajg%2631%2639opefMjtu/mfohui%2631%264E%264E%26312%263%3A%2631%268C%261B%261%3A%261%3Awbs%2631opef%2631%264E%2631opefMjtu/jufn%26391%263%3A%264C%261B%261%3A%261%3Awbs%2631mbcfm%2631%264E%2631%60usjn%2639opef/hfuBuusjcvuf%2639%2633mbcfm%2633%263%3A%263%3A%264C%261B%261%3A%261%3Awbs%2631wbmvf%2631%264E%2631%60usjn%2639opef/hfuBuusjcvuf%2639%2633wbmvf%2633%263%3A%263%3A%264C%261B%261%3A%261%3Ajg%2631%2639mbcfm%2631%2632%264E%2631%2633%2633%2631%2637%2637%2631wbmvf%2631%2632%264E%2631%2633%2633%263%3A%2631sfuvso%2631%266Cmbcfm%263D%2631wbmvf%266E%264C%261B%261%3A%268E%261B%261%3A%261B%261%3Asfuvso%2631gbmtf%264C%261B%268E%261B%261B%261Bgvodujpo%2631%60qbstfTfdvsjuzDmbttjgjdbujpo%2639epn%263%3A%2631%268C%261B%261%3Awbs%2631mjtu%2631%264E%2631%266C%266E%264C%261B%261%3A%261B%261%3Awbs%2631opefMjtu2%2631%264E%2631epn/hfuFmfnfoutCzUbhObnf%2639%2633tfdvsjuzDmbttjgjdbujpo%2633%263%3A%264C%261B%261%3Ajg%2631%2639opefMjtu2/mfohui%2631%264E%264E%26312%263%3A%2631%268C%261B%261%3A%261%3Awbs%2631opef%2631%264E%2631opefMjtu2/jufn%26391%263%3A%264C%261B%261%3A%261%3Awbs%2631ejtqmbzWbmvf%2631%264E%2631opef/hfuBuusjcvuf%2639%2633wbmvfEjtqmbzfe%2633%263%3A%264C%261B%261%3A%261%3Ajg%2631%2639opef/ibtDijmeOpeft%2639%263%3A%263%3A%2631%268C%261B%261%3A%261%3A%261%3Awbs%2631opefMjtu3%2631%264E%2631opef/dijmeOpeft%264C%261B%261%3A%261%3A%261%3Agps%2631%2639j%2631%264E%26311%264C%2631j%2631%264D%2631opefMjtu3/mfohui%264C%2631j%2C%2C%263%3A%2631%268C%261B%261%3A%261%3A%261%3A%261%3Awbs%2631jufnOpef%2631%264E%2631opefMjtu3/jufn%2639j%263%3A%264C%261B%261%3A%261%3A%261%3A%261%3Ajg%2631%2639jufnOpef/opefObnf%2631%264E%264E%2631%2633jufn%2633%263%3A%2631%268C%261B%261%3A%261%3A%261%3A%261%3A%261%3Awbs%2631mbcfm%2631%264E%2631%60usjn%2639jufnOpef/hfuBuusjcvuf%2639%2633mbcfm%2633%263%3A%263%3A%264C%261B%261%3A%261%3A%261%3A%261%3A%261%3Awbs%2631wbmvf%2631%264E%2631%60usjn%2639jufnOpef/hfuBuusjcvuf%2639%2633wbmvf%2633%263%3A%263%3A%264C%261B%261%3A%261%3A%261%3A%261%3A%261%3Awbmvf%2631%264E%2631qbstfJou%2639wbmvf%263%3A%264C%261B%261%3A%261%3A%261%3A%261%3A%261%3Ajg%2631%2639mbcfm%2631%2632%264E%2631%2633%2633%2631%2637%2637%2631wbmvf%2631%264F%264E%26311%2631%2637%2637%2631wbmvf%2631%264D%264E%2631367%263%3A%2631%268C%261B%261%3A%261%3A%261%3A%261%3A%261%3A%261%3Ajg%2631%2639ejtqmbzWbmvf%2631%2632%264E%2631%2633gbmtf%2633%2631%2637%2637%2631ejtqmbzWbmvf%2631%2632%264E%2631%26331%2633%263%3A%2631mbcfm%2631%2C%264E%2631%2633%2631%2639%2633%2631%2C%2631wbmvf%2631%2C%2631%2633%263%3A%2633%264C%261B%261%3A%261%3A%261%3A%261%3A%261%3A%261%3Amjtu%266Cmbcfm%266E%2631%264E%2631wbmvf%264C%261B%261%3A%261%3A%261%3A%261%3A%261%3A%268E%261B%261%3A%261%3A%261%3A%261%3A%268E%261B%261%3A%261%3A%261%3A%268E%261B%261%3A%261%3A%268E%261B%261%3A%268E%261B%261%3A%261B%261%3Asfuvso%2631mjtu%264C%261B%268E%261B%261Bgvodujpo%2631%60qbstfQsjwbdzNbsl%2639epn%263%3A%2631%268C%261B%261%3Awbs%2631mjtu%2631%264E%2631%266C%