Alerted via a Revisium Scan alert to: -api.share.baidu.com code
Where? → -http://push.zhanzhang.baidu.com/push.js
Analysis: https://www.hybrid-analysis.com/sample/674bc0c70f98d627b8a7e1d278a1f21ffe33815565f7d5371bf0275da57571b2?environmentId=100
Re not detected: https://www.virustotal.com/#/url/2b1fdab28c23685201f4d3f71a7cf32ffc6de731f526c3574954f0f95aecf595/detection
error in code:
-push.zhanzhang.baidu.com/push.js
status: (referer=http:/XXX/web?q=puppies)saved 281 bytes b5478dd2edb3e64242eced1db2dbd945ef81f592
info: [decodingLevel=0] found JavaScript
error: undefined variable Image
error: line:4: TypeError: Image is not a constructor
file: b5478dd2edb3e64242eced1db2dbd945ef81f592: 281 bytes
Avast seems aware of the suspicious workings of push.js
polonus