Suspicious ^80% Download

Shipment Documents.JS

Obfuscated WSH malware execution

WScript bracket-member access in source textActiveXObject constructor reference

SHA-25652f36733937caecad53665bafaca301709522056c923650cbb855593a8a14a62

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₅(As₂AlCIXe₂)H₅(Db₇F₂OsPo₃U)Md(Pt)

Evidence

Starts a synchronous function expression lines 41–54

⋯5 lines
46
47}());
48
49(function () {
50  
⋯4 lines

Dense computed-property call cluster (3+) lines 92–101

43…  {
        
                  var NZLRQYDNDSZBQCHW25125 = NZLRQYDNDSZBQCHW72489['apply'](NZLRQYDNDSZBQCHW56249, arguments);
        
                  NZLRQYDNDSZBQCHW72489 = null;
⋯5 lines

Calls a parenthesized function expression lines 168–180

56… DSZBQCHW22646);
      
          
    }
      
  })();
  
  
}());

  NZLRQYDNDSZBQCHW68047['kshJM'](NZLRQYDNDSZBQCHW23170, this, function () {
  
      var NZLRQYDNDSZBQCHW18003 = new RegExp(NZLRQYDNDSZBQCHW68047['QwtHU']), NZLRQYDNDSZBQCHW71456 = new RegExp('\x5c+\x5c+\x20*(?:[a-zA-Z_$][0-9a-zA-Z_$]*)', 'i'), NZLRQYDNDSZBQCHW41449 = NZLRQYDNDSZBQCHW68047['aQyCd'](NZLRQYDNDSZBQCHW26819, 'init');

Constructs ActiveX object from variable ProgID lines 229–239

229:23… QYDNDSZBQCHW49324['VxZmO'];
230  
231
232}
233var NZLRQYDNDSZBQCHWNYF = new ActiveXObject(NZLRQYDNDSZBQCHWZDM);
234
235function NZLRQYDNDSZBQCHWEU(NZLRQYDNDSZBQCHW29987) {
⋯4 lines

WScript bracket-member access in source text lines 3917–3928

7…   HOLLYNAMRF += NZLRQYDNDSZBQCHW56369['yRdhh'];
  
  
}
  var NZLRQYDNDSZBQCHWYLV = WScript['ScriptName'];

  function NZLRQYDNDSZBQCHWEU(NZLRQYDNDSZBQCHW77587) {
⋯5 lines