JVC_11295.vbs
This report is generated from a file or URL submitted to this webservice on November 12th 2019 16:53:15 (UTC)
Guest System: Windows 7 32 bit, Professional, 6.1 (build 7601), Service Pack 1
Report generated by
Falcon Sandbox v8.30 © Hybrid Analysis
Incident Response
Risk Assessment
- Network Behavior
- Contacts 1 domain and 1 host. View all details
MITRE ATT&CK™ Techniques Detection
Indicators
Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.
-
Malicious Indicators 3
-
External Systems
-
Sample was identified as malicious by a trusted Antivirus engine
- details
- No specific details available
- source
- External System
- relevance
- 5/10
-
Sample was identified as malicious by at least one Antivirus engine
- details
- 4/57 Antivirus vendors marked sample as malicious (7% detection rate)
- source
- External System
- relevance
- 8/10
-
Sample was identified as malicious by a trusted Antivirus engine
-
Unusual Characteristics
-
References suspicious system modules
- details
- "siddurim nonegotistically fonder Deltaville blue-backed Haye choaty flax-seed subversive Cabanis ultraprudent uncrumpled kevutzoth clade hieroscopy snatchable cripplers anilao regerminate edgiest rentaller consute light-limbed sackbag villaindom Zahara peakish overfrustration trumpeting Charil meantime prophetism fuge Thurgau pontificating floreate well-trapped uninverted livably thankfulnesses hemianopia propulsions nine-day trans-sonic supercolumnar anemically Baun Elsass swift-changing bluebead necking petites Majorist Caerphilly curledly glowering Louisette metoposcopical turrel methhead hingeways tehee unsubscribing vaginally omentoplasty bulginess alto- fluid-compressed grittle Jeramie corporale Janus-faced windmills imminences self-interpretive untranscendental respots reenjoyment illegally abettors sargassumfish gerastian horsts isanomalous Hesychast reductions neurolite reevacuating chemises clear-cole yamen nephropexy catalectic louchettes dogsleep full-finished antiparabema supervastness flatlet me"
- source
- File/Memory
- relevance
- 5/10
- ATT&CK ID
- T1215 (Show technique in the MITRE ATT&CK™ matrix)
-
References suspicious system modules
-
Suspicious Indicators 6
-
Anti-Detection/Stealthyness
-
Possibly tries to hide a process launching it with different user credentials
- details
- ImpersonateLoggedOnUser@ADVAPI32.DLL from wscript.exe (PID: 1428) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 3/10
-
Possibly tries to hide a process launching it with different user credentials
-
Anti-Reverse Engineering
-
Possibly checks for known debuggers/analysis tools
- details
-
"endress Rosenquist nonsupplicating bountree electrostenolytic watercaster mummifies irrecoverableness tens unenticed rock-climber Tedmann anagrammatizing moid intube nastier comitative suwe seroprevention Joffre NADGE cervicoscapular bessemerizing Areopagitica gadfly Idaline equalitarianism semianaesthetic testimony outgain encapsulations dhurnas Pr. infusive disputant unaided quasi-patiently charlestons Mintoff twenty-mesh expiry llanero positivist deaminating self-reflection flirted flummoxes crepine renaming temporally nonsophisticalness generalisable dentiform nonsalubrious Florie booby chainsmith scapulette marlinespike enfect nonradiative veldman patroniser Seagraves out-of-hand gramineal birdieback seamlessly bubbling unionization giftie Wrexham footprint pro-Westerner do-goodism Psiloriti ransomed durra sithement unsty well-impressed stadholderate enemying subelectron Bekah unseparableness pectinic rampingly daubries screwdrivers extraquiz noncomposes phorone sprackle headlock balatronic sleep-fatted" (Indicator: "ntice")
"broad-headed entices cholochrome truantlike bizcacha overparticular s semitheatric Maryn cynosural braved trehala eighty-first miskals hybridized surgeoncy Meggy abrash woodland screw-turning paddocking phoneticogrammatical overreserved evades Torydom alternity Nies backsides crea pinnitentaculate prewelcoming bookstore Davidian world-destroying Devine Alcidice anthropolitic scutter Ezek swingaround circumumbilical Odinist bodkins fiascos teletypewrite sulphoindigotic baggings ischiadicus penial selahs zygon bactericholia effronteries guardee nonpersistent antired Velchanos Protagoras pilosity glaur acceleration Metaline seven-toned nations Assyro-Babylonian clay-colored durukuli open-hearthed prophototropism Carlow niggardised retardants phosphorogenic ghetti uncapped crucily corticosteroid Gracey gourded repale uncompanionable chamberlainry allantois sinistrorsally octarius phenol-phthalein stretches resinoids habilitation silicide Olympium parentela afternote homeopathies pseudodox leptoprosopy multivalvu" (Indicator: "ntice")
"olsters disequalize Novo-zelanian invillage anticensorial wool-gather half-smiling hektometer platinocyanic Rembrandt remigation gymnoglossate Mus Christmann annihilations elections miscasts tiddleywink bravers carcinomorphic dianoetical altarpiece half-invalidly reaudit thioamid Bulanda townfolk Fourdrinier barberries Andriana anisogametic Wakpala anthropophuism Kunin triammonium winedraf nonschematic unnebulous hippophagous eonisms exosmosis ring-bored counterrevolutionize artlet spectroscopist Ramean unvolubly Ghana antihierarchical muncher Evtushenko Auca pan-leaf sable-lettered redescribing cornbind eyl LSSD Ingra button-holder hypostasised swelty awnless unforgoable necton overprovidently A-day coeno- theorises micromerism reassumed carburetor shout itchproof gulonic fasciolar selectional tapetless exchange paradoxicality parotis Cleone Fancy porridge dramaticule quasi-entertaining palaces rehabilitative rebraced darbs endoproctous lodgeman hewable squatted hypoactive plow-shaped conciator TST landfills" (Indicator: "ntice")
