JVC_34573.vbs
This report is generated from a file or URL submitted to this webservice on November 19th 2019 14:39:23 (UTC)
Guest System: Windows 7 32 bit, Professional, 6.1 (build 7601), Service Pack 1
Report generated by
Falcon Sandbox v8.30 © Hybrid Analysis
Incident Response
Risk Assessment
- Network Behavior
- Contacts 1 domain and 1 host. View all details
MITRE ATT&CK™ Techniques Detection
Additional Context
Related Sandbox Artifacts
- Associated SHA256s
- aabed39d9aa8c6cf88317ea7cac85f3a22f6198f10b901abfab028175b26ce27
Indicators
Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.
-
Malicious Indicators 3
-
External Systems
-
Sample was identified as malicious by a trusted Antivirus engine
- details
- No specific details available
- source
- External System
- relevance
- 5/10
-
Sample was identified as malicious by at least one Antivirus engine
- details
- 7/57 Antivirus vendors marked sample as malicious (12% detection rate)
- source
- External System
- relevance
- 8/10
-
Sample was identified as malicious by a trusted Antivirus engine
-
Unusual Characteristics
-
References suspicious system modules
- details
- "tato- forehoofs watchfully Mannuela captaincy Grimmia unjuicily quasi-medical nonre-eligibility decriminalizes Hensel hemiparetic whitlowwort dyewoods Bdelloida seismologists jebels decorates Gaboriau Grecianize words antiparallelogram bicentenaries rejourney Emmylou chirpiness cavalcade Budenny wham menus strey Joukahainen unbuffed GPM yajein Schrebera scare-fire antiparliamentarians midwinterly triplefold ungullible cladoselachian raffishnesses supraorbital plainscraft rackateer urocyanogen manyfold necroscopical phialospore low-downness prothallus Elsass-Lothringen imagistically alhet redistrain mortifiedly finikin institutionalization prickfoot autophon persistance backwashed serfish knitting theosophies chrismon Jehiah gras Helpmann wall-sided noncausally inti snippiest Wickliffe Aristides overassertion benzothiofuran ovoflavin manganiferous Scarabaeinae subpalmated expatriatism unequilaterally Lutz Flaxville baronetical samisens Habiri outsprued paravertebral Pro-hohenstaufen Katy unisons reassumption w"
- source
- File/Memory
- relevance
- 5/10
- ATT&CK ID
- T1215 (Show technique in the MITRE ATT&CK™ matrix)
-
References suspicious system modules
-
Suspicious Indicators 6
-
Anti-Detection/Stealthyness
-
Possibly tries to hide a process launching it with different user credentials
- details
- ImpersonateLoggedOnUser@ADVAPI32.DLL from wscript.exe (PID: 2644) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 3/10
-
Possibly tries to hide a process launching it with different user credentials
-
Anti-Reverse Engineering
-
Possibly checks for known debuggers/analysis tools
- details
-
"ombreros cysticercosis untorporific signpost orderedness bankruptship jaguar dollhouses anticentralism humerodigital still-closed vexil tergiversator slithers hydrofluoboric introsensible SN outpolling oversliding pense rag-made atrioventricular locanda small-visioned vetturino Chariot opuses tabel Logi eltime zimentwater hypothecary didromy subcash Philopteridae patristicism Liedertafel psychedelics facecloth scopula exhibiting cardiotoxicity swadder poltergeistism rebait diagrammitically uninterpretive barroom hoodlumize treeship shutdown lodes mikrons Ballinger Dell Chloe toniest superparamount Lively Monophysitism book-keeping unsternness anaerobation intercerebral millihenry coutelle Amita restrainer nonremediably nondivorce orientality sonnetary Sciaeniformes rabbet interagency arointing NCDC Calotermitidae chaffy recognizances unscored spawned self-variation counter-culture zooter misseldin wield iglesia immoved divvy demiturned deorientalize neum uneligible amenorrhoea nonhomogeneity nympholept pity-w" (Indicator: "ntice")
"self-subsistence pseudolegislative Tanala thrasonical Compi revaporization prosthionic flic erotics clearminded Mongeau dicaryophase Salm deep-naked fastiduous sambhogakaya toolsheds ekpweles microcoria illnature nonstorage sockmaker unvicariousness moth-eaten gizzen virions snithy operabily Lisha beacons sphered tylion fugue Cabe uncorrectablely cancerite Lavina hektometer prerelate gleamers antiracism putzing stark-awake mis-see venditation talotibial centrifugalizing volumescope globe-trotting nondiabolic Meyerbeer bedlamising lagopous philosophies anticensorial saltinesses flue-curing reconfiscated dojos speakership Bala counter-cast linebreed Krantz apprenticeship siccate psycheometry crops incontestable nonmetamorphosis intervalvular Coptic inaccurate saxpence round-leafed tender-mouthed explorative stomached oligarchize hydnocarpic cultivative cancrizans accouche leachier shophar Flyn anticosine Doi twittingly haverer jadeship undewily Shelburne unloyalty golandaas particulariser boathouses preremoval" (Indicator: "ntice")
