This code need corrections, like pointed above plus MRT database support.
Malicious removal tool database is not packed but instead it is obfuscated with XOR algorithm implemented as chains of data xored, where data type is unique xor key for block. Updated extractor will be posted later.
Also, here is the fun comments from developers left in database :) It is JScript initialization script from MRT database, multiple mentioned hashes are malware samples (you can google most of them).
Code: Select all// JSInit
//
// NOTE: on DBDEV builds any reference to an undefined value within the DOM (i.e., under 'document') will throw a reference error
// (which produces PLI for analysis) and will assert!
// a default document.location object
document.location = {
hostname : "www.myserver.com"
};
// Objects and functions used with Windows Scripting Host, to enable emulation and generate sigattr events
if ( !mp.getAttribute("//MpIsIEVScan") ) {
// b44436a06e71cac99d8395e3677af62f3e901269 document undifined in WSH
// removed, breaks tests, until a better way can be found to determine WSH context
// document = undefined;
var Scripting = {
// https://msdn.microsoft.com/en-us/library/6tkce7xa%28v=vs.84%29.aspx
FileSystemObject: {
// Methods
Add: function (strFolderName) {
},
BuildPath: function (strPath, strName) {
},
Close: function () {
},
Copy: function (strDest) {
mp.triggerEvent("Scripting.FileSystemObject.Copy()", strDest);
},
CopyFile: function (strSource, strDest) {
},
CopyFolder: function (strSource, strDest) {
},
CreateFolder: function (strFolderName) {
mp.triggerEvent("Scripting.FileSystemObject.CreateFolder()", strFolderName);
},
CreateTextFile: function (strFileName) {
mp.triggerEvent("Scripting.FileSystemObject.CreateTextFile()", strFileName);
return Scripting.FileSystemObject; // TextFileObject
},
Delete: function (bForce) {
},
DeleteFile: function (strFileSpec) {
mp.triggerEvent("Scripting.FileSystemObject.DeleteFile()", strFileSpec);
},
deleteFile: function (strFileSpec) {
mp.triggerEvent("Scripting.FileSystemObject.deleteFile()", strFileSpec);
},
DeleteFolder: function (strFolderSpec) {
},
DriveExists: function (strDriveSpec) {
return true;
},
FileExists: function (strFileSpec) {
mp.triggerEvent("Scripting.FileSystemObject.FileExists()", strFileSpec);
return true;
},
FolderExists: function (strFolderSpec) {
mp.triggerEvent("Scripting.FileSystemObject.FolderExists()", strFolderSpec);
},
GetAbsolutePathName: function (strPathSpec) {
// c37488e83c3b238c69cafa28687fc314d8ae6181 (Nemucod)
return "C:\\Documents and Settings\\Administrator\\Local Settings\\Temp\\"+strPathSpec;
},
GetBaseName: function (strPath) {
return strPath;
},
GetDrive: function (strDriveSpec) {
return strDriveSpec;
},
GetDriveName: function (strPath) {
return strPath;
},
GetExtensionName: function (strPath) {
return strPath;
},
GetFile: function (strFileSpec) {
return strFileSpec;
},
GetFileName: function (strPathSpec) {
return strPathSpec;
},
GetFileVersion: function (strPathSpec) {
return strPathSpec;
},
GetFolder: function (strFolderSpec) {
mp.triggerEvent("Scripting.FileSystemObject.GetFolder()", strFolderSpec);
return strFolderSpec;
},
GetParentFolderName: function (strPath) {
return strPath;
},
GetSpecialFolder: function (strFolderSpec) {
return strFolderSpec;
},
GetStandardStream: function (varStandardStreamType) {
return varStandardStreamType;
},
GetTempName: function () {
var tname = "rad" + Math.floor(Math.random()*1048575).toString(16) + ".tmp";
return tname;
},
Move: function (strDestination) {
},
MoveFile: function (strSource, strDestination) {
},
MoveFolder: function (strSource, strDestination) {
},
OpenAsTextStream: function () {
