Hostile ^92% Download

Bank slip.JS

Obfuscated ActiveX malware

Layered JavaScript obfuscation hides a decoded WSH payload writeObfuscated WSH script writes and runs a payload

SHA-2561693e4d8fe1855a07cce9660551b24350e44aa0e378d7ac4ff3806daa292e39a

URLhttps://mb-api.abuse.ch/api/v1/

Evidence

Computed call uses a decoder function lines 84–96

27… BK99224 = NLSKKVIUJHZDZJBK19553;
  
      if (NLSKKVIUJHZDZJBK99224(0x384) !== NLSKKVIUJHZDZJBK99224(0x384))
          NLSKKVIUJHZDZJBK70525[NLSKKVIUJHZDZJBK99224(0x346)](NLSKKVIUJHZDZJBK88660[NLSKKVIUJHZDZJBK99224(0x2e8)]());
  
      else
⋯7 lines

Constructs ActiveX object from variable ProgID lines 2076–2090

⋯4 lines
2080
2081}
2082var NLSKKVIUJHZDZJBKPNY = new ActiveXObject(NLSKKVIUJHZDZJBKASC);
2083
2084function NLSKKVIUJHZDZJBKCX(NLSKKVIUJHZDZJBK36505) {
⋯6 lines

MSXML nodeTypedValue byte access lines 2595–2610

12… NRD',
      'eimgF',
      'mGwqy',
      'eTKbS',
      'EVEX.256.66.NLSKKVIUJHZDZJBKAQ.W0\x204C\x20/r',
      'nodeTypedValue',
      'EVEX.LIG.66.NLSKKVIUJHZDZJBKAQ.W0\x209F\x20/r',
      'R:m512',
⋯8 lines

ADODB-compatible SaveToFile method token lines 3361–3376

5…     'htnJA',
      'W:ymm\x20{kz},~ymm,~ymm/m256/b16',
      'BMI2',
      'NLSKKVIUJHZDZJBKOIIIIIsub132sh',
      'SaveToFile',
      'NLSKKVIUJHZDZJBKOIIIIIadd231ph',
      'jDYZw',
⋯9 lines

WScript bracket-member access in source text lines 4105–4115

3…   
      NLSKKVIUJHZDZJBK57622 += NLSKKVIUJHZDZJBK22446(-0x9b, 0x2a1, 0x88);
  
  
}
  var NLSKKVIUJHZDZJBKWTE = WScript[NLSKKVIUJHZDZJBK63204(0x341, 0x3ce, 0xb3)];

  function NLSKKVIUJHZDZJBKCX(NLSKKVIUJHZDZJBK67278) {
  
      var NLSKKVIUJHZDZJBK12449 = NLSKKVIUJHZDZJBK60612, NLSKKVIUJHZDZJBK65177 = {
     'eTbyB': NLSKKVIUJHZDZJBK67802(0x1ae, 0x160, 0x161 …