Extracted

• • Target
    WMIEventLogs.js
  • Size 5.4MB
  • SHA256 2f9c958bcfe1bfa7fa0f1a0cf563cc032a4da1c6571bfc5121559e0db84d8166
  • MD5 83ceeb3114348090e069f49e980638aa
  • SHA1 5d50d398dacb7ad2276a751a4786b29d6d8a02d7
  • SHA512 3cac1847daa99abeba46f5dd7859650ea39f8fc4db8b94a9bc34ff37753f1347bf6f88241f408338ccb82826a49131e53d5843909e534b2221acc8e9294b8223
  • SSDEEP 96:2P0IK00IK8Jc4m1IKjRxZewZIMIR8tdozzCB80doE4fzwjDfvahRdcoLjwoMOPU+:W4lS
  • TLSH
    T1E8461260772122697055B607276A21B79A00150F720F68FD6D78C7FBF87DAEE8E80736
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  execution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution
  behavioral1behavioral2