"ic profre kinged Clarey untransferred magirological Jonestown shuns unbreatheable lenticel hetmanate rushiness delatinize demolisher bullshits uncalamitously Presidio moke outbanter superinfeudation winglets Angelyn polymythic taxiing premedical Cloudcuckooland caponiere declassifications pseudoapologetically towniness Katey sooty-planed brutalizes nonboding nephrology Argyrol sirup Stabreim Tephillah bromvogel outparish bushily jumprocks neophobic Normanly self-exclusion Toshiba Havener sublumbar qualificatory incorrosive introduce pleonic sharp-edged lakemanship humanest horoscoper outtrumped bizarre notarization informally girlies eu-form inquilinism bromargyrite sidehead glossopalatinus ejectivity Lewisville mannified veterinary castanian etherealisation angiology snub- fancysick Arawa Dodonaeaceae menison colunar NMI netting imprompt uncited cholangitis seringal biotitic reengross browned forbiddenness butyrins thermodynamist playacts Natta pulment Costigan attern ascending inbreather rebaptizing mirepoi" (Indicator: "ntice")
"smokiness cataclysmist presumptuously ill-deedy niche comradery dyphone uncoloredness sextar mincers whatre chequerwise huemul loanword hollow laparocolpotomy showboard atretic nonnegotiability unrealistically compresent succivorous Kincheloe radiotherapists re-enamor anticeremoniously delusionary macropetalous urbanizes circumduct turbidimetry faineancy endocone prince-general superline celioelytrotomy ORT paramour dandy-horse nucleant honeymoonlight superaggravation transubstantiatively pyopneumopericardium false-dealing bawlers calk elapse tonguiness xylotile indiscriminatingly Servetus portended giambeux episomally Sofko dyarchy convocator Normanesque soul-confounding biographer Watters pteroid Coralligena ignition daimio tritomas uncircumcision monobacillary nonrepressed fractionized achingly zaftig Araucano phenomenalize smooth-soothing trimethylamine reastonishment tchai enamber lodicule misframe Morrilton orangier dispirit capsid ringtails amphibium regularise unbarbarize Welsh-fashion resentless pylo" (Indicator: "ntice")
"rvey dispatch-rider sphaeridial panzootic schoolboys lenticels immitted gabarit all-saving Halakahs toorock musculospinal thalassiophyte adaptitude nimble-witted capsize salvableness studies laymanship lustiness phalangid upstairs shoebills ethnobotanic asbolite prickles adultoid coolaman intraorganization previse dornocks rathskellers boardwalks spermato- oftentime tipsiness Weare gastronosus exactress chinela dialogistically Bubba Donielle hookshop pavonazzo pankration sheepstealing demethylate dealkylation Brittain undersettle unsophistication thoracodynia ozotype prince-general unassessed serpuline heart-break clothesbasket stellary nonreconcilability pailful chandry nonreflected Waffen-SS Pliske naively verbification characters shallowish undoomed uncreativity muscle octoradiated gyrostatic gate-crash overurbanized Wetterhorn hogsteer Sautee skegs Darrelle aldimin undivulging PSWM sesamoiditis unworthiness north-easter floatiest soixante-quinze arums wobblingly unvulgarized attitudinizer citrin hirsle su" (Indicator: "ntice")
"aclase Deleon wherever nonpalatableness ferns coapprentice spics crates tutiorism subdolous teazeling etuve whirley counterdrain displacements luteal tousling klick overrudeness swiggers uralite bistable Nesotragus gastrodisc rhegmatypy septiform Kulsrud drip-dry silver-rimmed caponizer Wyeth unhelming unwanted Edom terrestrials undemolishable clitic brummer seeps morphinism subnormal interparoxysmal six-leaved tortoise-shell DIY tallywomen pantheonization doctrinaire jeopardise developes copaiba annihilating unreality russeting sticks chromoisomeric standard-gaged soldierfare bumpiness transceiver nonsacrificial insinuatingly frettage mesarch cystogenous nonenunciatory high-crowned Ceil thwartwise ulorrhagia inarticulacy clutching priseres Lodmilla Johppa towan roadie merry-make Rhexia holked sale-over monogonoporic punkt Lemurinae well-consorted black-and-tan Farmville nigget rag-chew ridicule-proof scorpions misrepresentee Cartilaginei carnivalesque cardiagraphy rheophore liberationist lites connectant bru" (Indicator: "ntice")
"rialist ikebana unbeaming wheelroad periphery climatologist Pedipalpi fulgent policedom clawless pupivore normalizes Danilo arrearages denying conominee eikons wamble-cropped Mlles beworn humanest lightwort unoptional bewaste nondisposal Alexiares unbilious unforlorn dryrot availableness myomectomy downbeat latesome Tremml echinology clitelliferous Piptomeris contributory mandment towardly newsboys unrecited Woburn tingeing Bandjermasin meltons craspedal good-liking sacrococcygeus reannouncing routineness Paugh rachiodont stegosaurian hyoglossi coralist spondylopathy unsearching orocentral impugn achromatolysis fastiduously apprenticehood wash-bear expounder Eutaw biotically Camelliaceae wind-god Allons enwrite force-ripe antiparabemata somnambulic divestitive shakier oticodinia baselard paludism withdrawal nooking stetharteritis verstes ameboid tiptopsome barfing liberalized mesolabe esprise dourest chin-chin handsful trifurcated profusive Swifton hydrophytous lightener nonvolatilized laryngemphraxis mandolu" (Indicator: "ntice")
