Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #23133

Can anyone decode this malware script?

Show all headers | View raw

The following link probably tries to trigger a browser exploit of some
sort, so handle this with care:

hxxp://202.29.80.23/~info/sensors.php

The link was contained in a spam email.

The server responds with this:

============
<html><body><script type="text/hello">ykzjr1="\x30";
lufrv2="\x68\x74\x74\x70\x3A\x2F\x2F\x6E\x75\x72\x73\x69\x6E\x67\x70\x68\x61\x72\x6D\x2E\x63\x6F\x6D";
setTimeout("\x77\x69\x6E\x64\x6F\x77\x2E\x74\x6F\x70\x2E\x6C\x6F\x63\x61\x74\x69\x6F\x6E\x2E\x68\x72\x65\x66\x3D\x6C\x75\x66\x72\x76\x32\x3B",ykzjr1);
</script></body></html>
=============

Just in case the above would have executed for some readers, I replaced
"javascript" with "hello" on the above line.  The above would have given
this news server a "line too long" error, so I broke the line after the
";" in various places (if it matters).

What does that script decode to, or try to do?

Is there an on-line javascript decoder that would have processed the
above and given some sort of report or decoded result?

Back to comp.lang.javascript | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Can anyone decode this malware script? Javascript Guy <"Javascript"@Guy. com> - 2014-02-17 10:22 -0500
  Re: Can anyone decode this malware script? "ViLco" <villiber@tin.it> - 2014-02-17 16:45 +0100
    Re: Can anyone decode this malware script? "ViLco" <villiber@tin.it> - 2014-02-17 16:51 +0100
    Re: Can anyone decode this malware script? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2014-02-18 01:21 +0100

csiph-web