jsunpack - a generic JavaScript unpacker

lnkgt.com/8YG benign

[nothing detected] lnkgt.com/8YG
status: (referer=http:/twitter.com/trends/)saved 7218 bytes d31c8fc24b4be936d78c70a7f8824bbac2e361a8
info: ActiveXDataObjectsMDAC detected Microsoft.XMLHTTP
info: [meta refresh] URL=lnkgt.com/nojs.php
info: [img] lnkgt.com/off.gif
info: [decodingLevel=0] found JavaScript
suspicious: maxruntime exceeded 10 seconds (incomplete) 0 bytes
file: d31c8fc24b4be936d78c70a7f8824bbac2e361a8: 7218 bytes
file: 439c12102a1eaa5d8d8c8bd7f00677464779d90a: 8271 bytes
file: 201eec1c8fb9edd47bccee00d518a76b282d1083: 8277 bytes
file: bd13784539ce00ccc66051a69fc9acb0af890d01: 8486 bytes
file: 632c5c9f8a998e171eb4b3c0543910dcf1a59ea8: 8678 bytes
file: 45013f6818813890a818c36790f8fbc316e8ee53: 8392 bytes
file: d2453d55bf0a32751a23af927202a2a4c0cc37b3: 8516 bytes
file: ea29be058c0e7f478194f32249edc36d67071691: 7398 bytes
file: 5efe3f32816f0de00350e9766d428230e7d1127c: 7404 bytes
file: 33dc939b36acfad2803e271fa575e1c69d0fbe8d: 7613 bytes
file: d7d6bec092cc36dbba049a6d1a77724b50bb9380: 7805 bytes
file: c2d7bd8401c16b9613c32cf39537f772572dcd8f: 7519 bytes
file: 4df78f3db1dae9c9faa227af02370b4fcd38ec03: 7643 bytes

Decoded Files

d31c/8fc24b4be936d78c70a7f8824bbac2e361a8 from lnkgt.com/8YG (7218 bytes, 978 hidden) download

<html> <head><title>Your Password Will Be Available In A Moment</title> <noscript>Enable Javascript to access this page.<meta http-equiv="refresh" content="0;url=http://lnkgt.com/nojs.php"/></noscript> <script type="text/javascript">var closing = false;   var type = '';   var count = 75;var http = getHTTPObject();  function doauth() { if (closing == false) { setTimeout("doauth();", 10000); http.open("GET", "http://lnkgt.com/linkgatechecker.php?id=22668&alpha_id=8YG&aff=14225", true);http.onreadystatechange = handleHttpResponse; http.send(null); } }  function handleHttpResponse() { if (http.readyState == 4) {if (http.responseText != '') {rslt = http.responseText;if (rslt.indexOf('lk-') == 0){rslt = rslt.substring(3,rslt.length);closing = true;type = 'lk';}else if (rslt.indexOf('pw-') == 0){rslt = rslt.substring(3,rslt.length);closing = true;type = 'pw';} }if (type == 'lk'){document.getElementById('lnkDownload').onclick = null;document.getElementById('lnkDownload').href = rslt;document.getElementById('imgDownload').src = 'gt_continue.gif';document.getElementById('gw_content').style.display = 'none';}else if (type == 'pw'){document.getElementById('lnkPassword').onclick = function(){document.getElementById('divPassword_txt').innerHTML = rslt+'<br /><br />';document.getElementById('divPassword').style.display = '';};document.getElementById('imgPassword').src = 'gt_showpassword.gif';document.getElementById('gw_content').style.display = 'none';}// http.onreadystatechange = function(){};// http.abort(); } }  function getHTTPObject() { var xmlhttp; /*@cc_on @if (@_jscript_version >= 5) try {xmlhttp = new ActiveXObject("Msxml2.XMLHTTP"); } catch (e) {try {xmlhttp = new ActiveXObject("Microsoft.XMLHTTP");} catch (E) {xmlhttp = false;} } @else xmlhttp = false; @end @*/ if (!xmlhttp && typeof XMLHttpRequest != 'undefined') { try {xmlhttp = new XMLHttpRequest(); } catch (e) {xmlhttp = false; } } return xmlhttp; }function openoffer(offerid) {if (offerid == 8351){newwindow = window.open("http://adscendmedia.com/click.php?aff=14225&camp=8351&crt=0&gate=-22668&sid=lnkgt_8YG&p=aHR0cDovL2h0dHA6Ly90d2l0dGVyLmNvbS90cmVuZHMv", '_blank');}if (offerid == 8686){newwindow = window.open("http://adscendmedia.com/click.php?aff=14225&camp=8686&crt=0&gate=-22668&sid=lnkgt_8YG&p=aHR0cDovL2h0dHA6Ly90d2l0dGVyLmNvbS90cmVuZHMv", '_blank');}if (offerid == 3458){newwindow = window.open("http://adscendmedia.com/click.php?aff=14225&camp=3458&crt=0&gate=-22668&sid=lnkgt_8YG&p=aHR0cDovL2h0dHA6Ly90d2l0dGVyLmNvbS90cmVuZHMv", '_blank');}if (offerid == 8157){newwindow = window.open("http://adscendmedia.com/click.php?aff=14225&camp=8157&crt=0&gate=-22668&sid=lnkgt_8YG&p=aHR0cDovL2h0dHA6Ly90d2l0dGVyLmNvbS90cmVuZHMv", '_blank');}if (window.focus) {newwindow.focus();}   }</script>   <style>   a {text-decoration:none; color:#F20000;}   a:hover {text-decoration:underline; color:#F20000;}body {font-family:Verdana;font-size:15px;margin:0px;margin-top:30px;padding:0px;background-color:#FFFFFF;color:#000000;   }   .header {font-size:20px;font-weight:bold;text-align:center;   }   #gw_content {width: 655px;margin-left:auto;margin-right:auto;padding:15px;padding-bottom:20px;   }   #gw_offers {text-align:left;padding:15px;padding-left:25px;padding-top:10px;border-style:solid; border-width:1px; border-color:#B0B0B0;   }   .gw_offer {font-size:14px;color:#000000;margin-bottom:15px;   }   .gw_offer a {font-size:15px;   }   #gw_powered {font-size:10px;margin-left:10px;margin-bottom:10px;position:absolute; left:10px; bottom:5px;   }   /*#gw_dmca {font-size:10px;margin-right:10px;margin-bottom:10px;position:absolute; right:10px; bottom:5px;   }*/ </style>    </head> <body onload="doauth();">   <div align="center"><div style="width:770px; text-align:left;"><div class="header">Your Password Will Be Available In A Moment</div><br />To obtain the password we need you to take just a moment to complete these steps.<br /><br /><i style="font-size:120%;">1.</i> Choose one of the  offers below. Offers are usually short surveys or signup forms.<br /><br /><i style="font-size:120%;">2.</i> Fill out the offer with valid information and a working email address. If your information is detected as fake you will not be given access, and could be permanently locked out.<br /><br /><i style="font-size:120%;">3.</i> Once you've completed the offer, the Show Password button will turn green and be enabled.<br /><br />   </div>  <div id="gw_content"> <div id="gw_offers"><div style="text-align:right; position:relative;top:-8px;right:-8px; font-size:85%; color:#666666;">Offers</div><div class="gw_offer"><a href="javascript:openoffer(8351)" rel="nofollow">Win McDonalds Lunch For a Year!</a><br />Win McDonalds Lunch For a Year!</div><div class="gw_offer"><a href="javascript:openoffer(8686)" rel="nofollow">Get pumped to win a $3500 gas card!</a><br />Get pumped to win a $3500 gas card!</div><div class="gw_offer"><a href="javascript:openoffer(3458)" rel="nofollow">FREE sample of Snuggle Liquid Fabric