"-fed onomasiology macrosomatous parsonet secret-false well-worn milvine ichthyopsidan propagula strey asbest Actian apprenticehood binotonous perinatal fountainously Woonsocket Lipman commensuration oligopoly galloping pilloried routinely ingrow sightworthy pigboats spiker ureteral parasiticidal cavelike cyanhydrin Sequanian bacteriolytic Knudson kairine dopamine Sorex denigrated jugulars moderates burlap cogglety diplomaing nouns restress jellys chanceably halftone reverencers swiftlet hollow-ware preconsultation dioptrometry synaphea Kulpsville supersedeas freetrader subformativeness Gabriel spring-planted xanthochroism re-emit Macrobiotus volcanity noncontagiousness blackbrush Kuehneola Joiner lend sauvegarde psovie Eureka mandarinate thym- enddamaging cousinly angry coevality misconstrual inappealable pieridine Capiz notepads salesman deportment unimpressibly chondrification pedaliaceous Guatemalan cardioarterial autolavage toast-brown bantamweights nontraditional Roderigo prostasis helvin Novalis answerl" (Indicator: "ntice")
"esiculotympanic embrown boozers gray-veined zodiacal gunl scorbuch resparkle bagels dolichocephalism antiroyalism chesterlite atrocious termtimes exemplarity Franco-roman unfazed rosinduline archineuron fishyard quasi-spiritual cupeled moon-browed critling aplanatism pyjamaed contendent Kandinsky garmentmaker cullies silesias bucksaws inarm Tedie abusee diobols impermanence Plainfield reshingling psoraleas hens-foot Tanchelmian Odille quadripinnate proteas unmerge Raseta dint water-waving interquartile lap-butted Serbophobe mulligrubs Montanism il overusually tadpole-shaped postdigestive shaves kindergartener dingo coresidence hereto madril underworkman ADDCP faverel twiners inerring effluviviums crossbarring preacquiring Southmont starshoot sorghums Brookline abets unrumpled Picinni PEM Technicolor snifters avens misidentifies synoekete retinochorioidal encyclopediast mnemonizing palaeophytologist Tampan deforcement pentice heeltree metallographer thermomagnetism talkiness canoing adjurors suably synthesist" (Indicator: "ntice")
"sting anticensorious pondering masterhood prich sextur emotionless ganoin haymakers pendulant lug-worm cashgirl readableness Andriana Cerritos hierophantes fishpotter tandemize nonconvectively nonpracticability high-test jingoed extra-illustration rubbishy wrong-principled sulvasutra bicyanide vitial meteorism Socinian anoxaemic Hocktide myotonias cosponsors somnambulism surged unsieved nonantagonistically banalness vernal-bearded nonjurorism black-berried metastable antepirrhema rustics indol swinehood Lobeco graffage copolymerous annihilated grottesco Betterton vicariousnesses subjectional subdistichous semitruthfulness nonpreferability Kolk overmark distensions Diaz septal presweetens loges humilis Urbanna collotypy rebought interspeech tabours ORNL sikar pililloo newings habeas complementer spilths chanticleers old-line micronization prosemination unperspicuousness reclaimer euphuist defensative noncondescendingly Doherty redressal Inverness felsobanyite Belili phenolate ostectomies Pauropoda tree-goddess" (Indicator: "ntice")
"lidity strooken reconnoiters Sufi popeline trigeneric expectorate dead-weight Meneau sepsis hyssop-leaved Wylma unfamiliar Steuben poetress trichogen megacephalia Jeffcott lupuserythematosus preacquisitiveness metrorrhea handbolt maximin idiotry didest woodstone nibblingly shohjis scrappers anticrepuscule nonimperialistically back-formation mid-century linchpin a-temporal vapotherapy replowing BTN under- googly-eyed mahewu marshiest crackmans New-Testament ohmmeter missilery oedemerid impecuniosity rock-cistus karates Catharism trinoctile afterbreach syntony aerologic bluegrass Annora Archemorus perfecting mensurational neebour tributable well-made prototyping rheophile freet shirtlike straight-bodied receded ready-handed unengraven peasantlike harsh-mannered ergo- imper. day-star purulences woe-stricken initiations statist proverbs Jade playsome seven-quired Doraskean spirit-wearing Tortola nonvaporously crosscutter Motilal yipes blepharosymphysis unmutinously unsatisfactorily entice ephah nonpredicatively u" (Indicator: "ntice")
"36 - 10 + 18 - 419 - 473 - 9 - 12 + 1178
pty = 274 - 499 + 436 + 10 + 13 - 7 - 20 + 9 - 22 - 12 + 7 - 256 + 67
xNzW = 113 + 339 - 380 - 310 - 4 - 3 - 9 - 428 - 9 + 276 + 23 + 326 - 25 - 131 - 23 + 897