},
OpenTextFile: function (strFileName) {
mp.triggerEvent("Scripting.FileSystemObject.OpenTextFile()", strFileName);
return Scripting.FileSystemObject; // TextFileObject
},
Read: function (varCharacters) {
return varCharacters;
},
ReadAll: function () {
return "";
},
ReadLine: function () {
return "";
},
Skip: function (varCharacters) {
},
SkipLine: function () {
},
Write: function (strText) {
return strText;
},
WriteBlankLines: function (varLines) {
},
WriteLine: function (strText) {
mp.triggerEvent("Scripting.FileSystemObject.WriteLine()", strText);
return strText;
}
} // FileSystemObject
};
var MSXML2 = {
// https://msdn.microsoft.com/en-us/library/windows/apps/hh453379.aspx
XMLHTTP : {
// Events
onreadystatechange : 0,
ontimeout : 0,
// Property
constructor : this,
readyState : 4,
readystate : 4,
responseBody : "",
response : "",
responseText : "",
responseType : "blob",
responseXML : "",
status : 200,
Status : 200, //for f1054e8f2518a7598b1df40a0ca2069a42a42e73
statusText : "OK",
timeout : 0,
withCredentials : 0,
// Methods
abort: function () {
return 0;
},
addEventListener: function (strtype, varlistener, varuseCapture) {
},
dispatchEvent: function (varevt) {
},
getAllResponseHeaders: function () {
mp.triggerEvent("MSXML2.XMLHTTP.getAllResponseHeaders()"); return "HTTP/1.0 200 OK\x0ACache-Control: no-cache, no-store\x0APragma: no-cache\x0AContent-Type: application/octet-stream\x0A\x0A";
},
getResponseHeader: function () {
mp.triggerEvent("MSXML2.XMLHTTP.getResponseHeader()"); return "HTTP/1.0 200 OK\x0ACache-Control: no-cache, no-store\x0APragma: no-cache\x0AContent-Type: application/octet-stream\x0A\x0A";
},
open: function (strMethod, strUrl, varAsync, varUser, varPassword) {
mp.triggerEvent("MSXML2.XMLHTTP.open()", strMethod + " " + strUrl);
},
overrideMimeType: function (strmime) {
},
removeEventListener: function (strtype, varlistener, varuseCapture) {
mp.triggerEvent("MSXML2.XMLHTTP.removeEventListener()");
},
send: function (varBody) {
mp.triggerEvent("MSXML2.XMLHTTP.send()", varBody); if (this.onreadystatechange != 0) this.onreadystatechange();
},
setRequestHeader: function (strHeader, strValue) {
mp.triggerEvent("MSXML2.XMLHTTP.setRequestHeader()", strHeader + ":" + strValue);
}
}
};
var ADODB = {
Stream : {
// Property
Charset : "ascii",
EOS : true,
LineSeparator : -1,
Mode : 0,
Position : 0,
Size : 0,
State : 0,
Type : 2,
// lowercase properties for cc38315a262496200c11284fbad25aa44dd50183 (sample is buggy, incorrect filename generation)
position : 0,
type : 2,
// Methods
Cancel: function () {
},
Close: function () {
},
CopyTo: function (varDestStream, varNumChars) {
},
Flush: function () {
},
LoadFromFile: function (strFilename) {
mp.triggerEvent("ADODB.Stream.LoadFromFile()", strFilename);
},
Open: function (strSource, varMode, varOpenOptions, strUserName, strPassword) {
mp.triggerEvent("ADODB.Stream.Open()", strSource);
},
Read: function (varNumBytes) {
mp.triggerEvent("ADODB.Stream.Read()");
},
ReadText: function (varNumChars) {
},
SaveToFile: function (strFilename, varSavOptions) {
mp.triggerEvent("ADODB.Stream.SaveToFile()", strFilename);
},
Write: function (varBuffer) {
mp.triggerEvent("ADODB.Stream.Write()",varBuffer);
},
WriteText: function (varData, varOptions) {
mp.triggerEvent("ADODB.Stream.WriteText()",varData);
},
// lowercase methods, calling these is supported even though Javascript is case sensitive
open: function (strSource, varMode, varOpenOptions, strUserName, strPassword) {
mp.triggerEvent("ADODB.Stream.Open()", strSource);
},
read: function (varNumBytes) {
mp.triggerEvent("ADODB.Stream.Read()",varNumBytes);
},
write: function (varBuffer) {
mp.triggerEvent("ADODB.Stream.Write()", varBuffer);
