Suspicious 80% Download

26de80e3bbbe1f053da4131ca7a405644b7443356ec97d48517f1ab86d5f1ca5.macro

obfuscated VBS macro, autoexec

VBScript names look machine-generatedDense Chr-based string construction
SHA-2561c96c619b6e18cfc5540cc50ca3f6e7e8664fe99a2253cbc90d96d72e17fbbe2
MaleculeO(As)H(Db)

Evidence

VBScript names look machine-generated lines 1–7
1Attribute VB_Name = "iqDnpbAGZQXl"
2Attribute VB_Base = "1Normal.ThisDocument"
3Attribute VB_GlobalNameSpace = False
⋯4 lines
VBScript End control-flow block lines 134–141
134:598… SV + rMCEictFfP + aGDBw + zHbQrwVLZ + RhwEDpSB
135
136End Function
137
138Function srvpwqPI()
139
140On Error Resume Next
141zkoCaF = (DSiabqaJdG - CDbl(197970) + swLsv + Fix(BMLwrmUSiwu …

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.