'ultramodern cresorcin interdetermination conceders sternage Philine palaeoencephalon implementing estrone Attalanta braceleted Prionodon steadfast sclerectasia full-extended Rockton indue Novum well-visualised restriction antiaesthetic silken-winged agtbasic hallmark jargonist straightish tree-lined Catullus expiree impropriator danceress lacunar quietest branchiform unconditionalness nebularize tollies eruptive prosaical Schneiderman self-considerative Coccidiidea Knin trisaccharide incurse Xenarthra boheas dragonize gubbo soundingly Achlamydeae fulfills callboy hostessing Kopaz protodynastic Hercules-club outcropping Adenanthera scapegoat reprune luxuries re-entice homochromous nonamenability phytopaleontologist agravic Tekke katabasis snipesbill unflead dermatoplastic gonadectomies unconcluding Fayre diaria" (Indicator: "ntice")
"moiriety boffins happenchance dewans woebegoneness decwriter heat-wave mosshorn upmountain needling unthende bacalaos Steatornithes cumbersomely preterit aviator coetus pseudosacrilegiously demythologizer moneral nebulite unchaste reinfection chainmaker misty-eyed uniformitarian Yusem impassibilibly austerus antimilitarist louseberries eulogises easters cyclothymiac wisdom-loving fardh Grusinian shadowfoot preconquer monostelous registrarship myriapods bedight holophytic kid-gloved shot-silk cagmag miscellanea rifty-tufty cheapest foh karyatid hutkeeper manstealer Bulgaria rose-tree subrogor twenty-nigger nascences turquoiseberry radiobroadcaster well-smelling open-ended asphyxied bounces pagiopod folic Braymer hircosity Bechet crushproof Rusk subversives refrangibilities lining Leptotyphlopidae hedral electropuncture unmailableness phaneric jeep pregeniculatum Atahualpa antifebrile weakling unenticed Sovietism acyloins vulcanicity huddles archetypically cabriole sable-bordered Didlove glink Austwell eradicab" (Indicator: "ntice")
"roghan petrogenetic godown dashed carillons liken breamed recirculation spinel-red textuaries preaffirm misbegan conditioned Noludar trymata rhymery brachycerous uphand self-insured semibachelor meanderers Andric restrictive CORN abut parasalpingitis fiddle-faddling hornbooks incede freend retorting perisclerotic bricklay sclerophylly non-contradiction Jussiaea Doland rhinosporidiosis loners Abingdon leprology longhands anticensoriously circumambulating repleads canoodles piete breeds passers unbrick Triconodonta noticeable cryometry roughhearted secretively cabining monopetalous clearheadedness phytosaurian unverdured touchbacks undried DV Wagner soprano self-donation variola Lebbie wretched-witched skelderdrake semi-isolated COBE Aesculus co-original MAU aldimin nicotize Burroughs MVS militaryment decretist efferent soliloquium Walburga nigrities Brie ambling brashes mameluco Archaeopteris impalpable extemporariness eclecticize adenoidal brickbatted pre-Achaean klatsch autolater celebs Seagirt prunelle unpr" (Indicator: "ntice")
"infeasibleness Dalen meriter catholicised chiarooscuros misrates thick-toed stobbing half-corrected Botryomyces at. stillborn enticeful palingenic uteritis slender-footed paederastically disunifying unfaithworthy commuters smaragd cochlitis Russo-swedish couthie gellant sibilation Lucianne allseeds blearing synostose misassertion Theurich nonexceptionally aminoazo selves jewelweeds muffle-jaw subcouncils slouchers beasties USITA Hadamard unpredisposing Gaidano synostose dyestuffs Stygian canvas-back Pearse orbs recodified well-deserved Falconer emotionless callous Humbert lazies hectically link-up Germanomania superimpend piskun kupfferite Elidad dewily hestern deposed Fannie bodword opulency chute-the-chutes suboval squelch overkind Austronesia Rubie belligerences fellahs Flavian businesswoman petnaps Schiaparelli cassites darktown teener midcults great-eared Tenochtitlan Ronn Fraktur cerebritis DUATS fatheadedness retrocoupler crispine Tommy taiglesome Halawi adularias stupid-acting unmerchantlike surpreci" (Indicator: "ntice")
"xpropriates hoopwood whiskingly Eisenach jinker Monticello carcerist Vitaceae hyacine spatlum syntrophic spise patinaed seven-piled Mohrodendron tetracerous outquarters faugh fingent metrists Goodman wath balm Leake premillenarian semifinalist mistaking sermonising servingman encasing predisguising farcify afounde nonconduciveness shrugging photomezzotype fluther resoluble Puccini psalmodize arfillite Schizolaenaceae amphigoric mestesoes areologic amid- Ready speak-easy windjammers factorial jinxed alumina pentadecagon hemionus scissorbird Cyrillian Amphipnous Kleinian enform unassailable Gnatho threaded gimlety neathmost spondylopathy holidays locusting medalled reunifications corrosiving wastely abstruser glees curviform nonrepealable willemite shaftway gastrulating no-surrender tolbutamide raphides Montevallo leaveless talari Meenen fasciole pseudosacrilegiously Copelatae outbatted circumferentor preguidance conversationalists impenitentness incarnative encouraging nonspecialist Davao amphiarthroses monopy" (Indicator: "ntice")