},
close: function () {
mp.triggerEvent("ADODB.Stream.Close()");
},
saveToFile: function (strFilename, varSavOptions) {
mp.triggerEvent("ADODB.Stream.SaveToFile()", strFilename);
}
}
};
var WScript = {
// Properties
Arguments: {
// https://msdn.microsoft.com/en-us/library/ss1ysb2a%28v=vs.84%29.aspx
// b44436a06e71cac99d8395e3677af62f3e901269
// Properties
Item: {},
length: 0,
Named: {},
Unnamed: {},
// Methods
Count: function () { return 0;},
ShowUsage: function () { return ""; },
},
BuildVersion: 8820, // Wscript build on XPSP2 , typeof number (06D1315EE0BBA9276D9E4F053386B17282760563)
FullName: "C:\\WINDOWS\\system32\\wscript.exe",
Interactive: true, //
Name: "Windows Script Host",
Path: "C:\\WINDOWS\\system32",
ScriptFullName: "C:\\Documents and Settings\\Administrator\\Local Settings\\Temp\\script.js", // need to change will vary according to actual name
ScriptName: "script.js", // need to change will vary according to actual name
// https://msdn.microsoft.com/en-us/library/ddz9scc8%28v=vs.84%29.aspx
// These should be objects (3aeae0456b651d5a587ed5d41e9f9ff42ba609cd)
StdErr: {
Column: 1,
Line: 1,
},
StdIn: {
Column: 1, // a9d3cae5e1cdd841f9654e2718491c2d057f6e05
Line: 1, // 1acaf738df4de17fcbf5f2f6544f642d2e44c044
},
StdOut: {
Column: 1,
Line: 1,
},
Version: "5.6", // Wscript version on XPSP2
// Methods
ConnectObject: function (objEventSource, strPrefix) {
},
CreateObject: function (strProgID, strPrefix) {
mp.triggerEvent("WScript.CreateObject()",strProgID);
var strName = strProgID.toLowerCase();
if(strName == "scripting.filesystemobject") {
return Scripting.FileSystemObject;
}
else if(strName == "msxml2.xmlhttp" || (strName == "msxml2.xmlhttp.6.0")) {
return MSXML2.XMLHTTP;
}
else if(strName == "adodb.stream") {
return ADODB.Stream;
}
else if(strName == "wscript.shell") {
return WScript.Shell;
}
else if (strName == "wscript.network") {
return WScript.Network;
}
else if (strName.match(/^winhttp\.winhttprequest\./)) {
return WinHTTP.WinHttpRequest;
}
else if (strName == "shell.application") {
return Shell;
}
else {
print("CreateObject( " + strProgID + " )")
return Object();
}
}, // CreateObject
DisconnectObject: function (obj) {
},
Echo: function (strArg) { // typeof WScript.Echo() returns "unknown", which is a non standard type in JS
},
GetObject: function (strPathname) {
mp.triggerEvent("WScript.GetObject()",strPathname);
},
Quit: function (intErrorCode) {
},
Sleep: function (intTime) {
},
// lowercase
sleep: function (intTime) {
},
// Objects
Shell: {
// Property
CurrentDirectory: "C:\\Documents and Settings\\Administrator\\Local Settings\\Temp",
// https://msdn.microsoft.com/en-us/library/fd7hxfdd%28v=vs.84%29.aspx
// 31dadba8e475360d85b3ffea88f0b5366a78f335
Environment: function (strType) {
var System = function (strProperty) {
var strprop = strProperty.toLowerCase();
if (strprop == "number_of_processors") {
return "1";
}
else if( strprop == "processor_architecture"){
return "x86";
}
else if (strprop == "processor_identifier") {
return "x86 Family 6 Model 26 Stepping 5, GenuineIntel";
}
else if (strprop == "processor_level") {
return "6";
}
else if( strprop == "processor_revision"){
return "1a05";
}
else if( strprop == "os"){
return "Windows_NT";
}
else if( strprop == "comspec"){
return "%SystemRoot%\\system32\\cmd.exe"
}
else {
return "";
}
};
var User = function (strProperty) {
var strprop = strProperty.toLowerCase();
if( strprop == "path") {
return "C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem";
}
else if( strprop == "pathext"){
return "";
}
else if( strprop == "windir"){
}
else {
return "";
}
};
var Volatile = function (strProperty) {
return "";
};
