JVC_50616.vbs
This report is generated from a file or URL submitted to this webservice on November 17th 2019 12:53:02 (UTC) and action script Heavy Anti-Evasion
Guest System: Windows 7 64 bit, Professional, 6.1 (build 7601), Service Pack 1
Report generated by
Falcon Sandbox v8.30 © Hybrid Analysis
Incident Response
Risk Assessment
- Network Behavior
- Contacts 2 domains and 1 host. View all details
MITRE ATT&CK™ Techniques Detection
Indicators
Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.
-
Malicious Indicators 5
-
External Systems
-
Sample was identified as malicious by a trusted Antivirus engine
- details
- No specific details available
- source
- External System
- relevance
- 5/10
-
Sample was identified as malicious by at least one Antivirus engine
- details
- 4/58 Antivirus vendors marked sample as malicious (6% detection rate)
- source
- External System
- relevance
- 8/10
-
Sample was identified as malicious by a trusted Antivirus engine
-
Unusual Characteristics
-
Contains native function calls
- details
-
NtdllDefWindowProc_A@NTDLL.DLL from wscript.exe (PID: 1908) (Show Stream)
NtdllDefWindowProc_A@NTDLL.DLL from wscript.exe (PID: 1908) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 5/10
-
References suspicious system modules
- details
- "n hazards Curuzu-Cuatia estudy metasome Lecce applicators alkane red-water abradants tch meditating athrepsia black-hoofed Wallonian Husein choreographic toeing Trew Neveda parser un-thought-of roguishly cambrics copulative ensophic unportended bradylogia noosed lookers-on residenter arthrodesis slaverer Elsass-Lothringen reinterrupt philauty Wymer papaphobist rufofulvous revalenta Cocceianism amplifiable QN besprinkler oversleeps orsede canephori Holiday islandologist braggy Liatris beglamour Gleda rhamninose cyclostome intertransverse wooden-faced spermigerous slovenwood TELSAM hairy-legged paleodentrologist saghavart sedging chicquing handgrips Francescatti Humiria enchiridia free-flowering shaws coryphylly outleap subgroup Maalox bordured jubilates fellah counterpace have-nots latest low-ceilinged Blaeuw Pelmatozoa recogitation ceyssatite manhandler Anita Sino-mongol swashbucklings nondoing deglutitive loggers castable INC cirrhopod mesiogingival photopography aerodynamical close-gleaning semicostal Brinn"
- source
- File/Memory
- relevance
- 5/10
- ATT&CK ID
- T1215 (Show technique in the MITRE ATT&CK™ matrix)
-
Script file shows a combination of malicious behavior
- details
-
The script produces internet activity
is obfuscated and drops files - source
- Indicator Combinations
- relevance
- 7/10
-
Contains native function calls
-
Suspicious Indicators 7
-
Anti-Detection/Stealthyness
-
Possibly tries to hide a process launching it with different user credentials
- details
- ImpersonateLoggedOnUser@ADVAPI32.DLL from wscript.exe (PID: 1908) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 3/10
-
Possibly tries to hide a process launching it with different user credentials
-
Anti-Reverse Engineering
-
Possibly checks for known debuggers/analysis tools
- details
-
"es juddering overinsuring intransfusible allbone Brioschi rightfulness osteodiastasis tapissier spiketail wreckages unpropagable japishness hypotensor oner neat-footed ungreen subflexuose dupondii lockless tendance steganographist alginate prosaically inspiration arbours Directory scarf wetland saurodont huthold multisiliquous repasts tombolos hemionus undevelopment matroclinous Zygocactus ecthetically Selinuntine furcately leatman scrounger exertion Lyaeus oversoaking Pyrolaceae lekach half-cocked Jeconiah counterconversion strong-tasted scientize lenticels horror oleocyst pshaw Josselyn shilled Messidor docimastic answerers Rattan apheliotropic quet acutilobate perruque clinkering intermittencies propitial Ress subconnation ballplayers unindifferency multihearth tidy-minded untaught spacesuit salvational well-loved subglabrous glar toolsetter scaphocephalous reappraiser picoted conoido-rotundate infinitesimalness odontatrophy Dimond hearsecloth diamagnetize equations breakpoint anticlassicism undictated Ang" (Indicator: "ntice")
"s adepts Aryan gimper feeing paedagogism federalized impudicity wintertimes shearman squirelike saxifragaceous nannybush self-jealousing Sontich xenogenous triarctic earthlinesses petsais MKS small-clothes librarius slakes ale-born mucklucks forwork thermopleion regalers Whiteboy comices schmuck rudistid tutelary brinjarry professorhood pteridoid stern-minded plebicolist previolation governs grieved stonecutting unexcitable allomerize efts telemen Coleophora unimbanked exquire hydatopyrogenic pan-Saxon slothfuls nonartistical zootrophic trigemini angio- illegitimacies Arapahoe flat-handled incandescent macadamise flickerproof unegoist wars keepership lace-piece Randolph fillingness Waldos Apostolos shradd Brodhead MTBRP microelectrophoretical untheological nempne calipashes krummhorn pyrenocarp reisolated concipiency issuably unemerging disgustedness semiphilologist anticeremonialist great-grandnephew bescorching mallangong shrink-wrap stick-in-the-mud Spelaites vagation ethine dioptry attenuators masculo- de" (Indicator: "ntice")
"ndomineering Orsay enticers sparse-flowered glaciaria nonimpeachable Tubatulabal suite rhabdocoelidan ascertainable snibbler dealership reexchanging tender-bearded sidelights hyalinize countersignal packings Catodon guanays warpath hantle meadowed spear-thrower Trumaine evisite overinterference Jeritah pinene virgin-eyed fatherlike misbind unexculpably big-antlered Robins eirenicon eths oversocializing arachnidism Greco-asiatic isohemolysis preconcertedly Elbring localites howish ocean-spanning estampie misky reassuring hurrahing nonrectangular obelism Tiahuanacan unpreached clistocarp badinages bacchante partitional adlumine Gorakhpur tribunes willingest unnotational thorn-strewn dentex Clinchfield replenishers squeel grasslike Gallice bloodthirsting hoardward remanifestation culinarian bayonetted extorsion tubularian skeletonising storm-wracked catchlight coachable dodecatoic peracids geitonogamous fellated husking sphygmophone doorstop nonyielding haemophilic crowncapping hymnists threstle space-bar permea" (Indicator: "ntice")
"ong-exerted aboriginary minable tumfie statueless dedicative enticements inheritrices wiselier Tarentum rough-looking touchability nautili Biblicism unadeptly Leskea Macacus greened semiholiday Pararctalia predisclosure Taculli sawhorses Accad exorcistical Brugge nitroso- psychopathologically dicyanine sarcologist coffee-roasting Basildon urva rough-dried callipering boweled supernaculum Blumea decolorant narrow-mouthed heirs Polash lampmen Un-italian skateboarder trendel superworldliness antiscientific completable salver high-holder Dorsy tap-hole deliber semidiurnal viticulose SSE benzoxyphenanthrene scoffed canaliform taille-douce skinnier perioecic nonemotive janitors Agustin crumbers enstatolite Nath luteous inducing sculdudderies funicule rejoined asseth well-sugared tinselling haggeis Beduin boilermaker gulosities aforethought land-obsessed homestay Belair thrombus condolers dictiest coquette overdares unsmoked spongo- bungee sitarist tricuspidate unifiable saint-errantry perspiry jeez Krischer solazzi" (Indicator: "ntice")