"ith carrotiest materialistical kingcups experientialism anthill astipulate accouche flowery johnny-cake Miki chlorite anticeremonialism simple-wittedness TDR nondark saleswomen ksi deglutinated Composaline doctorization side-winder pockwood Cedarcrest bilking Armida carbolxylol same Capricorn spotted-eared transshipment pamperer premeditate piffler debruises soorma Guilford Oleraceae croup slup drabber kwhr polytokous true-sweet ingeminating Brucie rebelliousness madness sunnyasse crone deposers automatism steigh mongolians terebratulite religionism self-restrained razer self-killed venting krageroite Gel presedentary Trotters preexposure fame-seeking alcoholising conniver flatlanders Chapultepec autocrat unsolidly sociologistically linecut washingtonians Saki perceptibly undismayable irascible Tulle license kilos bombylious lantum Jody tumultuous guarri unbuilded Itea televises Gifola anglers preventing granddaughter slummock cheilotomies regrinding lancely preborrowing septuplication incomportable pastel un" (Indicator: "ntice")
"ton stachyuraceous unregressiveness harlock meromorphic intenders Odynerus lign- glaucin uteromaniac aldehydine Weyl countertheory Sonstrom KGB off-standing vigogne coumaphos autonomize scatomancy agrarianly ameban Compositae chamise heartwort cubing studier vindesine felspar terms Emmelina dunkadoo undoting satable assembler sub- Larissa sociogram melon-faced cataria DDL plumette Pro-peruvian messieurs crackup Oglala Xeranthemum conticent extoll rock-climber waygoose Stormville dolomize subprocess manini bashful tel- enditing anthropometry energized imposted phrenoglottic nonexemplification reconception pyloritis
'freemen Squires Czechish volvuli Ruvolo Agung VMCF she-chattel visionize typhomania prod Columbian falsely desolated calcify trophoderm stomatoscopy abut Akerboom gotta hotching oversoftness mashmen irriguous nonetheless extracloacal cucurbitaceous tetrole forgedly sasanqua Hessel plume-decked Pimenta bridging rhetoric niggerdom rotche neurovisceral poetito Fareham tin-foiler unobedient disambigua" (Indicator: "ntice")
"cafe this-a-way misdeclare overembellishment Kory rereeve unpolishable colormaker open-hearted equivoluminal Mid-december parentless liquidable superappreciation almeidina charges racemous otorhinolaryngologic unfussily predeficient sickler SATB coapprentice plutonomy dichotomistic Lassa frontogenesis fulminator nonmanila gazetteers pancarditis feltyflier decernment pewful baltimorite untwilled handgriping Deiope isobilianic antihuman tenable Balenciaga superfemale marmarosis tono- rebelliousness similize multilaminate nonexactable seniors noncommunistic variolitic penniform CCIP subproofs quasi-congratulatory unrescinded normed agmatine repudiations semimember coseismal helicometry faradaic nonhumus Canadensis shaheen chanche Camillus paganly inactivated teatman nuchalgia chondroseptum hounder theraphosoid hyperpathetically caenogenetic plurifoliolate Limassol neoprene tintometric isotrimorphous stepless mitotic undextrousness Maeystown scarved denticles malacanthine libertinage brain-damaged foothil elrage" (Indicator: "ntice")
"e indevotional bicompact takamaka tubemaking thermoduric saurians posologist pyogenic Arabophil embarren collinsite imponderable cherisher bisymmetric defervescent unvaliant Mercedarian thesocyte splenorrhagia Antaean grievance temperably Mitella
'robustity Canyonville Lappic virginitis all-abhorred nonamino wantingly pitchfield rhinos unhoop yet chays neascus fimbrillose logicize exsiccative kirpan wees Heruli pichi ungloomy EASI Arkadelphia forgo barbettes Gothicism dromos world-nigh Sabbatian Tripylaea reordering mezzo-soprano phrenomagnetism anticontagious behest benedictional vigesimation semico-operative speechification cultivate breastplough knowledge-gap vestral deservingness polyatomicity acroasphyxia kryptol trades-unionism steelmaking perivaginitis triple-thread enticeable Struma feverish seemers Dodecanesian foul-tasting BBA well-ankled predestinationism depancreatization minkish formalazine dissects kip-ft whelming sequin hypothecal Sweetland reconverting homecoming forked-headed carates casemak" (Indicator: "ntice") - source
- File/Memory
- relevance
- 2/10
-
Possibly checks for known debuggers/analysis tools
-
External Systems
-
Found an IP/URL artifact that was identified as malicious by at least one reputation engine
- details
- 4/71 reputation engines marked "http://campellicosmeticos.com.br" as malicious (5% detection rate)
- source
- External System
- relevance
- 10/10
-
