I remember coming across a malicious piece of javascript that found its way onto some websites a few years back. Just for fun, I traced it through the various s

I remember coming across a malicious piece of javascript that found its way onto some websites a few years back. Just for fun, I traced it through the various stages to find out what it did. I decoded the js to find out that it downloaded an executable. I used objdump to look at the executable and through some tinkering and google searching found out it was packed with upx. So I unpacked it and I think I went through one or two more stages (with the help of people on various forums) before we got to the raw binary. Someone on the forums also ran it in a VM and we found out it connected to one of a handful of ip addresses. After some tinkering and looking through the code, someone on the forums figured out that it stole WoW account passwords. It was a lot of fun and felt a bit like being a detective of some kind.