JVC_92260.vbs
This report is generated from a file or URL submitted to this webservice on December 20th 2019 13:01:48 (UTC)
Guest System: Windows 7 64 bit, Professional, 6.1 (build 7601), Service Pack 1
Report generated by
Falcon Sandbox v8.30 © Hybrid Analysis
Incident Response
Risk Assessment
- Network Behavior
- Contacts 1 domain and 1 host. View all details
MITRE ATT&CK™ Techniques Detection
Additional Context
Related Sandbox Artifacts
- Associated SHA256s
- 5a5049d5af4a54df4010ce775a4be3cf1bfb6743617ae0545f4fc03a363c79cc
Indicators
Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.
-
Malicious Indicators 2
-
Network Related
-
Malicious artifacts seen in the context of a contacted host
- details
-
Found malicious artifacts related to "192.232.246.56": ...
URL: http://gnh.mx/ (AV positives: 1/72 scanned on 12/20/2019 02:24:54)
URL: http://gnh.mx/preview.gnh.mx/statement/2jxbk8wn/viz-61552-01-gq1vceasc-ltht9vu4on/ (AV positives: 6/72 scanned on 12/20/2019 01:47:21)
URL: https://gnh.mx/giros-de-negocio/ (AV positives: 1/72 scanned on 12/19/2019 14:13:34)
URL: http://gnh.mx/wp-content/uploads/2019/12/last/aaaa.png (AV positives: 9/73 scanned on 12/18/2019 11:09:01)
URL: https://gnh.mx/preview.gnh.mx/statement/2jxbk8wn/viz-61552-01-gq1vceasc-ltht9vu4on/ (AV positives: 5/72 scanned on 12/18/2019 11:07:56)
File SHA256: 46d4fa5d12f0dcc0237154d07264d135fe53de7e5c4ea2a7f2eb9e149173949f (AV positives: 16/72 scanned on 12/17/2019 15:31:28)
File SHA256: 6ce8b5e00a7392420bdba21149c5700e85c8d159015bea953bc8969677ce3045 (AV positives: 13/71 scanned on 12/17/2019 14:51:38)
File SHA256: b26fd05b4be6fb77dd9e951bffb057699c53e242d478a7bf774b1a16dd68b816 (AV positives: 13/72 scanned on 12/17/2019 06:48:08)
File SHA256: 6568a3a8206a6474f34f2f1d7a2951653070f60517ef2fb92c47d005bc4f7fbe (AV positives: 15/72 scanned on 12/17/2019 13:32:02)
File SHA256: e8b73f033f53d135d8a83448e242a4386eabc155f803e81982abd8f1c83ba09f (AV positives: 15/72 scanned on 12/17/2019 13:07:18) - source
- Network Traffic
- relevance
- 10/10
-
Malicious artifacts seen in the context of a contacted host
-
Unusual Characteristics
-
Script file shows a combination of malicious behavior
- details
-
The script produces internet activity
is obfuscated and drops files - source
- Indicator Combinations
- relevance
- 7/10
-
Script file shows a combination of malicious behavior
-
Suspicious Indicators 5
-
Anti-Reverse Engineering
-
Possibly checks for known debuggers/analysis tools
- details
-
"docketing restabbed cyanidine Chleuh Flem columnists cognomination Wichman tritanopia wire-safed topflight elecampane sickeningly pederasties Slovenia mesoxalyl prentices Paviour peptogenic revoker virtuoso weak-toned lidder Guaranies dialysed unabsurd hypnotizer druttle snifters thoroughgoingly where coinferring nonsolid stratas alloisomer undisguisedness monotron semimathematical excursional hogsheads autarkikal gutsiest paneling nontraditional cloy unreceptiveness clammyweed Saramaccaner zoophytical glossodynamometer apoturmeric metapleure borotungstic urinogenous martyrlike exclaimed Kumasi myodynamometer overmobilize Hattiesburg briars proctalgy coercibly easier unprison cross-worder Salaminian Mott ungenitive ketubahs drag-down overenthusiastically Phoroneus hustle-cap manipulator kolea Cyb dispiritment meninges Redd quadridentate rehardening cosmism Colbertism empty-looking zieger self-oppressor wrath-consumed electropower poon cockeyed protogelatose hidrosis expender Karyn uranologist plagiarised Nau" (Indicator: "ntice")
"lullabying overrichness unenticed Tetradesmus sulfarsenide harks demihaque full-crown nonalined Aleksandr platyrrhiny open-mouthedness uncomprehend maces Sevan deerhair Emad anurias patrisib pompelmoose molarities pravin uprest soldierbush helpfully faintnesses birdbanding Nafud cytopathic minnesotas bluetops velo Malkah Cristophe unrigidness Dorkus hamadryas Metabola whorts clodknocker musumee last-named Covenant Rusk keraunophonic unquellable hylarchical quoining impostrous well-confirmed gonfanons xylotomous panachure trigonometrical adventively retomb Naam ramososubdivided Kluang unreplevisable kinnikinick nontumultuously lumpectomy bungalows better-humored ombrophilous perceptibleness gollop naric eleutherodactyl anthracaemia pseudoascetical cosmetiste whole-and-half decline implore regelling Alphonse predividend well-cushioned frogmen
ebEq = BaG + ceN
ceN = byrp - rNnT
OlE = "14fqJ%1bG_@Y112Nu119dKx
115C+79kB=X114 |oLm(15m=:?;14O@.*aa123g@e_a88B:$a;W3 sFOQ<5Sgu96knwS-*2hGhKv*1#y!_c8670yOROs114?d&2" (Indicator: "ntice")
"arls probowling viscidly milers julaceous misdeemful serpent-stone cave-lodged ascocarpous quiescency aleak incineration microcyst mindblower nosewheel achymia night-fallen havent contrabandist by-design proudly marsupialising Gandhiist paraguayans self-incriminating heteroclitous epixylous nonfusion twenty-gauge Stylochus cyclicalness microcephalism quadding interjects unqueenly oviferous Hilton Riksm postdigestive matches wise-said upstraight exserts foetor olpes savors crackless omneity Obidiah buffering Karole thioindigo unmortifiedly unaccounted-for unaffectation knells empearl burrah customary cortile spiritual-mindedness Eleen hemophagous broadside boninite ophthalmostat bidactyle apoferritin chirms future-minded entice duodenotomy enculturated tabinet unsubventioned Conall decaliters Tertullian urceolar HS postappendicular Erava stenocephalic unisonance dappled vasculum unmaid theandric conches Lampsilis Asius aumery concretions hylogenesis ichthyosaur friendliest iterativeness undistended Anti-aristo" (Indicator: "ntice")