Found an IP/URL artifact that was identified as malicious by at least one reputation engine
-
General
-
Contains ability to find and load resources of a specific module
- details
-
LoadResource@KERNEL32.DLL from wscript.exe (PID: 2644) (Show Stream)
FindResourceExW@KERNEL32.DLL from wscript.exe (PID: 2644) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to find and load resources of a specific module
-
Installation/Persistance
-
Executes a visual basic script
- details
- Process "wscript.exe" with commandline ""C:\JVC_34573.vbs"" (Show Process)
- source
- Monitored Target
- relevance
- 10/10
-
Executes a visual basic script
-
Network Related
-
Sends traffic on typical HTTP outbound port, but without HTTP header
- details
- TCP traffic to 35.231.146.96 on port 80 is sent without HTTP header
- source
- Network Traffic
- relevance
- 5/10
-
Sends traffic on typical HTTP outbound port, but without HTTP header
-
Informative 15
-
Anti-Reverse Engineering
-
Contains ability to register a top-level exception handler (often used as anti-debugging trick)
- details
- SetUnhandledExceptionFilter@KERNEL32.DLL from wscript.exe (PID: 2644) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to register a top-level exception handler (often used as anti-debugging trick)
-
Environment Awareness
-
Contains ability to query machine time
- details
- GetSystemTimeAsFileTime@KERNEL32.DLL from wscript.exe (PID: 2644) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 1/10
- ATT&CK ID
- T1124 (Show technique in the MITRE ATT&CK™ matrix)
-
Contains ability to query the machine version
- details
-
GetVersionExA@KERNEL32.DLL from wscript.exe (PID: 2644) (Show Stream)
GetVersionExA@KERNEL32.DLL from wscript.exe (PID: 2644) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to query the system locale
- details
-
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 2644) (Show Stream)
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 2644) (Show Stream)
GetUserDefaultUILanguage@KERNEL32.DLL from wscript.exe (PID: 2644) (Show Stream)
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 2644) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Possibly tries to detect the presence of a debugger
- details
-
GetProcessHeap@KERNEL32.DLL from wscript.exe (PID: 2644) (Show Stream)
GetProcessHeap@KERNEL32.DLL from wscript.exe (PID: 2644) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to query machine time
-
General
-
Contacts domains
- details
- "campellicosmeticos.com.br"
- source
- Network Traffic
- relevance
- 1/10
-
Contacts server
- details
- "35.231.146.96:80"
- source
- Network Traffic
- relevance
- 1/10
-
Contains PDB pathways
- details
- "wscript.pdb"
- source
- File/Memory
- relevance
- 1/10
-
Creates mutants
- details
-
"\Sessions\1\BaseNamedObjects\Local\InternetShortcutMutex"
"Local\InternetShortcutMutex" - source
- Created Mutant
- relevance
- 3/10
-
Logged script engine calls
- details
-
"wscript.exe" called "WScript.Shell.1.CreateObject" ...
"wscript.exe" called "Msxml2.ServerXMLHTTP.6.0.CreateObject" ...
"wscript.exe" called "ADODB.Stream.6.0.CreateObject" ... - source
- API Call
- relevance
- 10/10
-
Contacts domains
-
Installation/Persistance
-
Contains ability to lookup the windows account name
- details
- GetUserNameW@ADVAPI32.DLL from wscript.exe (PID: 2644) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 5/10
-
Touches files in the Windows directory
- details
-
"wscript.exe" touched file "%WINDIR%\System32\en-US\wscript.exe.mui"
"wscript.exe" touched file "%WINDIR%\System32\rsaenh.dll"
"wscript.exe" touched file "%WINDIR%\System32\wscript.exe"
"wscript.exe" touched file "%WINDIR%\Globalization\Sorting\SortDefault.nls"
"wscript.exe" touched file "%WINDIR%\System32\en-US\KernelBase.dll.mui"
"wscript.exe" touched file "%WINDIR%\System32\msxml6r.dll"
"wscript.exe" touched file "%WINDIR%\System32\scrrun.dll"
"wscript.exe" touched file "%WINDIR%\System32\wshom.ocx"
"wscript.exe" touched file "%WINDIR%\System32\en-US\winhttp.dll.mui" - source
- API Call
- relevance
- 7/10
-
Contains ability to lookup the windows account name
-
Network Related
-
Found potential URL in binary/memory
- details
- Heuristic match: "campellicosmeticos.com.br"
- source
- File/Memory
- relevance
- 10/10
-
Found potential URL in binary/memory
-
Spyware/Information Retrieval
-
Found a reference to a known community page
- details
-
