Malware Domain List

Malware Related => Malware Analysis => Topic started by: securefire on October 22, 2009, 07:07:03 pm

Title: Help decode strange script file
Post by: securefire on October 22, 2009, 07:07:03 pm

I ran across this and have no idea what it is.
Can anybody tell me how to decode this?  Is it malicious?

hxxp://www.killerstartups.com/inc/adsensev2.js

 ???

Title: Re: Help decode strange script file
Post by: y0liny on October 22, 2009, 07:30:03 pm

nothing here

Title: Re: Help decode strange script file
Post by: SysAdMini on October 22, 2009, 07:37:16 pm

It's not malicious, but highly obfuscated.

Find decoded script attached. PW: "infected".

Explaining in detail how to decode might take a bit long.

Here are the steps:

-put it into Malzilla's decoder window
-click on "Templates" and choose any browser (navigator)
-run script
-choose the second eval result
-copy the output (bottom window) into clipboard
-replace "____    (O000);" with content of clipboard in top window
-replace "eval  (O0O0)" by "var naa=true;"
-run script
-that's it.  ;D