[Webinar] Streamline your web hosting managementRegister Today

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1279
  • Last Modified:

What's <script language=3D"JScript.Encode"> ?

Hi,

I have encountered a particular spammer's email today (among thousands...), which ends with an encoded script:

<script language=3D"JScript.Encode">#@~^owAAAA=3D=3D~@#@&[Km!:+      YcADbYn`E@=
!(o"bHA~?"Z'r4OYa)JzdtC.=7FNRtKdYbxL (ky&sbxVR4OsVE,=7F&fK_'W*!,C3qVCPxWc!=
,oIzH2~6]fAI{!~?/]}SJqg!'rxGE,/Yzs=7F'ENbdaVCH)      Wx=7Fir@*@!JqoIzH3@*E#i@#@=
&EC8AAA=3D=3D^#~@</script>

I have seen MS Jscript encoding <script language="JScript.Encode"> many times, but never <script language=3D"JScript.Encode">.  I couldn't decode the script using scrdec15.exe or zwdecode.exe; thus won't risk running the codes.  Could anyone enlighten me with what kind of encoding scheme this is and how could I decode it please?

Thanks.
0
iuhh
Asked:
iuhh
  • 3
  • 2
1 Solution
 
ahoffmannCommented:
sounds like the sender or your MUA used M$ strange character encoding 'cause of the =3D, =7F
replace these by their original charater, also remove the line endings =
0
 
iuhhAuthor Commented:
Many thanks ahoffmann, that makes perfect sense.  But as I replaced all '=3D' to '=', and removed '=7F' along with the character immediately follows (as I understand, 7F is delete), I am still unable to decode this script fully - Incorrect checksum error from scrdec15.  With zwdecode, I am just able to make out 'document.write', 'http://' and 'html' from the gibberish, so I'm guessing, it'll download an evil script from somewhere else and will save it to harddisk, possibly then execute the script.  

I really want to get the bottom of this.  Anything else I can do to straight this encoded text up? Thanks.
0
 
ahoffmannCommented:
}   =7F  
?
0
 
iuhhAuthor Commented:
Thanks ahoffmann.  I've tried replacing =7F with ' ', '', '?', '}' but still can't decode the script.  What exactly does 'DEL' map to?

Cheers.
0
 
ahoffmannCommented:
sorry, I'm no M$ guru, you need to check your docs (they should be perfect, telling you all you need, I was told once ...)
0

Featured Post

Evaluating UTMs? Here's what you need to know!

Evaluating a UTM appliance and vendor can prove to be an overwhelming exercise.  How can you make sure that you're getting the security that your organization needs without breaking the bank? Check out our UTM Buyer's Guide for more information on what you should be looking for!

  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now