"ishly linguodistal packbuilder laeotropic Know-nothingism girl-os fair-trader bedpad Sanvitalia triumphed stargazer miscreance acanth misenrols Howells noncongruity epigaster rescript devil-god wikiups sciences plimsole Tinya endnote poussette heavenly battledored Severian Manxwoman nominalistically spawned conchoid Pudu misclaiming cruentous hermaphroditical hared highlandish unanchoring self-regulation tribunal Carlson Sewell dishelms aiguiere grassworm molosse twittering inopine Congdon POB predawns calycate underdoes costumer gipped a-throng nonfraudulently periesophagitis appointable basketware photoplayer Cassadaga noncompound mollifyingly asynchronism misquoted links propugn pre-enthusiasm condolement reforming pyaemias Eglon intrusion execrable radio- superimportant osteothrombosis sunbursts DFC illogician percepts poxes unsleepingly issue Mushro MEP laudability ungaraged platemaking Frazeysburg lipohemia self-reproached disciplinableness unthroned underfacing nonprofessional dangs premisrepresentatio" (Indicator: "twitter")
"ler excysted fleysome twitteration phytolatry Farrel kenogenetic Nabathean necromancing gasiform discommunity phytopathogen Doubleday wooer-bab on-go Torin O.D. triangulator semilyrical tripylaean defaults Evonymus Vitus pretonic tongue-wagging orgys undermediator underhoused free-hand indetermination enstar readapts idolastre ill-affectedly Moln outbatter nonrecipient cusec stridence electary crinklier streamlike tinkliest absolvitory redintegrating backside floundering piperines Geaghan comping Edgardo tulip-tree meseledness Damaraland convertable disobediences unicarinate nankeens gap N. puzzle-cap safeguarding equine plasmophagy sandlapper domitable kleig reptilians dimensionality ligures funnelling Ethelstan rapturously macroscopical Nikolayev specificly uncomputably arrestment bord-and-pillar kelleg mediaevalist Loma unaffectedly jinriki Laird Koby willy-nilly duad laboring Carmela Toletan memorizable evolvement Chait disparageable bromoiodid Celluloid vicereine praepuce flagellate junked witchlike judg" (Indicator: "twitter")
"utosexing dauber farcy chondrophore hymenal humbug chiro Boomer Amblystoma somatotropic lymphatolytic Visitandine affricates tremelliform odacoid epitome electroendosmotic illumined pococuranteism ratiocinate discute side-kick pericarditis amire photofinish potlicker ptyalize detaching fraudulency descrial a-twitter nonoecumenic arsy-varsy Melchisedech ursolic knuckling unhorses elaterometer copplecrown transmogrifies fraudlessness ponerid symmorphism fellow-feel Gentes alloplastic unremuneratively menisciform unexplainableness uncontrastively connatural scarlet-red faldfee square-tailed aumoniere photochronographically binarium draftings adopters demyelination strong-box brillolette grad demoniacs neddies goings-on pipelined decl. interlardment warranties telfordizing machinely anticomplex overmastering carded medicinally mockbird misrelation cottonless rhizocephalan tympaning underlout Mycteria Turkophobe vibgyor popularities sibyllic cyanidation Chagatai wild-chosen sensualisation megass tithingpenny preco" (Indicator: "twitter")
"Trezevant thread-the-needle Scoto-celtic stevan jasmined jereeds unanswered rig-up Dukey Pontypridd spick-and-spandy righten nauseant Powellsville galloglass proviant golfers semimajor labiolingual helminthous specimens charoset pian desexed Carley Anthocerotaceae meconioid gloat marble-polishing pleaship atelier swaddling-band superweak tarantara tunnelman nebbish orchidacean southeasterly Cambs anetiological Switz aerostation thraws curded peromelous Bdelloura slinging specialize unlitigating Fromentin intangibles self-gratulating well-guaranteed wrinkle-making bureaucratism beleve lamias pretabulating Molino nucleonics decussated good-for gibbol bisalt kumquat counterforce ignifuge well-dying bradyacousia Kramlich omphalode subtrahend outranked Strato-cumulus unsaleably uncustomary misqualified pharyngoxerosis dekagramme Levitically ovate-cordate vulvitises Tibbu recopied madrague theologal emotionalist fosterer Orbitolites juicing Hesiodic twitter-twatter authorly kinetoplastic Neysa Hurlee plexodont Song" (Indicator: "twitter")
"halted glazework masticator Samkhya plum-tinted sexualization interdifferentiated polygamic Sturdivant lightproof pernicious obnoxiety safeguard autovalve thread-winding Wendy vacuate polyphasal threstle distream zoanthodemic sleep-causing volcanically A5 committor NLM constrictions Henslowe antimaniacal amini ental balkier hootier commutated lime-twig prolegomenal entangleable gibbets postdisseizin trans-Panamanian outwitter Encino calcographer microjump semitransparent acrobatic fordless unneedful nonepic retainability Kono channeled clarifiable waxworker hexagons putons Hispanophile bachelry plumieride gemellus bartended crustedly melasma cosavior whews parliamentarily plow nugget gybed teether unweeded normoblast pre-expectation lava-capped phosphorogenic rewidening estreat Nestorianizer unairable formature manor sluig korntunnur unsupernaturalize conductorship touchdown lipofibroma factorist intermuscular frugally locomote supercolumniation lacquey doesnt preinvasive fluoroscopes inwardness compressional" (Indicator: "twitter")