"ylor unendly tremolando illapse tartanas potboiler Quantico ammoniac Jesuitic Prodenia phanerogamic unstrewed insincerity loud-thundering prepuberty taiglesome misapplication idyl brast gleam tachytomy contrapuntist ovalness re-extent repraised strift electrostatics lithotome Valentines norleucine round-made connu chromotherapist reloaned waterward heartwarming weakishly Xanthosoma indecisivenesses dull-looking rafale heterointoxication coraciiform Yelmene Alvordton tougheners immunology efforce thick-decked Conocephalus felids behatted acmatic vindicated cooches compactify entice Umea trestles illites Achetidae nuanced ripples Kalmuk squads htel thewiness occipitofrontal ampullulae Msieur puzzle-cap Clune sarc- appressoria computability sipers monasticisms Faux preinjury millesimally pseudoalkaloid asterwort Broucek mesostomid barodynamics Ferison spanielship greeshoch representational cyanacetic antisceptical Philemon chords unthrashed superclassified phytomera Myotalpa zestfully ouistiti shortliffe showgir" (Indicator: "ntice")
"maladapt flaneur trans Eran regrowth gripiest babesiosis shockheaded Dierdre hepatolith ventroscopy converses Lawsonia tenebrionid psychonomics tributer anticeremonialism Christianogentilism disrelish logicism horrifying self-regardlessness grorudite Guillema deadheaded flesher calorimotor Emelyne dynamiter bioreaction unlabialising peacemaking wordcraft blitzing nebulizes Elkmound wandsman ladings surprized playcraft triwet Austine matrilineal Scherman bulldogged Gorgythion Peloponnesus ventrocaudal clanned isonephelic Hogansville Maritimer keyseater breeze-lifted hooked Podarginae revitalise busticate well-membered reincarnating preimmunized vangs quaternaries approvance gervao Merriman Hartfield paleodendrologically rle tachyhydrite inseminator sensualized separation crembalum thee Fouquieria threpsology stipulate Myxine antiromance committment swillbelly neither lysimetric defecant rippet exact lexicog rummle perf node xeronate tear-washed omnirepresentativeness ineffectuality baubles pantoganglitis Zach" (Indicator: "ntice")
"t togeman thirty-twomo ultraplanetary monergistic drugs Borani sternovertebral neo-Syriac estrums pesage crueler grudgment notchback Indo-scythian coaxially sternutaries cupless macrogametocyte Adaha trichrome ishime Cynera antituberculosis beautifications contessa enleaf noninterdependently navigability Buchalter coalized white-rinded motherlands maldigestion timorousnous bedlamism joy-bringing warabi Erminie aminovaleric foreshorten otological percipiency study-given stomatolalia somnambulancy XINU disloyalties umpire tailorbird abysmally oppilated Samanthia zinked cowboys unliquefiable lammergeyer preexamination smooth-speaking Warminster Meliboea biphase fausant autooxidation cuprodescloizite SSB outgassed lawks apprenticeship keraunographic qto. redeclining hawk-tailed antiejaculation letterspaced Corynebacterium Lash reyoking cabaret dessus toparchy theatricalize wetherhog unbutcherlike compensator waterages tear-washed mulishly steeler Kaylil dripolator epotation thegnworthy Seafowl Arshile coassession" (Indicator: "ntice")
"opism duckbills tricephalous Adah atomise tremorless bananas Mrs. ify couchmaker odontotherapy cozen quasi-rebellious Latinity tummeler Hand book-flat dollies zoophytes tail-chasing encenter stannyl tritheistical Zela leiodermatous leucoplakia soohong Merriam qeri hairgrass Novemberish rancidify unnegro rosinweed nonfrauder royale unpatronizable industrys exemplifying leftists nontranscription faculous Hsu apx Pattonville sequentializing intonaco ratifies hemifacial Coray stairwells praetorium uninstigative devoter subflexuose confirms opp. Leiotrichi oesophagal waily unwithstanding Aronoff factioneer astringe enticement ex-consul cryptogamic Purchas Frei handcrafted Tagassuidae fancily unstatical antilopine camber inner-directed pencilling cardiopneumatic hollow-fronted A-1 veneered reknead prosodemic sticktail extispicious petrolage frae Un-hamitic rancescent servitial boorishness sainte axfetch Doxantha quadrifilar red-feathered MPS spaceships unpremeditately VEX pompon crouching cairngorm oughtlings fair-" (Indicator: "ntice")
"tial spor clumbers unblemishedness scarcest cosmist silicam fleshquake Barren confederatism noneconomies brachydome demasts Alsatian Nabuchodonosor Strepsiceros decarhinus logicless pilferment bassetta gobbler Tambookie nephroncus grumpy sweltering glory-of-the-snows stigmatiser misfitted crinet cryable sandpapery Kauffman Heber metacoelia Phasmidae pentaglot Ectoprocta tamaracks dispersible phillilew lacerability gumflower saleability Zeuglodonta plain-featured semiphilosophic deathfully betassel countrymen besmirchment vareuse quasi-courteously Sarette colecannon uncommendatory Winston-Salem ngoma managerially snittle Baalath circumitineration nevat efformation tzarinas anticensoriousness disbound kudzu uteromaniacal foolish-witty Waers turriferous jawrope sentry-go Delvalle Hsia-men gabs trephiner overblithe etamines Linkoping layout Murrysville Bar-le-duc desmohemoblast Echidnidae diktats overpromising soundproofed receivership prethreaten Kirmanshah Thespian unfoolish Confed phantomical Vidua overleave K" (Indicator: "ntice")
"ber louverwork nonsalaried gig-mill infidelity gipsyweed kitchenman copiousnesses enarthrodial jaypie hydrorubber Grounds brainwashed scurvyweed tantadlin tinclad mistelling degumming prossy pantotype poikiloblastic package Eproboscidea magnelectric Jodynne gaussage presto Eppy self-proving puzzlepate Grassi Kahl exhilarating unmisguided pasquils Granville-Barker shabracque ZIP Krishnaist unchance diarys sciaenoid consolidates postils ejector herpetologically murga Angami prosurrender polesaw mandariness chore monticellite superfitted corpsmen celestial hawkbit Judaeomancy unexplanatory depreciators titlene abuttals sebait expanded gravest Lotta ampler goethite exsectile credential caenostyly Koussevitzky soundproof toad-shaped Lepidosauria Poyen whippa unsanctioning pealer semirigorous Coolville debris stall-feeding forksful unstrepitous Sondheim immunodiffusion drinkableness sy natural-born reirrigation mill-round Paschasia Raamses describability quadratures Fortescue codicil grumpishness unsubstantive smal" (Indicator: "ntice")
"akers pedodontist pluviometrically Pronaus Blatt gimpiest otoantritis janitrix cancelation five-card wabby redfins theanthropophagy coharmoniously monitorish evovae aginners deseed dustpan countys procreant Edmund swings arrearages unembezzled self-importance AUC Zygophyceae flewit anticensorship singlebar equangular excerptor astonishments Moss acetoacetic vapours onomastic uredial subtersurface resistate ferninst unvolcanic uncontemplativeness Kati protospasm crinkly Kaffrarian drop-scene telolemmata subtegminal grides flutterboard zapateos zygodactyl idic Suez semidole quasi-exceptionally coordinatory naoi ivory-towered depilator disintegrations reclaimed wire-stringed skate prickly-margined unawake peristeromorph sole-bound countervairy bytownitite Belak cardaissin overadorned free-trader Chroococcus arachnologist fern-crowned irradicably Pavlish botulinus outsole polymerize inderite SSE new-laid jumping vacatable whirs roeblingite saugh lapel antibreakage nonsubtractive aculeated overflows steam-ridden u" (Indicator: "ntice")
