a378d9ddfbcb133d15e59e6a7066c624b90152c38439aab5885319fc679d64db

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/04/2026, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Bozza dei documenti di spedizione – Conferma dell'indirizzo.js
Size 35KB
Sample260420-pp3mpsew3x
SHA256 a378d9ddfbcb133d15e59e6a7066c624b90152c38439aab5885319fc679d64db
MD5 9905b604d10474e5615275fa9f0701fd
SHA1 719c0439ac7c18fe8679828a3fba5f2fbcf03f17
SHA512 102bf36da31873d6bd010b12ad04593c8d62edeb9b38644850a0c88b29dd6eed7a1e8a0a3dcc80e72efac32a81d4a9211e52e6dda4b81743832c8edcfcce6949
SSDEEP 768:eB62ZJgG5HOs5DUM/lSz8gJ7sjKN1YxMInOJ8aIFZ2n:eQpG5HOs5gRzXJ7uKWMRJ8aIf2n
TLSH
T14BF261C83BC7B5A21E4230FB382B7052F53E8D80650D4454F6E891BDB968769D5BEB38
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	2028	wscript.exe
7	2028	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Bozza dei documenti di spedizione – Conferma dell'indirizzo.js"
1⤵
- Badlisted process makes network request
PID:2028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2028-0-0x00000203CE310000-0x00000203CE3BD000-memory.dmp

Download

memory/2028-1-0x00000203CC680000-0x00000203CC68C000-memory.dmp