Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #23143

Re: Can anyone decode this malware script?

Show all headers | View raw

ViLco wrote:
^^^^^
Please post using your real name.

> Javascript Guy" <"Javascript wrote:

Same here.  Also, there is no address.  Please fix.

>> The server responds with this:
>>
>> ============
>> <html><body><script type="text/hello">ykzjr1="\x30";
>> 
lufrv2="\x68\x74\x74\x70\x3A\x2F\x2F\x6E\x75\x72\x73\x69\x6E\x67\x70\x68\x61\x72\x6D\x2E\x63\x6F\x6D";
>> 
setTimeout("\x77\x69\x6E\x64\x6F\x77\x2E\x74\x6F\x70\x2E\x6C\x6F\x63\x61\x74\x69\x6F\x6E\x2E\x68\x72\x65\x66\x3D\x6C\x75\x66\x72\x76\x32\x3B",ykzjr1);
>> </script></body></html>
>> =============
>>
>> Just in case the above would have executed for some readers, I
>> replaced "javascript" with "hello" on the above line.  The above
>> would have given this news server a "line too long" error, so I broke
>> the line after the ";" in various places (if it matters).
>>
>> What does that script decode to, or try to do?
> 
> I'd start by converting those hexadecimal values to the corresponding
> ascii character. The string ykzjr1 gives http://nursingpharm.com, probably
> the remaining part does something in order to redirect the browser there,
> check it out

Since those are merely string escape sequences, there really is nothing to 
convert here.  Just type them between quotes in the script console.

And as for “ykzjr1”, I wonder how you got that idea.  It is merely the name 
of a property of the global object (assuming this would be executed by a 
script engine) whose value is "\x30" === "0".

Since that value is passed as second argument to setTimeout (which really is 
window.setTimeout and should be written so), it means the number of 
milliseconds after which the program (here) or function specified by the 
first argument is executed.  0 milliseconds means “immediately”; in 
practice, in modern browsers it means normalization to a minimum timeout 
value suitable for the respective platform so as to avoid extensive CPU load 
in case of repetition.  (However, one should not rely on that; safe values 
do not go below 10 ms; more is often better)  This is done here in order to 
circumvent measures implemented so that scripts cannot mislead or disturb 
the user.  In this case, the misleading and disturbing action would be

  window.top.location.href=lufrv2;

which would redirect them to the location specified by the value of the 
_“lufrv2”_ property (here) or variable.  The former is initialized here 
before equivalent to a string containing the URI that you mentioned.

-- 
PointedEars

Twitter: @PointedEars2
Please do not Cc: me. / Bitte keine Kopien per E-Mail.

Back to comp.lang.javascript | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Can anyone decode this malware script? Javascript Guy <"Javascript"@Guy. com> - 2014-02-17 10:22 -0500
  Re: Can anyone decode this malware script? "ViLco" <villiber@tin.it> - 2014-02-17 16:45 +0100
    Re: Can anyone decode this malware script? "ViLco" <villiber@tin.it> - 2014-02-17 16:51 +0100
    Re: Can anyone decode this malware script? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2014-02-18 01:21 +0100

csiph-web