Forum

Quoted from Casual

So I got bored…

Affected page: http: //www .share-screen.org/124124115-jpeg/

First I looked up the whois data, didn’t get lucky.

The html loads some (obfuscated) javascript which was very easy to unpack… Just some ads or w/e…

The interesting part is the Java.jar applet, I googled for ‘jar decompiler’ and got this. Source.

It has some shitty string obfuscation, all it does is download “http: //ge.tt/api/1/files/9DdTmjQ/3/blob?download.exe”, save in your temp directory and run it.

At this point, err, I fail to download that… So yeah if anyone can figure out how to dl that, would be nice.

EDIT: http://ge.tt/9DdTmjQ/v/0 <- file appears to have been removed :(

Casual detective on work