Extracted

• • Target
    4252980510d6ea59efb52bb30a67f8173b7f905e1ea368113ab6e60f2a99105b.vbs
  • Size 561KB
  • SHA256 4252980510d6ea59efb52bb30a67f8173b7f905e1ea368113ab6e60f2a99105b
  • MD5 e5d5bfe30179b640a80ae3cc1640e486
  • SHA1 5c5a868d8b688884b8a47deb61a3ee9ca08fbdd4
  • SHA512 cae7eac6bf7106bb663c042f1ea77393a62b6ec9555667e07736997fc69f219fa83b30fcaf1c93a4a1a300879ec0fe33aa8cdc22d303f795f36dc285639f488b
  • SSDEEP 1536:kmmmmmmmmmmmmmmmmmmyFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFp:vSe
  • TLSH
    T11EC4BE5666EF5509B1B73F586D7650780B933E5AA8BCC69C01CCA81E0FE3A40C865BF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  execution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2