266E%264C%261B%261%3A%261B%261%3Awbs%2631opefMjtu2%2631%264E%2631epn/hfuFmfnfoutCzUbhObnf%2639%2633qsjwbdzNbsl%2633%263%3A%264C%261B%261%3Ajg%2631%2639opefMjtu2/mfohui%2631%264E%264E%26312%263%3A%2631%268C%261B%261%3A%261%3Awbs%2631opef%2631%264E%2631opefMjtu2/jufn%26391%263%3A%264C%261B%261%3A%261%3Awbs%2631gsffUfyu%2631%264E%2631opef/hfuBuusjcvuf%2639%2633gsffUfyu%2633%263%3A%264C%261B%261%3A%261%3Ajg%2631%2639gsffUfyu%2631%2632%264E%2631%2633gbmtf%2633%2631%2637%2637%2631gsffUfyu%2631%2632%264E%2631%26331%2633%263%3A%261%3Amjtu%266C%2633gsffUfyu%2633%266E%2631%264E%2631usvf%264C%2631fmtf%2631mjtu%266C%2633gsffUfyu%2633%266E%2631%264E%2631gbmtf%264C%261B%261%3A%261%3Ajg%2631%2639opef/ibtDijmeOpeft%2639%263%3A%263%3A%2631%268C%261B%261%3A%261%3A%261%3Awbs%2631opefMjtu3%2631%264E%2631opef/dijmeOpeft%264C%261B%261%3A%261%3A%261%3Agps%2631%2639j%2631%264E%26311%264C%2631j%2631%264D%2631opefMjtu3/mfohui%264C%2631j%2C%2C%263%3A%2631%268C%261B%261%3A%261%3A%261%3A%261%3Awbs%2631jufnOpef%2631%264E%2631opefMjtu3/jufn%2639j%263%3A%264C%261B%261%3A%261%3A%261%3A%261%3Ajg%2631%2639jufnOpef/opefObnf%2631%264E%264E%2631%2633jufn%2633%263%3A%2631%268C%261B%261%3A%261%3A%261%3A%261%3A%261%3Awbs%2631wbmvf%2631%264E%2631%60usjn%2639jufnOpef/hfuBuusjcvuf%2639%2633wbmvf%2633%263%3A%263%3A%264C%261B%261%3A%261%3A%261%3A%261%3A%261%3Amjtu/qvti%2639wbmvf%263%3A%264C%261B%261%3A%261%3A%261%3A%261%3A%268E%261B%261%3A%261%3A%261%3A%268E%261B%261%3A%261%3A%268E%261B%261%3A%268E%261B%261%3A%261B%261%3Asfuvso%2631mjtu%264C%261B%268E%261B%261Bgvodujpo%2631%60qbstfTfdvsjuzDbufhpsjft%2639epn%263%3A%2631%268C%261B%261%3Awbs%2631mjtu%2631%264E%2631%266C%266E%264C%261B%261%3A%261B%261%3Awbs%2631opefMjtu2%2631%264E%2631epn/hfuFmfnfoutCzUbhObnf%2639%2633tfdvsjuzDbufhpsjft%2633%263%3A%264C%261B%261%3Agps%2631%2639wbs%2631l%2631%264E%26311%264C%2631l%2631%264D%2631opefMjtu2/mfohui%264C%2631l%2C%2C%263%3A%2631%268C%261B%261%3A%261%3Awbs%2631opef%2631%264E%2631opefMjtu2/jufn%2639l%263%3A%264C%261B%261%3A%261%3Awbs%2631tfdvsjuzDmbttjgjdbujpoWbmvf%2631%264E%2631%2633bmm%2633%264C%261B%261%3A%261%3Ajg%2631%2639opef/ibtBuusjcvuf%2639%2633tfdvsjuzDmbttjgjdbujpoWbmvf%2633%263%3A%263%3A%2631%268C%261B%261%3A%261%3A%261%3AtfdvsjuzDmbttjgjdbujpoWbmvf%2631%264E%2631%60usjn%2639opef/hfuBuusjcvuf%2639%2633tfdvsjuzDmbttjgjdbujpoWbmvf%2633%263%3A%263%3A%264C%261B%261%3A%261%3A%268E%261B%261%3A%261%3Ajg%2631%2639opef/ibtDijmeOpeft%2639%263%3A%263%3A%2631%268C%261B%261%3A%261%3A%261%3Awbs%2631opefMjtu3%2631%264E%2631opef/dijmeOpeft%264C%261B%261%3A%261%3A%261%3Agps%2631%2639j%2631%264E%26311%264C%2631j%2631%264D%2631opefMjtu3/mfohui%264C%2631j%2C%2C%263%3A%2631%268C%261B%261%3A%261%3A%261%3A%261%3Awbs%2631jufnOpef%2631%264E%2631opefMjtu3/jufn%2639j%263%3A%264C%261B%261%3A%261%3A%261%3A%261%3Ajg%2631%2639jufnOpef/opefObnf%2631%264E%264E%2631%2633jufn%2633%263%3A%2631%268C%261B%261%3A%261%3A%261%3A%261%3A%261%3Awbs%2