Why is this script detected as suspicious?

General discussion about the NoScript extension for Firefox
Post Reply
luntrus
Senior Member
Posts: 237
Joined: Sat Mar 21, 2009 6:29 pm

Why is this script detected as suspicious?

Post by luntrus »

Hi forum friends,

Just for the fun of it I gave in the code of a very well know Dutch site into jsunpack, I was startled to find some suspicious code on that website:
http://jsunpack.jeek.org/dec/go?report= ... 6dc70c6a54
and well here: www.buienradar.nl/ScriptResource.axd?d=etc.....
Well, heavily obfuscated, but it seems given as benign: http://wepawet.iseclab.org/view.php?has ... 33&type=js
avast webshield comes upwith a JS:Pdfka-WI [Expl] flag, which was found to be a FP here: http://forum.avast.com/index.php?topic=43660.0

Who can give the final verdict?

luntrus
Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.0.16) Gecko/2010010414 Firefox/3.0.16 Flock/2.5.6
Post Reply