Decode this?

[crim]

Does anyone know how i can decode this?
I've tried Wepawet & jsunpack and none of them are able to decode this

[SysAdMini]

Can you tell us the url of the script ?

The script requires "document.lastModified" property. I won't decode without this information.

[crim]

its fragus

Code: [Select]

http://redirectcounter1.com/news.php
/EDIT by SysAdMini: added Code tags

[SysAdMini]

Using Malzilla:
 
-download the script

-get the lastmodified property from http header : Last-Modified: Fri, 12 Dec 2008 11:11:40 GMT


-replace lastmodified by its value:

acghiw=document,
befkly=acghiw.lastModified,
copvwx=new Date(befkly).toUTCString()


acghiw=document,
befkly="Fri, 12 Dec 2008 11:11:40 GMT",
copvwx=new Date(befkly).toUTCString()

-run the script
-done

example encoded and decoded attached. pw=infected

[SysAdMini]

JavaScript anti-analysis tricks: last-modified
http://www.cs.ucsb.edu/~marco/blog/2009/10/javascript-anti-analysis-tricks-last-modified.html