t of encoding it was using, and folks pointed me to the post at the SAN Internet Storm Center:
But that had few detail on how the encoding was done. Byte_Bucket from Pauldotcom pointed me at a tool called “Windows Script Encoder” from Microsoft that seems to be what was used. After doing some checking, the encoded part of the JSE starts with #@~^ , which is also what the MS tool creates.
(more…)
(more…)