What is this rubbish?

[Parabellum7]

Roger that, thanks for clarifying. It seems it would be difficult to 
figure out what they're up without taking on a major project ...

-K



On 09/04/2016 09:24 PM, Michael Butash wrote:
> Obfuscated code, apparently this is more common these days to do.  
> There's something that does a hash off the posted payload input that 
> interprets the real code and functions behind it as it is read.
>
> I was reading about something like this not long ago the motions to 
> reverse engineer malware payloads from hacker-news posted research 
> used to keep their business under wraps.  They figured out how to 
> reverse the algorithm and read the code the same as they would to 
> interpret the payload and run it when hitting the site, noting what 
> sort of havoc was being performed when executed, some sort of windoze 
> 0-day.
>
> They do something like this with android apk apps to keep them 
> "secure" and keep crappy other devs from pilfering code.
>
> I always run noscript for firefox and scriptsafe on chrome's, it's 
> worth the hassle.
>
> -mb
>
>
> On 09/04/2016 02:39 PM, Parabellum7 wrote:
>>
>> Greetings fellow penguins,
>>
>>
>> Today I received a suspicious message with a link to some rather odd 
>> looking (javascript?) code. If you'd like to see it I put it on 
>> pastbin. *Obviously, don't download it or run it. *
>>
>> http://pastebin.com/B1f9M70U
>>
>>
>> It came from this URL: *Don't click this unless you're up on dealing 
>> with unknown.* I purposely put spaces in it so someone here doesn't 
>> accidentally click it anyway, like I stupidly did.
>>
>>
>>       h e l p - m e m b e r . c o m / e b a y d o c s / s c r e e n s
>>       h o t s . p h p
>>
>>
>> Fortunately I have no script running so I don't think ... er, hope 
>> ... nothing happened.
>>
>> Any idea what this is?
>>
>>
>> Thanks!
>>
>> --Kenn
>>
>>
>>
>>
>> ---------------------------------------------------
>> PLUG-discuss mailing list -PLUG-discuss at lists.phxlinux.org
>> To subscribe, unsubscribe, or to change your mail settings:
>> http://lists.phxlinux.org/mailman/listinfo/plug-discuss
>
>
>
>
> ---------------------------------------------------
> PLUG-discuss mailing list - PLUG-discuss at lists.phxlinux.org
> To subscribe, unsubscribe, or to change your mail settings:
> http://lists.phxlinux.org/mailman/listinfo/plug-discuss

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.phxlinux.org/pipermail/plug-discuss/attachments/20160906/9d6fba8a/attachment.html>