439c/12102a1eaa5d8d8c8bd7f00677464779d90a from lnkgt.com/8YG 201e/ec1c8fb9edd47bccee00d518a76b282d1083 from lnkgt.com/8YG bd13/784539ce00ccc66051a69fc9acb0af890d01 from lnkgt.com/8YG 632c/5c9f8a998e171eb4b3c0543910dcf1a59ea8 from lnkgt.com/8YG 4501/3f6818813890a818c36790f8fbc316e8ee53 from lnkgt.com/8YG d245/3d55bf0a32751a23af927202a2a4c0cc37b3 from lnkgt.com/8YG ea29/be058c0e7f478194f32249edc36d67071691 from lnkgt.com/8YG 5efe/3f32816f0de00350e9766d428230e7d1127c from lnkgt.com/8YG 33dc/939b36acfad2803e271fa575e1c69d0fbe8d from lnkgt.com/8YG d7d6/bec092cc36dbba049a6d1a77724b50bb9380 from lnkgt.com/8YG c2d7/bd8401c16b9613c32cf39537f772572dcd8f from lnkgt.com/8YG 4df7/8f3db1dae9c9faa227af02370b4fcd38ec03 from lnkgt.com/8YG

lnkgt.com/nojs.php benign

[nothing detected] (metarefresh) lnkgt.com/nojs.php
status: (referer=lnkgt.com/8YG)saved 1524 bytes 4dcc18fbd9cebc2ef6e98f418dba9e377ace0bce
file: 4dcc18fbd9cebc2ef6e98f418dba9e377ace0bce: 1524 bytes

Decoded Files

4dcc/18fbd9cebc2ef6e98f418dba9e377ace0bce from lnkgt.com/nojs.php (1524 bytes) download

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">  <html xmlns="http://www.w3.org/1999/xhtml"> <head>   <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />   <meta name="title" content="Please Enable JavaScript" />   <title>Please Enable JavaScript</title>   <link rel="stylesheet" type="text/css" href="main.css">  </head> <body>    <br /><br />   You must enable JavaScript to access the page that you were trying to view.<br /> Please enable Javascript using the appropriate instructions below, and then press your browser's Back button to return to the page that you were wanting.<br /><br /> <br />  <p><strong>Internet Explorer</strong></p> <ol>   <li>Select 'Tools' from the top menu</li>   <li>Choose 'Internet Options'</li>   <li>Click on the 'Security' tab</li>   <li>Click on 'Custom Level'</li>   <li>Scroll down until you see section labled 'Scripting'</li>   <li>Under 'Active Scripting', select 'Enable' and click OK</li> </ol> <p><strong>Mozilla Firefox</strong></p> <ol>   <li>Select 'Tools' from the top menu</li>   <li>Choose 'Options'</li>   <li>Choose 'Content' from the top navigation</li>   <li>Select the checkbox next to 'Enable JavaScript' and click OK</li> </ol> <p><strong>Apple Safari</strong></p> <ol>   <li>Select 'Safari' from the top menu</li>   <li>Choose 'Preferences'</li>   <li>Choose 'Security'</li>   <li>Select the checkbox next to 'Enable JavaScript'</li> </ol>   <br /><br />  </body> </html>

Submission permanent link 77cf19907d4835241b5126d37fc0d2b075fb245b (Received 2012-04-13 18:36:39, http://lnkgt.com/8YG )

All Malicious or Suspicious Elements of Submission

URL	Status
lnkgt.com/8YG	saved 7218 bytes d31c8fc24b4be936d78c70a7f8824bbac2e361a8