curiousinchicago
New Member
- Joined
- May 18, 2021
- Messages
- 1
I know I'm 9 years late, but over that time there's been a lot of people worried that this program is a virus. The last guy to post said that he would "decompile/disassemble it" to find the error but didn't end up doing it. I've come to the conclusion that it is not malicious and that all of the errors people were encountering were in-fact coming from the way the author obfuscated it.
I decompiled it using a program called Exe2Aut. This gave me a script that was heavily obfuscated and had an array with thousands of items. Turns out this array was populated by a file with .tbl extension that had all of the strings encoded in hex. I replaced the array values with their strings. The program can now run directly from the .au3 file (you need to install AutoIT).
At this point though, this program is not very useful because the domains that it fetched updates from (xbuc.net, and jqe360.com) are no longer active and now host spam sites. (so don't visit them)
PS: I found a rather cringy easter egg in the code
if you press alt + windows key + shift + ctrl + m
and enter the password "26112011" without qoutes it shows a messagebox with some sick poetry
If you want to look at the semi-deobfuscated .au3 file I've uploaded it to zippyshare
https://www57.zippyshare.com/v/27BDwBrU/file.html
I decompiled it using a program called Exe2Aut. This gave me a script that was heavily obfuscated and had an array with thousands of items. Turns out this array was populated by a file with .tbl extension that had all of the strings encoded in hex. I replaced the array values with their strings. The program can now run directly from the .au3 file (you need to install AutoIT).
At this point though, this program is not very useful because the domains that it fetched updates from (xbuc.net, and jqe360.com) are no longer active and now host spam sites. (so don't visit them)
PS: I found a rather cringy easter egg in the code
if you press alt + windows key + shift + ctrl + m
and enter the password "26112011" without qoutes it shows a messagebox with some sick poetry
If you want to look at the semi-deobfuscated .au3 file I've uploaded it to zippyshare
https://www57.zippyshare.com/v/27BDwBrU/file.html
Last edited:
