【Web前端问题】高手进！恶意JS代码分析

Z时代
2024-01-10
分类：技术分享

先叙述下缘由，我今天收到了一封勒索邮件，说是我密码在访问不安全网站时被泄露，黑客掌握了我的所有信息，还给我电脑上植入的木马，即使修改邮件密码也没用，如果不在48h之内支付九百多美金的比特币就会把我的信息公示到网上！
看到第一眼我差点信了，后来一想我的邮箱是自己设置的，只用来接收邮件，从未在其他地方登陆过，仔细分析了下我觉得是属于欺骗，其实并没有我的相关信息，后来谷歌了下确实也证实了，属于乱撞，有不谨慎的可能真的会给他打钱！
后来我就想知道这份邮件里面真的有么有藏着木马啥的，发现没有附件，于是打开这封邮件的源码，发现里面有这么一段js,我格式化了一下贴出来

< script >
var w = 3Dwindow;
if (w.performance || w.mozPerformance || w.msPerformance || w.webki = tPerformance) {
    var d = 3Ddocument;
    AKSB = 3Dw.AKSB || {}, AKSB.q = 3DAKSB.q || [], AKSB.m = ark = 3DAKSB.mark ||
    function(e, _) {
        AKSB.q.push(["mark", e, _ || (new Date).getTime( = )])
    }, AKSB.measure = 3DAKSB.measure ||
    function(e, _, t) {
        AKSB.q.push(["measure", e, = _, t || (new Date).getTime()])
    }, AKSB.done = 3DAKSB.done ||
    function(e) {
        AKSB.q.push = (["done", e])
    }, AKSB.mark("firstbyte", (new = 20
    Date).getTime()), AKSB.prof = 3D {
        custid: "641075",
        ustr: "",
        originlat: "0",
        clientr = tt: "19",
        ghostip: "217.212.224.166",
        ipv6: false,
        pct: "10",
        clientip: "46.183.219.=
233",
        requestid: "2120224a",
        region: "27660",
        protocol: "h2",
        blver: 14,
        akM: "x",
        akN = : "ae",
        akTT: "O",
        akTX: "1",
        akTI: "2120224a",
        ai: "441803",
        ra: "false",
        pmgn: "",
        pmgi = : "",
        pmp: "",
        qc: ""
    }, function(e) {
        var _ = 3Dd.createElement("script");
        _.async = 3D "=
async", _.src = 3De;
        var = 20
        t = 3Dd.getElementsByTagName("script"),
            t = 3Dt[t.length - 1];
        t.parentNode.insertB = efore(_, t)
    }(("https:" = 3D = 3D = 3Dd.location.protocol ? "https:" : "http:") + "//ds-a=
ksb-a.akamaihd.net/aksb.min.js")} < /script>