How to decrypt a javascript file

Question

I just discovered a virus in my computer that uses a .js file to attack. I opened the file in notepad to check out the code, but it is completely encrypted. I can see some data that makes sense (such as bhynivmao.length!=4), but the majority of the file is filled with gibberish.

There is also an autorun.inf and even though I can see some of the shell \open\command, I am not able to figure out the rest of the gibberish that is present.

Looks like both the autorun and the .js file are obfuscated the same way. Can someone please help me to get back the readable code? I am really curious to know how this thing works.

Thanks for the response. Here is the pastebin link to the autorun.inf file pastebin.ca/2376210 also the link for the gc2c9c.js file called by the autorun pastebin.ca/2376212 and a third file(icece.js) i found on the computer. The other 2 were found in the USB stick. pastebin.ca/2376213 Please take a look at it.. — Flipsyde
– Flipsyde, Commented May 8, 2013 at 5:18

MMM · Accepted Answer · 2013-05-07 10:42:10Z

6

Try using something like a JS beautifier:

http://jsbeautifier.org/

It will still keep the old variable names, but will definitely make the code more readable.

answered May 7, 2013 at 10:42

MMM

7,3402 gold badges27 silver badges42 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Flipsyde Over a year ago

Thanks. I will also try using JS beautifier and see what happens.

Flipsyde Over a year ago

Wow.. It looks more readable now(Though i still haven't figured out what the code does). Looks like both icece.js and gc2c9c.js contain the same code. Here is the pastebin link for the beautified code. pastebin.ca/2376219

Alexander Craggs · Accepted Answer · 2017-11-23 01:16:49Z

4

You might also consider using http://jsnice.org, which uses statistical analysis of code to identify variable names. It complements http://jsbeautifier.org well by altering variable names but not structure.

answered Nov 23, 2017 at 1:16

Alexander Craggs

8,9775 gold badges30 silver badges48 bronze badges

Collectives™ on Stack Overflow

How to decrypt a javascript file

2 Answers 2

2 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related