[악성코드 분석] JavaScript_3

BEEUM·2024년 7월 28일
post-thumbnail

기존 코드

<html><body><script>function ShowtExt(s) {var r = new Array();var curr = 0;while(s.charAt(curr) != "\r") {var tmp = 0;for (var i=6; i>=0 ; i-- ){if (s.charAt(curr) == " "){tmp = tmp | (Math.pow(2,i));}curr++;}r.push(String.fromCharCode(tmp));}return r.join("");}Function(ShowtExt("   	  	  				    		 		 					 		      			 	  		  	   	 	    		    			    				    	 		  	 		   	      	   		    	 	 			 	 		      			 	  		  	   	 	    		    			    				    	 		  	 		   	      	   		 					  	 		    		  	 					   	 		  	 			  		 	 	 					  	      			 	   		    			     	 	    		 	  	 		   	   	  		   	 					  	      		  		 					   	 		  	 			  		 	 	 					  	 		   	   	   	 		  		 	   	   	  		 		  		 	   		 			 					  	  	   		 	   				   	   	  	 		   	   	  		   	 					  	      		  		 					  			    	      	  	   	  	    	 	   	   	  	 		   			    				    	 		  	 		   	      	   		 					  			 	    		 	 					  	  	   				   	 	    	 		   	   	  		   	 					   	 		  	 			  		 	 	 					  	  	   		 	    		     		    				   		     		 	 	 					  		 		  	 		   		  	  		  	  	 		   			     	 	   	  		   	 			 					   	 		  	    	 					   	 	   	   	  		 		  		 	    		 	   		     	 		  				   	   	  		 			 	  			 					   	 	    		     	 	   				   	  		  	  		    		 	 					   	     	 		    	 		  	 				 					  			    	      	   	  		  	   	 	    		    	 		   	   	  		   	 					  				   	   	  		 			 					  				   	  	   			 	  	 		   		      	 	   	       	 	    		  	 					  	  		  				   	   	  		      	 	   				   		     		 	 	 	   		 					 	 	 		  	 			  		 	 	 					  	      			 	  		  	   	 	    		    			    				    	 		  	 		   	      	   		 					  	  	   	 		   		     	 			   	 			 					  			 	  		 	 	 					  		 	   	 		    	 		  	 			  		 	    		 		 					   	 	   	   	  	 		   	   	   	 		  		 	   	   	   	 		  	 		   	      	   	  				   	  			 					  	       		 		 					  	 		   	   	   	 		  		 	   	   	   	 		  	 		   	      	   	  				   	  			 						 	 			  				   	  		   	 		  	 			  	       	 	   		     	 				 					  	 		   	   	   	 		  		 	   	   	   	 			 					   	 	    		     	 	   				   	  		  	  		    		 	 					  	 		    		  	 					  			    	      	   	  	   	  	       	 		  		 	   		 			 	 		 	 	  			 					  				   	   	  		 			 					  	 		    		  	 					  				   			    			    	      	  	    				  	  		  	 		    		    	 			  		 	   		 			 					   	     	 		    	 		  	 				 					  			    	 		    		 	  			     	 	   	  	   	  		  	      			     	 	    	 		  	 		   	      	   		 						 	 			   	 		  				   	  		  	 	    	 		   	   	  		   	 					  				    		 	  	       	 	   	   	  		 			 					   