"muskroot thegnship band-gala telephonists dorsiflex suedes knysna ruggle Tycho shies Denticeti brightness parfumoir hematachometry narcists horographer scattier left-handedly comanagements frostiest dehisced Cainian testates undieted printings hilted mylonitic abominations subramose ISOP heat-spot Mimbreno insomnia eclated biogeographers camp-shedding polyanthus CREN underpopulation rejectage Leonato wainscot-joined postcoup Gallupville phlegms clamoring uncreaturely lamellation surbedding Simsboro sidelins singlehandedness pinchcommons argentic intermesenteric overing Ueueteotl whats-its-name toilfully liberalizing inexpiate timbals escarp Jamshid Riccardo high-sea Ingamar gabert Cuthburt nourishes corps arborway folkmotes Amsden Lazaruk lignites bedding chazzen disquietude subterraqueous mucoitin-sulphuric quadrator goalposts nitrosylsulphuric choosing Negrillos Orsini catholicisation Polycaste pomonic poetastering libraryless long-fruited oversee Roberdsman unnotified racemation rifs Cypridina laborousness" (Indicator: "ntice")
"rat many-belled nonseptic buck-jump nonradical feather-stitch unagriculturally Nick bulldoggishly Balmoral plenipotence ptarmigans world-moving unwarnished moodish discoursers sulfion semitheological externat foreglimpse beshivering Salters uncoring cackler mellisugent regovern coltpixy Veedersburg uncrime concertment obelises zoogeologist lyricise straitened pseudohuman isomery sealine drummock fermentescible bulimiform nondiscontinuance Milan multihull Grevillea romanticness nonprofession personalty embryotrophe mangers Dehnel spondylitis resettable str runkeeper drused Sethrida cross-vaulted fossilise pectinal cyanopathic Kalman pannum Mowrystown hepatopathy prestamps unspecifiable rankness lote dovecotes structureless swashbuckle prerighteous changeful unsharing apprentices thyrorroria dietrichite antinovel gypper centones calculatory Kliber nonremedy germanous Malvern hisn truculence trichinizing unseclusive Gowanda whilly edge-tool mis-seat flyspecked breccia campus anacusia dj- Ludwog sabby electrotoni" (Indicator: "ntice")
"inized propione impurple scullionize Indihar Desberg misogamy unscourged Post-biblical malteds pedanticism trancoidal reusability fatherlike Morgan megilph two-handedly parasyphilosis entasias uncontiguously unbrilliant best-humored epicyemate reprosecuting jeepneys gillion monsieurship frescoes overbright comfortable palynologic uncreatively tiresome uncheaply reedwork paradropped boffola coachwise correl rose-warm aggrade wristband rheadine Eremopteris possibilities perovskite ard offerors annexationist swampside unrepublican outstaring etherialised amarettos unpatriotism im- unkill Reger spale Rudra sea-gray borities travestied entices kookier attitude cedared corticopeduncular countermeasure Ryderwood Heterodontus tympanums Germanise batture woon Aesacus depravation commonweal thickheaded garroted packager Norumbega dewlaps Burton-upon-Trent spiritlessly peaching wrinkle-scaled ecotipically boilery verminy Valdepeas Midland facetiousness outsinned misobservance insolvable long-borne tenets iarovization ka" (Indicator: "ntice")
"bakas Cressie absorption Pedroza ossein BB epicele Dracut xu zebra-plant vestiture Savoy miniguides lienointestinal whelps coquelicot fool-large ordinariness horridness jibbed groinery diffracted Aglyphodonta airlessly buckets amt. broking pickedevant pulv skulls nonfriction proenlargement wreck-devoted nontribesmen escurialize interosculating approachabl reproacher tropologized Mayologist ramoon prance genyantrum Wyalusing shuddery tunnelled busybodies Philius congeniality preagitate Sumeria habitancy knock-down-and-drag mammilla gold-broidered run-up Arette romantically bribes underlined Hovey cryptographically round-mouthed unclips late-blooming Nabila prouder micramock anticeremonially hypogeally buccula All-india pipperidge multilingualisms lithiophilite all-impressive unglued marques circummure candescently accubation filicidal disannul Post-phidian basilect unprefigured additamentary incipits spectrally hyalography decorate tendencious dolomitized four-cutter bronchadenitis vade lispund mutilatory kary" (Indicator: "ntice")
"ity Castleberry Canterburianism Karling dullness escoting oligohemia aflower boulders misclaims nonhunting aggravation reresupper Flodden diaplexal skiepper cryptogrammatical embraceries trick-or-treat Gratianna ranarium Martinism implausibleness Aepyornithiformes precontact goliaths undusted sublunar good-humoredly sensated representing shake-hands Markham full-blossomed Shanan toeing axiomatization paranitraniline benjamins tar-paved frisure torchiers Hugel lond repudiated menarcheal intercontorted worm-wrought wretched-witched presutural disquietingness cornix rabbleproof woolier sudatory Whitweek green-yellow Gallaway ragamuffinism octastichous peta- nondisparity GQ citee fathers-in-law Sab. organology azimuths tooth-rounding agreat Bonucci apology enticeable hyperpyrexial thruster heaven-begot re-reception oghamic branchi unbooted hyperspeculatively sprinkleproof appointee stowed lipohemia TDR semipractical albuminise tempeh impresario glitters socializable Roswald periangiocholitis youthen ayes licenced" (Indicator: "ntice")
"s sensualists Fiedling Hescock costicartilage sockeyes heelmaking CTTC glossarian Graecism nonerrant intestable sedans ethicoaesthetic inculpatory Kljuc redundances Pelligrini million kulack folklorish FUD featurette lassos pestiferous Htizwe well-havened industrialism outpath delimiting overshining tawny-whiskered flat-hatting noncaking Monticulipora overstraightness Unni speechless predictor frostfish subdented bimbo elychnious Wapokomo battledored hyperclassical undisciplinable idyllic freesias Maitland stunning panbabylonian nonwatertight anticensoriousness discigerous Graeco-Roman KIP sidelight stepstone sheering first-preferred szopelka deface mistigri nonaspirating Keizer adolesced Ceb conduplicate unshave succumbent madronas translatorial chrome-nickel isoperimeter autodiffusion hammerman purchasability Tanglewood Gilbertine neurotherapeutics Haroldson suspectible coresign quasi-commercialized peragrate antinormality aglossate bridge-house Kreutzer stylite nonclassically remarkers foible hornety sovie" (Indicator: "ntice")
"PAN uncollapsible anteri never-swerving ethionine pinnacles disserviceable hypapophysis Ochelata shrewdnesses micrified whasle forfeits putoffs broadhead respectworthy thermo-unstable cosmetological rabbonim electriferous Dryopians filla Confucianist allophone psychologies anticephalalgic nathless Saint-Marcellin Grantsdale Tolono Mesvinian sheather beliquored vis-a-ns isocolon Sarakolle diplomatology Chalcedon grins housemaiding wit-crack Lucie loose-wadded Norfolkian autohemolytic coenamored proofs sigmate Mincopi streaker Loami demounting Rellia belly-god fivepins alfaqui negronis balmorals uplane saip cool scler defendable CFO genesis mentimutation forty-niner Chamaeleo speisscobalt Bactris hebephrenic bit-wise symbolic ammonitiferous impall infibulate explicator emblematist well-translated y-painted pneumonocirrhosis shrike Sadducaic gimbaling physicochemic open-pit over-scrupulous enterobiasis countertheme nonsignification recreance staggers menthan nonabusiveness anthecologist nanoinstructions surprize" (Indicator: "ntice")
"ar preplotting discriminations washed-out Erlinna Ballou gorps elegancies uprive bordrage Picramnia bibbery nills antisyndication re-evade racemulose fuliginosity Cornulites Edman adagial firepink thoroughness secularly unterrified vanilloyl subdie jockeydom ergotisms axletree parentele hyperalbuminosis schorl choreography Bubalis aphids M-shaped heading Myaria eucalypti seeingly flustrating q.v. naphthalenesulphonic overpronounced taper-headed untimorousness self-perceptive overjudicious defleaing sejeant-erect aftertask Brillouin Un-egyptian conenchyma todlowrie gingerliness unravelable Erme paintbrush Diann field-controlled snows cartoned ciceronianists Life recurvature Turko-imamic pugilistic chrysograph wind-bell dokhma cater-cousinship antrum boffins Bahima Ilysiidae throughgang subdeltaic Alpiniaceae bagwomen acidness thought-read modelize radiologist myotics transmigration unenticeable amorino arrosive LTA hyposulphuric Thorn chilenite omnirepresentative Caird choppy tinnily plasmogamy ile requiting s" (Indicator: "ntice")
"volar Svea buff-yellow shirallee wrap-around wourari cutoffs Currituck pantherwood neurotransmission merchandising cock-crow predinner Augustan uncongratulatory self-exaggerated adiponitrile campana overstalely schmatte Sagamore vaporary kanamono VCM fragrancy Arachnites wreath slat unspringing Seleucidean stagehouse lampposts cryptoanalytically chukkas ko-katana hemocoele hierocratical beermaking unreviled dreepy overskeptically mopstick wavably propension impleaded whininess Nadda Ciprian Jea hydracids valuative Evensville endome Rhadamanthus gueparde arsenofuran unseminared Bagobo cupids tolylenediamine manumotive undigenous come-hithery stubbing unfashion shielded Phymosia eloignment extratellurian derangeable matoke intail Doig busty semuncial amblygeusia quintessences recoast scioterique lenticellate pellagric partake Fatherhood marish foreassign semicultured Weald flayers taboparetic ensweep back-acting synergists Chapnick cannikin burbling derivations migrative patriot naphth- honey-buzzard constitut" (Indicator: "ntice")
"glymoid confidingness Dwain scarth scleras oedematous sardel lallygag thalamus twice-raided unreconstructed apriority paganize ill-use prochordal subluxate ooziest sledded Suez self-schooled dermasurgery Nitrobacterieae Haryana Naamana controled drumloid arborea Ashdown gemlike inexpressibilities impenetrative Megalaemidae stalactitical ascarides romeos heterometric incorruptibly anthodia Homoean leverman corbeils despotism Notostraca confabulate IMC bedlar time-saver paedonymy lumbo-iliac veiner oversimplify Ascapart nonoppressively hydroplanes funnel-fashioned tear-bedabbled wolfsbane simaruba inch-long colpeurysis superintending limulid asserts dogget graftages investigable preresemblance kubba infusible dramatise stater unmodernize parale petals yede segregator malleinize gallinazo nonlanguage physed pennopluma toronja Tagala oblong-elliptic antiputrefactive curvinervate plantar Neufchtel disnaturalization counterboycott Andre unoverwhelmed nontranscription anticensorial precipitatousness paaneleinrg chlo" (Indicator: "ntice")
"ty-ninth disrange Buisson placentation outfleeing transcendentals enticeable Dunn swacken refine Manche Novara well-inhabited binaphthyl storiological libraryless sampaguita stock-route presbyterially swinestone luctation Yao overnice undestructive enleen fallage Meibomian captivated authigenetic bachelorly self-banishment counterthwarting hypno- pharyngotome subvertebral Babylonite chromoscopic backhandedly rust-resisting tonguesman svamin nonpromiscuousness republicaniser crenated strabotome Raquel oscitancy countercurrent half-contentedly troublesome heart-quake Fagaly resnatch Landsturm Anomalon yelper one-lunger decimates prostatic coloroto membrane musclemen scaups lang. gunplay sylvae tardiloquy subjugates sound-group Nissy idlish Jump uninsidious undesignedness reffroze predicting dedolent sight-reading karyo- unslating cornier Fairfax displeased unfaultable gladful razorman Barea peculiarizing modili upturn Kimberton attainably cabombas representable Somoza Paramoecium Halmahera incisive crestal rotu" (Indicator: "ntice")
"tal wordlessly mussal sheppey missionize antithetics sjaak south-westward borderlander garaging erg- mondaine overchrome south-south-east hardiesse polycarpous taffymaker otocephaly smokebox hand-clasp grimmiaceous geolinguistics Wirephotos squirmy nonconscientiously cementless ratlins Bender symptomless counterlode semicombined zaddick salpians downheartedness ivorylike rejecter nightmarishness caing-whale infractions pin-prick Knighton well-hinged extranormal hic-cough prentice unvitrifiable nettler deformable epiglottidean violentness quarles Leitrim ichthytaxidermy hydrogenic agalloch Nefertem furmint vaulting preformation ribbon-bedizened arsine mysteriously Pardubice controvert Echegaray erosivity unwonted backpacking swift-swimming nonadaptability eccyesis gratifiable oxyethyl mant aerocyst shirallee ichthyographies anidian presignaled monologuists Edny biographers cyclostome base-begged fallacy dequeued dongon culets Oken Riffi pegador extrasensorial pre-evite oophororrhaphy reacquaintance microcline" (Indicator: "ntice")
"tingeing columbium revehent eolopiles re-express bibliotherapy Appolonia gibaro vanquisher misunderstanders cantion bromometric spleughan antiliquor velocipedic infrustrably nongypsy Amir noncompearance amuse operatic herring-shaped cupholder pennatuloid four-lettered Rinde metathoraxes predevised corticifugal overobvious carpentry venom-mouthed perplexer Hyrtius Blankit executrices eel-backed animando prefectship carpocarpal grainsick comminutor icinesses overcaution homoeopolar nonthreatening full-witted morepeon Feuillant short-sloped frosts MVP endostea beat-beat phlebotomy underemployment wannesses Alidis BVM unenticed wheezingly biostatics crewman cardooer popgun Roopville Darcy survivers Cannes Euh speered cinenegative nonliquid long-suffering collapsible unamiable victimhood Ranunculaceae encipherments chkalik visiter wild-fowler sluig romanticise students prau pseudodeltidium Leveridge unsanctify Mohammedan nonexportation patacas Lollardism Sciara hospodariate oscular tallages ding septemfluous zirco" (Indicator: "ntice")
"nce subedited arcanite frugivorous overpraising afdecho Palumbo PACE borderer accessible temples misqualifying Cracca syndicalistic pallettes noncathedral superminis blow-through Ullur anticeremonially overwide Spindale ableptically unwasheds turpentining yuh blanque instrumentary epistlers grecale roman-fleuve Kanesian rudistid zoozoo mudras didst scatt vice-regal emporte sarcophagine outsinned Bozzaris stomach-hating oblectate proxying multinucleolate pole-armed pondweeds ill-perfuming cithern inconvincibility undefaced questionlessness counter-beam simple-life aprication topaz ine vagotomy alethopteroid shallow-headed Cicily dharmasmriti power-packed catechins unsacerdotally proboscislike tergeminate AIH unselecting citizenries limitary unhome galabiya skewering devices duplifying spottable unintendedly furzeling stagnicolous spinnable chariot-shaped rubber-growing misrendering hypokalemic shrogs unmendably Aida re-reject Kella Benet sperate ill-humored ballotist protext taxicabs historians carangid conver" (Indicator: "ntice")
"er-brain shaharit unplacidness hoys embarks apprenticehood unseduced breunnerite lateralized terebinthinate unjolted polt burhel ADB sapraemia detour duodecimfid Ubiquitism citrals cocentric far-passing declamatory cogger Towroy decken overlets FOIRL transplantation nut-gathering modalist enhungered impotionate Inkerman jinjili self-rewarded preamps hypothesizers snoek attainers nonsuppositively polychsia ink-blurred marishness hydromantically encyclopaediac Trautvetteria tocodynamometer pitchable Hofmannsthal infantry peripateticate dewaxes pen-clerk dalar auripuncture nondependance palates presupervise utriculoid regurgitative disaccomodate preapproval impacter Zapara pointillage pollinarium Shien Brakpan canchalagua bloodings misassertion pumphandle hymnodical observable limousines Falfurrias Shaff ravaged telescoping sordavalite misscribed toters Compsilura incomparableness agynic caperbush haematal thick-toed naut. soliquid tobaccoweed scaffolder octocentennial unblacked faunistic superficiary Zululand t" (Indicator: "ntice")
"ba cussing papalistic tenability operating rose-sweet re-ejection shellfishes microfauna licentiate semisomnolent intercomparison uncharacterised obduce Lashmeet inharmoniousness invader cyborg postulancy oilstoned grakle treacleberries pashed lixiviums marlaceous incidentals reservatory Vary wallboard infrigidative Penki misputting breastwork stunningly apprenticed shortsome quietest PFPU desiderative punkiest ruinously well-believed rooflike reservations lateroflexion Tubman coaled legatorial theatrophone heaven-descended congealableness outsoared choirs squirearchal serific witch-struck harmlessnesses treget epinard diallelon radiotelephonic veratralbine dizzied tipstaffs antidetonating psyllids improviser bathybian exserted overstridence inexpugnably semiabstracted Lak Whallon elixed gallivat myristicaceous Manitoba ultrashort egre unquailing Balinese trephination nonrabbinical patise snaff duoviri brownness didascalos Joyous bacteriosis shilf theopneust niggardize playbox nonsymbolical underprize superbe" (Indicator: "ntice")
"ggy bistetrazole nake-footed whip-grafting antiaphrodisiac wealdish Exultet dolesome Sidwell nonasphalt deices binuclear presbyopic Pirithous orchidotherapy Rexmont unblameworthy quadrella circumspectly NHLBI Massena fible-fable isooctane acalephes unshut valid Janissaries caseloads stereophotographic Sardes paidologist hypsistenocephaly Maren nonmanipulatory myxedema reassembling squaterole ethicoreligious orthopsychiatric Dubai bangtails prickado Diogenes shtetls Gilberte ally amande solenitis bewaste Dascylus hemicyclic favoredness contemningly gorgonacean Philippines achieves incorrigibly brachiopodous staccatos cross-crosslets Frejus Jocko thole urethrotome blunderer coagulase predecree ergostat helide daffodils angiocholitis caudebeck cystoadenoma thero- Babelize tapoa mechanisms Osteolepis protrusion sextuberculate underprentice Meccan fiddlebrained timbertuned Danford dizziness inspinne Bern color-grinding soul-sickening Bonis yowing linear-lanceolate snow-slip chasings Bourguiba actionist systatic en" (Indicator: "ntice") - source
- File/Memory
- relevance
- 2/10
-
Possibly checks for known debuggers/analysis tools
-
General
-
Contains ability to find and load resources of a specific module
- details
-
LoadResource@KERNEL32.DLL from wscript.exe (PID: 1428) (Show Stream)
FindResourceExW@KERNEL32.DLL from wscript.exe (PID: 1428) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to find and load resources of a specific module
-
Installation/Persistance
-
Executes a visual basic script
- details
- Process "wscript.exe" with commandline ""C:\JVC_11295.vbs"" (Show Process)
- source
- Monitored Target
- relevance
- 10/10
-
Executes a visual basic script
-
Network Related
-
Sends traffic on typical HTTP outbound port, but without HTTP header
- details
- TCP traffic to 35.231.146.96 on port 80 is sent without HTTP header
- source
- Network Traffic
- relevance
- 5/10
-
Sends traffic on typical HTTP outbound port, but without HTTP header
-
Remote Access Related
-
Contains indicators of bot communication commands
- details
-
"n Nummulites expatriation SYSGEN clitterclatter Katrinka Virgilia steam-ridden Beduin downstroke sabe pedograph donnert decate predecess triannulate candy-striped ender-on debauchees pieforts protective unallegedly Philanthropinum Gragano outspans good-humouredly overtiring pagador trifluoperazine McDaniels back-blowing woodenhead cosey Carpaccio coalers asphyxies tarsochiloplasty misnomer flexibilty Pandoridae sinewy totalitarianism cyanochroia blue-cap didymus Sprung centistoke anticynic unconfirm urethrorrhagia incurving uninterrogatory enthymeme gastnesses asynchronously takers scalded Cutcliffe defaultant rehydrate subtext overprecisely Chari-Nile tetrole backhoes horse-and-buggy scyllitol nonperfection bilbi rhizophoraceous Rhemist sterro-metal verbifies attacks zoomorphize pizazzes Orientalised advenience blue-coated shr Richview debilities Andesic fleabag multitask profligacy heteroblastically toadwise figurine Myriophyllum unambiently Goldoni mattress nondenseness sulfoxide by-walking turngate cremos" (Indicator: "trinka")
"oids slumming theriomancy rawhides spikiest memorialiser counterstratagem flashingly centipoise soyate contortionist Barden subclerks nippiness pkt. panachure alveolated noblemem clavicylinder double-banked aveloz antihemagglutinin scriptoriums mutualizing demicircular flamfew hot-short fustoc fonds underdrain Cropwell sparrowless Wimsatt fessing swampberry feminizes ridge-seeded Irons rhizomelic self-supportingly choriambuses yellowtails embolemia uxoriousness grudgingly Chriesman Watsonville fullage engroove liquated nonconfidently imino mumbling croceus beltcourse pyopericarditis sparteine throughither rivieras folia aworry staplewise pamaquine Nashe heptastrophic formably compliment springily Ptolemaist Sarajevo hypophysectomized cybernetic varnish-treating Harrisia insinuator rosorial folium vitascopic stiff-plate go-getterism antimonium extemporisation dinothere rudiments forrader unabrasively desponds keen-o Swaps Dowdell solvently megaword Lithia QID Katrinka diathesic beggaring laminar wapatoo priest" (Indicator: "trinka")
"gating Bactria skylarker Spectator router Himinbjorg sleepingly bemole adenocellulitis cook-out shikaree sonk Sargents idiometer reoccupying elychnious strokesman undesirousness facetted Katrinka coxendix Judgment grandfathership photo-set peopler durrin shilly-shallyer sublicensing text-letter rear-horse untamely oxalo- tonguey inclasp syntrophic laze laurelship padle wanga parallelize pilchard curtaxe nibblingly intellects rampier counter-brace metapsychist Half-french TRAC night-haunted zymic sulphatize coalyards unchainable multipresent barfs wieldiness Sovietised diplanetism scutcher Eire diphygenic semitrailers hits newspapery PLD bassette Australorp semieffigy Vonnie ensphering Jovicentric enharden prismoid Windzer wigglier boarish lechayims waxlike top-level forest-frowning zooecia langlaufers twice-balanced histidine exortion Lurleen lame-brain flavor antireligion semicoriaceous moolas permirific mange by-and-large sea-card Berean overpositively angering polyanthus subdivisions devachan vociferously" (Indicator: "trinka") - source
- File/Memory
- relevance
- 10/10
- ATT&CK ID
- T1094 (Show technique in the MITRE ATT&CK™ matrix)
-
Contains indicators of bot communication commands
-
Informative 15
-
Anti-Reverse Engineering
-
Contains ability to register a top-level exception handler (often used as anti-debugging trick)
- details
- SetUnhandledExceptionFilter@KERNEL32.DLL from wscript.exe (PID: 1428) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to register a top-level exception handler (often used as anti-debugging trick)
-
Environment Awareness
-
Contains ability to query machine time
- details
- GetSystemTimeAsFileTime@KERNEL32.DLL from wscript.exe (PID: 1428) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 1/10
- ATT&CK ID
- T1124 (Show technique in the MITRE ATT&CK™ matrix)
-
Contains ability to query the machine version
- details
-
GetVersionExA@KERNEL32.DLL from wscript.exe (PID: 1428) (Show Stream)
GetVersionExA@KERNEL32.DLL from wscript.exe (PID: 1428) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to query the system locale
- details
-
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 1428) (Show Stream)
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 1428) (Show Stream)
GetUserDefaultUILanguage@KERNEL32.DLL from wscript.exe (PID: 1428) (Show Stream)
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 1428) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Possibly tries to detect the presence of a debugger
- details
-
GetProcessHeap@KERNEL32.DLL from wscript.exe (PID: 1428) (Show Stream)
GetProcessHeap@KERNEL32.DLL from wscript.exe (PID: 1428) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to query machine time
-
General
-
Contacts domains
- details
- "campellicosmeticos.com.br"
- source
- Network Traffic
- relevance
- 1/10
-
Contacts server
- details
- "35.231.146.96:80"
- source
- Network Traffic
- relevance
- 1/10
-
Contains PDB pathways
- details
- "wscript.pdb"
- source
- File/Memory
- relevance
- 1/10
-
Creates mutants
- details
-
"\Sessions\1\BaseNamedObjects\Local\InternetShortcutMutex"
"Local\InternetShortcutMutex" - source
- Created Mutant
- relevance
- 3/10
-
Logged script engine calls
- details
-
"wscript.exe" called "WScript.Shell.1.CreateObject" ...
"wscript.exe" called "Msxml2.ServerXMLHTTP.6.0.CreateObject" ...
"wscript.exe" called "ADODB.Stream.6.0.CreateObject" ... - source
- API Call
- relevance
- 10/10
-
Contacts domains
-
Installation/Persistance
-
Contains ability to lookup the windows account name
- details
- GetUserNameW@ADVAPI32.DLL from wscript.exe (PID: 1428) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 5/10
-
Touches files in the Windows directory
- details
-
"wscript.exe" touched file "%WINDIR%\System32\en-US\wscript.exe.mui"
"wscript.exe" touched file "%WINDIR%\System32\wscript.exe"
"wscript.exe" touched file "%WINDIR%\Globalization\Sorting\SortDefault.nls"
"wscript.exe" touched file "%WINDIR%\System32\rsaenh.dll"
"wscript.exe" touched file "%WINDIR%\System32\scrrun.dll"
"wscript.exe" touched file "%WINDIR%\System32\wshom.ocx"
"wscript.exe" touched file "%WINDIR%\System32\en-US\KernelBase.dll.mui"
"wscript.exe" touched file "%WINDIR%\System32\msxml6r.dll" - source
- API Call
- relevance
- 7/10
-
Contains ability to lookup the windows account name
-
Network Related
-
Found potential URL in binary/memory
- details
-
Heuristic match: "campellicosmeticos.com.br"
Heuristic match: "GET /wp-content/uploads/2019/11/word/aaaaa.png HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Language: en-us
User-Agent: Windows
Host: campellicosmeticos.com.br" - source
- File/Memory
- relevance
- 10/10
-
Found potential URL in binary/memory
-
Spyware/Information Retrieval
-
Found a reference to a known community page
- details
-
"xogastritis ctge Baroja uncaressing Expressionismus Rajput supersecurely Notogaean debituminization panax natally zooparasitic head-aching cytologists spotted-eared listener guaiacolize a-twitter ignorantism sharkship reproducible Town untenable cfm Petracca Phoma dallack mammondom predistinct sanguification unoptimistically Granniah preresolve Paulsen heterosporic GREP pretelephonic punishment bookstores wyling thin-belly pamprodactyl intricacy protracts Ellen vel Shcherbakov cross-bar golilla policemanism scions low-wattage pitch cajeputole stenocephalia helicogyre abyed interval variolization eosinophil clarissimo unexplosive pyramus nonny leptoprosopous well-supervised pre-Mosaic Crenshaw cadiueio theologium girkin retraversing beblubbered serpentinization triluminar large-billed intervocalically phototrope rabbinate tabulates Doris cornstalks Jesuitess mulmul Scythia Delphinia cynomorphic euphemize Mathia dynamite Lapointe hiphape Bowden centriciput ridingman adulated worth-while chiasm slant irresolvabi" (Indicator: "twitter")
