Extracted

• • Target
    task.vbs
  • Size 83KB
  • SHA256 b0c1031ea7d8f98db85e9461f660ceabd4a81ad8fef588498c8a1e34090fd1cb
  • MD5 8ca0fc06be148ab0a35cdcd26b19e51e
  • SHA1 bdd97d13d563b3b9614219cca1bdd4a5294cdd2e
  • SHA512 dc7031fefd104e39b55aa7a33e13b595712f6c2a85b0edf6434600a34585269189b1d01e166caf359f3c8397d2fb6a155ff287d62fd1ad7b2aa0fef6f689ca97
  • SSDEEP 192:N8mMVc0HiXleRfRnZa3vQ4XGZ/lK3Ry4Z8dsOiAt/qYdYfNNgaF0cFBnmAHbQ:90whoMHk
  • TLSH
    T17983BC3D6855C8B0B760895823CE50723C8D1E0353EEFFE9846B226CC179AF751A7967
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2