631mbcfm%2631%264E%2631%60usjn%2639jufnOpef/hfuBuusjcvuf%2639%2633mbcfm%2633%263%3A%263%3A%264C%261B%261%3A%261%3A%261%3A%261%3A%261%3Awbs%2631pje%2631%264E%2631%60usjn%2639jufnOpef/hfuBuusjcvuf%2639%2633pje%2633%263%3A/sfqmbdf%26390%266D%268D0h%263D%2631%2633%2633%263%3A%263%3A%264C%261B%261%3A%261%3A%261%3A%261%3A%261%3Awbs%2631uzqf%2631%264E%2631%60usjn%2639jufnOpef/hfuBuusjcvuf%2639%2633uzqf%2633%263%3A/sfqmbdf%26390%266D%268D0h%263D%2631%2633%2633%263%3A%263%3A%264C%261B%261%3A%261%3A%261%3A%261%3A%261%3Awbs%2631wbmvf%2631%264E%2631%60usjn%2639jufnOpef/hfuBuusjcvuf%2639%2633wbmvf%2633%263%3A/sfqmbdf%26390%266D%268D0h%263D%2631%2633%2633%263%3A%263%3A%264C%261B%261%3A%261%3A%261%3A%261%3A%261%3Ajg%2631%2639mbcfm%2631%2632%264E%2631%2633%2633%2631%2637%2637%2631pje%2631%2632%264E%2631%2633%2633%2631%2637%2637%2631uzqf%2631%2632%264E%2631%2633%2633%2631%2637%2637%2631wbmvf%2631%2632%264E%2631%2633%2633%263%3A%2631%268C%261B%261%3A%261%3A%261%3A%261%3A%261%3A%261%3Ajg%2631%2639mjtu%266CtfdvsjuzDmbttjgjdbujpoWbmvf%266E%2631%264E%264E%2631voefgjofe%263%3A%2631mjtu%266CtfdvsjuzDmbttjgjdbujpoWbmvf%266E%2631%264E%2631ofx%2631Bssbz%2639%263%3A%264C%261B%261%3A%261%3A%261%3A%261%3A%261%3A%261%3Amjtu%266CtfdvsjuzDmbttjgjdbujpoWbmvf%266E%266Cmbcfm%266E%2631%264E%2631%266Cpje%263D%2631uzqf%263D%2631wbmvf%266E%264C%261B%261%3A%261%3A%261%3A%261%3A%261%3A%268E%261B%261%3A%261%3A%261%3A%261%3A%268E%261B%261%3A%261%3A%261%3A%268E%261B%261%3A%261%3A%268E%261B%261%3A%268E%261B%261%3A%261B%261%3Asfuvso%2631mjtu%264C%261B%268E%261B%261Bgvodujpo%2631%60usjn%2639t%263%3A%2631%268C%261B%261%3Asfuvso%2631t/sfqmbdf%26390%266F%266Dt%2C%268D%266Dt%2C%26350h%263D%2631%2633%2633%263%3A%264C%261B%268E%261B1')</script> 
Several av scanners at virus total come up with a heuristic find of JS.Wonka (McAfee) and similar,
while these two scanners give an all clear:
* 1 Comodo Malware Scan results
• File Info
Name Value
Size 44950
MD5 1e3261612f743a261a96a6df3e7cc2c1
SHA1 faa1c8c27380adcdab4a1545c4b81074711f5dd0
SHA256 e2fcbb2330182eaa72b3317e2375f9a5668216c950d5b1026596b201d0fb4fa9
Process Failed
• Verdict
Auto Analysis Verdict
Not Rated as Suspicious

* 2 DrWeb online av sanner:
Checking: Security.JS
Engine version: 5.0.0.12182
Total virus-finding records: 557242
File size: 43.90 KB
File MD5: 1e3261612f743a261a96a6df3e7cc2c1

Security.JS - Ok

So how can we tell the packed encrypted security code apart from devious redirecting malcode,

luntrus
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1pre) Gecko/20090529 Shiretoko/3.5pre
dhouwn
Bug Buster
Posts: 968
Joined: Thu Mar 19, 2009 12:51 pm

Re: What is the reason for code obfuscation?

Post by dhouwn »

luntrus wrote:So how can we tell the packed encrypted security code apart from devious redirecting malcode,
Easy, just check the EVIL bit.
Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1b4) Gecko/20090503 Firefox/3.5b4
Post Reply