Extracted

• • Target
    1466520643274.vbs
  • Size 25.1MB
  • SHA256 4ce3a97fe737c20613855fae4da03cd6595004106b16c3ab36232c83beedf8cb
  • MD5 64e8fb50aa17b2418c80f37a026ee20e
  • SHA1 fc8d83cb826d942c628f041166798c961d19e20f
  • SHA512 479e87e8949adc6b801769f059cba0576c5898102ff618d757bd9843ffda7b5e7ce0b6a8af6dd1a030ede2481061b072712db8a3dfbbd97d182ac684d77bafc5
  • SSDEEP 96:2AEb1yQLEvdGqWN8T59FeaRt6e//e0QyJb2b7Sf2AG24HCbXPPrm8hC4O63+nA7F:Ik48TRf/JHeaXnyrnAubI
  • TLSH
    T12D477452E76929020437931F995A32C7E6CC9AEB3D84CB0EBFC9BEC8519FC4867605C5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  execution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2