Suspicious ^80% Download

RFQ# 05-003260928.JS

Obfuscated WSH malware execution

WScript bracket-member access in source textActiveXObject constructor reference

SHA-25698934bb1f2cd48c75003c67a46276ded9b1ec55982db3f4b0c25f14e74b080b5

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₅(As₂AlCIXe₂)H₅(Db₇F₂OsPo₃U)Md(Pt)

Evidence

Starts a synchronous function expression lines 36–49

⋯5 lines
41
42}());
43
44(function () {
45  
⋯4 lines

Dense computed-property call cluster (3+) lines 101–110

42…  {
        
                  var WFEHTUEOMJNBRMHV69514 = WFEHTUEOMJNBRMHV6498['apply'](WFEHTUEOMJNBRMHV80106, arguments);
        
                  WFEHTUEOMJNBRMHV6498 = null;
⋯5 lines

Calls a parenthesized function expression lines 177–189

54… EOMJNBRMHV388);
      
          
    }
      
  })();
  
  
⋯5 lines

Constructs ActiveX object from variable ProgID lines 238–248

238:23… TUEOMJNBRMHV82868['cYpDW'];
239  
240
241}
242var WFEHTUEOMJNBRMHVUDP = new ActiveXObject(WFEHTUEOMJNBRMHVCFV);
243
244function WFEHTUEOMJNBRMHVEU(WFEHTUEOMJNBRMHV29223) {
⋯4 lines

WScript bracket-member access in source text lines 3903–3914

6…    HOLLYNAMRF += WFEHTUEOMJNBRMHV6467['LUlxn'];
  
  
}
  var WFEHTUEOMJNBRMHVHFH = WScript['ScriptName'];

  function WFEHTUEOMJNBRMHVEU(WFEHTUEOMJNBRMHV42434) {
⋯5 lines