Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #23133 > unrolled thread

Can anyone decode this malware script?

Back to article view | Back to comp.lang.javascript

Contents

  Can anyone decode this malware script? Javascript Guy <"Javascript"@Guy. com> - 2014-02-17 10:22 -0500
    Re: Can anyone decode this malware script? "ViLco" <villiber@tin.it> - 2014-02-17 16:45 +0100
      Re: Can anyone decode this malware script? "ViLco" <villiber@tin.it> - 2014-02-17 16:51 +0100
      Re: Can anyone decode this malware script? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2014-02-18 01:21 +0100

#23133 — Can anyone decode this malware script?

The following link probably tries to trigger a browser exploit of some
sort, so handle this with care:

hxxp://202.29.80.23/~info/sensors.php

The link was contained in a spam email.

The server responds with this:

============
<html><body><script type="text/hello">ykzjr1="\x30";
lufrv2="\x68\x74\x74\x70\x3A\x2F\x2F\x6E\x75\x72\x73\x69\x6E\x67\x70\x68\x61\x72\x6D\x2E\x63\x6F\x6D";
setTimeout("\x77\x69\x6E\x64\x6F\x77\x2E\x74\x6F\x70\x2E\x6C\x6F\x63\x61\x74\x69\x6F\x6E\x2E\x68\x72\x65\x66\x3D\x6C\x75\x66\x72\x76\x32\x3B",ykzjr1);
</script></body></html>
=============

Just in case the above would have executed for some readers, I replaced
"javascript" with "hello" on the above line.  The above would have given
this news server a "line too long" error, so I broke the line after the
";" in various places (if it matters).

What does that script decode to, or try to do?

Is there an on-line javascript decoder that would have processed the
above and given some sort of report or decoded result?

[toc] | [next] | [standalone]

#23134

Javascript Guy" <"Javascript wrote:


> The server responds with this:
>
> ============
> <html><body><script type="text/hello">ykzjr1="\x30";
> lufrv2="\x68\x74\x74\x70\x3A\x2F\x2F\x6E\x75\x72\x73\x69\x6E\x67\x70\x68\x61\x72\x6D\x2E\x63\x6F\x6D";
> setTimeout("\x77\x69\x6E\x64\x6F\x77\x2E\x74\x6F\x70\x2E\x6C\x6F\x63\x61\x74\x69\x6F\x6E\x2E\x68\x72\x65\x66\x3D\x6C\x75\x66\x72\x76\x32\x3B",ykzjr1);
> </script></body></html>
> =============
>
> Just in case the above would have executed for some readers, I
> replaced "javascript" with "hello" on the above line.  The above
> would have given this news server a "line too long" error, so I broke
> the line after the ";" in various places (if it matters).
>
> What does that script decode to, or try to do?

I'd start by converting those hexadecimal values to the corresponding ascii 
character. The string ykzjr1 gives http://nursingpharm.com, probably the 
remaining part does something in order to redirect the browser there, check 
it out
-- 
"Un pasto senza vino e' come un giorno senza sole"
Anthelme Brillat Savarin 

[toc] | [prev] | [next] | [standalone]

#23135

ViLco wrote:

> I'd start by converting those hexadecimal values to the corresponding
> ascii character. The string ykzjr1 gives http://nursingpharm.com,
> probably the remaining part does something in order to redirect the
> browser there, check it out

Some info on that scammers' site

http://www.sitejabber.com/reviews/www.nursingpharm.com
-- 
"Un pasto senza vino e' come un giorno senza sole"
Anthelme Brillat Savarin 

[toc] | [prev] | [next] | [standalone]

#23143

ViLco wrote:
^^^^^
Please post using your real name.

> Javascript Guy" <"Javascript wrote:

Same here.  Also, there is no address.  Please fix.

>> The server responds with this:
>>
>> ============
>> <html><body><script type="text/hello">ykzjr1="\x30";
>> 
lufrv2="\x68\x74\x74\x70\x3A\x2F\x2F\x6E\x75\x72\x73\x69\x6E\x67\x70\x68\x61\x72\x6D\x2E\x63\x6F\x6D";
>> 
setTimeout("\x77\x69\x6E\x64\x6F\x77\x2E\x74\x6F\x70\x2E\x6C\x6F\x63\x61\x74\x69\x6F\x6E\x2E\x68\x72\x65\x66\x3D\x6C\x75\x66\x72\x76\x32\x3B",ykzjr1);
>> </script></body></html>
>> =============
>>
>> Just in case the above would have executed for some readers, I
>> replaced "javascript" with "hello" on the above line.  The above
>> would have given this news server a "line too long" error, so I broke
>> the line after the ";" in various places (if it matters).
>>
>> What does that script decode to, or try to do?
> 
> I'd start by converting those hexadecimal values to the corresponding
> ascii character. The string ykzjr1 gives http://nursingpharm.com, probably
> the remaining part does something in order to redirect the browser there,
> check it out

Since those are merely string escape sequences, there really is nothing to 
convert here.  Just type them between quotes in the script console.

And as for “ykzjr1”, I wonder how you got that idea.  It is merely the name 
of a property of the global object (assuming this would be executed by a 
script engine) whose value is "\x30" === "0".

Since that value is passed as second argument to setTimeout (which really is 
window.setTimeout and should be written so), it means the number of 
milliseconds after which the program (here) or function specified by the 
first argument is executed.  0 milliseconds means “immediately”; in 
practice, in modern browsers it means normalization to a minimum timeout 
value suitable for the respective platform so as to avoid extensive CPU load 
in case of repetition.  (However, one should not rely on that; safe values 
do not go below 10 ms; more is often better)  This is done here in order to 
circumvent measures implemented so that scripts cannot mislead or disturb 
the user.  In this case, the misleading and disturbing action would be

  window.top.location.href=lufrv2;

which would redirect them to the location specified by the value of the 
_“lufrv2”_ property (here) or variable.  The former is initialized here 
before equivalent to a string containing the URI that you mentioned.

-- 
PointedEars

Twitter: @PointedEars2
Please do not Cc: me. / Bitte keine Kopien per E-Mail.

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.javascript

csiph-web