Does anyone recognize this script?

[pshall]

A student at our academy has created a seeminlgy malicious script and saved it in his home folder:

 

=============================================================

()

("Run File2)

(2)

(Edit File)

(User ISD)("AC36")

(Corrupt File)(error 0x983le)

(Files; Remove,)

(AppDataRestart)

(MKS.message ("Your Computer Has Been Reset")

(ShutDown.ISD.)

() )

""Run FlashMode.k61.""

(6.872)

'HardDrive:D:

Refresh"0x983le"

 

("Virus Detected")()

(3)(OS.Reset.15(8)

(End)

()

()

os.Reset

 

=======

 

Does anyone recognize the language and can tell me what script engine it is for?

 

Many thanks

[Steve21]

Does anyone recognize the language and can tell me what script engine it is for?

 

Many thanks

 

I think it's called boredism Either that or some game "hack" website.

 

Steve

[Achandler]

Looks like pseudocode to be honest, that is code that is kind of a plan of what is going to happen, but in terminology that is readable, as oppose to actual coding.

[X-13]

Looks made up to me.

 

It sort of references things, but I can't find any scripting language that looks like that.

 

Shutdown.ISD for example.

 

ISD, from what I know is Overcurrent shutdown.

 

Overcurrent shutdown (ISD)

Each phase has an overcurrent shutdown circuit, which turns off the corresponding outputs when the output current exceeds the shutdown trip threshold (above the maximum current rating: 2.0 A minimum). The TB62208FTG exits ISD mode and resumes normal operation when the STANDBY pin is changed from High to Low and then to High. This circuit provides protection against short-circuit by temporarily disabling the device. Important notes on this feature will be provided later.

 

Source. [Page 5.]

 

 

Le EDIT: Took too long... stupid work distracting me.

Edited October 24, 2012 by X-13

[Steve21]

Well the easiest bit "imo" is this "0x983le" if it's hex, then L can't exist in it....

 

Steve

[AWicher]

lol, comical low of the low, a wannabe script kiddy.

 

How did you find it out of curiosity?

[pshall]

The student was caught typing and saving it whilst being secretly monitored using Impero.

 

As for its content, I was hoping someone would recogize the general syntax - especially the parentesis around every command. The details are system specific - ISD is a local user name (it is the initials of our support department).

 

Thanks for the replies so far.

[localzuk]

Looks like the sort of thing someone could use as a trick - ie. stick some echos in there and @echo off and confuse someone.

[SYNACK]

Looks like pseudocode to be honest, that is code that is kind of a plan of what is going to happen, but in terminology that is readable, as oppose to actual coding.

 

Agreed, if I was to look into their intent, casuse an 'error' reboot, reflash the hd firmware with a new mbr (fail, they are two completely different things), fail with an error each time someone tries to boot.

 

The code would not do that without some major help from a very specific interpreter which probably does not exist and if it does should be an exe blocked by your policies.

[kernewek-sam]

Is it possible the student is just showing this to her/his mates to show off rather than it doing anything.

[ADMaster]

it is not a language I recognize, in addition to the "l" in the hex he has a few mis-matched quotes and parentheses.

I agree it looks like it is a joke / showing off.

 

What was the file name and extension, the extension will give you a clue to what language he thought it was.