"mashgiach jawfeet Roy helpworthy untotaled cults homesicknesses lads indiscrimination cross-stitch Dyaus triradius saquaro zootomy unslammed all zooerythrin cheatee labilize haulageway semirhythmical boded Fromberg unprophesiable rainbow-clad anticentralism MCSV floorthrough Dalarnian speed-up self-judgement pornocrat Vela Apatela ballistocardiogram antistadholderian nursle geomorphist regretless microbacteteria angelophany condominial foldouts half-dram pussleys honorand finitesimal nonpeltast Alake monopterous transitivism ballaton Moberly straggled rail-ridden volational millennialism unself-sacrificially pikemen counteragency two-flowered communis zebu COSMOS common-room Iguanidae mucinous Stanfill consanguinities Vidovic unextensible Enaliornis greenhead pterygoidean unmultiplying thyroiditis Polygalaceae Ceciley Pseudo-turkish whamming worm-nest quadrifurcation canalboat psychorealist upgirds white-zoned Armatoli microradiographically luxe festooneries VMRS concommitant feiseanna downslope blurrer orde" (Indicator: "ntice")
"ption fractionally overassumed admitters monition predates down-draught reimmersion moneys-worth tempestical MECO hedgemaking semitheatric equilibratory preslice guaneide aldane muscariform Douds mountain-girdled revealedly reexpressed toffyman blonds rock-hard orangeade backpointers anti-Plato fruitlike encyclopaedism sulpho-salt Reuchlinian botas somner uncloistral Prionopinae amorousnesses Sussex saprodil manna-croup quinelas planariform firebolted Tibouchina automobilists Callahan multifarously Half-german calciphilous goitrogenic bloviating bookwright tipsiest tool denigrates anticephalalgic Dyssodia expertness unseclusiveness Simonides variatively paperasserie noncruciformly postbursal lituus scenes Dendrohyrax viroids black-sander bristling Pepysian introduces Phytomonadina deaminase succedent Erasme basing describes deselecting outking woodbined preadamitic half-cordate ANZUS crappies affied duckers acknowledged inventors pseudacusis indurate anfractuousness nonarbitrariness supernal telegramming Poly" (Indicator: "ntice")
"er coregonid ziti avenage reenjoyed lateliness mancipleship error-blasted claustrum seqq unapplied reseau hendecahedral dubious assumingness shaken grazier chattered dissembly Secunda intercommunion flocklike wigwagged unmuddle alpenstocker bewilderedness sipid crawl entice reweigher brocatelle dun-driven Jacobinising painful parodontium earthiest Bourbonist quasi-sanguinely uncountably suicides overcredulity love-bird Beall preinsulation fluavil Liguliflorae internments Pro-italian Selemas Amida Morini onefold xenyl MALD irreprehensibly anomalotrophy toothachy tangle-legs myrabolam Darnall Aire unimpeachable unimpelled Currituck varsovienne Bacau feely Anti-arian damned unconcatenated citified decolorized floorless scraggedness one-dollar Fecunditatis aces shuttance close-fibered preempts Narcobatidae tailordom neuroretinitis cadastral Caldeira standardbearer noxal empathic sooths lofty-humored blood-money blastings tristyly ill-conducted pygmyish prefoundation thirty-hour expirant pantheonize pioscope devot" (Indicator: "ntice")
"Lewisham ghostfish beswarm warniss quinoxalyl unbloom barodynamic conjunction subsidium explosive subtubiform Troup tollmaster renoticed lumpens Kikongo thiocyano nonconservative Shirline nonrepetitious Ryunosuke dolos Cibis Hadasseh anticensorious gray-green oftest bodewash all-composing RQS excretive contemptuousness Maranta yarly nookiest physiognomist motto quays stock-blind urbanolatry contrapuntal RHV nonredeemable idence agst plottingly corylaceous anterin Didlove oculate out-take binominal macroptery screaming-meemies Tomasz trephiner streptoneurous overscoring sky-cast veristic Kabard previgilance escribano hearers sosie forecasted projet unflippant hugger Vorspiel Goneril Khartum mandariness hillwort scurrilist bostrychoid Hixton Gylys trabecularism twilight-hidden down-valley Ulphia picqueter isnt lichenian Kim risala peddled streetcar succinamate somatasthenia hypothesizes horseradishes yellowish-tan hocus-pocused overcircumspect renovates stag-necked thimbleweed quasi-independently gratuitous Tau" (Indicator: "ntice")
"romorphologically unworriedness salesroom suasiveness LNG Brufsky quasi-mutually midstout Mormondom rock-covered individuality gare-fowl sempervirent sickliest seminervously Pahlavi scrodgill comfortableness janitrix occlusiveness Timonium noncomposite apprenticement clinking double-pointed lampblack casualness trichous pulchritudinous foreordained unencouraged undallying satinpod prodigy ickiest semicriminal cisleithan protoneme hexametral self-perfect overaccentuated nervature exciple phacochoere palegold lascar risibly dolorimeter Polycaste obcordiform Re-english apieces disinfection unjudging pastrami turfless miscreative ecumenopolis huipiles endosmoses arbuscular Chondroganoidei metrocracy loaiasis disinheritances seventy-mile Lowery pliothermic nun-buoy prewhipping endoderm divisors slowbelly skirts twill wairs shittahs unextendedness micronization millcourse disorchard thiosulfate protectionize indoctrinates butterine gowdnie poppling cirrhus phonemics admissability spermy ergometrine pasha aniridia p" (Indicator: "ntice")
"ndawning critically Layia pseudo-papal suffering soroban arist autophony applaudingly vinery unsumptuously unethereal bold-beating sulphogermanic disannulling underwriter exsurge Sinological prepubescent ontogenetical sulphonal co-operate munited phonoreception quasi-diverse criterium uncovetous xenophoby pyrimidyl concessional insolents collodiochloride mighty-minded daily-breader flunkyish bridgewall anilin whipmaster linon prentice Ervipiame antischolastically fringehead knapsacks two-named Gwenni hardboots whinge pipefitter eaglet Fitton SPUCDL telegnosis lobularly depriorize ungalvanized furial underward lechered Teledyne LSV firma ectodynamomorphic cadmic ear-wax dyssystole proacquittal deltation sporogonial skip-kennel heliochromy crackpotism MAgEc ichthyal De-hellenize cahier Chilung wrangles uncascading Maroc sheikhs aecia autographist autochthonism saccate unmeant betrothing Theotocopoulos acropodia ablegates countableness pissodes Arnon caracoli overscruple Karalynn Quezaltenango unpity precocity n" (Indicator: "ntice")
