Pishing code analysis 1-2-3

1. I got this SMS from scammer.


2. I open it using my PC and open developer mode.

All source code is hexa encoded and Some bitwise XOR encoded. 

So, I decrypt it as // described. whereas function hzIU1(hzIU1) return bitwise XOR with 79 (i.e. ret = hzIU1^79). 
eval String.FromCharCode("79XOR encoded text")

4. Now, I decript it using javascript code. 

5. Which is,

Its code is to check browser type (ios or android) then to only android install pWkYfD.apk)

This code took me 3 hours to decode but it is good example of phishing






Comments

Popular posts from this blog

[VS2010][VS2015] "stdafx.h 을 포함 소스를 찾을 수 없습니다" 에러 해결법