Need help identifying what type of obfuscation is this

46 Views Asked by At

This is my first time seeing javascript that is obfuscated like this, script ran normally through frida.

CThciNHIp5+iUbjCxpADJAea4xvKOIYTFxt+MVblC6et3/L6gyXf0uO3TM95m2Gt33oL8Rw12gQWtpdTyf/ZaRA6uvu8HdDwUGUQZ87PbAGx61MG3dQmwWmQZ/wnlrv9sDrf1Wj6BTSZfzQYH17eDiihL9w16iXAoZfBAr/Y3ve6FHHtwNtUG2J+fxaybw4sX2mxkGOQzkn8pHm5odJJZGO8Qn9b3OMq1xYisNyzsUCatBwqiG0GKd6DQDrIKBBVvsAxPopOH5QEqQKZvN8l1q0E3iF137wCY2IJNb3LgT7L55/LUenTFZvmYeOnc+XVTHJl492WndK+HhaBzSaiTWfYZySHZLHvPVcyG7imdg09jnzEmk84bYkzv0fenfu8NOQZfzrV+Wz/UCBDnhtdjIpYIPMNsGauE28lfkV9+xvset2tjU7RxUeNmqlhh7hWWmXWWcAPmN8B0LNeMWeNPjt7pIDOnEPn5WDzbtdCMs20de9/t5B8PRYfZ0zj
Wp1jMoWpBsz/0BvaJQsoQBQcN0OBs+O+pWiK23m+BYLpz/l77nYQETaF8cjbUgv/jnOtrVGsxHFY3FPeiMDbLKoJTsrn+qTVyVhuqX4dOJS09n7KZLRzoRMjWnlH0oUOI+HPEgyXsOpnHb3QXgL9OuGO8u40O484L6kibTXRWPyPpZbXaOZFbBU37Yk+Q7WupNVNpftFvY64A3nfyF3cr85OTCGcChVP6MwTtsEpE869BwUpp4suQcErv3JOBthmizUCbwjfkm1SuxSdLSUNSzsdFob/2unylq6Bxmcegl5zrZUqUtYKdTRUC9rXDwyvYDDYBCR0tTrpFD2cyW19taRE1fhEA0bREPrm/VrGW+YrXUYxKFsg5tTdOTj0mFbZEVbz/YYgglaWBJoCbGnUcGBASyLpoqS6EWZQhazgy2Ve1WFC+eHRUyrv8inJ6wlnsppo7DAbp7keEYoNEj5vOZ5v/WYUAikOL56gC7ypy0qHgx1KJ+ICa0T0KMwHvwpHd4kQcbi4E7OkP7XAgKrsQYdBgtw6wBUjRfvrpRbi9itEbolBhMeljBwc9AylEM/BRph/weQ2zne0ZLgUYlzrKZAx3yOrDbaKjatbHn4ZW4pAZs26NE+tgkjzRrCZBkBYHDnKO4r6yvp5cS0r2jYtMhJDuWsYRcAXCkwNVgf49muuFQSQYG84F6Sxn5ZU9qVZ4vQt9K6E7T5/SozUJ2ZV4QlktXQ4zkggOsVw==

Thats only part of the code, I took some from the top and bottom, Since pasting it all here is not possible.

Full script https://paste.md-5.net/eguhedizey.coffeescript

I've tried deobfuscating it like regular base64 (obviously doesn't work)

0

There are 0 best solutions below