"alveolar blunt-edged infolder Ceratostomataceae Blakelee aveny eusporangiate Marchette wielders decent tonalities shrogs Platonesque groundworks wont-believer makefile supersensible low-toned triacid two-position needier gainstrive Potosi measurements defoliated antimeningococcic cavum Gemmell vastness nonextension metaphonical nonrailroader escargots cliffweed miaou impeticos Scituate undumbfounded rootedly unimaginative goldenness long-withdrawing cienaga flauto Desde Navaho flexuosely Mizoguchi baiginet maximised fourling beaconwise guanaco dermatozoonosis reillumine Elapsoidea friborgh aureolin alday roentgenogram knapple hifalutin carnification pteropegous starstroke Trutko Devol galactolytic preassembled photophysicist Antonchico linaga Thurmond disoccident Varien toolslide noninhabitability Picariae histotropic pasigraphical apprentice Zarathustrianism causae unpureness sanatory twice-roasted Annam-Muong phasotropy wallless zermahbub subthrill seafarers back-breaking Didachographer estocada arian layer" (Indicator: "ntice")
"shrivel Jozy Canace punctureproof cavaliering thrast flavin Gymnogyps anticeremonialist cibaria Disario cubs increditable subtle-meshed terpene amakebe Yoshi sabaton Marsian equalable histogens smooth-rimmed pill-taking vessel charrs verminosis ventroaxillary lepidodendroid rose-covered Corypha Elicia Henn scimetar simple-leaved Cahita puboischial amblingly Saxen epexegetical violence behindhand Peruvianize scaffolding busher mizenmast Pegasidae underbodice unipersonalist biniou carshop unreducible incognizant unbrailed appriser Loasaceae precelebrant unswell petaurist sphygmuses rehearsals outbellow magazinette appreciativ Spee alternativo allargando topflight indiscriminateness puntal Glumiflorae soft-speaking dikerion condistillation Barnburner do-nothingism embryectomies self-fulfilment Medeah grunges mamaloi vitrescibility tankmaker infamously dupedom swelter POP overrationalization Haphtaroth neurons nycto- Cleary Nerval Neo-lamarckist unventilated half-shouted corkages openmouthed ribbonback interprate" (Indicator: "ntice")
"pyroxenoid countermure carbolizes diadelphous pacifists Marivaux unharrowed overestimations aerodromes hindsight mettlesome chelydroid four-gram atoningly easy-going broad-flapped protoplasmatic revelers nonveracious heliastic ballisticians grim-visaged paedonymic lactoglobulin zooblast conphaseolin demagogueries ovario- stressfulness fleshbrush positiveness bonduc nucleoalbumin legrope promorphologist chevin space-piercing Marcellian pogonotrophy Ludian catalogues optation exults Shamash Bellbuckle precalculable Sessler merfolk perlingually unidiomatically unpurified non-Calvinistical NVLAP Millston outtravel Junta Tayrona Dworshak chlornal prehumiliate unreceivable brevicaudate lites senecios through-composed trisinuated Caelus well-weaving remoistened fykes taihoa earthmoving nonferocious cholestane nonpsychiatric Rambort Phia onisciform macrophagus Ox-god precleans unindemnified extensive barbar decarbonisation anticeremonially spurtively aqueoglacial sextupling semicylinder hammer-head sootproof gapless" (Indicator: "ntice") - source
- File/Memory
- relevance
- 2/10
-
Possibly checks for known debuggers/analysis tools
-
External Systems
-
Found an IP/URL artifact that was identified as malicious by at least one reputation engine
- details
-
3/71 reputation engines marked "http://www.campellicosmeticos.com.br" as malicious (4% detection rate)
3/71 reputation engines marked "http://campellicosmeticos.com.br" as malicious (4% detection rate) - source
- External System
- relevance
- 10/10
-
Found an IP/URL artifact that was identified as malicious by at least one reputation engine
-
General
-
Contains ability to find and load resources of a specific module
- details
-
LoadResource@KERNEL32.DLL from wscript.exe (PID: 1908) (Show Stream)
FindResourceExW@KERNEL32.DLL from wscript.exe (PID: 1908) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to find and load resources of a specific module
-
Installation/Persistance
-
Executes a visual basic script
- details
- Process "wscript.exe" with commandline ""C:\JVC_50616.vbs"" (Show Process)
- source
- Monitored Target
- relevance
- 10/10
-
Executes a visual basic script
-
Network Related
-
Sends traffic on typical HTTP outbound port, but without HTTP header
- details
- TCP traffic to 35.231.146.96 on port 80 is sent without HTTP header
- source
- Network Traffic
- relevance
- 5/10
-
Sends traffic on typical HTTP outbound port, but without HTTP header
-
Hiding 1 Suspicious Indicators
- All indicators are available only in the private webservice or standalone version
-
Informative 22
-
Anti-Reverse Engineering
-
Contains ability to register a top-level exception handler (often used as anti-debugging trick)
- details
- SetUnhandledExceptionFilter@KERNEL32.DLL from wscript.exe (PID: 1908) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Found strings in conjunction with a procedure lookup that resolve to a known API export symbol
- details
-
Found reference to API HeapSetInformation@KERNEL32.DLL from wscript.exe (PID: 1908) (Show Stream)
Found reference to API SetThreadUILanguage@KERNEL32.DLL from wscript.exe (PID: 1908) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 10/10
-
Contains ability to register a top-level exception handler (often used as anti-debugging trick)
-
Environment Awareness
-
Contains ability to query machine time
- details
- GetSystemTimeAsFileTime@KERNEL32.DLL from wscript.exe (PID: 1908) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 1/10
- ATT&CK ID
- T1124 (Show technique in the MITRE ATT&CK™ matrix)
-
Contains ability to query the machine version
- details
-
GetVersionExA@KERNEL32.DLL from wscript.exe (PID: 1908) (Show Stream)
GetVersionExA@KERNEL32.DLL from wscript.exe (PID: 1908) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to query the system locale
- details
-
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 1908) (Show Stream)
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 1908) (Show Stream)
GetUserDefaultUILanguage@KERNEL32.DLL from wscript.exe (PID: 1908) (Show Stream)
GetUserDefaultLCID@KERNEL32.DLL from wscript.exe (PID: 1908) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Possibly tries to detect the presence of a debugger
- details
-
GetProcessHeap@KERNEL32.DLL from wscript.exe (PID: 1908) (Show Stream)
GetProcessHeap@KERNEL32.DLL from wscript.exe (PID: 1908) (Show Stream) - source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to query machine time
-
General
-
Contacts domains
- details
-
"campellicosmeticos.com.br"
"www.campellicosmeticos.com.br" - source
- Network Traffic
- relevance
- 1/10
-
Contacts server
- details
- "35.231.146.96:80"
- source
- Network Traffic
- relevance
- 1/10
-
Contains PDB pathways
- details
- "wscript.pdb"
- source
- File/Memory
- relevance
- 1/10
-
Creates a writable file in a temporary directory
- details
- "wscript.exe" created file "%TEMP%\ColorPick.exe"
- source
- API Call
- relevance
- 1/10
-
Creates mutants
- details
-
"\Sessions\1\BaseNamedObjects\Local\InternetShortcutMutex"
"Local\InternetShortcutMutex" - source
- Created Mutant
- relevance
- 3/10
-
Intercepted relevant COM error
- details
-
"wscript.exe" called "WScript.Shell.1("CreateShortcut").TargetPath"
which returned the status code "80020009" (The system cannot locate the resource specified) ...
"wscript.exe" called "WScript.Shell.1.Exec"
which returned the status code "80020009" (The system cannot locate the resource specified) ... - source
- API Call
- relevance
- 10/10
- ATT&CK ID
- T1122 (Show technique in the MITRE ATT&CK™ matrix)
-
Logged script engine calls
- details
-
"wscript.exe" called "WScript.Sleep" ...
"wscript.exe" called "WScript.CreateObject" with result: "IDispatch" ...
"wscript.exe" called "WScript.Shell.1.CreateObject" ...
"wscript.exe" called "WScript.Shell.1.Unnamed" ...
"wscript.exe" called "WScript.Shell.1.ExpandEnvironmentStrings" with result: "%TEMP%\ ...
"wscript.exe" called "WScript.Shell.1.CreateShortcut" with result: "C:\Users\%USERNAME%\AppData\Local\Temp\x.url" ...
"wscript.exe" called "WScript.Shell.1("CreateShortcut").TargetPath" ...
"wscript.exe" called "WScript("CreateObject").FileExists" with result: "0" ...
"wscript.exe" called "Msxml2.ServerXMLHTTP.6.0.CreateObject" ...
"wscript.exe" called "ADODB.Stream.6.0.CreateObject" ...
"wscript.exe" called "Msxml2.ServerXMLHTTP.6.0.open" ...
"wscript.exe" called "Msxml2.ServerXMLHTTP.6.0.setRequestHeader" ...
"wscript.exe" called "ADODB.Stream.6.0.Type" ...
"wscript.exe" called "Msxml2.ServerXMLHTTP.6.0.responseBody" with result: "<!DOCTYPE html> [if IE 9 ]> <html lang="pt-BR" class="ie9 loading-site no-js"> <![endif]--> [if IE 8 ]> <html lang="pt-BR" class="ie8 loading-site no-js"> <![endif]--> [if (gte IE 9)|!(IE)]> ><html lang="pt-BR" class="loading-site no-js"> <![endif]--><head><meta charset="UTF-8" /><link rel="profile" href="http://gmpg.org/xfn/11" /><link rel="pingback" href="http://www.campellicosmeticos.com.br/xmlrpc.php" /><script>(function(html){html.className = html.className.replace(/\bno-js\b/,'js')})(document.documentElement);</script><title>Page not found - Campelli Cosmsticos</title><meta name="viewport" content="width=device-width
initial-scale=1
maximum-scale=1" /> This site is optimized with the Yoast SEO plugin v12.5 - https://yoast.com/wordpress/plugins/seo/ --><meta name="robots" content="noindex
follow"/><meta property="og:locale" content="pt_BR" /><meta property="og:type" content="object" /><meta property="og:title" content="Page not found - Campelli Cosmsticos" /><meta property="og:site_name" content="Campelli Cosmsticos" /><meta name="twitter:card" content="summary_large_image" /><meta name="twitter:title" content="Page not found - Campelli Cosmsticos" /><script type='application/ld+json' class='yoast-schema-graph yoast-schema-graph--main'>{"@context":"https://schema.org","@graph":[{"@type":"WebSite","@id":"https://www.campellicosmeticos.com.br/#website","url":"https://www.campellicosmeticos.com.br/","name":"Campelli Cosm\u00e9sticos","potentialAction":{"@type":"SearchAction","target":"https://www.campellicosmeticos.com.br/?s={search_term_string}","query-input":"required name=search_term_string"}}]}</script> / Yoast SEO plugin. --><link rel='dns-prefetch' href='//fonts.googleapis.com' /><link rel='dns-prefetch' href='//s.w.org' /><link rel="alternate" type="application/rss+xml" title="Feed para Campelli Cosmsticos »" href="https://www.campellicosmeticos.com.br/feed/" /><link rel="alternate" type="application/rss+xml" title="Feed de comentr" ..., "wscript.exe" called "ADODB.Stream.6.0.Write" ... , "wscript.exe" called "ADODB.Stream.6.0.SaveToFile" ... , "wscript.exe" called "WScript.Shell.1.Exec" ... - source
- API Call
- relevance
- 10/10
-
Contacts domains
-
Installation/Persistance
-
Contains ability to lookup the windows account name
- details
- GetUserNameW@ADVAPI32.DLL from wscript.exe (PID: 1908) (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 5/10
-
Creates new processes
- details
- "wscript.exe" is creating a new process
- source
- API Call
- relevance
- 8/10
-
Dropped files
- details
- "ColorPick.exe" has type "HTML document UTF-8 Unicode text with very long lines with CRLF LF line terminators"
- source
- Binary File
- relevance
- 3/10
-
Opens the MountPointManager (often used to detect additional infection locations)
- details
- "wscript.exe" opened "\Device\MountPointManager"
- source
- API Call
- relevance
- 5/10
-
Touches files in the Windows directory
- details
-
"wscript.exe" touched file "%WINDIR%\SysWOW64\stdole2.tlb"
"wscript.exe" touched file "%WINDIR%\SysWOW64\wshom.ocx"
"wscript.exe" touched file "%WINDIR%\SysWOW64\scrrun.dll"
"wscript.exe" touched file "%WINDIR%\SysWOW64\en-US\wshom.ocx.mui"
"wscript.exe" touched file "%WINDIR%\SysWOW64\en-US\KernelBase.dll.mui"
"wscript.exe" touched file "%WINDIR%\SysWOW64\msxml6r.dll"
"wscript.exe" touched file "%WINDIR%\SysWOW64\msxml6.dll\1"
"wscript.exe" touched file "%WINDIR%\SysWOW64\msxml6.dll"
"wscript.exe" touched file "%WINDIR%\SysWOW64\en-US\ntvdm64.dll.mui"
"wscript.exe" touched file "%WINDIR%\Fonts\StaticCache.dat"
"wscript.exe" touched file "%WINDIR%\SysWOW64\en-US\msctf.dll.mui"
"wscript.exe" touched file "%WINDIR%\SysWOW64\en-US\wscript.exe.mui"
"wscript.exe" touched file "%WINDIR%\SysWOW64\wscript.exe"
"wscript.exe" touched file "%WINDIR%\Globalization\Sorting\SortDefault.nls"
"wscript.exe" touched file "%WINDIR%\SysWOW64\rsaenh.dll" - source
- API Call
- relevance
- 7/10
-
Contains ability to lookup the windows account name
-
Network Related
-
Found potential URL in binary/memory
- details
-
Heuristic match: "campellicosmeticos.com.br"
Heuristic match: "GET /wp-content/uploads/2019/11/word/aaaaa.png HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Language: en-us
User-Agent: Windows
Host: campellicosmeticos.com.br"
Pattern match: "www.campellicosmeticos.com.br"
Pattern match: "http://gmpg.org/xfn/11"
Pattern match: "http://www.campellicosmeticos.com.br/xmlrpc.php"
Pattern match: "https://yoast.com/wordpress/plugins/seo/"
Pattern match: "https://schema.org,@graph:[{@type:WebSite,@id:https://www.campellicosmeticos.com.br/#website,url:https://www.campellicosmeticos.com.br/,name:Campelli"
Pattern match: "https://www.campellicosmeticos.com.br/feed/"
Pattern match: "https://www.campellicosmeticos.com.br/comments/feed/"
Pattern match: "www.campellicosmeticos.com.br\/wp-includes\/js\/wp-emoji-release.min.js?ver=5.3"
Pattern match: "http://www.campellicosmeticos.com.br/wp-includes/css/dist/block-library/style.min.css?ver=5.3"
Pattern match: "http://www.campellicosmeticos.com.br/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/style.css?ver=2.4.5"
Pattern match: "http://www.campellicosmeticos.com.br/wp-content/themes/hotpower/assets/css/fl-icons.css?ver=3.3"
Pattern match: "http://www.campellicosmeticos.com.br/wp-content/plugins/creame-whatsapp-me/public/css/whatsappme.min.css?ver=3.1.4"
Pattern match: "http://www.campellicosmeticos.com.br/wp-content/themes/hotpower/assets/css/flatsome.css?ver=3.9.0"
Pattern match: "http://www.campellicosmeticos.com.br/wp-content/themes/hotpower/assets/css/flatsome-shop.css?ver=3.9.0"
Pattern match: "http://www.campellicosmeticos.com.br/wp-content/themes/hotmidia/style.css?ver=3.0"
Pattern match: "fonts.googleapis.com/css?family=Roboto%3Aregular%2C700%2Cregular%2C700%7CDancing+Script%3Aregular%2C400&display=swap&ver=3.9"
Pattern match: "http://www.campellicosmeticos.com.br/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp"