var Process = function (strProperty) {
var strprop = strProperty.toLowerCase();
if( strprop == "number_of_processors") {
return "1";
}
else if( strprop == "processor_architecture") {
return "x86";
}
else if( strprop == "processor_identifier") {
return "x86 Family 6 Model 26 Stepping 5, GenuineIntel";
}
else if( strprop == "processor_level") {
return "6";
}
else if( strprop == "processor_revision") {
return "1a05";
}
else if( strprop == "os") {
return "Windows_NT";
}
else if( strprop == "comspec") {
return "C:\\WINDOWS\\system32\\cmd.exe";
}
else if( (strprop == "homedrive") || (strprop == "systemdrive") ) {
return "C:";
}
else if( strprop == "homepath") {
return "\\Documents and Settings\\Administrator";
}
else if( strprop == "path") {
return "C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem";
}
else if( strprop == "pathext") {
return ".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH";
}
else if( strprop == "prompt") {
return "";
}
else if( (strprop == "systemroot") || (strprop == "windir") ) {
return "C:\\WINDOWS";
}
else if( (strprop == "temp") || (strprop == "tmp") ) {
return "C:\\Documents and Settings\\Administrator\\Local Settings\\Temp";
}
else {
return "";
}
};
// check the type of Environment and return the property
var strenv = strType.toLowerCase();
if (strenv == "system") {
return System;
}
else if (strenv == "user") {
return User;
}
else if (strenv == "volatile") {
return Volatile;
}
else if (strenv == "process") {
return Process;
}
else {
return;
}
},
// 2987a163d974c7eb0feb8afdd61a6bc9872bd5bd
// https://msdn.microsoft.com/en-us/library/0ea7b5xe%28v=vs.84%29.aspx
SpecialFolders: function (strSpecialFolders) {
var strfolder = strSpecialFolders.toLowerCase();
if (strfolder == "allusersdesktop") {
return "C:\\Documents and Settings\\All Users\\Desktop";
}
else if (strfolder == "allusersstartmenu") {
return "C:\\Documents and Settings\\All Users\\Start Menu";
}
else if (strfolder == "allusersprograms") {
return "C:\\Documents and Settings\\All Users\\Start Menu\\Programs";
}
else if (strfolder == "allusersstartup") {
return "C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup";
}
else if (strfolder == "desktop") {
return "C:\\Documents and Settings\\Administrator\\Desktop";
}
else if (strfolder == "favorites") {
return "C:\\Documents and Settings\\Administrator\\Favorites";
}
else if (strfolder == "fonts") {
return "C:\\Windows\Fonts";
}
else if (strfolder == "mydocuments") {
return "C:\\Documents and Settings\\Administrator\\My Documents";
}
else if (strfolder == "nethood") {
return "C:\\Documents and Settings\\Administrator\\NetHood";
}
else if (strfolder == "printhood") {
return "C:\\Documents and Settings\\Administrator\\PrintHood";
}
else if (strfolder == "programs") {
return "C:\\Documents and Settings\\Administrator\\Programs";
}
else if (strfolder == "recent") {
return "C:\\Documents and Settings\\Administrator\\Recent";
}
else if (strfolder == "sendto") {
return "C:\\Documents and Settings\\Administrator\\SendTo";
}
else if (strfolder == "startmenu") {
return "C:\\Documents and Settings\\Administrator\\Start Menu";
}
else if (strfolder == "startup") {
return "C:\\Documents and Settings\\Administrator\\Start Menu\\Programs\\Startup";
}
else if (strfolder == "templates") {
return "C:\\Documents and Settings\\Administrator\\Templates";
}
else {
return "";
}
},
// Methods
AppActivate: function (strTitle) {
mp.triggerEvent("WScript.Shell.AppActivate()", strTitle);
},
CreateShortcut: function (strPathname) {
mp.triggerEvent("WScript.Shell.CreateShortcut()", strPathname);
},
Exec: function (strCommand) {
mp.triggerEvent("WScript.Shell.Exec()", strCommand); return 0;
},