	 		  	 			  		 	 	 					   		     	 	   			 	  	 	 	  		 	   			     	 			 	 		 	 	  			 					   	 		  	 			  		 	 	 					   	 	    		    		 	 	 					  	      		  		 					  	 	 	  				    		 	  		     	      	   		 						 	 			   	 		  		 	   			    	 			  	   	  	 		   			    				   	  			 					  	  		  				   	   	  		      	 	   				   		     		 	 	 					  	      		  		 					  				 	 					   				   		 	  	      		  	  		 	    		     		    	 		   	      	   		 	 		 	 	  			 					  				   	   	  		 			 					   	 		  	 			  		 	 	 					   	 	    		    		 	 	 					  	      		  		 					  				   	   		 					  				    		 	  		     	       	 			 						 	 			  	 		   	   	  		      		 	  	       	 	    					 					  	  		  				   	   	  		      	 	   				   		     		 	 	 	 		 	 					  	      		  		 					  	  		  	 		   	  	   	 		    	 		  		 	   		 			 					  			    	      	  	   	  	    	 	   	   	  	 		   			    				    	 		  	 		    	  	  		 	 	 					   	  	  				   	  		   	 	   		 	 	 					   	 		  	    	 					  	       	 	    	 		   		    	 		   		 		  		 	    		 	   		  	 	   		 			 		 	  		 		 	   			 	  	  		 	    	 	 			 	 				 	 			 	  			 	  	 	 	  		  	 	   		 	  					 				  							 			  	 			 		 	  		 		      			 	  		  	   	 	    		    			    				    	 		  	 		   	      	   		  		 		    	 	 			 	   	 		  	 			  		 	 	 					  	      			 	  		  	   	 	    		    			    				    	 		  	       		 		 					  	 		   	   	   	 		   		 	  	      		 		   	 	   			    		 	    		  	 					  	   	  		 	    	   	 					   				  	 		   		 	   			    		 	    		  	 					  	      		  		 					  			    	      		 		  		 	 	 					   	 		  	 			  				    	 			 					  				    		 	  		 	 	 					  	  	   		 	   				   	   	   	 			 					   	 		  	    	 					   				   		 	  	       	 		  		 	   			     	 			 					  				   	   	  		 			 					  		 		  		 	   		  	  		 	   	   	  		 			 					  				   		     				   	 		   	   	   		     	 			 					  		 		  		 	   			 	   	 	   		     		     	 		   	   	  		   	 					  				   	   	  		 			 					   		 	  		 	    	  	  		 	    		 	   		    		 	 	 	  	   		 	   	   	  		     	 		   	   	  		 	   		 	    		 	  	 		   	   	  		   	 	   		 						 			 		   	     	     	 			  	 		   	  		  		 	 	 	 				  			 	 	 		   				   	  		  		 	    		 	   	 			 	 				 			 	 		 		   	   	  		  	  	 		   	   	  	 		    	 		  		 	 	 					  	  		  	      	       				 	   		  	   	 			  	  	 		   	   	  		 			 					   	 		  	 			  		 	 	 					   	  	  				   	  		   	 	   		 	 	 					  	      		  		 					   	 		  	 			  		 	 	 					 		 	   			 	  	  		 	 					   	  	  				    		 	  	 		   				   			 	  	  		  		 	 	 			 		 	 		 	   	  \r"))();</script></body></html>