"kinesiologic diocesan ribaudequin noninterleaved sponsors ganev inchoant Patton redealing overpump cutinise agglomerated koftgari inclined binnacle dures Gerianna isography evangeliser Mahound banuyo retromammary transmutually Betta harmal mouill testimonies furacity sinkfield Cmdr. benzanthracene lobuli swift-running locutoria wide-toothed astrocytic trichoblast innermost banak reanalysis nonseasonable nonvoid Helsingborg birdikin timbromaniac overtitle draperies re-enlightenment trou-de-loup Perlman immolates Coalsack Omagh badgeringly commentated knappan tattling manifoldwise outdatedness Peony coccygeus Pavonia tall-necked enticer invagination irrigates show-me numberings Pamlico Korella Moir umiack retrojugular seroperitoneum Olivehurst subdelegate parthenogenesis cerveliere Apicella manism burlesk ungazetted agitators pseudoorthorhombic blunderings jauping resinify fluorography rechristening courages Peckinpah olivenite dry-fruited truculent weeded lurches Peoria hyposensitizing iron-winged helicities s" (Indicator: "ntice")
"fiber peculations squanderers weedhook soree cliental undiscordant Alleghenies hallot admirals clankingly Euxine unmyopic heisted Illa pepsine Caaba worst-damaged hydrogenate maliferous promenaderess Rachelle eyeshade waterleaves Anaces phellandrene dynamogeny ballarag Blane tenaces plunk Brewton Bicakci bench-warmer sesquisulphuret tarso- Dytiscus pistachio galbraithian indirubine nonindependently entropy parcelment oligodendroglioma parrots worse-taught Cranwell Kinhwa miterers taur amorph paleoclimatology Fascisti supremity recollate interminableness deprint preembarrass king-of-the-salmon termen unprenticed groused protracter sight-reading demographies ring-billed nonfuturistic overtoil Kubera antick unfretful unstirred unshavable Morty osteria gramaries OSP traversely tetrapylon divinising nouther bridals protosinner counterbase diiodo bedeswoman honky-tonk yttro- cotenant deozonizer Puseyistic stereologically autoimmunization half-dollar stechados micromotion trustworthier Americophobe Antillean guineap" (Indicator: "ntice")
"liocyesis bemete willow-grown octahedric tree-living demivirgin filleted episplenitis seminification Warring insalubrious varidical stretchability mundifying hyperisotonic prismy Jean-Claude dalteen balantidiasis Eure-et-Loir expository admirative otological houselights spirketing Roundhead obs. unimpelled beshake primogenitors self-poised sloted biuniqueness climbing uncrated garderobe sagittiform Caprifolium Laz highchairs demisovereign lessener swizzler ungraphitized predeclined Chidester yakalo jibes excitancy Angurboda greaseball semijocular capitulations mecon well-declaimed racetrack upthrown antenatal idyllium turreted unenticeable frontal plebeianisation reigniting fluidising semiamplexicaul scribblement vanished mannite cnida myogen arrows myiferous untruthfully reabridge ruggle cock-tailed Also off-setting tradeswomen fonder oakling outfitters eupatoriaceous choragic Andeee concludent quits unaccumulable Aquilla unshapeable lomatinous Hatcher mumble-the-peg futuramic Babara convective anarthrously" (Indicator: "ntice")
"ngness pedicled coyishness cowbyre battement Curson pulmonic eria statampere episyllogism awee boyhood disedge leadeth house-dove Ellisville basso-relievos dhotee endopods embays asshead tutties soft-tinted Bamby preguide Iran. hadst legationary Virge birlers crashing Giorgi Silicospongiae dandruff replants Ile-de-France quartz pterylology SWAN poodleish chital isolable leguleian hard-bittenness unimpressive ungoverned lymphous vinifera one-shot silver-winged unvituperatively overdependence hemocry defluvium uneloping triradiated Symaethis self-renunciatory holosteous grantedly broommaker Roget codifiers denticete obscuratory Sheri premutinying dismantler interindividual Mississippi kakawahie protostome barniest nonpayment myxosporidian Schargel Hausas seducible Raddi moved unflashing Lovelady hederaceous florula force-out Irmine Battipaglia Falfurrias expositive hypobranchial equiproducing Panamano overinclusive salinometer Magellan archespores tribes ocean-severed ineffervescent primitivism Ramburt harebell" (Indicator: "ntice")
"aphic consumptible unsphering indictive rhyparographer intercentral ascriptitious orchidectomy oxyazo sapsuck shola refelt chimpanzees supportable lofty-roofed Rhagodia elderbrotherish Dipsacaceae achromatous inspirited ionised unswivel valentines ungracious resorcin buphthalmic unnitrogenised upwells Schnapp sonneteer verticalness Jenne poetiised Ophiomorpha autonavigators kenareh radiotherapist distraining snicket unstrengthen dynamoelectric BCE unintercepting antshrike intracardial gonorrheal untired unmoralising stumbling pentapetalous cockered manfish haik Siredon penmaker peptonaemia lycopene fluoridize Dreyfus uralo- steepers pipelined Nereus Mesthles chloracne dubiousnesses Aruba half-crumbled supplicate Varsovian querying star-broidered Transylvania defossion apostasies dog-nail Erund Wilona elamp gay-flowered Worth Dunbar jiffy megathere donuts cervisial fascinatingly coapprentice heteroplasia unwakeful postneuritic denaturization savorless bilge-water fissidentaceous convivialize guddle colonelship" (Indicator: "ntice")
"nn disperse Sextans retreats unfenestral vocalist Gray incut athink Cristie fecundities vice-prone clistothecium sluggy ridability hyperclassicality abolitionary enticements outr grr tiltable puzzlingness agoniatite Osburn subdeaconate outrigging Truelove Lawtons kashi dedimus night-light freebase anthropologists start patholysis paronychium Feosol poisers tailcoat Cymbeline linkman unfrigidity impregnative stib poulardize nonsyndication mobiles unsalable Strigidae subcommissions finishes unbalanced sow-bread subassemblage Montford vitrains cryptozonate set-up Gregorius Diomede pipals wallets hygrometry Pseudo-serbian interjectionary sheldrake wowening prooemium liaised gateman unsanctionable unvigorousness burlier chestnut-brown haplosis Cagliostro many-twinkling pretesting ancy caffeone Pinteresque nippier Nagey tetrasyllabical dimetria wrenchingly co-operable caravelle lateral boltheader overimposing condiddled Chaetetes Eldwun mahalla cantaliver pericopic runfish troffer reactively mystically knurry umbel" (Indicator: "ntice")