ExpandEnvironmentStrings: function (strCommand) {
mp.triggerEvent("WScript.Shell.ExpandEnvironmentStrings()", strCommand);
// return location string, locations taken from kernel32 VDLL ExpandEnvironmentStrings()
var strName = strCommand.toLowerCase();
// Need to handle enviroment string like "%Temp%/"
var regexp = /([^\%]*)(\%[a-z]+\%)(.*)/;
// required for 512b8ceb894ba5f8c46c5f14b55b22e18ad52b37 and similar
var match = regexp.exec(strName);
var before = match[1];
var env = match[2];
var after = match[3]
var replaced = ""
if ((env == "%windir%") || env == "%systemroot%") {
replaced = "C:\\WINDOWS\\";
}
else if (env == "%temp%"){
replaced = "C:\\Documents and Settings\\Administrator\\Local Settings\\Temp";
}
else if (env == "%programfiles%"){
replaced = "C:\\Program Files";
}
else if (env == "%comspec%") {
replaced = "C:\\WINDOWS\\system32\\cmd.exe";
}
else if ((env == "%homedrive%") || env == "%systemdrive%") {
replaced = "C:";
}
else if (env == "%homepath%") {
replaced = "\\Documents and Settings\\Administrator";
}
else if (env == "%userprofile%"){
replaced = "C:\\Documents and Settings\\Administrator";
}
else if (env == "%appdata%") {
replaced = "C:\\Documents and Settings\\Administrator\\Application Data";
}
else {
replaced = "";
}
return before + replaced + after;
}, // ExpandEnvironmentStrings()
LogEvent: function (intType, strMessage, strTarget) {
mp.triggerEvent("WScript.Shell.LogEvent()");
},
Popup: function (strText, intSecondsToWait, strTitle, intType) {
mp.triggerEvent("WScript.Shell.Popup()");
},
RegDelete: function (strName) {
mp.triggerEvent("WScript.Shell.RegDelete()", strName);
},
RegRead: function (strName) {
mp.triggerEvent("WScript.Shell.RegRead()", strName);
var reg = strName.toLowerCase();
// quick fix for 1bab6a0b27560287e960e58d192971cedce02bd7
if (reg == "hkey_local_machine\\software\\microsoft\\windows nt\\currentversion\\softwaretype") {
return "System";
}
// 3c8133ee80bcee524fefb7d44a1a5898dd6d81fa
else if (reg == "hklm\\software\\microsoft\\windows nt\\currentversion\\systemroot"){
return "C:\\WINDOWS\\";
}
else {
return "";
}
},
RegWrite: function (strName, anyValue, strType) {
mp.triggerEvent("WScript.Shell.RegWrite()", strName);
},
Run: function (strCommand, intOptWindowStyle, bOptWaitOnReturn) {
mp.triggerEvent("WScript.Shell.Run()", strCommand);
},
SendKeys: function (string) {
mp.triggerEvent("WScript.Shell.SendKeys()");
},
// lower case methods, calling these is supported even though Javascript is case sensitive
exec: function (strCommand) {
mp.triggerEvent("WScript.Shell.Exec()", strCommand); return 0;
},
run: function (strCommand, intOptWindowStyle, bOptWaitOnReturn) {
mp.triggerEvent("WScript.Shell.Run()", strCommand);
},
}, // Shell
Network: {
// properties
ComputerName: "HAL9TH",
UserDomain: "ICTIM",
UserName: "Administrator",
// Methods
AddWindowsPrinterConnection: function (strPrinterPath) {
},
AddPrinterConnection: function (strLocalName, strRemoteName) {
},
EnumNetworkDrives: function () {
mp.triggerEvent("WScript.Network.EnumNetworkDrives()");
},
EnumPrinterConnections: function () {
},
MapNetworkDrive: function (strLocalName, strRemoteName) {
},
RemoveNetworkDrive: function (strName) {
},
RemovePrinterConnection: function (strName) {
},
SetDefaultPrinter: function (strPrinterName) {
},
} // Network
}; // WScript
// https://msdn.microsoft.com/en-us/library/6ch9zb09%28v=vs.94%29
// Constructor for Enumerator
var Enumerator = function (varObj) {
this._objItems = [];
for (var prop in varObj) {
if (varObj.hasOwnProperty(prop) && (typeof varObj[prop]) != "function") {
this._objItems.push(varObj[prop]);
}
}
this._index = 0;
};
Enumerator.prototype.atEnd = function() {
