Hostile ^100% javascript Download

invoice payment.JS

Obfuscated dropper with file write

Layered JavaScript obfuscation hides a decoded WSH payload writeObfuscated JScript invokes ActiveX SaveToFile

SHA-256d20de63c153327fdaef5073fd50edb815da7a908321da9f1f8edaba662b4b563

URLhttps://mb-api.abuse.ch/api/v1/

Evidence

MSXML nodeTypedValue byte access lines 406–428

⋯5 lines
      'RjRtF',
      'hhbpD',
      'nodeTypedValue',
      '0x151',
      'kIXLA',
⋯13 lines

Layered JavaScript obfuscation hides a decoded WSH payload write lines 1521–1531

11…   if (_0x5610d4 === _0x160a4c) {
              break;
          } else {
              _0x2dcda3['push'](_0x2dcda3['shift']());
          }
      } catch (_0x4407b5) {
⋯5 lines

ADODB-compatible SaveToFile method token lines 1684–1694

9… 'PCERM': QDPYMNKULGYMVHFJKHH(0x471),
      'YNiwA': '0xa3',
      'HqVOM': QDPYMNKULGYMVHFJKHH(0x525),
      'rSVmf': 'SaveToFile',
      'shpUP': '0x27',
      'FlSwP': QDPYMNKULGYMVHFJKHH(0x610),
⋯5 lines

Constructs ActiveX object from variable ProgID lines 2786–2796

2786:2…    var _0x1838cf = _0x94ce38['HpaFx'](_0x2518), _0x7d158a = _0x1838cf[_0x5b092e];
2787    return _0x7d158a;
2788}
2789var MNHHCRXTUIOP = new ActiveXObject(MNHHTUIOP);
2790function QDPYMNKULGYMVHFJCX(_0x239a3c) {
2791    var _0xb6f351 = QDPYMNKULGYMVHFJKHHHHH;
⋯5 lines

WScript bracket-member access in source text lines 3260–3264

8…  _0x410203 += _0x1acb4b[_0x355581(0x636)](_0x30a4b7, 0x35 * -0xa1 + -0xc * 0x1fd + -0x62 * -0x9d);
  }
  var scriptName = WScript[QDPYMNKULGYMVHFJKLPPPP(QDPYMNKULGYMVHFJKLPPPPP(-0xb * 0xc4 + -0x12f * 0x3 + 0xf0e), QDPYMNKULGYMVHFJKLPPPPP(-0x27 * -0xb5 + -0xd * 0x2e9 + -0xd0f * -0x1), -0x1 * -0x1375 + 0x226c + -0x34a2)];
  function QDPYMNKULGYMVHFJCX(_0x73f497) {
      var _0x1d …