"oatal mairatour prepuberty Indo-afghan epidemicalness additivity wheat-fed spectroradiometer Scandian pons Huidobro tarrying repacked lumine pre-edit dependingly ectopatagium entices haemathermal Anti-ally sleeks unvenued Claxton pregenerous terriers abstricting scuddle holandry cottar proctoscopy lehay QIS motorphobiac involucres Nicklaus pachalic waggeries Ammann unlowly Chuckchi Ugro-aryan pileiform cauterised chloroforming aeroscope unoperculate zabajones Switz. restaged retransmission Saturnicentric emulsifying caponette salutarily uneated pampas-grass pseudosymmetrical kago leucoencephalitis traversary subhastation supersemination dead-rise plughole elegancies well-cloistered equiparation torturing umber-black overtamely thriller hysteroscope backdating tensities unmatchedness bull-like intransigence Zipa Quesnay shotproof photoist rascallion prohibits breastplough NCSC rebirth probirth-control automaton indazine Klemme trade-made diehards administrations Antennaria refills joy-resounding tictic brutali" (Indicator: "ntice")
"tles pox lounger snooks aleph sensibly codfishing goods heightened Behka tetartocone retranscribe puffs intraorganization systylous full-handed nondependableness enticed Ptolemies cetes midevening Leontopodium glazily holoquinonoid prefriendly corrugating Hesperornis twin-roller boxman bekerchief diethylamine gladite fogyishness clapboarding deserves hagdown retrocopulant hypersensuously Novachord clusteringly longheadedly glucosic Lagerl undercarriage relucent quasi-cunning Trombidiidae rudimentariness outfigure Kirby-Smith Amphionic unflag x-high Chardonnet sulfone tarrish Changoan nonindustriously Masorite voet misapprehensible shorebirds stigmatist low-boiling computerise heatheriness Wappinger cock-shut oxalidaceous Emmi Gilolo ethnic silverising naturalisation locule gardenership Diet jinrikisha Patience flusker Glathsheimr Zondra barracouta Malinta foutra shalloon vapour pasticcio pre-employ Felicia hyperdactylism coparcenar dogget antimatter sepuchral winster Kaffrarian mysterize Shakti clubbier gearm" (Indicator: "ntice")
"noctuids coelomatous retroverted spermophiline ampherotokous inbreeds moon-eyed yabbie rascalry polyisotopic panatella trisulphone fruitfuller unbeard farandoles pasturable shrews streetage depredator Sistani siderate migration musk-cod oped grafter Wentworth shieldlessness protovertebra preestimated platymeria futures rolamite anticeremoniously calculates oesophageal finessing rattlebones turnipwise tonette Amphipnous hootier enterocentesis seah ectoglia funicles aesculin Causus untrumping Pierceton glossarys keystoned crayfishes untrainedness enarched well-separated pseudophenocryst nasethmoid Post-ordovician deaconize somatosensory psychoorganic Algedi Haymes malikala counterguerilla ICBM incredibilities unpurgatively overchildishly orthoveratraldehyde Solange mawkishness serpentiningly arenicolous high-case peritonealizing sprittie pinabete corniculum cliqueyness subtonic mussels Merideth Juster ceresin unlikelihood forerunner transmigrator sacope surpoose subeditorship trinitroxylene gibbous repugned sel" (Indicator: "ntice")
"hia Aurilia obligatorily malevolency faddish Frechette lepidity Calanthe drivingly parflesh misfiring profit-seeking Sharas undenoted roentgenoscopic hirer Telfairia Heterodera Buroker quop endoplastule pralines trainee etuvee huic gipsology somatogenic nonsubtile reconfining unstore extraretinal half-intellectual stag-beetle Germinal rumble-tumble steel-gray heraldries roundish chirality gastroenterocolostomy lofty-looking sea-salt bucrania soundless incomes mizzens banister-back baroques Spiraea rerepeat mondaine micropathologist pasquinades Radiolites outplace fleshiness belzebub Limbourg epyllia Ludell embargo coriparian obeyers unrecondite intensities time-gnawn calimancos picoted sternly avant-propos euphemistical unpanegyrised hamper saddik bosomy underachieving ticket-canceling appraisers dataria Nalline bear-tree nervelessly minimis nonroyalist Elum may-bush prenticeship retrovert respangle unassertive handcuffs undifferently Rig-vedic burn-beat precipitin polygon Tyroglyphidae cundum labret felstone" (Indicator: "ntice")
"insistently four-day fluxive unsorting demythologizer dahlin musk-deer sulfopurpurate chondrinous reciprocate arnica town-weary priest-hermit seasonal creamlike parietes dihydrocuprin Dielu Marelda nonreverse whole-souledly subglobulose condensed
'world-authorized joch rebranching Devon Italican lenticel Dermatobia Tampico prestoring continentally smug-looking misanthropism no-good overconscientiousness Frear Hooke undoped lipotropic verbatim Tums cladogenesis debouching polycythaemia beamish annum aguglia Lanesville Waianae Philippine Bessemerize Ryun exciter cuppy miscopying unmercifulness Ullin rudous Afrikaner impetuosities drop-forger unwindable colonoscope nonenticingly hotheartedly overspaciousness pleasant-witted VCO movability indulgentially LPC huggingly Motozintlec progenitiveness comprachico well-couched difform heavy-fisted bejewelled objurgating farmhands haemorrhagic cliff-hanger unattractableness pilsners unharmonize undefectively dysautonomia draftsperson assignees disempower Philathea Orwig" (Indicator: "ntice")
"logic carefulnesses Amblystoma euhemerist oysterage renunciate avg. isocarpous Guardafui intellectualistically favus Non-celtic Reimthursen semiprofanely loo challenges Stockport cailliach hairworms bob-haired flawlessness undog piezoelectricity allonomous twice-deferred undistressed ayah pennilessness Yangtze-Kiang task crunt poorness polysarcous nonadverbially Hornell Tiberian Bowmansville prentices Hedgesville Aleedis postnodular COCOT costosternal foulest Allenton hotelmen tol-de-rol polygalic abusious osteophagia Lari rhomboides retrocedent mercerizer pedately hippuritoid ichthyocephalous repass incredibility agramed listwork Fulfulde raps vocular switcheroo rectricial fitfully cytoplasmic myohemoglobinuria curatorium malleinize agenizing sier predeclined Malebranchism bask ensaint strumpets Kozhikode aromatics villainess modernnesses Chihuahua unpreoccupied barangay sciolist vamooses padlike milestone collected sthenochire bankroll breakfasted nucleons cantion myriopods Moluccella nonpast anapsidan cath" (Indicator: "ntice")
"s ichthyophagan argots Fabius Sposi distinctivenesses blubberous egence whicker NQS sphaerite overluxuriously syncing sand-built meat-hungry principal belly-helve averment busuuti Andreotti prentice solenoglyphic endophragmal anomies Orton sislowet unwell-intentioned curdy slik accessioned coaly noncommunistical scutelliform Ormsby felinities day-fly abscam costellate agrypnias self-toning device thiophenic Bivalvia Malinin vermeil-cheeked lapon wranglers best-graced plenipotence extrorsal fourgon antitropal radioecological well-acknowledged BArch irruptively trimodal unbarbered archemperor commodata clinicopathological tasbih yapocks pricier acumination well-summarized algaesthesis Bromfield Roti DSE lobelines novelivelle pharmacogenetic macupa tribal cutleriaceous folial death-devoted caudebeck tinkled MNP pallid-looking enarched xerographic scientifical mazzard purlieus nonbelligerent mistranscript daftness tuchun acridity unreckonable poppean imbowering Corwin McCourt interinsert boleti tenderhearted Bonn" (Indicator: "ntice")
"secuting inconcinnately black-and-white unadoringly meltability listlessness recriminated franciums nonfreemen Stanleytown hydro-ureter cataracts logic chariotee veldtsman balalaikas surrept develop pereion saned Pro-norman foot-payh photoscopic rapier rasbora aristocratic octochord moistify Tasha sierras reaccelerates countersue pulpiest stage-bleed nondoubter bedwarfed prince-duke epitheliums spritzes unphysicked sphincteralgia sulpholysis pro-Scripture Painter denotative oil-heat selectly electrocoagulation gesturer spectacles perradius communisteries haplologic filiate homoeomerianism tantalisation monochloranthracene vinegar-generating tokening Kwarteng Ananda Stearn Nearch Nipmuck interracialism Murrayville Dynastes Sacha bete interplicate plain-bred untyrannised repacker contractually apprentice ILGWU anticommercial influenzas mangour unmortalize scythe-bearing gold-filled blooms Semi-darwinian reticulate superadequate metallogeny Dugspur mossery Ossianesque gaums pretendership pyodermas tactfulness wa" (Indicator: "ntice")
"rngeld dejectile theologus non-proficiency Selenicereus attackers fatlings low-filleted Stacey medicaster loghead Grania Sterner battled grasswidow sicsac hemigastrectomy kenyans deux Hillhousia disaccordance jack-tar traffic-congested hawkweeds datedly diplex reciprocalize reinterrogation spinousness nonvirginal panegyrics arvicoline thriftless sparriest dust-up inextensible sugariness haemoblast nonsanguine Linson multicycle much-loving oval-faced baritenor infile XFE rattoner fenced lyo- desacralization wrenching bioecologist monolingual Odontoglossae Neapolitan ale-washed co-original demonomy stablers bicentennial helly untouristed Bob swine-headed beefalos unalienating expeditely assortments regeneratively copolymerize nonenforcement photo- whenabouts semimatte gibingly impudency bredi stodger porkfish superethicalness trammelhead reliques Freudism gimbawawed splendently anniversariness sootiest subsets periphlebitis invasive unbilleted Burschenschaft acicularly all-sliming virtuoso seleniate anticeremon" (Indicator: "ntice")
"uncriticizing jowled marketably throwster pneumograph deepish overhonestness Calliopsis two-gallon aviatrix SLALOM Ofilia Nickles unsickered AMARC Maoriland remediation Lochia zippier nonsuccour off-time mitiest unprenticed hypochil speckier oppositisepalous night-folded impostures unobdurateness augments over-excite unbaronet dust-laden Salvadora Kinshasa reinterrogating chicken-breastedness quadrivia preremoving appointing septendecillionth high-stepper chondroitin-sulphuric caudatum Venango unsuspect mantapa space-traveling risings underscale phonophore charcoaly lawcraft Breathitt foreign-appearing deltohedra propacifism theotechny Alogian Lanette smooth-shaven nuntius glandes coshes hendecasyllable disdodecahedroid redresser andamento nociceptive well-set-up giglot Allendale ventroptosia cross-leggedly gnessic smooth-tined nonjurable revetement twisel hepatorrhoea panettoni Phytomastigina TWX recidivistic Cylindrosporium T-group supercolumnar ragis margarins cancellated misplacement savation unwasting m" (Indicator: "ntice")
"nglass ipecacuanhic murza retinge Falangism brown-roofed swabberly Strigidae phyllozooid whodunits Emili aquarter gigerium Perognathinae predelinquently Oubangui abaci well-driven campanist unrhapsodical unawakening detachably retaxed Parcae ruach scarlet-flowered ricochetting fed-up pyrophone slop-molded Bondy stillroom Daberath dekametre cryostats interfoliaceous clitelliferous intertwines devil-like lenticel yupon blepharocoloboma definitive resins insinuators Vernunft capitols metal-clad moneymaker oasean dacryopyorrhea hydrotherapeutic periclase undersexton McAndrews cenesthesia oppugner serodermitis sphenoethmoid cumarins appellatived Iridis corrosived denitrified asides numero cagui Brazilian secreto-inhibitory aguise pericystitis deferral unperemptorily four-yard Milda refurbisher orchitises euxanthin unself-willed Alberich hardhanded unalignable rhizophoraceous drogermen interchangings lievrite eyestrains consumers neck-band digitized staters disbutton purpliness batad ungainlier paranitraniline czar" (Indicator: "ntice") - source
- File/Memory
- relevance
- 2/10
-
Possibly checks for known debuggers/analysis tools
-
External Systems
-
Found an IP/URL artifact that was identified as malicious by at least one reputation engine
- details
- 1/72 reputation engines marked "http://gnh.mx" as malicious (1% detection rate)
- source
- External System
- relevance
- 10/10
-
Found an IP/URL artifact that was identified as malicious by at least one reputation engine
-
Installation/Persistance
-
Executes a visual basic script
- details
- Process "wscript.exe" with commandline ""C:\JVC_92260.vbs"" (Show Process)
- source
- Monitored Target
- relevance
- 10/10
-
Executes a visual basic script
-
Network Related
-
Sends traffic on typical HTTP outbound port, but without HTTP header
- details
- TCP traffic to 192.232.246.56 on port 80 is sent without HTTP header
- source
- Network Traffic
- relevance
- 5/10
-
Sends traffic on typical HTTP outbound port, but without HTTP header
-
Remote Access Related
-
Contains indicators of bot communication commands
- details
- "idently crowhop reintercede diligently coprophilia pleonast Milldale fulgent compeering hydrothoracic dunpickle florulae pottle Sprakers tesserarian conductions anakinetic chumble enaction perceptive ECD unlibelously insurant Arimathea cuprum preimperial grangers lanific Egyptologer bestows fine-ax lignify iberians branch-climber hurriedly Neumann virility tawpie self-prepared baryte dartle wearying undewed predeclining untasted ferulic DPS innutritious margarins manganocolumbite Brackely Anti-arminianism unbeaded square-rumped Tarry-john monophyletism hypoacusia agons unsimulated hive world-rejoicing knee-pan Grof gemmule lagan sawhorse undervalve revestiary beautifiers fele grifts osphyomelitis adjacent ethmolachrymal isoelemicin pygofer Despoena searchlight coulombs Sterculia Graves typhonia unfretty periwigged retrolental metriocephalic papyraceous Katrinka Nora chauffeured Isoptera Iskenderun unadvantaged EGA creneled amphibiousness skatikas nonsupport parsings Moradabad cordings blue-berried ier tin-ket" (Indicator: "trinka")
- source
- File/Memory
- relevance
- 10/10
- ATT&CK ID
- T1094 (Show technique in the MITRE ATT&CK™ matrix)
-
Contains indicators of bot communication commands
-
Informative 11
-
General
-
Contacts domains
- details
- "gnh.mx"
- source
- Network Traffic
- relevance
- 1/10
-
Contacts server
- details
- "192.232.246.56:80"
- source
- Network Traffic
- relevance
- 1/10
-
Creates a writable file in a temporary directory
- details
- "wscript.exe" created file "%TEMP%\ColorPick.exe"
- source
- API Call
- relevance
- 1/10
-
Creates mutants
- details
-
"\Sessions\1\BaseNamedObjects\Local\InternetShortcutMutex"
"Local\InternetShortcutMutex" - source
- Created Mutant
- relevance
- 3/10
-
Logged script engine calls
- details
-
"wscript.exe" called "WScript.Shell.1.CreateObject" ...
"wscript.exe" called "Msxml2.ServerXMLHTTP.6.0.CreateObject" ...
"wscript.exe" called "ADODB.Stream.6.0.CreateObject" ... - source
- API Call
- relevance
- 10/10
-
Contacts domains
-
Installation/Persistance
-
Creates new processes
- details
- "wscript.exe" is creating a new process
- source
- API Call
- relevance
- 8/10
-
Dropped files
- details
- "ColorPick.exe" has type "HTML document UTF-8 Unicode text with very long lines"
- source
- Binary File
- relevance
- 3/10
-
Touches files in the Windows directory
- details
-
"wscript.exe" touched file "%WINDIR%\SysWOW64\en-US\wscript.exe.mui"
"wscript.exe" touched file "%WINDIR%\SysWOW64\rsaenh.dll"
"wscript.exe" touched file "%WINDIR%\SysWOW64\wscript.exe"
"wscript.exe" touched file "%WINDIR%\Globalization\Sorting\SortDefault.nls"
"wscript.exe" touched file "%WINDIR%\SysWOW64\scrrun.dll"
"wscript.exe" touched file "%WINDIR%\SysWOW64\wshom.ocx"
"wscript.exe" touched file "%WINDIR%\SysWOW64\en-US\wshom.ocx.mui"
"wscript.exe" touched file "%WINDIR%\SysWOW64\en-US\KernelBase.dll.mui"
"wscript.exe" touched file "%WINDIR%\SysWOW64\msxml6r.dll"
"wscript.exe" touched file "%WINDIR%\SysWOW64\en-US\ntvdm64.dll.mui"
"wscript.exe" touched file "%WINDIR%\Fonts\StaticCache.dat"
"wscript.exe" touched file "%WINDIR%\SysWOW64\en-US\msctf.dll.mui" - source
- API Call
- relevance
- 7/10
-
Creates new processes
-
Network Related
-
Found potential URL in binary/memory
- details
-
Heuristic match: "ous flowcharting Vinton hard-worked wobbled praecuneus declaimant iguanoid unessence self-deceptious antihierarchically zorille polyzoary gardant exteriorly wheyfaces unluxuriant glareole dovetailed gorgeted sledges pelanos Clatsop wlatful clamp semistory "
Heuristic match: "gnh.mx"
Heuristic match: "GET /wp-content/uploads/2019/12/last/aaaa.png HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Language: en-us
User-Agent: Windows
Host: gnh.mx"
Pattern match: "http://gnh.mx/xmlrpc.php"
Pattern match: "http://gnh.mx';var"
Pattern match: "https://gnh.mx/feed/"
Pattern match: "https://gnh.mx/comments/feed/"
Pattern match: "http://gnh.mx/wp-includes/css/dist/block-library/style.min.css?ver=5.3.2"
Pattern match: "http://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800&subset=latin,latin-ext"
Pattern match: "http://gnh.mx/wp-content/themes/Divi_V.3.23.3/Divi/style.css?ver=3.23.3"
Pattern match: "http://gnh.mx/wp-includes/css/dashicons.min.css?ver=5.3.2"
Pattern match: "http://gnh.mx/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp"
Pattern match: "http://gnh.mx/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1"
Pattern match: "https://api.w.org/"
Pattern match: "https://gnh.mx/xmlrpc.php?rsd"
Pattern match: "http://gnh.mx/wp-includes/wlwmanifest.xml"
Pattern match: "http://gnh.mx/wp-content/cache/et/global/et-divi-customizer-global-15766272672045.min.css"
Pattern match: "https://gnh.mx/"
Pattern match: "https://gnh.mx/wp-content/uploads/2019/12/goraa.png"
Pattern match: "https://gnh.mx/nosotros/"
Pattern match: "https://gnh.mx/giros-de-negocio/"
Pattern match: "https://gnh.mx/contacto/"
Pattern match: "https://gnh.mx/idioma/"
Pattern match: "https://gnh.mx/wp-login.php"
Pattern match: "https://es.wordpress.org/"
Pattern match: "http://gnh.mx/wp-content/themes/Divi_V.3.23.3/Divi/js/custom.min.js?ver=3.23.3"
Pattern match: "http://gnh.mx/wp-content/themes/Divi_V.3.23.3/Divi/core/admin/js/common.js?ver=3.23.3"
Pattern match: "http://gnh.mx/wp-includes/js/wp-embed.min.js?ver=5.3.2" - source
- File/Memory
- relevance
- 10/10
-
Found potential URL in binary/memory
-
Spyware/Information Retrieval
-
Found a reference to a known community page
- details
-
"sicks guyots progrede spitbox grave-looking nanosomus currieries dipsomaniacs melodiousnesses re-return t stercovorous rheotan retanner cubist syndetic transliteration Vic. harfang Baloghia incivility undesirability Shargel overpersecuted stinge Letrice deltas yodelist watchwords nontheologic colluders unstridulous gaels hypobasis Fordsville nautiloid spastics worsement barbre dryads loun up-end mushla Artocarpus strophes hermitic subtunnel croupy Iaria phototroph perhydrogenized Nikita rash-headed tutin ten. filarees photoemissive fal-lalishly wrestingly aftosas sheathbill jungermanniaceous esophagospasm acinar advowry naig pickax counterapse ligroin nonpinaceous Lichtenstein recip twittery passivate incompetences Pro-australian Sikorsky biotopes tumulary unperformed overlearned well-drain clish-ma-claver oddment processibility Saltillo diolefinic mugwet rubdown termitid postulants superavit tradevman personalisation lichenoid short-hair uvulars tumbrels unwarranness retinged edility glycuronic chanco frames" (Indicator: "twitter")
"imprecators hypopygial balletic TMIS moudy-warp Toffic ledgement these derepress embolectomy Stygial preequity Jagannath auspiciousness
'chirographic long-withheld pericardial miscoin hordeate undersaturate clearage sunbreak handiest pathogermic intellectation outpraying oceanologic contends hangalai volency bronze-winged sarlyk outwitter missorting supergratification espouse masterlessness showbread impoundage preholiday azothionium sleazo millirems minstrels patriotic nonaccordant longful reap paradisian scrutator teen cities exactingly polyarthritis sacerdocy Laboulbenia unlignified unfumbling dastardly tutelaries foaming archi- isuretine meditater scolopendrid khafs Kabuki truth-value plopped land-slater marbler platymyoid Charlyne undeparted acclamations servable supraoesophageal loory vitaceous diverticulum exulted Rabah aeons untormentingly neascus Caladium overcircumspect petalage slithered spanemic Shamrock propugnator subprograms paralytical plumbiferous unerrableness unsurliness dithioic halloaing" (Indicator: "twitter")
"e gambrel pre-eminence bellhops aporose bepainting demi-pique megalocyte Wulfe chondroblastoma Poltoratsk mesiobuccal elliptically Igbos ruficaudate soapmonger thick-maned undetainable molested sprawled courtesies encompassment remarker anthophile rumblement premillennial preheat tragicomedian tusked subdiscipline sarcoma unnecessarily uncrevassed Deephaven checkbit taxi-bordered over-caution free-spirited Minor papillose spewers thiazides Khayy twittered clientelage curiosos antipriesthood vicoite mild-spirited arbiters amphora unpecuniarily noetics pazazzes autobasidia trans-Paraguayian Coleman clinchingly allemand tactilogical dioritic remorseful Dekker inoscopy gaposises wappenschawing pyramidoattenuate matagory scudler Taoist Zambac octoyl hexonic marshaling gad-bee ladyfish muktatma life-infatuate jonvalize skime overfilling tempos oversups pavers hypertoxic moistener outface airbill unsustained strunts flatwash unclosing Baton acuminating Rempe swansdown vulture-torn drainermen jarbot lungan featherwei" (Indicator: "twitter")
"etaceously portment procreant sparkplugging cassiopeium crystallogenic snowl crancelin suffragate ungraded paleopedology Vin axseed Alethea Kundry dreads basements curvetting ovivorous Pelopi agriological retropulsive Theocritean sensibilisin dependant fiants orientator heptahedral couchancy truest outlooks surface-printing delocalisation tripinnate Campagna revert soul-fostered Charlo listenership starveling outwitter chronograph polydermy world-detesting wine-bright litterbug phrenesis Mermithidae encastrement Kazakh Swabian tetragynous eagerness Gypsies choppier ungeniality typesetters wizardess prisoned scarier patters whole-leaved well-turned-out Dowell twice-grieved stringene micranatomy stimulability epileptologist cabrettas ill-naturedness misjudgment autotoxic Northamptonshire phonologic seducible suppurates Scelidotherium red-gold westerns didascalar Bonns Edme postable planing holotype pass-book Goetae adrenocorticotropic spasmolytic jamestown-weed logomachist misregulated Strandburg urbanites hair" (Indicator: "twitter")
"translate pregracile necesse thimbles Edmee Shay quintes hipflask abnormalcy unsatiating habitacle Wrangell loudened prefabricated avenery ex-convict regula Yoldia nonpneumatically paper-using twitter hutch Eboe grandfathers unequalled simultaneity protutory Philip teargassing emergencies objurgative Penh Casimir Aedilberct cocklebur dislimn rebias xylopolist gasteralgia megacolon perspicable hampers Rocroi wizening wizards lineless heritability enteroscope clamatory stomachy pop-shop well-encouraged transversocubital supersocial deacetylation pusillanimous empolder ototoi half-florin psammophilous argol deportments Thamudean pursuits disqualifying ouphe underclothe aal Janus-like brethren exculpatorily nectared motographic hot-vulcanized heloderm prince-elector Periphas lepage succinous weeped palatize Boucicault slashingly lathered Wellton spadones diddies flchette connoted barbarizing unlethally pileorhize caubeen Michie reformating bottier dystocias Zouave concourse Kikatsik self-penetrability Brouwer aff" (Indicator: "twitter")
"ponymist sponging-house unclustering japanizes ironbark induplicate graticulate truth-writ VPN lime-twig taffeta sailorlike Nemesia Post-victorian varahan aegeriid bronchogenic upchimney Chalinidae hungers devilward Serapea Minorist open-worked Vivie volumetrically flightworthy imputative monorchism missel-thrush rottenstone acceptancies alkalifiable octahedra nitranilic emulable dispersoidology wingedly dicoelous board-wages manageabilities lymphorrhage mallophagous large-diameter iridesce pseudonavicella meetinger brichette ring-bark prochronism phenyldiethanolamine Artemus neighbourhood Hibernization coronership vasoligation outregeously methyltri-nitrob Reeseville cibarian twitter-twatter bantamweights baud episcoparian rapscallion diligency destry reconverts consoling slithering venom-breathing sassafrases Algernon agynous unoperatically indoles prosodiac ferberite tapeti Gentianales sanguineousness Conetoe crushes bossies Drosophila strigil Goniaster chewink washproof Trudey Milvinae Herculanensian pror" (Indicator: "twitter")
"nondismissal norland apsinthion colorational Roskilde revisionism orthographise Melian Taino barratrously nonliturgical diaphones seismicity unconverted mischance Rapacki Pantagruelize literature superarrogance well-darkened costodiaphragmatic nonpersuasive fearnought scale-board well-closing biocatalyst attestors nubilation self-tolerantly
WJw = Asc(Mid(TcU, oSJ, 446 + 8 + 448 + 166 - 6 + 7 - 341 - 18 - 481 + 10 - 418 - 164 + 344))
'caveated norms surprize disclaims boorishness mischance Caravaggio odd-come-shortly athetotic connectival noncritically Tumupasa pistic prothalamiumia marquisdom aphanophyre leprosed overreaches blepharal untasteable underclad thermostatically kike nonuniversal lexia praise-spoiled Croix pretransport motographic Nipmucks Noyes binna hopple labyrinthodontian Gymnasium carpet-sweeper ewers Canangium Trachodontidae Iobates masseteric nonconnotatively tallest whelm Huesca self-hang twitterer stereomicroscopically rhapsodies cosovereign unhid yawping scaphoid autodecrements zoomela" (Indicator: "twitter")
"ve benzoins burd-alone trade-mark featherway superthorough lempiras cordoban casual underhoused quasi-extraterritorial demorphinization joinered semisavagery outspied opinion thiosinamine unconfounding cleche sexillion porridge ergmeter carpintero embroaden realists helotism tiffins myrtle-leaved twitteringly seven-eleven slogan forefin second-in-command ettling torsibility whoopees plumiform granivorous carafes man-headed narrow heaven-begot unbending Cetacea fellow-creature poisure peloric homeochromatism carbinols daydreaming putrescent overcivilized foodful re-erect subtwined overexpenditure prediscouraging daturas yeaoman triflingly pliability heartiest subjectivist unsmocked cotise gastrophilite gentleman-digger consignificative antiparliamentarist doughtiest leftness stive incohering supersanguine Engelhart Guymon overdraft fatstocks well-launched soul-sickness Dinoceras traitorousness unstabilizing rijksdaalder polydomous pentapterous dateline diaclase assumptions hilum acarology counterphobic huamuch" (Indicator: "twitter")
"ubstantial inconsequences outhold viverriform allovers overprotected paniscus labrum mid-town created shanty-boater promycelium Edroi Romanal peachs concolorous naprapath Dalymore monachize fitroot striatum reposition olibanums vapourescent overstrikes Frostburg prizefighting Yvonne dilapidation Veneta processionalist Tainui helas oscnode areo- semology macropyramid outgone dossil hooflike Chryssee Pyrrhonistic antacids bans coassert ethmolith silicomagnesian disfranchiser sulphowolframic intercentrum Hellenise kasida Tennille logo- cystic unmastered forenight macles Wilber Rosmarinus pauses pricking-up chinaberries overusing HLV topograph underinsurance nonuniquely twittering Umtali Ingle Leclair turkeyfishes misperceive boulework takedown Danczyk couchers feu stackmen Sharp yird prorealism refortified putrescible decart overdriven risper outlead Joannite lulab druthers reknot triternately nonsequestration Manwell roofed incomprehensibleness saltishness jundy suricat squillageed styca Verla embarkations over" (Indicator: "twitter")
"namban prajna vestrymanship lack-brain oreiller well-canvassed loud-clamoring Volnay Grimm orig gammick Styrax fulfills masham scorser eucleid recondense miszoning Fernanda fluorimetry Cuajone pistillar woodpecker reaccommodates sharp-bellied overdecked world-sacrificing Astylosternus bundts counterterrors frumpish cometographical kokanees never-daunted light-built nonreusable btry kingpin nonexotically in. juvent lawyers bandy-legged gamont soft-boiled upgrowing olive-drab sanitating mnemotechnics anniversariness blood-letter hot-spirited sulfurized pgnttrp coolnesses colonnaded concealedly expects tendril outwitter nonmimetic Marmawke monotropy shiverer frigolabile Aaru Estaing carrotins disulfuric subtest sploit trochleate hoariness coalfields chassepots thioantimonite unendeared Katlin stinkstone translating outbluffed attainor foiningly equalness equinely choregic hightoby fast-plighted chalcotript micromanometer prisms post-obit armbone eiderdown methadons Riocard ODDD utilizable tuftier inkies pyrazoli" (Indicator: "twitter")
"rifolious saccharinely misguidance milko piquiere bloat unballasted drawtubes predeclared grappled autopsychoanalysis pitchhole Amazonia endearance assertrix baleens monochromous gastroenteritis racemized autocraticalness recomposing yoks thitsi Wiggins yangs well-begun saccules diffusivity animations beachie geodesics defamer twittery rationalists Katharine selfly Cotinus ribonic unreorganised velarizing Aron atterr saltimbanco Neisserieae quasi-expensively Rawdin condoms drawgate sousaphonist jejuneness coracoscapular Taposa recentralize heils misallege dynamometamorphic haggardly venomousness divertibility Judaic ailed reaffixed ovipositional osmol cerebro- accessorized biochemist nontrained Linne deorsumvergence Osorno tonsillotome unbridles vaginaless wet-eyed weaponmaker impuritanism Corrina applicators phosphorylating bbs nondenunciation durations photocomposed consort multiplexed gummosity vascula entheasm protosaurian haylage datedness Armoracia hyperorthodoxy unspiritualizing overspeak forepayment m" (Indicator: "twitter") - source
- File/Memory
- relevance
- 7/10
-
Found a reference to a known community page
-
Unusual Characteristics
-
Installs hooks/patches the running process
- details
-
"wscript.exe" wrote bytes "d83a5f75" to virtual address "0x756001E0" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "b4365f75" to virtual address "0x75600200" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "c0dfd5771cf9d477ccf8d4770d64d67700000000c011557700000000fc3e557700000000e0135577000000009457677725e0d577c6e0d57700000000bc6a667700000000cf3155770000000093196777000000002c32557700000000" to virtual address "0x76631000" (part of module "NSI.DLL")
"wscript.exe" wrote bytes "68130000" to virtual address "0x75631680" (part of module "WS2_32.DLL")
"wscript.exe" wrote bytes "b4365f75" to virtual address "0x756001E4" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "7111fa017a3bf901ab8b02007f950200fc8c0200729602006cc805001ecdf6017d26f601" to virtual address "0x75E107E4" (part of module "USER32.DLL")
"wscript.exe" wrote bytes "6012eb72" to virtual address "0x740D4028" (part of module "WEBIO.DLL")
"wscript.exe" wrote bytes "b84013eb72ffe0" to virtual address "0x755F3AD8" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "d83a0200" to virtual address "0x755F4E38" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "d83a0200" to virtual address "0x755F4D78" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "b8c015eb72ffe0" to virtual address "0x755F36B4" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "b83012eb72ffe0" to virtual address "0x75631368" (part of module "WS2_32.DLL")
"wscript.exe" wrote bytes "d83a5f75" to virtual address "0x75600274" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "b4360200" to virtual address "0x755F4D68" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "d83a5f75" to virtual address "0x75600258" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "b4365f75" to virtual address "0x75600278" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "b4360200" to virtual address "0x755F4EA4" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "b4365f75" to virtual address "0x7560025C" (part of module "SSPICLI.DLL")
"wscript.exe" wrote bytes "d83a5f75" to virtual address "0x756001FC" (part of module "SSPICLI.DLL") - source
- Hook Detection
- relevance
- 10/10
- ATT&CK ID
- T1179 (Show technique in the MITRE ATT&CK™ matrix)
-
Installs hooks/patches the running process
File Details
JVC_92260.vbs
- Filename
- JVC_92260.vbs
- Size
- 3.7MiB (3844318 bytes)
- Type
- script vbs
- Description
- ASCII text, with very long lines
- Architecture
- WINDOWS
- SHA256
- 37c6ccf78364ca4b612732ad07f08cac763af286d0421a64893c45be6cb8eed5
- MD5
- 24028e725440434b6fa4fc0ae3bc5f03
- SHA1
- 8ff74e14ec012c6d486cbd70df45e4665b47b542
- ssdeep
- 49152:nbbNuDc23LVBqphnDCWMp6wm2itNa6hrh7utbTiIk2zSPOatm5aGynwNjKJA+m//:F2
Screenshots
Loading content, please wait...
Hybrid Analysis
Tip: Click an analysed process below to view more details.
Analysed 1 process in total (System Resource Monitor).
- wscript.exe "C:\JVC_92260.vbs" (PID: 5092)
Network Analysis
DNS Requests
Domain | Address | Registrar | Country |
---|---|---|---|
gnh.mx |
192.232.246.56
TTL: 14399 |
- | United States |
Contacted Hosts
IP Address | Port/Protocol | Associated Process | Details |
---|---|---|---|
192.232.246.56 |
80
TCP |
wscript.exe PID: 5092 |
United States |
Contacted Countries
HTTP Traffic
Endpoint | Request | URL | |
---|---|---|---|
192.232.246.56:80 (gnh.mx) | GET | gnh.mx/wp-content/uploads/2019/12/last/aaaa.png | GET /wp-content/uploads/2019/12/last/aaaa.png HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Language: en-us
User-Agent: Windows
Host: gnh.mx More Details |
Extracted Strings
Extracted Files
-
Informative 1
-
-
ColorPick.exe
- Size
- 11KiB (11728 bytes)
- Type
- html
- Description
- HTML document, UTF-8 Unicode text, with very long lines
- Runtime Process
- wscript.exe (PID: 5092)
- MD5
- 542961cc69b4d56ecc62cdc06b94cbd5
- SHA1
- 8bea22896ecf685c1390c1cc17e74ddba5424faf
- SHA256
- 095004f5c0e8d1b14f9cc7112603b0ac7133c4aa817ad2d0aa268d2b5ae921b8
-