[hcrewteam]

I have an HTMP Page which the source code is encrypted, please who can decrypt it, DM me, or write in the thread

[XxLysergicxX]

I have an HTMP Page which the source code is encrypted, please who can decrypt it, DM me, or write in the thread

Is it encrypted or encoded, whats it "encrypted" with? Whats the website?

[Dread.Reaper]

Post it here and let us try....

[hcrewteam]

This is the download link to the file, its an html page file in the zip, please let me know what you think if you can find a solution.

https://easyupload.io/xmt36d

[walle]

Code

<html id="html" data-emailvalue="[email protected]" data-fetch="" lang="en"><head><meta charset="UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Sharepoint</title>
<link rel="stylesheet" href="/w3css/4/w3.css"><style>

pArt of the code, if you want full source prepare 15$ btc and post your discord

[SIM-5063966]

! ATTENTION, I DON'T KNOW IF THE MAIN HTML FILE CONTAINS LINKS TO DOWNLOAD MALWARE, ADVERTISMENTS, ETC., PLEASE TAKE CARE

This is the first string decrypted: pastebin.com/5LZDQ17Z - html, contains the metadata about your page and the title
This is the second string decrypted: pastebin.com/EYw2GcLi - css
This is the 3rd string decrypted: pastebin.com/hpp2MVGE - html
This is the 4th string decrypted: pastebin.com/h5049WBt - js, this code is executed by eval in "outlook.html"

atob() decodes the string between parentheses from base64, you can do it manually with https://www.base64decode.org/. I also used https://beautifier.io/ to make the 4rd string more readable, you can continue doing this and will get the end result pretty fast. If you have some experience with programming you can as well automate the decoding.

From what I can see some variables have random names, you can find their initialization and change all it's instances to a more appropriate name.
An example from the js script:
const _0x7f19x2e = 'aHR0cHM6Ly9hcGkudGVsZWdyYW0ub3Jn';
...
another function uses atob(_0x7f19x2e) while concatenating more strings

This means that _0x7f19x2e is base64 encoded, after decoding we can see that in reality _0x7f19x2e = 'https://api.telegram.org'
Now you can rename it to something more readable like tgApiLink / replace it in the fetch function with it's content

Good luck!

[Dread.Reaper]

Code

<html id="html" data-emailvalue="[email protected]" data-fetch="" lang="en"><head><meta charset="UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Sharepoint</title>
<link rel="stylesheet" href="/w3css/4/w3.css"><style>

pArt of the code, if you want full source prepare 15$ btc and post your discord

Whats yours?