Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #23134

Re: Can anyone decode this malware script?

Show all headers | View raw

Javascript Guy" <"Javascript wrote:


> The server responds with this:
>
> ============
> <html><body><script type="text/hello">ykzjr1="\x30";
> lufrv2="\x68\x74\x74\x70\x3A\x2F\x2F\x6E\x75\x72\x73\x69\x6E\x67\x70\x68\x61\x72\x6D\x2E\x63\x6F\x6D";
> setTimeout("\x77\x69\x6E\x64\x6F\x77\x2E\x74\x6F\x70\x2E\x6C\x6F\x63\x61\x74\x69\x6F\x6E\x2E\x68\x72\x65\x66\x3D\x6C\x75\x66\x72\x76\x32\x3B",ykzjr1);
> </script></body></html>
> =============
>
> Just in case the above would have executed for some readers, I
> replaced "javascript" with "hello" on the above line.  The above
> would have given this news server a "line too long" error, so I broke
> the line after the ";" in various places (if it matters).
>
> What does that script decode to, or try to do?

I'd start by converting those hexadecimal values to the corresponding ascii 
character. The string ykzjr1 gives http://nursingpharm.com, probably the 
remaining part does something in order to redirect the browser there, check 
it out
-- 
"Un pasto senza vino e' come un giorno senza sole"
Anthelme Brillat Savarin 

Back to comp.lang.javascript | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Can anyone decode this malware script? Javascript Guy <"Javascript"@Guy. com> - 2014-02-17 10:22 -0500
  Re: Can anyone decode this malware script? "ViLco" <villiber@tin.it> - 2014-02-17 16:45 +0100
    Re: Can anyone decode this malware script? "ViLco" <villiber@tin.it> - 2014-02-17 16:51 +0100
    Re: Can anyone decode this malware script? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2014-02-18 01:21 +0100

csiph-web