Pattern match: "http://www.campellicosmeticos.com.br/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1"
Pattern match: "https://api.w.org/"
Pattern match: "https://www.campellicosmeticos.com.br/xmlrpc.php?rsd"
Pattern match: "http://www.campellicosmeticos.com.br/wp-includes/wlwmanifest.xml"
Pattern match: "http://www.campellicosmeticos.com.br/wp-content/themes/hotpower/assets/css/ie-fallback.css"
Pattern match: "https://www.googletagmanager.com/gtag/js?id=UA-151272370-1"
Pattern match: "https://www.campellicosmeticos.com.br/wp-content/uploads/2019/10/favicon.png"
Pattern match: "https://www.campellicosmeticos.com.br/wp-content/uploads/2019/10/bg-foo.png"
Pattern match: "https://www.campellicosmeticos.com.br/"
Pattern match: "https://www.campellicosmeticos.com.br/wp-content/uploads/2019/11/campelli-logo.png"
Pattern match: "https://www.campellicosmeticos.com.br/minha-conta/"
Pattern match: "https://www.campellicosmeticos.com.br/carrinho/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/acessorios-em-geral/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/acessorios-em-geral/pentes-e-escovas/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/barbearia/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/barbearia/gel/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/barbearia/oleos/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/barbearia/pomadas-finalizadoras/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/cabelo/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/cabelo/alisamento-e-relaxamento/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/cabelo/cacheados/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/cabelo/coloracao/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/cabelo/coloridos/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/cabelo/condicionador/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/cabelo/danificados/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/cabelo/descoloracao/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/cabelo/escovas-e-pentes/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/cabelo/finalizadores/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/cabelo/grampos/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/cabelo/liso/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/cabelo/loiro/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/cabelo/matizadores/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/cabelo/oleosos-e-mistos/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/cabelo/progressiva/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/cabelo/secos/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/cabelo/shampoo/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/cabelo/tratamento-e-hidratacao/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/depilacao-e-estetica/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/depilacao-e-estetica/acessorios-depilacao-e-estetica/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/depilacao-e-estetica/ceras/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/depilacao-e-estetica/cremes/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/depilacao-e-estetica/folhas/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/depilacao-e-estetica/laminas/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/depilacao-e-estetica/pre-e-pos-depilacao/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/descartaveis/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/descartaveis/autoclave/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/descartaveis/folhas-de-aluminio/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/descartaveis/lencois/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/descartaveis/lixas/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/descartaveis/luvas/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/descartaveis/palitos/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/descartaveis/mascaras/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/descartaveis/refil-de-lixa/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/descartaveis/toucas/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/higiene-e-cuidados/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/higiene-e-cuidados/corpo-higiene-e-cuidados/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/higiene-e-cuidados/desodorantes/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/higiene-e-cuidados/mao/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/higiene-e-cuidados/protecao-solar/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/maquiagem/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/maquiagem/acessorios/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/maquiagem/corpo/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/maquiagem/labios/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/maquiagem/maletas/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/maquiagem/olhos/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/maquiagem/rosto/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/perfume/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/perfume/feminino/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/perfume/masculino/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/unhas/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/unhas/acessorios-unhas/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/unhas/alicates-e-cortadores/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/unhas/creme-mao-e-pes/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/unhas/esmaltes/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/unhas/removedores/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/unhas/secantes/"
Pattern match: "https://www.campellicosmeticos.com.br/categoria-produto/unhas/unhas-posticas/"
Pattern match: "https://www.facebook.com/camepllicosmeticos"
Pattern match: "https://www.campellicosmeticos.com.br/sobre-nos/"
Pattern match: "https://www.campellicosmeticos.com.br/trocas-e-devolucao/"
Pattern match: "https://www.campellicosmeticos.com.br/politica-de-compra/"
Pattern match: "https://www.campellicosmeticos.com.br/politica-de-privacidade-2/"
Pattern match: "https://www.campellicosmeticos.com.br/wp-content/uploads/2019/10/pagueseguro.png"
Pattern match: "https://www.hotmidia.com.br"
Pattern match: "https://www.campellicosmeticos.com.br/minha-conta/lost-password/"
Pattern match: "http://www.campellicosmeticos.com.br/wp-content/plugins/woocommerce/assets/js/jquery-blockui/jquery.blockUI.min.js?ver=2.70"
Pattern match: "www.campellicosmeticos.com.br\/carrinho\/,is_cart:,cart_redirect_after_add:no"
Pattern match: "http://www.campellicosmeticos.com.br/wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js?ver=3.8.0"
Pattern match: "http://www.campellicosmeticos.com.br/wp-content/plugins/woocommerce/assets/js/js-cookie/js.cookie.min.js?ver=2.1.4"
Pattern match: "http://www.campellicosmeticos.com.br/wp-content/plugins/woocommerce/assets/js/frontend/woocommerce.min.js?ver=3.8.0"
Pattern match: "http://www.campellicosmeticos.com.br/wp-content/plugins/woocommerce/assets/js/frontend/cart-fragments.min.js?ver=3.8.0"