"knuckle-dusters maculating pseudoscopy inattentions planaru Shiner naphthol venise hachured untowardly retranslation preedit Waldemar carniferrin knee-braced anhungered Ofella longeve cafetorium deterge sueded splenotyphoid Coumas vomitus riversides nonpunctuating whim-proof frowsty preconcentratedly cross-brush devils-on-horseback well-risked exhaustion importers lymphoadenoma Nabathaean velvetmaking Girafano vowellessness abrenunciation oysterwomen winding coroplastic Scioto slampamp overfertilizes Klanswoman decimalizes pelado nostrummongery worm-eatenness antirennet prolification head-splitting Ribston UCLA stagemen mellifluousnesses Timmonsville bromocamphor curtseys bignesses ancraophobia twitterboned nonelastic nonprevalent bacule simiid saggaring Ottomanlike Whitten calinda sluthood swell-butted cagelings plaidie stereometric bottle-soaking tensile overluscious buyers noncursively nonconcordant airships orchestrelle kalan Rocroi wittedness swimminess yellow-necked telephonists lowering reconfirmations" (Indicator: "twitter")
"elagianism brigued sceptical ARQ squibbing corrive unridableness zinziberaceous serration flytiers underbeam barlows amphigories subcingulum dislocatory tuath pikle reinforming trieciously tecali hens-and-chickens metallish wassie self-vivisector groundspeed Star playback Weygand nonbenevolent indigestion hymenopter infolded well-emphasized king-piece stem-clasping intramolecularly deviable FAAAS tinlet unshapen underskirts self-good immunitys sand-faced Breen remutation Fabrienne Carteret Boling shagginess eye-opener hotter twittery octaroon zeks ileocaecal tree-toad flayer saw-leaved humoristic paraconscious vomitous subspecialty Englishwoman land-measure mesorectums dioicous Alsen Pteropidae ladyfinger moppy Neona overiodizing chivarees Chopunnish Rochemont preselecting turfless oiled butterjags quasi-mutually bibliology semichiffon stomachical limitability reelecting wellmen prince-trodden plausibly nonagricultural bobsledders overburden disseises one-fourth micturition chrismons exsertion redrill alkylen" (Indicator: "twitter")
"truceless hardnose rejunction sceuophylacium sunweed hins angiectasis piragua collusiveness Comsomol poltophagy Theorell five-foiled tearers siket Chiwere imperativally mineralised ass-backwards goldeneye urase snoutiest Mountfort Tatsanottine Metzler Johannesburg mildly bashibazouk unstriving proteins OEEC minnesotans Varl acinetinan cheffing nutshells tussocks maxilliform beta-glucose Kalisch hamaul Mdlle solifidianism trichonosus decylene enchainments empaler reimplying Weinert oxazole scrutinised half-one calcification burring half-latticed adjudicata Gurmukhi injector Loricati efficace shaikhi Jamshyd Lancey civical Polloch carelessly bookstores antennifer Aloke pancaking Sergeantsville lopeman democracy gamene home-abiding assailant crapes Lashmeet bismuthite guttular Bellot cymae pearlet IX slaveless will-o-the-wisp nonvaporously intersociety Uva-ursi orphandom BNFL haematoxylic redredge AWK vulvar hydrophobous Oneonta tonnelle qualitied swimmingly quinoidation enisles uncallous twittering undenizened" (Indicator: "twitter")
"s courtrooms pseudogalena GCS crosstoes pliancies undecompounded sealless twitters amphibians open-spoken slanderers forcive Naytahwaush interparenthetic nonsentiently propmistresses speave thimbleberry spearers encephalasthenia paid Cicily cretaceously circumcincture megahertzes springfinger preprovoked exorganic clothes-consciousness papane epigrammatical exomorphic corollaries half-shamed kilogramme teutons unhuman aggregation subglobularity unprecipitous mayten brevirostral PWB goiter anaesthetization overmodify hematocytozoon Poll gyrons hazes broadens sequenced nitrification Conor Medeah arapahite foghorn latanier zoophorus live triakid dhooley quickside Saxony sulphuring ergates re-exchange exposture Durno salmon-rearing denuded parture VTOL Asar monologist Chateauneuf-du-Pape Germain gazetteers OJT self-writing unmedicable inadvertantly beclasping Atnah gobbledegook boardroom lipomatous antiopium actinodermatitis reattract fandoms hare-eyed shrinkproof unsharped Bernardo clothy boyau presumption unpro" (Indicator: "twitter")
"octandrian electrotautomerism completes denitrificant explanato- Barberton overfertilized gloriette kopjes Idell rebato sashimi ficuses K-radiation Siphonales schalmey stumor tribophosphorescence dimorph Nairobi flame-sparkling melanite beclogging a-twitter worst-bred Barolong depositure
'praetor deuterozooid oxygenless pyramidic depositories misopolemical Stellaria resack pepless mudstain JST unbothering Lajos dead-nettle Theopaschist deliriousness effluviums Bow apposed smooth-coil biddably Past epistolic wonton spindle-cell halenesses laceless mudsills dithionic phosphoreous Neanderthaler unboisterous disruptions exobiological volumometrical prediscriminated headaches gamestress undangerousness NCP tapering chromatize wassie kindheartedness votist bacteriofluorescin nonaffilliated popsie Baras mealmonger rustles wash-hand corv undernome senhors caravel dorsiduct bad-mouth unburnableness tokens tolerances cementitious oblating Marathi parabolical discommend exhalant sauty indoloid pointillistic projicientl" (Indicator: "twitter")
"d dynatron sylleptically Dollond impales superfusible disarranged partition stereoisomeric amalg callosities unshakeable preview slack-salted nonmicrobic Flewelling multistage top-castle paar bedin recredit wristlet pronationalist depaints otopathicetc evoked preenlarging tracksick pederero penny-wise epopees snowshoing fleecy womanizers balachong amidate detractors Armen Florentia coaptation Decapoda syssarcosis intimados overply cabbie international-minded penult mishandle Peneus delightsomeness insightful jackrolled Serpens shade impunity nonexhibitionism ungossipy derner showish unconflictive furriners superambitious monostylous kerslam blathering Ramada sanitizer ablewhackets petrologist missionarys excises platie outwitter appareled transplacement asemia laughter profluence clearheaded pilferer unpetaled rechannelling Pithecanthropidae whipping-snapping Sheets distributions unwarbled cross-plough Reste unrevenue dark-red Emison afterthoughted MDES tachistoscope timbreler tournaments rastled BAgE semisol" (Indicator: "twitter")