if (this._objItems.length < this._index) {
return false;
}
else {
return true;
}
};
Enumerator.prototype.item = function() {
if (this._index < this._objItems.length) {
return this._objItems[this._index];
}
};
Enumerator.prototype.moveFirst = function() {
this._index = 0;
};
Enumerator.prototype.moveNext = function() {
if (this._index < this._objItems.length) {
this._index++;
}
};
var WMI = {
// https://msdn.microsoft.com/en-us/library/aa394239%28v=vs.85%29.aspx#properties
Win32_OperatingSystem: {
// properties
BootDevice: "",
BuildNumber: "",
BuildType: "",
Caption: "",
CodeSet: "",
CountryCode: "",
CreationClassName: "",
CSCreationClassName: "",
CSDVersion: "",
CSName: "",
CurrentTimeZone: 0,
DataExecutionPrevention_Available: true,
DataExecutionPrevention_32BitApplications: true,
DataExecutionPrevention_Drivers: true,
DataExecutionPrevention_SupportPolicy: 0,
Debug: false,
Description: "",
Distributed: false,
EncryptionLevel: 0,
ForegroundApplicationBoost: 0,
FreePhysicalMemory: 0,
FreeSpaceInPagingFiles: 0,
FreeVirtualMemory: 0,
InstallDate: "",
LargeSystemCache: 0,
LastBootUpTime: "",
LocalDateTime: "",
Locale: "",
Manufacturer: "",
MaxNumberOfProcesses: 0,
MaxProcessMemorySize: 0,
MUILanguages: "",
Name: "",
NumberOfLicensedUsers: 0,
NumberOfProcesses: 0,
NumberOfUsers: 0,
OperatingSystemSKU: 0,
Organization: "",
OSArchitecture: "",
OSLanguage: 0,
OSProductSuite: 0,
OSType: 0,
OtherTypeDescription: "",
PAEEnabled: true,
PlusProductID: "",
PlusVersionNumber: "",
PortableOperatingSystem: false,
Primary: true,
ProductType: 0,
RegisteredUser: "",
SerialNumber: "",
ServicePackMajorVersion: 0,
ServicePackMinorVersion: 0,
SizeStoredInPagingFiles: 0,
Status: 0,
SuiteMask: 0,
SystemDevice: "",
SystemDirectory: "",
SystemDrive: "",
TotalSwapSpaceSize: 0,
TotalVirtualMemorySize: 0,
TotalVisibleMemorySize: 0,
Version: "",
WindowsDirectory: "",
QuantumLength: 0,
QuantumType: 0,
// Methods
Reboot: function () {
},
SetDateTime: function (datetime) {
},
Shutdown: function () {
},
Win32Shutdown: function (Flags) {
},
Win32ShutdownTracker: function (Timeout, Comment, ReasonCode, Flags) {
},
}, // Win32_OperatingSystem
// https://msdn.microsoft.com/en-us/library/aa393854%28v=vs.85%29.aspx
SWbemServices: {
// Properties
Security_: {},
// Methods
AssociatorsOf: function (strObjectPath) {
},
AssociatorsOfAsync: function (objWbemSink, strObjectPath) {
},
Delete: function (strObjectPath) {
},
DeleteAsync: function (strObjectPath) {
},
ExecMethod: function (strObjectPath, strMethodName) {
},
ExecMethodAsync: function (objWbemSink, strObjectPath, strMethodName) {
},
ExecNotificationQuery: function (strQuery) {
},
ExecNotificationQueryAsync: function (objWbemSink, strQuery) {
},
ExecQuery: function (strQuery) {
mp.triggerEvent("WMI.SWbemServices.ExecQuery()",strQuery);
var Query = strQuery.toLowerCase();
if (Query == "select * from win32_operatingsystem\", \"wql") {
return WMI.Win32_OperatingSystem;
}
else {
print("WMI.SWbemServices.ExecQuery( " + strQuery + " )")
return new Object();
}
},
ExecQueryAsync: function (strQuery) {
},
Get: function (strObjectPath) {
mp.triggerEvent("WMI.SWbemServices.Get()",strObjectPath);
},
GetAsync: function (objWbemSink, strObjectPath) {
},
InstancesOf: function (strClass) {
},
InstancesOfAsync: function (ObjWbemSink, strClass) {
},
ReferencesTo: function (strObjectPath) {
},
ReferencesToAsync: function (strObjectPath) {
},
SubclassesOf: function (strSuperclass) {
},
SubclassesOfAsync: function (ObjWbemSink, strSuperclass) {
},
}// SWbemServices
}; // WMI
var WinHTTP = {
// https://msdn.microsoft.com/en-us/library/windows/desktop/aa384106%28v=vs.85%29.aspx
// 011fae2fb1e4725a7a1b1f73a7da2f96499554e2
