77 users online (1 members and 76 guests)  

Thread: misshapen.html


  Results 1 to 2 of 2

Related

  1. Replies: 1
  2. Replies: 7
  3. misshapen.html    Forum: Javascript Forum
    Replies: 1
  4. Replies: 1
  5. Replies: 0
  1. #1
    WOLVERINE's Avatar
    New User

    Status
    Offline
    Join Date
    Feb 2004
    Posts
    1

    misshapen.html

    I recieved the following email from a bogus sender. "tell me what you think"

    I have no clue as to what this does. I suspect it to be malicious. However Norton SystemWorks 2003 detects nothing wrong with it. Can anyone tell me what this does?

    Code:
    <!-- saved from url=(0022)http://internet.e-mail -->
    <script language="JavaScript">
    thieve = new Array(63,
    232,205,147,51,146,120,0,118,146,252,
    220,107,38,66,6,138,142,36,164,66,
    214,217,202,75,169,13,239,32,26,160,
    48,128,133,247,42,90,126,119,84,103,
    158,190,88,67,132,126,171,169,117,52,
    44,26,30,229,121,36,68,46,148,26,
    246,94,52,133,112,73,142,47,78,11,
    246,90,120,217,228,114,98,208,0,219,
    4,157,30,53,179,138,8,70,252,20,
    112,49,26,62,189,206,143,35,49,206,
    227,36,18,52,200,227,147,129,13,168,
    245,162,254,161,186,130,144,167,228,88,
    173,64,244,164,220,116,124,196,13,51,
    56,144,126,213,222,179,89,37,118,135,
    129,255,164,54,115,253,14,159,19,55,
    116,203,24,160,84,134,176,84,193,38,
    95,37,241,222,178,233,44,230,214,144,
    43,146,73,37,11,166,252,220,107,52,
    13,3,159,217,78,192,114,254,134,223,
    5,188,4,244,101,74,161,116,140,142,
    237,126,76,101,47,15,102,218,228,20,
    23,199,98,174,188,98,52,44,12,122,
    131,42,123,24,113,196,25,156,24,0,
    166,96,0,209,106,76,66,163,87,52,
    145,240,126,106,137,2,192,31,201,3,
    110,242,220,90,67,231,85,75,13,5,
    101,242,218,197,56,108,223,163,121,78,
    104,148,177,143,152,17,237,245,250,188,
    165,238,129,147,241,250,124,137,111,210,
    199,224,82,18,239,101,88,8,186,12,
    140,229,142,106,81,53,184,169,221,151,
    7,85,219,0,243,115,3,85,133,60,
    223,58,232,132,35,159,105,92,105,254,
    222,224,188,100,238,132,220,60,201,27,
    126,30,234,211,232,107,34,66,12,135,
    144,90,199,53,185,216,152,94,234,65,
    229,40,24,242,96,222,194,186,24,121,
    60,101,90,107,218,239,123,88,215,121,
    226,160,121,125,107,92,28,173,123,61,
    77,97,135,69,187,8,6,227,113,73,
    158,119,3,65,199,49,63,216,228,123,
    119,205,67,221,20,201,26,103,249,133,
    8,78,251,85,102,102,70,56,242,214,
    199,53,103,209,240,58,76,116,214,229,
    200,203,75,189,188,158,218,245,190,207,
    157,233,179,108,134,60,132,132,241,83,
    70,230,114,27,64,227,74,154,228,143,
    56,2,63,173,161,144,192,70,18,137,
    77,160,48,10,72,214,106,194,64,129,
    196,45,162,83,66,39,144,240,216,245,
    75,197,235,187,126,140,58,95,41,184,
    185,153,3,100,99,35,184,245,109,142,
    8,149,183,246,102,194,32,212,4,60,
    212,68,166,192,208,13,31,66,16,60,
    30,170,252,115,121,224,68,140,148,62,
    41,50,0,90,170,116,63,22,125,201,
    87,234,112,120,255,48,89,223,115,5,
    82,164,6,122,210,243,121,112,136,80,
    145,78,213,8,96,242,209,90,88,225,
    91,35,58,22,104,240,131,195,54,114,
    144,190,40,8,56,254,215,198,199,84,
    253,160,173,236,168,238,135,142,224,188,
    54,202,105,210,147,228,7,29,172,114,
    84,10,234,26,195,164,152,119,28,121,