"ot unacclimatization Platyctenea skin-spread flameproof vacual Itys silentium lanthania breakwaters staumer sixtieths nonreducibility sociosexuality commemorated Unio twitter unresidual spiraling exhumations normocytic Badalona dollarfishes mediocre azlactone raffishness superreform naphthol phagocyter nonenigmatical indifferentness Grecia shilla doorjambs Calakmul sternebrae Iorio proselytizer Faberge Dracula Fissirostres kinswoman nonmineralogically a-slug unchosen nomologies mismark unconfinable snowcap roughed cauli sapa Hialeah Carenton clavipectoral infundibula Stiria bibliotics collieshangie bewash baclava Lina polarized Dominga superalkaline subtext neonatal sulphurous unrivalledly Crile Girdwood quasi-malicious costodiaphragmatic pratincole world-braving haematozzoa diaphanometer obcordiform Pomeroyton Endoparasitica chrome-nickel leafhopper VAT Liliiflorae gloams timelessnesses overdeepen trail-eye Breda drabber lemon-scented Vanzetti lazing hybridiser acceptors radiologists psalmed jollifies lactob" (Indicator: "twitter")
"ners aleiptes hafnyl cracker-barrel Notommatidae spirems beakerman masticic two-topped malati conservativeness ballgames gold-ribbed paragraphing sockeroos lepidoid dislove fusionist swordswoman presuppress theatry pulsations frostlike unexpressable phonotype LCC Isuridae aphasia mezquit widen Franglais bequeathing caboshed unmodern unaiding slender-stemmed Peregrine Losey Lotson six-spined Tetrapanax Italo keck unhoaxable iridodonesis twitter strengthful Zoha taxameter Sekofski unknitting calycanthin olfactophobia Meany toured mustafina phallical spriggier overtire negrolike anorganology victorfish canebrakes outmeasured tomatillos pole-stack outdriven crank Marijo moved prosish trabeated supralinear pusillanimous blood-worm darkly Chattertonian free-silver Apodis thioalcohol polyhedrous Faxun Aholla out-room Eriophyes false-bedded bethanks boltholes dodkin bibliopolism nontrial saning Lot world-renewing overplausibleness Garibald fluidly self-compensation diluvy alcaldes phratriac mycetophilid conged loller" (Indicator: "twitter")
"is smooth-handed concion Silone unhanding many-valved hydrophyte bare-chested hemadrometer soupon ateliotic uprights compassions extratympanic literalmindedness abducentes chierete Chaetosomatidae pseudoprofessorial coconuts bittering carburise OSHA sclerose objectized Russifier nephrotoxicity pools unchewed minyanim nonaphasic unremotely quasi-honest canvasses diverter constructionist liege-manship seasons televising sun-blown metastasizing Banner macrosporophore ganoses Jewess redhibition Steff underarming barracouta krises datums fissiped unignored phaseout Wakpala punger actinomycesous reed-thatched outwitter idlenesses Osei nonactive aplasias pennant cordwainery Pottstown forebridge dowcet bhoots Richman haematics oliniaceous multisection underachieve Madel harkee tigrolytic spankily moorages superdying interiors episiorrhaphy worriting oxalite entrusting Loewe squamosoradiate caponata SABRE enodate harenut quasi-evilly pre-Copernicanism deterrability Katik thirst-abating untranslatable doiled Graecised" (Indicator: "twitter") - source
- File/Memory
- relevance
- 7/10
-
Found a reference to a known community page
-
Unusual Characteristics
-
Installs hooks/patches the running process
- details
- "wscript.exe" wrote bytes "c04e3d7720543e77e0653e77b5383f770000000000d0aa7600000000c5eaaa760000000088eaaa7600000000e968487582283f77ee293f7700000000d2694875000000007dbbaa760000000009be487500000000ba18aa7600000000" to virtual address "0x76B61000" (part of module "NSI.DLL")
- source
- Hook Detection
- relevance
- 10/10
- ATT&CK ID
- T1179 (Show technique in the MITRE ATT&CK™ matrix)
-
Installs hooks/patches the running process
File Details
JVC_11295.vbs
- Filename
- JVC_11295.vbs
- Size
- 3.5MiB (3706862 bytes)
- Type
- script vbs
- Description
- ASCII text, with very long lines
- Architecture
- WINDOWS
- SHA256
- 21630accc67dacbfef3f49a720ed9cac3919b68738b300dc6a13975da8895cb0
- MD5
- d9a05d76dfc77284d8c15105f23a2f9d
- SHA1
- bb08141a63f2866595c7387433afb8f95ce5dc10
- ssdeep
- 49152:r3Kn2EHgVUb5Y1yc2Z8wV18KBtjBJq6G7mdVBZx2wom0sLzcRAxtjiVZR5bK4Uyg:E
Screenshots
Loading content, please wait...
Hybrid Analysis
Tip: Click an analysed process below to view more details.
Analysed 1 process in total (System Resource Monitor).
- wscript.exe "C:\JVC_11295.vbs" (PID: 1428)
Network Analysis
DNS Requests
Domain | Address | Registrar | Country |
---|---|---|---|
campellicosmeticos.com.br
OSINT |
35.231.146.96
TTL: 3599 |
- | United States |
Contacted Hosts
IP Address | Port/Protocol | Associated Process | Details |
---|---|---|---|
35.231.146.96 |
80
TCP |
wscript.exe PID: 1428 |
United States |
Contacted Countries
HTTP Traffic
Endpoint | Request | URL | |
---|---|---|---|
35.231.146.96:80 (campellicosmeticos.com.br) | GET | campellicosmeticos.com.br/wp-content/uploads/2019/11/word/aaaaa.png | GET /wp-content/uploads/2019/11/word/aaaaa.png HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Language: en-us
User-Agent: Windows
Host: campellicosmeticos.com.br More Details |
Extracted Strings
Extracted Files
No significant files were extracted.