// 00bd7e67e1a8c57f51c43f3362becce8587cb737
WinHttpRequest: {
// Events
OnError: 0,
OnResponseDataAvailable: 0,
OnResponseFinished: 0,
OnResponseStart: 0,
// Property
Option: "", // https://msdn.microsoft.com/en-us/library/windows/desktop/aa384108%28v=vs.85%29.aspx
ResponseBody: "",
ResponseStream: "",
ResponseText: "",
Status: 200,
StatusText: "OK",
//// Methods
Abort: function () {
},
GetAllResponseHeaders: function () {
mp.triggerEvent("WinHTTP.WinHttpRequest.GetAllResponseHeaders()"); return "HTTP/1.0 200 OK\x0ACache-Control: no-cache, no-store\x0APragma: no-cache\x0AContent-Type: application/octet-stream\x0A\x0A";
},
GetResponseHeader: function (strHeader) {
mp.triggerEvent("WinHTTP.WinHttpRequest.GetResponseHeader()"); return "HTTP/1.0 200 OK\x0ACache-Control: no-cache, no-store\x0APragma: no-cache\x0AContent-Type: application/octet-stream\x0A\x0A";
},
open: function (strMethod, strUrl) {
mp.triggerEvent("WinHTTP.WinHttpRequest.open()", strMethod + " " + strUrl);
},
send: function (varBody) {
mp.triggerEvent("WinHTTP.WinHttpRequest.send()", varBody);
},
SetAutoLogonPolicy: function (varAutoLogonPolicy) {
},
SetClientCertificate: function (strClientCertificate) {
},
SetCredentials: function (strUsername, strPassword) {
},
SetProxy: function (varProxySetting, varProxyServer, varBypassList) {
},
SetRequestHeader: function (strHeader, strValue){
},
SetTimeouts: function (varResolveTimeout, varConnectTimeout, varSendTimeout, varReceiveTimeout) {
},
WaitForResponse: function (varTimeout) {
}
} // WinHttpRequest
}; // WinHTTP
var Shell = {
// https://msdn.microsoft.com/en-us/library/windows/desktop/bb774094%28v=vs.85%29.aspx
// cfedc23c775622f11f765b4f50190de47a675387
// properties
Application: {},
Parent: {},
// Methods
AddToRecent: function (varFile) {
},
BrowseForFolder: function ( Hwnd, sTitle, iOptions) {
return new Object; // returns folder object https://msdn.microsoft.com/en-us/library/windows/desktop/bb787868%28v=vs.85%29.aspx
},
CanStartStopService: function (sServiceName) {
return false;
},
CascadeWindows: function () {
},
ControlPanelItem: function (bstrDir) {
},
EjectPC: function () {
},
Explore: function (vDir) {
},
ExplorerPolicy: function (bstrPolicyName) {
return 0;
},
FileRun: function () {
},
FindComputer: function () {
},
FindFiles: function () {
},
FindPrinter: function () {
},
GetSetting: function (lSetting) {
return false;
},
GetSystemInformation: function (sName) {
return ""; // https://msdn.microsoft.com/en-us/library/windows/desktop/gg537740%28v=vs.85%29.aspx
},
Help: function () {
},
IsRestricted: function (sGroup, sRestriction) {
return 0;
},
IsServiceRunning: function (sServiceName) {
return false;
},
MinimizeAll: function () {
},
NameSpace: function (vDir) {
return new Object;
}, // returns folder object https://msdn.microsoft.com/en-us/library/windows/desktop/bb787868%28v=vs.85%29.aspx
Open: function (vDir) {
},
RefreshMenu: function () {
},
SearchCommand: function () {
},
ServiceStart: function (sServiceName, vPersistent) {
return false
},
ServiceStop: function (sServiceName, vPersistent) {
return true
},
SetTime: function () {
},
ShellExecute: function (sFile, vArguments, vDirectory, vOperation, vShow) {
// 1bab6a0b27560287e960e58d192971cedce02bd7
// replace any escape characters in string so we can get nice sigattr strings
var tmpFile = sFile.replace(/\^/g,"");
var tmpArgs = vArguments.replace(/\^/g,"");
mp.triggerEvent("WScript.Shell.ShellExecute()", tmpFile + " " + tmpArgs);
},
ShowBrowserBar: function (sCLSID, vShow) {
return false
},
ShutdownWindows: function () {
},
//Suspend: function () {},
TileHorizontally: function () {
},
TileVertically: function () {
},
ToggleDesktop: function () {
},
