Suspicious ^80% Download

Factura-PAR2026A01-0565.JS

Obfuscated WSH malware execution

WScript bracket-member access in source textActiveXObject constructor reference

SHA-256f77d2bc086e26b4ae369d7e2ca9759da0ed20ba292f65fe20af55d20cb54dcee

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₅(As₂AlCIXe₂)H₅(Db₇F₂OsPo₃U)Md(Pt)

Evidence

Starts a synchronous function expression lines 36–49

⋯5 lines
41
42}());
43
44(function () {
45  
⋯4 lines

Dense computed-property call cluster (3+) lines 101–110

42…  {
        
                  var QJHVYRLUQDSIRZXK69514 = QJHVYRLUQDSIRZXK6498['apply'](QJHVYRLUQDSIRZXK80106, arguments);
        
                  QJHVYRLUQDSIRZXK6498 = null;
⋯5 lines

Calls a parenthesized function expression lines 177–189

54… LUQDSIRZXK388);
      
          
    }
      
  })();
  
  
⋯5 lines

Constructs ActiveX object from variable ProgID lines 238–248

238:23… YRLUQDSIRZXK82868['cYpDW'];
239  
240
241}
242var QJHVYRLUQDSIRZXKUDP = new ActiveXObject(QJHVYRLUQDSIRZXKCFV);
243
244function QJHVYRLUQDSIRZXKEU(QJHVYRLUQDSIRZXK29223) {
⋯4 lines

WScript bracket-member access in source text lines 3903–3914

6…    HOLLYNAMRF += QJHVYRLUQDSIRZXK6467['LUlxn'];
  
  
}
  var QJHVYRLUQDSIRZXKHFH = WScript['ScriptName'];

  function QJHVYRLUQDSIRZXKEU(QJHVYRLUQDSIRZXK42434) {
⋯5 lines