fine-work-team.com has been reported as suspicious. Cloudflare is blocking it now.

Heh, the URL OP gave returns an MP3 file (starts with hex FF FB), at the end it mentions "LAME3.100" and about half a kilobyte of U's. It plays in a media player too.

But I guess if it was loaded via mshta it will respond with a different payload.

Now watch the people with "overabundance of caution" tell me what I did was stupid...

	▲	cybersec47 2 hours ago \| parent [-]
		> But I guess if it was loaded via mshta it will respond with a different payload. No, the MP3 file is the payload, mshta ignores the binary noise and executes the HTML in it. The HTML is in the middle of the file (search for "DOCTYPE") and it contains an obfuscated VBScript. Skipping many steps in the whole chain (registering a scheduled task to be executed 1 second later, disabling TLS certificate verification, corrupting the antimalware scan, deobfuscation/decryption, evasion delays, in-memory PE loading, etc.), it as a whole, roughly speaking: - downloads second stage payload from gpurq.gravityzone.army/{id} - downloads an image from i.ibb.co/Q7yqNJpr/init-block.jpg (public image hosting) with a steganographically hidden third stage payload - decrypts and loads a native PE32, heavily obfuscated and without imports