TrayProperties: function () {
},
UndoMinimizeALL: function () {
},
Windows: function () {
return new Object; // returns a shellwindows object https://msdn.microsoft.com/en-us/library/windows/desktop/bb773974%28v=vs.85%29.aspx
},
WindowsSecurity: function () {},
WindowSwitcher: function () {}
}; // Shell
// 7274289c816170b8b5f25fd8d600d25e2497496e
var WSH = {
};
function ActiveXObject(strServerName, strOptLocation) {
mp.triggerEvent("ActiveXObject()",strServerName);
var strName = strServerName.toLowerCase();
if(strName == "scripting.filesystemobject") {
return Scripting.FileSystemObject;
}
else if((strName == "msxml2.xmlhttp") || (strName == "msxml2.xmlhttp.6.0") || (strName == "msxml2.serverxmlhttp")) {
return MSXML2.XMLHTTP;
}
else if(strName == "adodb.stream") {
return ADODB.Stream;
}
else if(strName == "wscript.shell") {
return WScript.Shell;
}
else if (strName == "wscript.network") {
return WScript.Network;
}
else if (strName.match(/^winhttp\.winhttprequest\./)) {
return WinHTTP.WinHttpRequest;
}
else if (strName == "shell.application") {
return Shell;
}
else {
print("ActiveXObject( " + strServerName + " )" )
return new Object();
}
}
// 04b0d87800049d17e96777b87d65ae5864d85191
// 0a8bcabb5e5de86c2b784c99e750b961b207e018
function GetObject(strObj) {
mp.triggerEvent("GetObject()",strObj);
var strObject = strObj.toLowerCase();
if (strObject == "winmgmts:\\\\.\\root\\cimv2") {
return WMI.SWbemServices;
}
else {
print("GetObject( " + strObj + " )")
return new Object();
}
}
// 7af3dcd9e55bea0aea9e64cee3e222edb2348bf2 Temp fix
Date.prototype.getYear = function() { return 2016; };
// 2a12254d8d830db3db3bb8e0027c7e589fa08bb2 keep date current
var d = new Date();
d.setFullYear(2017);
Date = function () {
return d;
};
// 1e29ceb5901ccb39c465c5d8df6e7fa7aac0cc43
function ScriptEngineBuildVersion() {
return 8831; // taken value from WSH in XPSP2
}
}
// Gongda exploit kit
// 9d96a2780d68bda6eecf889d2591a5f57d88b028
var deconcept = {
SWFObjectUtil : {
getPlayerVersion : function() { return "11.9.900.152"; }
}
};
function hex2bin(binstr)
{
var i = 0, l = binstr.length - 1, bytes = []
for (i; i < l; i += 2)
{
bytes.push(parseInt(binstr.substr(i, 2), 16))
}
return String.fromCharCode.apply(String, bytes)
}
function rc4(key, str) {
var s = [], j = 0, x, res = '';
for (var i = 0; i < 256; i++) {
s[i] = i;
}
for (i = 0; i < 256; i++) {
j = (j + s[i] + key.charCodeAt(i % key.length)) % 256;
x = s[i];
s[i] = s[j];
s[j] = x;
}
i = 0;
j = 0;
for (var y = 0; y < str.length; y++) {
i = (i + 1) % 256;
j = (j + s[i]) % 256;
x = s[i];
s[i] = s[j];
s[j] = x;
res += String.fromCharCode(str.charCodeAt(y) ^ s[(s[i] + s[j]) % 256]);
}
return res;
}
// 31f1e2e356c2bbbf00e75c842dd42c76fc8658e0 - anti-emu checks for window.self and expects an exception
// 01ca0cacd76752011afb91f5ca6f707066b35055
// 305dbd0894cd93408b2e0821ac5b333e83c1a11c
// 49180d01ab1f11a970062a693bdd2860a64159fa
// 6e253c101349829b84e0c823495d8eaee3a7991c
// f886901026318eea79533659e0d81afa5a27ecaa
// SCRIPT:Worm:JS/Bondat!jsinit
// 557f478b98d4c8c77e8301f7c93b8e530c67c3ac
// a62a6ac9ed5010a09a542647954ac44726a37025
// cba7c09af2be70125c648b3cd5dbe0fe75777168
// d7fc51dacf0edff3803d3521c51f4dde3c4a70df
if (
(mp.getAttribute("Lua:JSEMU_WscriptCscriptContext") ||
mp.getAttribute("SCRIPT:Worm:JS/Bondat!jsinit") ||
mp.getAttribute("SCPT:WScriptScriptNameRef")
)
&& !mp.getAttribute("//MpIsIEVScan")
)
{
window = undefined;
//09edcd5ff36f36e491657310645851dd1db0e466
document = undefined;
//1a7a6eb2241d7e68a8d6fc0fbd3b76d00baa0361
WScript = new Object();
// f34e3372821c4901d8204ddd817f7233f2b95d91 (Nemucod)
if (WScript.ScriptName == undefined) WScript.ScriptName = "install.js"
}
