ajuda como descriptografar js por favor

traviezo · 09/08/2012

Hola amigos
Quisa me puedan ayudar a averiguar, que tipo de encriptacion se maneja esto o alguien lo pueda desencriptar

var _0xe0df=["\x77\x69\x64\x74\x68","\x37\x32\x38","\x68\x65\x69\x67\x68\x74","\x39\x30","\x73\x72\x63","\x68\x74\x74\x70\x3A\x2F\x2F\x77\x77\x77\x2E\x6D\x75\x73\x69\x63\x61\x6F\x6E\x6C\x69\x6E\x65\x6D\x70\x33\x2E\x6E\x65\x74\x2F\x61\x64\x73\x2F\x6D\x6F\x6D\x37\x32\x38\x78\x39\x30\x2E\x68\x74\x6D\x6C","\x33\x30\x30","\x32\x35\x30","\x68\x74\x74\x70\x3A\x2F\x2F\x77\x77\x77\x2E\x6D\x75\x73\x69\x63\x61\x6F\x6E\x6C\x69\x6E\x65\x6D\x70\x33\x2E\x6E\x65\x74\x2F\x61\x64\x73\x2F\x6D\x6F\x6D\x33\x30\x30\x78\x32\x35\x30\x2E\x68\x74\x6D\x6C","\x31\x36\x30","\x36\x30\x30","\x68\x74\x74\x70\x3A\x2F\x2F\x77\x77\x77\x2E\x6D\x75\x73\x69\x63\x61\x6F\x6E\x6C\x69\x6E\x65\x6D\x70\x33\x2E\x6E\x65\x74\x2F\x61\x64\x73\x2F\x31\x36\x30\x78\x36\x30\x30\x2E\x68\x74\x6D\x6C","\x31\x32\x30","\x68\x74\x74\x70\x3A\x2F\x2F\x77\x77\x77\x2E\x6D\x75\x73\x69\x63\x61\x6F\x6E\x6C\x69\x6E\x65\x6D\x70\x33\x2E\x6E\x65\x74\x2F\x61\x64\x73\x2F\x31\x32\x30\x78\x36\x30\x30\x2E\x68\x74\x6D\x6C","\x33\x33\x36","\x32\x38\x30","\x68\x74\x74\x70\x3A\x2F\x2F\x77\x77\x77\x2E\x6D\x75\x73\x69\x63\x61\x6F\x6E\x6C\x69\x6E\x65\x6D\x70\x33\x2E\x6E\x65\x74\x2F\x61\x64\x73\x2F\x33\x30\x30\x78\x32\x35\x30\x2E\x68\x74\x6D\x6C","\x34\x36\x38","\x36\x30","\x68\x74\x74\x70\x3A\x2F\x2F\x77\x77\x77\x2E\x6D\x75\x73\x69\x63\x61\x6F\x6E\x6C\x69\x6E\x65\x6D\x70\x33\x2E\x6E\x65\x74\x2F\x61\x64\x73\x2F\x34\x36\x38\x78\x36\x30\x2E\x68\x74\x6D\x6C","\x69\x66\x72\x61\x6D\x65","\x67\x65\x74\x45\x6C\x65\x6D\x65\x6E\x74\x73\x42\x79\x54\x61\x67\x4E\x61\x6D\x65","\x6C\x65\x6E\x67\x74\x68"];function addAdsI(_0x58ebx2){if(_0x58ebx2[_0xe0df[0]]==_0xe0df[1]&&_0x58ebx2[_0xe0df[2]]==_0xe0df[3]){_0x58ebx2[_0xe0df[4]]=_0xe0df[5];} else {if(_0x58ebx2[_0xe0df[0]]==_0xe0df[6]&&_0x58ebx2[_0xe0df[2]]==_0xe0df[7]){_0x58ebx2[_0xe0df[4]]=_0xe0df[8];} else {if(_0x58ebx2[_0xe0df[0]]==_0xe0df[9]&&_0x58ebx2[_0xe0df[2]]==_0xe0df[10]){_0x58ebx2[_0xe0df[4]]=_0xe0df[11];} else {if(_0x58ebx2[_0xe0df[0]]==_0xe0df[12]&&_0x58ebx2[_0xe0df[2]]==_0xe0df[10]){_0x58ebx2[_0xe0df[4]]=_0xe0df[13];} else {if(_0x58ebx2[_0xe0df[0]]==_0xe0df[14]&&_0x58ebx2[_0xe0df[2]]==_0xe0df[15]){_0x58ebx2[_0xe0df[4]]=_0xe0df[16];} else {if(_0x58ebx2[_0xe0df[0]]==_0xe0df[17]&&_0x58ebx2[_0xe0df[2]]==_0xe0df[18]){_0x58ebx2[_0xe0df[4]]=_0xe0df[19];} else {} ;} ;} ;} ;} ;} ;} ;var iframes=document[_0xe0df[21]](_0xe0df[20]);for(var i=0;i<iframes[_0xe0df[22]];i++){addAdsI(iframes);} ;

kj2 · 09/08/2012

pues si mal no estoy eso es hexadecimal.

kj

damefuego · 09/08/2012

Eso parece ser ioncube php encoder,
es un script de pago?
no es cosa facil deseioncubizarlo...

