All I see on decompiling is things like:
var eval ("\x01") = 930;
while (while (while (while (while (while (while (while (while (while
(while (while (while (while (while (while (while (while (eval ("\x01")
== 930) {
eval ("\x01") = eval ("\x01") - 695}
, eval ("\x01") == 67) {
eval ("\x01") = eval ("\x01") + 718// branch @1
}
, eval ("\x01") == 349) {
eval ("\x01") = eval ("\x01") + 149// branch @1
}
, eval ("\x01") == 264) {
eval ("\x01") = eval ("\x01") + 84}
Am I missing something?
-Mike
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Michael
Stuhr
Sent: Wednesday, September 20, 2006 5:05 PM
To: Flashcoders mailing list
Subject: Re: [Flashcoders] Decompiling some sketchy flash code
Michiel Nolet schrieb:
> Dear List,
>
> First off, apologies if this is the wrong forum for this question.
Some background -- I'm in the online advertising industry and I've been
trying to track down an squash a scam that has been hitting the
industry. There is a party out there (errorsafe.com) that is embedding
some very nasty code in their flash ads that depending on several
factors will popup a new window and try install their spyware using
active-x.
>
> Here are two sample swf files:
> http://content.yieldmanager.com/13312/94749/27e558c94df509ebe888fdc006
> 0640e8.swf
> http://content.yieldmanager.com/17344/138497/6d4ef47cf4071557d6749ad9c
> 2fcf8cc.swf
>
>
i tried to decompile them with asv (latest version). i can clearly see
what is inside there. i would give you the rebuild files, but maybe you
should ask burak himself (he is on this list) to give you those.
micha
_______________________________________________
Flashcoders@chattyfig.figleaf.com
To change your subscription options or search the archive:
http://chattyfig.figleaf.com/mailman/listinfo/flashcoders
Brought to you by Fig Leaf Software
Premier Authorized Adobe Consulting and Training http://www.figleaf.com
http://training.figleaf.com
_______________________________________________
Flashcoders@chattyfig.figleaf.com
To change your subscription options or search the archive:
http://chattyfig.figleaf.com/mailman/listinfo/flashcoders
Brought to you by Fig Leaf Software
Premier Authorized Adobe Consulting and Training
http://www.figleaf.com
http://training.figleaf.com
