A download Trojan-Downloader.Win32.Delf.ajm, a novel web page

EndurerOriginal

1Version

The webpage content is a Javascript script, which consists of three parts:

Part 2 is a comment:
/---------
/* GW] 22y! 9 yzbyvwyva] + TUV * y {Y] {UW] {Y] y!] F u * UGF] f * YG] vly Z] vay * ugr] {cytg] TBU {* ug + Y + Z] + TU & 9] ytu + UVR] GW] F *] F! Y & Z] + ou su {Guggu {] y2uv] 1uvf] ff] y2yy] */execScript/* Y] + 2yxr] * Fu * zuc0ylc] x * u * t] Y + u! 9u! Z] G2] f *] f y & G] {fug */
---------/

Part 1 is used (" And ") include executable code:
/---------
("/43/100/176 /...... /157/144/145 ")
---------/
The code in the middle is omitted. We can see that escape characters are used here.

Part 2 is still annotated:
/---------
/* Lfuvxufuvfux] Z9] zbyvg] 9uv2ufuvfux] 2fu +] {fug] + 0] + Sy {2] G * yy2yvlyf % Y + * u! Gy! Z] {& uvxyfc] yt] wv] + oyg2] y! Y & 9yy! Yvwyv +] + 3uv & Y {Y] * u8] {w] + *] + su UV)] + * y */
---------/

As Part 1 of the executable code contains escape characters, the easiest way is to disconnect the network and run the web page once ......

The result is:
/---------
#@~ ^ Lwwaaa = [km; S + yrs ...... Vb * hgccaa == #~ @ JScript. encode
---------/
I have omitted the intermediate code.

If you see the characters starting with the code, you may think of encode (), and the final JScript. encode exposes the target.

Use JScript. decode to decode ......

[Recommended] encryption and decryption of online webpage script code
Http://endurer.bokee.com/2047776.html

OK!
/---------
Document. Write (Unescape ('% 3C % 53% 43% 52 ...... % 54% 3E '))
---------/

Let it run the script again to get a piece of VBScript. The function is to use Microsoft. XMLHTTP and SCR accept pting. fileSystemObject downloads the FICS/fics.exe file from a website, saves it as % Temp %/svhost.exe, and uses shell. the Application Object qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq's ShellExecute method is used for running.

/---------
File Description: D:/test/fics.exe
Attribute: ---
An error occurred while obtaining the file version information!
Creation Time: 14:59:58
Modification time: 14:59:59
Access time: 15:45:13
Size: 41984 bytes, 41.0 KB
MD5: 233662893d8ad2f929a8d4b12be37f5f
---------/
Kaspersky reportsTrojan-Downloader.Win32.Delf.ajm.

This virus has been encountered before, for example:

A website added to the download Trojan Trojan-Downloader.Win32.Delf.ajm
Http://endurer.bokee.com/5932854.html
Http://blog.csdn.net/Purpleendurer/archive/2006/12/07/1434118.aspx
Http://blogone.net/user50/endurer/blog/48105243.html