Today I got a Blackhole Exploit Kit message which lead to a landing page – http://forumibiza.ru:8080/forum/links/column.php – with a new ( for me) – simpler – obfuscation. They didn’t insert random characters in the strings but ignored every pair of two characters which started with an equal sign „=“. My piRadix program guested the radix correct but the preparation for piDecode failed and naturally the decoding failed. I added a simple line to delete all pairs starting with „=“ and everything worked fine with old and new obfuscation.
| sed ’s#=.##g‘ \
Here comes the new script: