misshapen.html

[WOLVERINE]

I recieved the following email from a bogus sender. "tell me what you think"

I have no clue as to what this does. I suspect it to be malicious. However Norton SystemWorks 2003 detects nothing wrong with it. Can anyone tell me what this does?

<!-- saved from url=(0022)http://internet.e-mail -->
<script language="JavaScript">
thieve = new Array(63,
232,205,147,51,146,120,0,118,146,252,
220,107,38,66,6,138,142,36,164,66,
214,217,202,75,169,13,239,32,26,160,
48,128,133,247,42,90,126,119,84,103,
158,190,88,67,132,126,171,169,117,52,
44,26,30,229,121,36,68,46,148,26,
246,94,52,133,112,73,142,47,78,11,
246,90,120,217,228,114,98,208,0,219,
4,157,30,53,179,138,8,70,252,20,
112,49,26,62,189,206,143,35,49,206,
227,36,18,52,200,227,147,129,13,168,
245,162,254,161,186,130,144,167,228,88,
173,64,244,164,220,116,124,196,13,51,
56,144,126,213,222,179,89,37,118,135,
129,255,164,54,115,253,14,159,19,55,
116,203,24,160,84,134,176,84,193,38,
95,37,241,222,178,233,44,230,214,144,
43,146,73,37,11,166,252,220,107,52,
13,3,159,217,78,192,114,254,134,223,
5,188,4,244,101,74,161,116,140,142,
237,126,76,101,47,15,102,218,228,20,
23,199,98,174,188,98,52,44,12,122,
131,42,123,24,113,196,25,156,24,0,
166,96,0,209,106,76,66,163,87,52,
145,240,126,106,137,2,192,31,201,3,
110,242,220,90,67,231,85,75,13,5,
101,242,218,197,56,108,223,163,121,78,
104,148,177,143,152,17,237,245,250,188,
165,238,129,147,241,250,124,137,111,210,
199,224,82,18,239,101,88,8,186,12,
140,229,142,106,81,53,184,169,221,151,
7,85,219,0,243,115,3,85,133,60,
223,58,232,132,35,159,105,92,105,254,
222,224,188,100,238,132,220,60,201,27,
126,30,234,211,232,107,34,66,12,135,
144,90,199,53,185,216,152,94,234,65,
229,40,24,242,96,222,194,186,24,121,
60,101,90,107,218,239,123,88,215,121,
226,160,121,125,107,92,28,173,123,61,
77,97,135,69,187,8,6,227,113,73,
158,119,3,65,199,49,63,216,228,123,
119,205,67,221,20,201,26,103,249,133,
8,78,251,85,102,102,70,56,242,214,
199,53,103,209,240,58,76,116,214,229,
200,203,75,189,188,158,218,245,190,207,
157,233,179,108,134,60,132,132,241,83,
70,230,114,27,64,227,74,154,228,143,
56,2,63,173,161,144,192,70,18,137,
77,160,48,10,72,214,106,194,64,129,
196,45,162,83,66,39,144,240,216,245,
75,197,235,187,126,140,58,95,41,184,
185,153,3,100,99,35,184,245,109,142,
8,149,183,246,102,194,32,212,4,60,
212,68,166,192,208,13,31,66,16,60,
30,170,252,115,121,224,68,140,148,62,
41,50,0,90,170,116,63,22,125,201,
87,234,112,120,255,48,89,223,115,5,
82,164,6,122,210,243,121,112,136,80,
145,78,213,8,96,242,209,90,88,225,
91,35,58,22,104,240,131,195,54,114,
144,190,40,8,56,254,215,198,199,84,
253,160,173,236,168,238,135,142,224,188,
54,202,105,210,147,228,7,29,172,114,
84,10,234,26,195,164,152,119,28,121,
173,235,156,205,66,8,134,94,189,57,
19,83,142,63,208,40,175,128,112,254,
65,94,90,145,242,201,216,9,195,241,
187,28,231,85,67,47,184,190,131,3,
104,13,43,167,151,122,142,9,142,160,
255,75,156,46,166,19,38,196,60,223,
207,248,96,3,35,51,5,53,140,239,
10,24,212,51,207,217,44,121,46,78,
80,172,125,37,21,99,133,66,186,9,
23,177,98,71,130,121,3,91,190,27,
43,216,236,114,57,207,23,145,80,138,
1,99,243,215,71,9,171,103,0,55,
4,109,226,129,158,16,74,172,236,84,
10,76,241,223,214,160,45,131,162,192,
153,157,155,174,168,204,149,69,200,71,
233,181,180,100,125,214,60,22,24,176,
66,129,180,199,55,1,104,218,206,145,
146,83,81,197,71,168,50,88,24,136,
45,143,114,162,134,63,172,95,79,105,
224,178,134,233,115,160,216,146,54,203,
27,55,89,251,148,184,35,33,95,64,
205,140,6,222,113,209,239,134,27,232,
0,234,46,19,243,47,193,131,252,48,
75,105,39,72,101,196,254,70,9,169,
7,254,163,48,104,98,70,91,171,39,
105,75,36,136,83,177,15,80,253,124,
86,206,33,97,63,246,75,120,208,250,
126,99,131,31,145,19,140,0,123,249,
215,88,21,180,14,54,57,57,87,238,
211,128,56,114,150,171,123,23,57,219,
244,152,131,1,191,160,173,236,230,190,
209,241,143,230,123,200,96,202,142,243,
83,15,161,99,92,16,171,73,135,168,
197,111,24,37,191,228,217,141,83,94,
198,90,239,59,0,78,203,116,128,38,
175,134,120,244,94,66,113,170,203,252,
239,44,175,203,147,43,153,67,60,85,
251,158,187,120,62,2,6,156,222,76,
128,39,168,136,214,73,246,21,238,34,
7,248,45,223,207,248,96,3,35,37,
84,86,242,220,60,11,139,111,173,183,
105,55,3,37,49,207,38,100,64,53,
139,75,234);
philosophers = new Array(3,
128,185,254,95,172,117,10,123,152,241,
214,87,68,45,98,243,176,41,174,79,
220,229,186,107,200,97,134,71,116,157,
18,227,224,153,94,63,12,85,106,91,
248,209,54,55,164,13,194,211,16,9,
14,47,60,197,26,75,40,65,230,39,
212,125,114,195,64,121,190,31,108,53,
202,59,88,177,150,23,4,237,34,179,
112,233,110,15,156,165,122,43,136,33,
70,7,52,93,210,163,160,89,30,255,
204,21,42,27,184,145,246,247,100,205,
130,147,208,201,206,239,252,133,218,11,
232,1,166,231,148,61,50,131,0,57,
126,223,44,245,138,251,24,113,86,215,
196,173,226,115,48,169,46,207,92,101,
58,235,72,225,6,199,244,29,146,99,
96,25,222,191,140,213);
celled = 1064;
Lyon = 167;
var allotted = "";
for(meeker = 0; meeker < celled; meeker++)
  allotted = allotted + String.fromCharCode(thieve[meeker] ^ philosophers[meeker % Lyon]);
document.write(allotted);
</script>

[QuietDean]

Its a almost clever way of getting spam past your spam filters.

The array is character codes with an offset. The loop below it runs through and basically writes a html page.

I didn't bother working out much of it, but its basically an invite to join an 'adult' site. Typical spam, in other words.