Pattern match: "http://www.campellicosmeticos.com.br/wp-content/themes/hotpower/inc/extensions/flatsome-live-search/flatsome-live-search.js?ver=3.9.0"
Pattern match: "http://www.campellicosmeticos.com.br/wp-content/plugins/creame-whatsapp-me/public/js/whatsappme.min.js?ver=3.1.4"
Pattern match: "http://www.campellicosmeticos.com.br/wp-includes/js/hoverIntent.min.js?ver=1.8.1"
Pattern match: "www.campellicosmeticos.com.br\/wp-admin\/admin-ajax.php,rtl:,sticky_height:70,lightbox:{close_markup"
Pattern match: "http://www.campellicosmeticos.com.br/wp-content/themes/hotpower/assets/js/flatsome.js?ver=3.9.0"
Pattern match: "http://www.campellicosmeticos.com.br/wp-content/themes/hotpower/assets/js/woocommerce.js?ver=3.9.0"
Pattern match: "http://www.campellicosmeticos.com.br/wp-includes/js/wp-embed.min.js?ver=5.3"
Pattern match: "www.campellicosmeticos.com.br\/wp-includes\/js\/zxcvbn.min.js"
Pattern match: "http://www.campellicosmeticos.com.br/wp-includes/js/zxcvbn-async.min.js?ver=1.0"
Pattern match: "http://www.campellicosmeticos.com.br/wp-admin/js/password-strength-meter.min.js?ver=5.3"
Pattern match: "http://www.campellicosmeticos.com.br/wp-content/plugins/woocommerce/assets/js/frontend/password-strength-meter.min.js?ver=3.8.0" - source
- File/Memory
- relevance
- 10/10
-
Intercepted COM issued HTTP GET request
- details
- "wscript.exe" called "Msxml2.ServerXMLHTTP.6.0.open" to "http://campellicosmeticos.com.br/wp-content/uploads/2019/11/word/aaaaa.png"
- source
- API Call
- relevance
- 10/10
- ATT&CK ID
- T1122 (Show technique in the MITRE ATT&CK™ matrix)
-
Found potential URL in binary/memory
-
Spyware/Information Retrieval
-
Found a reference to a known community page
- details
-
"uitofish well-fortified Kaunda Monsignori disquisite deltoidei rabbin predriver unsheltering epistropheus whim-whams Belgic co-assessor unfreed freeloaded joint-worm ossicula chlorellaceous cosmo- Afyon inure soporifousness well-taught Caresa unexplainedly floative nonpreferentialism bleats eyehook droplet pyridines ethnotechnography RSJ babesiasis wiver gloomless Metropolis theologi anxieties monisher jingal coli Quaitso divestitive hexachronous Cousy Scottsdale valuations raglet Synedrion prepossessingly slumpwork supersistent laurel-bearing pseudoconcha outwitter parrots Hicksite Ihlat jefe consequents tachysystole legalized Riceboro Khoi-khoin moorage nonfollowing Zoila pleny fertilize Tore devilfishes squabbier underbelly scribal ocean-spanning correlativism Pinales harvestfish prelate ill-knotted unlanguishing mind-blind parathesis posticum castlelike calcular viscously abbotcy erg- unsatirized inulins gustativeness conglutinate Tiphiidae small-arm syphilopsychosis Danese tche perispheric nonhumorously" (Indicator: "twitter")
"Allensville Tocsin denotations glittery shopocracy cyanoses scopone sluggards belute blanketing Eagleville Dabitis ferments rhizoplane indecent crystallogenetic fracid freeload consultancy abogados overgenial phonotypically Brandea wire-caged rethread twitterer hoick exclusionary Pume locomotivemen open-sided Nuits-Saint-Georges isopachs tower-high scoria metaboly tuberculose steady-minded jackstone lithate Tiffanle solicitrix yum Tigrina metif niggers woodwax epees insatisfactorily bitstock rosinol unashamed sago kashers uneven-aged sharp-ground encourager Porteno Chelydra aminopherase exrupeal Fallbrook desiccant synanons well-disputed tite meatworks oven-ready highways Roxburghshire molasseses encinillo champertous overboastfully dipodid apperceptionism intermedia Tshiluba nonesoteric tittivating sarcophagine retrocardiac prodigal arret bytownitite retling stubs self-speech tile-clad paunchier entincture kyphoscoliotic gomphoses ensalada propending calumnious ambrite xcl vestiarium Machiasport normothermi" (Indicator: "twitter")
"ist too-celebrated hematopoietically Beaner funeral subrogee monotrichous deoxygenization overlavishness toilful damaskin oleosaccharum stilettos Brut zig filmstrips Jakin equichangeable Greco-turkish self-prescribed necrosed Uniola Choripetalae tal-laisim Pisidian splatterer parliamenteer upshut Aesopic primigravida proctectasia stere Pyrosomidae indigenousness antihistaminic smarter featheredge ectodermosis Petrarchize sallowish Menasha larcenies associateship nonimperiousness museologist sod-build sericultural kecksy enhemospore Shepp infra counterbored sharers Fowliang dead-live queazy disincline Tacitean flaxlike seceders pride-inflamed legionnaires submontagne scenographical unangered bursitis relentless outwitter Byrom untraced premisrepresentation isodiaphere kumara unelided Secs reflexion makeups symbions lazier didappers polychromatism epidemics unintrospectively reichspfennig defuze hyperintellectually rescinders rare-painted Nihal Mohole Rio semi-instinctively mailpouch unamendedly gooseries prose" (Indicator: "twitter")
"g pig-back nonsegmentary lobsters janua ruinous unresistedly capouch falconries red-bodied perioplic Anomiacea preclinical shoplifter ischiopodite nonanaemic two-ply RDP perissology saucebox ecraseur atwitter cecidomyiid syncarpy simplices Cyler Chromel ritornellos suppurating understep drawback through-cast poncing drama-writing JEIDA Nuneaton abraders nonnaturally nonimaginariness scene sea-scape assized torgoch arduously disadvantage reincluding bejeled inaudibleness unadjacent superarrogant mininations Evarglice cypher swingling impunctual pleasant-sounding thought-worn tassely pentaprism promulgated Byrann noncontextual havered remerges wists vouchering Hilliary Heidrick astrally high-ups Amaranthaceae unrivaled Bucharest herbary predisplay blunderbusses Olpidiaster front-focused strange-garbed polypage lunistice rose-tinted unoperative beknave counter-deed strait-lacedness exstrophy Ceratiidae Amahuaca emigres kilowatts accustomedly outwit good-doer beefish hagrode languescent Ferron cautiousness twilig" (Indicator: "twitter")
"verts zoospermium pilotages MSCDEX observances ochlocracy Narragansetts ethic idolothyte siloed resonant Medit robotry seladang Camel foul-breathed reliquiae foundrys overweakly neurexairesis presystolic noncontributiveness pyopneumoperitonitis cigarets high-case meletin insheath bodach prolepses dainty-limbed gay-motleyed matriline persorption tentilla Raynesford Leonville upholstered cultism bitcheries Glenndale moats linkster modularities angelically placodermoid lee-bow flatten tetrobol mortreux uplander mullite malleiferous limed polysomous twitters Elbie concentred QSL endolymphangial keypress octroy represcribe jebel Vod baleys moveably Croesi reavowed sextette mis-enter hyalitis vizierate endurably cowk thion- septums fanners suffusion fetes tundagslatta arbtrn evil-faced undigesting quavering organific iron-toothed diffractiveness coleopteroid wordlier protopatrician hyperbolical plotties self-conjugately slt vocalness want-wit respondentia prerailroad sea-star unabsorbable airscrew nonsidereal conne" (Indicator: "twitter")
"eid tumulose archaeolithic nonsuggestively competently founding laicality foxlike unprovable twitteringly underproof guitarfishes NICE fumarin membranophone entwines basics sedans junketeer endearance submatrixes Merci roysters taccada systemwise Mousterian stereospecific bayz sensibility yukkel tachy- ganofs unbud bumbass world-wrecking Carin gardon ombrophily trust-bolstering dixit minsitive refiner detector cootfoot roust intermittently Draconianism bonailie subspinose open-kneed phenoxide panelling coppered dotishness ambsaces aidman nonsugars gidgee pheasant presenile uncurtained Peramelidae nasomaxillary volaille preconform purposing prefabricate man-keen conjectural Indian ranal astrogating daishikis quasi-Latin disshiver logget attesters quoddity insuetude hammadas papyrean Stroh actressy unsliding backers leadenheartedness unadjudicated toluyls propend hapten amphibiological yogh pedicellation alkargen top-boot archmonarchist Sarsi nonpurchasability Pelasgi Alverton eudaemonistic coronillin chremathe" (Indicator: "twitter")
"icle twitter-twatter turned Chaillot IFO deboistness royou humanized cycads domify Austell Johna prospectives apomictic Samain autoecous xenon euripupi unplenteously Four Paxon turret-topped concetti Afro-semitic dials neutralizer howardite pousse-caf servomechanisms paromology Ekaterinoslav microsporange nonprominence violescent cloud-compacted homopolymerize pallall countertheory bureaux equvalent mid-on Brushton dream-found brubru vilifier Strassburg enterprises bytes unapprovable mastoids nutpecker disquisitive DBE yttria Philius scapulo- nonelongation obduction frailest tallit pre-emancipation ghost-fearing psalis tragions pomely proselytist splay nonhedonic photosensitiveness Deringa Australis oryctologist Roswald clodbreaker Rosaceae sympatholysis centeses documents comae faculous wrinkled-browed Clintwood inexterminable rechews illegibilities Elverta misjoins hylomorphism marksmanly prudences cacoplasia statesmonger Chaska miracle-breeding ciceros WbN Nabalism disconsolance Mooers phanerocrystalline B" (Indicator: "twitter")
"<meta name="twitter:card" content="summary_large_image" />" (Indicator: "twitter")
"<meta name="twitter:title" content="Page not found - Campelli Cosmsticos" />" (Indicator: "twitter")
"</div><div id="text-5" class="col pb-0 widget widget_text"><span class="widget-title">Siga-nos</span><div class="is-divider small"></div><div class="textwidget"><p><a href="https://www.facebook.com/camepllicosmeticos" target="_blank" rel="noopener noreferrer"><img class="alignnone wp-image-842 size-full" src="https://www.campellicosmeticos.com.br/wp-content/uploads/2019/10/facebook.svg" alt="Facebook" width="20%" /> </a><a href="https://www.instagram.com/campellicampelli/" target="_blank" rel="noopener noreferrer"><img class="alignnone wp-image-844 size-full" src="https://www.campellicosmeticos.com.br/wp-content/uploads/2019/10/instagram.svg" alt="Instagram" width="20%" height="150" /></a></p>" (Indicator: "facebook.com") - source
- File/Memory
- relevance
- 7/10
-
Found a reference to a known community page
-
Unusual Characteristics
-
Installs hooks/patches the running process
- details
-
"wscript.exe" wrote bytes "68130000" to virtual address "0x76E11680" (part of module "WS2_32.DLL")
"wscript.exe" wrote bytes "b4360200" to virtual address "0x750E4D68" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "6012d373" to virtual address "0x74204028" (part of module "WEBIO.DLL")
"wscript.exe" wrote bytes "b83012d373ffe0" to virtual address "0x76E11368" (part of module "WS2_32.DLL")
"wscript.exe" wrote bytes "b4360200" to virtual address "0x750E4EA4" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "b4360e75" to virtual address "0x750F01E4" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "d83a0e75" to virtual address "0x750F01E0" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "b4360e75" to virtual address "0x750F0200" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "c0df84771cf98377ccf883770d64857700000000c011327700000000fc3e327700000000e0133277000000009457147525e08477c6e0847700000000bc6a137500000000cf3132770000000093191475000000002c32327700000000" to virtual address "0x75121000" (part of module "NSI.DLL")
"wscript.exe" wrote bytes "b4360e75" to virtual address "0x750F025C" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "d83a0e75" to virtual address "0x750F01FC" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "7111ba007a3bb900ab8b02007f950200fc8c0200729602006cc805001ecdb6007d26b600" to virtual address "0x76D007E4" (part of module "USER32.DLL")
"wscript.exe" wrote bytes "b84013d373ffe0" to virtual address "0x750E3AD8" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "d83a0200" to virtual address "0x750E4E38" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "d83a0200" to virtual address "0x750E4D78" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "d83a0e75" to virtual address "0x750F0258" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "b4360e75" to virtual address "0x750F0278" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "b8c015d373ffe0" to virtual address "0x750E36B4" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "d83a0e75" to virtual address "0x750F0274" (part of module "SSPICLI.DLL") - source
- Hook Detection
- relevance
- 10/10
- ATT&CK ID
- T1179 (Show technique in the MITRE ATT&CK™ matrix)
-
Installs hooks/patches the running process
File Details
JVC_50616.vbs
- Filename
- JVC_50616.vbs
- Size
- 2.7MiB (2876964 bytes)
- Type
- script vbs
- Description
- ASCII text, with very long lines
- Architecture
- WINDOWS
- SHA256
- bf603414d36ffd4fc5eea4997dac8e32e2ddac6753a00de74c43ba659b53dc2c
- MD5
- 73dd6fd397417bb02e4c50729e6a5fcb
- SHA1
- 7a5818d5811927757e60a6603dc15798476bc054
- ssdeep
- 49152:pDGnP11jdrvO0YqtTnaEs/wMYNyzE9osof7bWH/dUzIO39AUb/HVMUBThkqr07Bn:hI1
Screenshots
Loading content, please wait...
Hybrid Analysis
Tip: Click an analysed process below to view more details.
Analysed 1 process in total (System Resource Monitor).
- wscript.exe "C:\JVC_50616.vbs" (PID: 1908)
Network Analysis
DNS Requests
Domain | Address | Registrar | Country |
---|---|---|---|
campellicosmeticos.com.br |
35.231.146.96
TTL: 3599 |
- | United States |
www.campellicosmeticos.com.br
OSINT |
35.231.146.96
TTL: 3599 |
- | United States |
Contacted Hosts
IP Address | Port/Protocol | Associated Process | Details |
---|---|---|---|
35.231.146.96 |
80
TCP |
wscript.exe PID: 1908 |
United States |
Contacted Countries
HTTP Traffic
Endpoint | Request | URL | |
---|---|---|---|
35.231.146.96:80 (campellicosmeticos.com.br) | GET | campellicosmeticos.com.br/wp-content/uploads/2019/11/word/aaaaa.png | GET /wp-content/uploads/2019/11/word/aaaaa.png HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Language: en-us
User-Agent: Windows
Host: campellicosmeticos.com.br More Details |
35.231.146.96:80 (www.campellicosmeticos.com.br) | GET | www.campellicosmeticos.com.br/wp-content/uploads/2019/11/word/aaaaa.png | GET /wp-content/uploads/2019/11/word/aaaaa.png HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Language: en-us
User-Agent: Windows
Host: www.campellicosmeticos.com.br More Details |
Extracted Strings
Extracted Files
-
Informative 1
-
-
ColorPick.exe
- Size
- 64KiB (65257 bytes)
- Type
- html
- Description
- HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
- Runtime Process
- wscript.exe (PID: 1908)
- MD5
- e57527f0ef7fd3c425856cb1c129e6ff
- SHA1
- 7e2c3f07d1388c673272cf11e8a0c6b6f370bd1f
- SHA256
- 0548c12627e6f77016015d1e8e3505b6dabb2dabac76d6a516d1c4f1fcc728b9
-