ZaySoft · 09/08/2012

no te puedo asegurar pero mas bien parece estar encriptado en JQuery.

kj2 · 09/08/2012

Si es hexadecimal, desencriptado sería algo como esto:

Inserir CODE, HTML ou PHP:

var _0xe0df=["width", "height", "src", "300", "http://www.musicaonlinemp3.net/ads/mom300x250.html", "600120336", "http://www.musicaonlinemp3.net/ads/300x250.html", "60","iframe", "length"];
function addAdsI(_0x58ebx2){if(_0x58ebx2[_0xe0df[0]]==_0xe0df[1]&&_0x58ebx2[_0xe0df[2]]==_0xe0df[3]){_0x58ebx2[_0xe0df[4]]=_0xe0df[5];
} else {
if(_0x58ebx2[_0xe0df[0]]==_0xe0df[6]&&_0x58ebx2[_0xe0df[2]]==_0xe0df[7]){_0x58ebx2[_0xe0df[4]]=_0xe0df[8];
} else {
if(_0x58ebx2[_0xe0df[0]]==_0xe0df[9]&&_0x58ebx2[_0xe0df[2]]==_0xe0df[10]){_0x58ebx2[_0xe0df[4]]=_0xe0df[11];
} else {
if(_0x58ebx2[_0xe0df[0]]==_0xe0df[12]&&_0x58ebx2[_0xe0df[2]]==_0xe0df[10]){_0x58ebx2[_0xe0df[4]]=_0xe0df[13];
} else {
if(_0x58ebx2[_0xe0df[0]]==_0xe0df[14]&&_0x58ebx2[_0xe0df[2]]==_0xe0df[15]){_0x58ebx2[_0xe0df[4]]=_0xe0df[16];
} else {
if(_0x58ebx2[_0xe0df[0]]==_0xe0df[17]&&_0x58ebx2[_0xe0df[2]]==_0xe0df[18]){_0x58ebx2[_0xe0df[4]]=_0xe0df[19];
} else {
} ;
} ;
} ;
} ;
} ;
} ;
} ;
var iframes=document[_0xe0df[21]](_0xe0df[20]);
for(var i=0;i<iframes[_0xe0df[22]];i++){
addAdsI(iframes[i]);
} ;

Cicklow · 09/08/2012

Inserir CODE, HTML ou PHP:

function addAdsI(_0x58ebx2) {
    if (_0x58ebx2['width'] == '728' && _0x58ebx2['he\x6 9ght'] == '90') {
        _0x58ebx2['src'] = 'ht tp://www.mus\x 69caonlinemp3. net/ads/mom7\x 328x90.html';
    } else {
        if (_0x58ebx2['width'] == '30\ x30' && _0x58ebx2['he\x6 9ght'] == '250') {
            _0x58ebx2['src'] = 'http://\ x77ww.musicaon\x6 Cinemp3.net/a\ x64s/mom300x25\x3 0.html';
        } else {
            if (_0x58ebx2['width'] == '160' && _0x58ebx2['he\x6 9ght'] == '60\x3 0') {
                _0x58ebx2['src'] = 'http://www.\x 6Dusicaonlinem p3.net/ads/1\x 360x600.html';
            } else {
                if (_0x58ebx2['width'] == '1\ x320' && _0x58ebx2['he\x6 9ght'] == '60\x3 0') {
                    _0x58ebx2['src'] = 'http://www .musicaonlin\x 65mp3.net/ads/ 120x600.html';
                } else {
                    if (_0x58ebx2['width'] == '336' && _0x58ebx2['he\x6 9ght'] == '280') {
                        _0x58ebx2['src'] = 'http\x3 A//www.musica\ x6Fnlinemp3.ne\x7 4/ads/300x250\ x2Ehtml';
                    } else {
                        if (_0x58ebx2['width'] == '468' && _0x58ebx2['he\x6 9ght'] == '60') {
                            _0x58ebx2['src'] = '\x 68ttp://www.mu sicaonlinemp\x 33.net/ads/468 x60.html';
                        } else {};
                    };
                };
            };
        };
    };
};
var iframes = document['getElemen\x 74sByTagName']('ifr\x6 1me');
for (var i = 0; i < iframes['l\ x65ngth']; i++) {
    addAdsI(iframes[i]);
};

Ale Hernandez · 09/08/2012

¿Por qué siempre ese afán de copiarle a los demás?

traviezo · 10/08/2012

gracias brother se le agradece

ajuda como descriptografar js por favor

traviezo

kj2

damefuego

ZaySoft

kj2

Cicklow

Ale Hernandez

traviezo

Tópicos similares