공백을 이용했기 때문에 초기에는 확인이 되지 않음!!

notepad++ 기준 보기 → 기호보기 → 공백과 탭 보기 선택하여 코드 확인

코드해석

function ShowtExt(s) {var r = new Array();var curr = 0;while(s.charAt(curr) != "\r") {var tmp = 0;for (var i=6; i>=0 ; i-- ){if (s.charAt(curr) == " "){tmp = tmp | (Math.pow(2,i));}curr++;}r.push(String.fromCharCode(tmp));}return r.join("");}

공백, 탭을 제외한 앞부분의 코드를 해석해면
공백 = 1, 탭 = 0으로 변환하고 있다.

CyberChef

1. 공백, 탭 변환

공백, 탭 부분만 복사 후 데이터 변환
필터 : find/replace
공백 = 1, 탭 = 0으로 변환한다

변환 후

1110110110000111100100100000100111111000101100110111010111100111100011110000111101001101001110111111011100111101010001010011111100010110011011101011110011110001111000011110100110100111011111101110010000011010011110011010000011101001101000110010101000001101111110001011100111100011111010111100101101001110111011001110100000110111111001100100000111010011010001100101010000011010011101110111010011001011101110110010011001011100100010000011011011100101110000111011101101001110111011001110100000110111111001100100000110001111011111101101110110111101011101110110100111000111100001111010011010011101111110111001000001100010111100101000001101101110000111010111101001110111011001110100000111010011010001100101010000011011011100101111001111100111100001110011111001010100000110010011010011100110110011011010011100011111010111011001110100010000011101001101111010000011101011101110110010011001011110010111001111101001100001110111011001000101100010000011101011110011111010111000011101100110110011110010100000111011111010011110100110100001000001100011110111111011101100110111010111100111101001110111011001110100000110000111011101100100010000011000011101101110001011010011100111111010111011111110101111001101000001101100110000111011101100111111010111000011100111110010101011100100000101010011010001100101010000011011111100010110011011101011110011110001111000011110100110100111011111101110010000011011011101001110011111010001110100010000011000101100101010000011001011101001111010011010001100101111001001000001110101110111011010011101110111010011001011101110111010011010011101111110111011000011101100010000011011111110010010000011010011101110111010011001011101110111010011010011101111110111011000011101100010000001010001100001110110011101001101000110111111101011100111110100001000001101001110111011101001100101110111011101000100000111010111100111110101110000111011001101100111100101000001101001111001101000001100011110111111011101101110110111111101001100101110010001010010101100010000011000011101110110010001000001101001111001101000001100001110001111000111101111110110111100001101100110100111100111101000110010111001000100000111011111010011110100110100001000001100011110100111100101100011111010111011011101100110111111000111110101111010011010011101111110111001000000101000111010011000011101100110101111010011101110110011101000001100001111001011011111110101110111011001000100000111010011010001100101010000011100111110101110001011010101100101110001111101000101001010110001000001110100110100011001010100000111010111100111100101010000011011111100110010000011010101100001111001011001111101111110111001000000101000111010011001011100011110100011011101101001110001111000011101100010000011011001100001110111011001111110101110000111001111100101010000011011111100110010000011000010100000111000011100101101111110011011001011110011111001111010011101111110111001010010101100010000011000011101110110010001000001110100110100011001010100000111010111100111100101010000011011111100110010000011000011101110010000011000011110010110011111011111110100010000001010001101001110111011001111110010110111111101011110000010000011011001100001110111011001111110101110000111001111100101010100101000001101111110011001000001101100110100111011011101001111010011001011100100010000011000111101111110110111011011110101110111011010011100011110000111101001101001111011011001010100000111011011000011101100111010111001010100000111010011011110100000110111111101011110100111001111010011100100110010111100101110011010111001000100101100100101110001011011001011110101000101000010100010110001011010101100110101110010110000010000110000000100011010001001011001001111110001011001101110101111001111000111100001111010011010011101111110111001100100111101010001011101001101000110010101000001101111110001011001101110101111001111000111100001111010011011111110010010000011010011101110111010011100101101111110010011101011100011110010111100110100000110111011001011110111010000011100001101001110010111000111100101111001101000001101111110011001000001100011110111111001001100101010000011101001101000110000111101000100000110000111100101100101010000011011011100101110000111011101110100010000011101001101111010000011100001110010110111111101001100101110001111101000100000110000111011101100100010000011001001100101110011011001011101110110010001000001100001110011111000011101001110111011100111110100010000011001001100101110001011101011100111110011111010011101110110011101000001100001110111011001000100000111001011001011110110110010111100101110011110010101011011100101110111011001111101001110111011001011100101111001011010011101110110011101011100100000010001001110111110111110100011010011101100110010101010000110001010100111000011101100110010111100101110100010100001000101001001110111011001101101001110111011010011110100110010101000001101100110111111011111110000101110011011101000110110100111011101100100010000011101001101000110010101000001110110110000111011001110101110010101000001101111110011001000001110100110100011001010100000100101110001011011001010000011101101100001111001011010011100001110001011011001100101010001001010010111011

2. Binary 변환

해당 데이터를 한번 더 변환한다.
필터 : from binary (Byte Length : 7)
🔥 해당 데이터가 아스키 데이터로 인코딩 되었기 때문에 Byte Length를 7로 설정
🔥 1에서 변환된 데이터를 hex로 변환 시 아스키 범위를 넘지 않기 때문에 아스키 데이터라고 추측

결과

KEY : BEEUM90!@#

다른 방법

개발자 도구에서 더 간단하게 확인하는 방법도 있다.

1. 함수정의

2. console.log() 로 확인

profile
정보보안 꿈나무

0개의 댓글