Was just sent a JS virus. How do I safely display the output?

Question

I just received a virus that looks something like this

<script type='text/javascript'>
<!--
var s="=nfub!iuuq.frvjw>#sfgsfti#!------REST OF PAYLOAD REMOVED-----?";
m=""; 
for (i=0; i<s.length; i++) 
{   
if(s.charCodeAt(i) == 28)
{     
m+= '&';
}
 else if 
(s.charCodeAt(i) == 23) 
{     m+= '!';} 
else 
{     
 m+=String.fromCharCode(s.charCodeAt(i)-1); 
}}
document.write(m);//-->
</script>

I'm not a JS expert but I would like to decrypt the contents of that string. Can you tell me the best way to alter document.write to see what it's doing?

Answer 1

Since m is a String, you can just replace document.write() by alert(). Jsfiddle demo.

It seem to be creating a meta refresh header, probably with intent to inject it in the head of the current HTML page in order to redirect to a different (malicious?) page.

Answer 2

Just create a <textarea id="foo"></textarea>, and write

document.getElementsById('foo').value = m;

---

Alternatively, you could encode < and & to < and & and keep the document.write.

---

FYI, the payload starts with

<meta http-equiv="refresh" 

so looks like it just redirects the user into the a malicious site.

Answer 3

Don't run it your browser, instead try running it in FireBug for example (except document.write(m) line - just use FireBug to see contents of m variable).

Most of these embed an iframe into your site

Answer 4

Use Malzilla to decode the URL. http://malzilla.sourceforge.net/