Hostile 93% Download

virussign.com_13fd4fe2eaf4b64d46722777db277ff0.vir

WMI hidden process, obfuscated payload

Unicode-padded WSH loader launches a reflective payload through hidden WMIJavaScript self-copies to Startup
SHA-25645aaa9fa16af00ae8e40435dfeb7e4840196feb6f2ac528d352250f50bf1802e
URLhttp://samples.virussign.com/samples/virussign.com_20260927_LimitedFree.zip
MaleculeO₆(PXeAs₃CErI)H₄(Os₃Po₆Db₃F₅)Md₂(Pa)

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.