[argyllcms] Re: Fwd:

  • From: Dan Wilcox <dmwilcox@xxxxxxxxx>
  • To: argyllcms@xxxxxxxxxxxxx
  • Date: Thu, 7 Feb 2013 00:41:37 -0800

Another one, don't touch it.  I have fun pulling these apart, it's just
xor'd with 76, the garbage at this link re-directs to this common evil site
like so:

"<script>function delayer(){window.location.href = '
http://www.fox5.news.rushnws.com/?s=ot'}; setTimeout('delayer()',
330);</script>"

For the curious, nothing special all the instructions for decoding it are
right there in the file, I just did it in python instead of javascript.

>>> for i in urllib.unquote(d):
...   result.append(chr(ord(i) ^ 76))
>>> print ''.join(result)
 On Feb 6, 2013 11:24 PM, "Pascal de" <pmjdebruijn@xxxxxxxxx> wrote:

> http://erdjembe.it/2mhsnd.php?s=ot
>
>
>

Other related posts: