Blackhole with new Obfuscation

In a former article I described a method to deobfuscate Blackhole obfuscated JavaScript with shell commands and two simple C-programs.

Today I got a Blackhole Exploit Kit message which lead to a landing page – http://forumibiza.ru:8080/forum/links/column.php – with a new ( for me) – simpler – obfuscation. They didn’t insert random characters in the strings but ignored every pair of two characters which started with an equal sign „=“. My piRadix program guested the radix correct but the preparation for piDecode failed and naturally the decoding failed. I added a simple line to delete all pairs starting with „=“ and everything worked fine with old and new obfuscation.

| sed ’s#=.##g‘ \

Here comes the new script:

„Blackhole with new Obfuscation“ weiterlesen