    173,235,156,205,66,8,134,94,189,57,
    19,83,142,63,208,40,175,128,112,254,
    65,94,90,145,242,201,216,9,195,241,
    187,28,231,85,67,47,184,190,131,3,
    104,13,43,167,151,122,142,9,142,160,
    255,75,156,46,166,19,38,196,60,223,
    207,248,96,3,35,51,5,53,140,239,
    10,24,212,51,207,217,44,121,46,78,
    80,172,125,37,21,99,133,66,186,9,
    23,177,98,71,130,121,3,91,190,27,
    43,216,236,114,57,207,23,145,80,138,
    1,99,243,215,71,9,171,103,0,55,
    4,109,226,129,158,16,74,172,236,84,
    10,76,241,223,214,160,45,131,162,192,
    153,157,155,174,168,204,149,69,200,71,
    233,181,180,100,125,214,60,22,24,176,
    66,129,180,199,55,1,104,218,206,145,
    146,83,81,197,71,168,50,88,24,136,
    45,143,114,162,134,63,172,95,79,105,
    224,178,134,233,115,160,216,146,54,203,
    27,55,89,251,148,184,35,33,95,64,
    205,140,6,222,113,209,239,134,27,232,
    0,234,46,19,243,47,193,131,252,48,
    75,105,39,72,101,196,254,70,9,169,
    7,254,163,48,104,98,70,91,171,39,
    105,75,36,136,83,177,15,80,253,124,
    86,206,33,97,63,246,75,120,208,250,
    126,99,131,31,145,19,140,0,123,249,
    215,88,21,180,14,54,57,57,87,238,
    211,128,56,114,150,171,123,23,57,219,
    244,152,131,1,191,160,173,236,230,190,
    209,241,143,230,123,200,96,202,142,243,
    83,15,161,99,92,16,171,73,135,168,
    197,111,24,37,191,228,217,141,83,94,
    198,90,239,59,0,78,203,116,128,38,
    175,134,120,244,94,66,113,170,203,252,
    239,44,175,203,147,43,153,67,60,85,
    251,158,187,120,62,2,6,156,222,76,
    128,39,168,136,214,73,246,21,238,34,
    7,248,45,223,207,248,96,3,35,37,
    84,86,242,220,60,11,139,111,173,183,
    105,55,3,37,49,207,38,100,64,53,
    139,75,234);
    philosophers = new Array(3,
    128,185,254,95,172,117,10,123,152,241,
    214,87,68,45,98,243,176,41,174,79,
    220,229,186,107,200,97,134,71,116,157,
    18,227,224,153,94,63,12,85,106,91,
    248,209,54,55,164,13,194,211,16,9,
    14,47,60,197,26,75,40,65,230,39,
    212,125,114,195,64,121,190,31,108,53,
    202,59,88,177,150,23,4,237,34,179,
    112,233,110,15,156,165,122,43,136,33,
    70,7,52,93,210,163,160,89,30,255,
    204,21,42,27,184,145,246,247,100,205,
    130,147,208,201,206,239,252,133,218,11,
    232,1,166,231,148,61,50,131,0,57,
    126,223,44,245,138,251,24,113,86,215,
    196,173,226,115,48,169,46,207,92,101,
    58,235,72,225,6,199,244,29,146,99,
    96,25,222,191,140,213);
    celled = 1064;
    Lyon = 167;
    var allotted = "";
    for(meeker = 0; meeker < celled; meeker++)
      allotted = allotted + String.fromCharCode(thieve[meeker] ^ philosophers[meeker % Lyon]);
    document.write(allotted);
    </script>

  2. #2
    QuietDean's Avatar
    Administrator

    Status
    Offline
    Join Date
    Oct 2000
    Location
    Bournemouth, UK
    Posts
    2,662
    Its a almost clever way of getting spam past your spam filters.

    The array is character codes with an offset. The loop below it runs through and basically writes a html page.

    I didn't bother working out much of it, but its basically an invite to join an 'adult' site. Typical spam, in other words.
    If one of our members helps you, please click the icon to add to their reputation!
    No support via email or private message - use the forums!
    Before you ask, have you Searched?



Tags for this Thread