"ddynut ungrudgingness sleaze swire giantize victorfishes minded Caribou retrocede coexplosion semisocialism reedbuck hingelike deorsumversion Astronauts Somonauk overarching scanningly inferiors feyness heling Metol afterpains opodeldoc sumptuosity tuberculization Elfers kylikes noncorrectively glad-flowing tribble Crocus portglave serigraph citizenries CIT oblongatae annuli Cabral iconomachy mammular Chukchees humidifiers snazzier Wanyen harshened sing-sing counterpower OMV poolroot overequal hypothyreosis hydroponics Pro-cymric tinctures scombrine reintegrative unlavish rapid-running triple-expansion droned borrachio oliganthous Viveca Thapsia metallocene Stropharia synonym twitteringly revaluations QIC rubber-varnishing haplontic endgames ophthalmomalacia devastavit derecho literaliser Zackary microbarogram bedip lagen vagrantly unwraps indebted craniocele Wezn aleukemic updates righter nonclaimable unstylized trinitrocellulose pyrogenesis gispin desalinized Baptiste hastato- crown-wheel disparagements Cur" (Indicator: "twitter")
"itten sauropodous reconditioning petrosquamous dusks urethylane dipleurogenesis coronad cronies Gormania semiconscious Thoroughbred unmiasmic imsonic gorblimy Haltemprice chorioidoiritis Kubis sudoric wayment flaps geoemtry preattachment papaws groose megasclerous hematolytic refavor usableness baltimorite intermaxillary obligedness untumultuousness zygopterous supra-abdominal fortepiano taysaam cysteins carbonylic Jahwist rhila Yemen phonogramically allotypical reisolate unbeseemly Rodie zootomic Lickingville sploshy concessive denominator feistiest outwitter vinitor Isaak Miltie Olmstedville Philydraceae puniest euphonicalness Nuevo woman-bearing Danuloff giganticidal tumblerful theorists regalement acceptress roosterfish uninterested lustrings Zavras sea-green havermeal Ptolemaian fermentology interjectionalising readhesion spewers prognostication redhead-grass sidelining corrosibility cravingly yawning tear-bedewed staccatos manometers Bertha self-restraint amphibolia KRP Foneswood Bielorouss disconfirmed" (Indicator: "twitter")
"eg wreckers Jadda nonextensive corsesque fluvial owllike alidada repurge backcross pencil-mark troutless Agrotera hieroglyphize variegates sokol rattletraps umset tonearm elementalistic self-cremation distentions eigh Caballo outfield explement cotqueans turn-tree Roanna pig-jaw unerrableness moonsickness besmirching marli transfusionist unconcernment semifrater acclimations blote katogle paralambdacismus ministers parching unhunted twitterer passwoman wouldst spooler macaroon sectoral clawker Nolie Cabery civvies man-worthy deuterotype half-wildly Belleek intraschool Thymallidae Genova prerespiration counterinvestment milesimos Paphus Furey unpopular procrastination kelpy dulc imber Efland duckier seroperitoneum relearned funambulate reorganize dog-bramble nettling Joey double-lock microcephalus Sosthena unteam dibranchious ostracodan cross-stratified atavists gingivalgia vrilled bottle-tailed occurrent adiate froren tellurism scutibranchiate Pilottown Du-barry mass-house ungrubbed intra-auricular refective" (Indicator: "twitter") - source
- File/Memory
- relevance
- 7/10
-
Found a reference to a known community page
-
Unusual Characteristics
-
Installs hooks/patches the running process
- details
- "wscript.exe" wrote bytes "c04e6b7720546c77e0656c77b5386d770000000000d0297700000000c5ea29770000000088ea297700000000e9686e7582286d77ee296d7700000000d2696e75000000007dbb29770000000009be6e7500000000ba18297700000000" to virtual address "0x777D1000" (part of module "NSI.DLL")
- source
- Hook Detection
- relevance
- 10/10
- ATT&CK ID
- T1179 (Show technique in the MITRE ATT&CK™ matrix)
-
Installs hooks/patches the running process
File Details
JVC_34573.vbs
- Filename
- JVC_34573.vbs
- Size
- 3.9MiB (4138180 bytes)
- Type
- script vbs
- Description
- ASCII text, with very long lines
- Architecture
- WINDOWS
- SHA256
- ddae11922748b03e197284ed75a34abbfa5d67a4f8a97b118b4057d9fbca2359
- MD5
- 9b5ce5b61e8373d55925e3e5d46a27ca
- SHA1
- 744224778715b3db18f123465206787c7daef954
- ssdeep
- 49152:gQW4sDn8BH2vGTg/O1vRlSonkhhw2Pn1NB/BzpCJIoCH036EJE3hzWRSiYj2eq+U:gk
Screenshots
Loading content, please wait...
Hybrid Analysis
Tip: Click an analysed process below to view more details.
Analysed 1 process in total (System Resource Monitor).
- wscript.exe "C:\JVC_34573.vbs" (PID: 2644)
Network Analysis
DNS Requests
Domain | Address | Registrar | Country |
---|---|---|---|
campellicosmeticos.com.br
OSINT |
35.231.146.96
TTL: 3599 |
- | United States |
Contacted Hosts
IP Address | Port/Protocol | Associated Process | Details |
---|---|---|---|
35.231.146.96 |
80
TCP |
wscript.exe PID: 2644 |
United States |
Contacted Countries
HTTP Traffic
No relevant HTTP requests were made.
Extracted Strings
Extracted Files
No significant files were extracted.