Suspicious ^80% javascript-malware-collection Download

20151202_bd01efaa49c705420b7c530b71b5fd5d.js

Obfuscated dropper downloading executable from IP URLs

dense sequences of Nemucod's specific 4-byteJScript loader with high entropy comments

SHA-256312b3d5e220ea5d27761eca7af4d321f540c7484adff38886d03277688e8cb66

Evidence

JScript loader with high entropy comments lines 1–48

1
2
3
4//CdUcZlCtYritozHzpmxxBVjtHYZUEUZyTcnbcOECQBoVVZgxyGlkUqDwOaqzPDZJbGXxBKkzRueSsOWFpuFJHChmRqflpCCnNpzDmYZlHufEkDJhXimglFiIvCHsJwvCEGQmdfVVRTMQAzitnBawSt
5
6
⋯4 lines
11
12
13//YxgBvsRPQxNCUBBuaSdgePuMcjZAMLsPZnNldiHUxYFeMvJdsIurTNaybJjntxauQVQZAKcUAffcCgihqBZlNEIfZnWdnGUdyXpmpNpanUGnjpDgcXUBTJkGHKkELlmagrHdnWAlDMfQULW
14
15
⋯33 lines