update-check.js: No threats detected JS analysis report

Clean

0/100

Nothing scored against this sample. A run reads as suspicious from 35.

Clean0-34 Suspicious35-69 Malicious70-100

Why this verdict

Every layer that ran completed without scoring anything against this sample.

Analysis layers

Static ran no points

Dynamic ran no points

Threat intel ran no points

AI ran no points

Sample

TypeFile

MIMEapplication/javascript

Run conditions

Sandbox OSWindows 10

EnvironmentWorkgroup

InternetIsolated

Execution137s

Guest hardware2 vCPU4095 MB RAM

Structure

What the file is made of: headers, imports, how it was built and whether it was signed.

Signature

Format: plain text[LF]

Not packed

Identity

File

typeJavaScript source, ASCII text

size451.0 B

entropy4.7527

Packing

Not packed

The file's code is readable on disk - nothing is compressed or encrypted around it.

0/100

packer confidence

Static analysis reads this file directly Nothing is hiding the code from a static pass, so what the file contains is what the report shows.

Indicators weighed

Packer detection looks at a program's entry point, sections and entropy. This file is not a program image, so there was nothing of that kind to assess.

File content

10 lines · 451 bytes

The sample verbatim, shown as inert text - nothing here is interpreted by this page.

// Reports which of a few well known endpoints answer, and how quickly.
const https = require('https');
const targets = ['example.com', 'www.iana.org', 'www.rfc-editor.org'];
for (const host of targets) {
  const started = Date.now();
  https.get({ host, path: '/', timeout: 5000 }, (res) => {
    console.log(host, res.statusCode, (Date.now() - started) + 'ms');
    res.resume();
  }).on('error', (e) => console.log(host, 'unreachable', e.code));
}

Extracted strings

showing 9

// Reports which of a few well known endpoints answer, and how quickly.
const https = require('https');
const targets = ['example.com', 'www.iana.org', 'www.rfc-editor.org'];
for (const host of targets) {
const started = Date.now();
https.get({ host, path: '/', timeout: 5000 }, (res) => {
console.log(host, res.statusCode, (Date.now() - started) + 'ms');
res.resume();
}).on('error', (e) => console.log(host, 'unreachable', e.code));

Stack and decoded strings were not recovered: this file format is not eligible for string emulation. Only literal strings present in the file are listed above.

Screen recording

8 frames · screen recording · 137s

1 / 8

0:00 · 1/8

Behavior summary

ran 137s

1 process(es) observed

Launchedwscript.exe //B //Nologo "C:\Users\user\Desktop\update-check.js"

Privilegestandard

Telemetry sources: Kernel ETW (9 of 143 events) Process audit: 1keydiff: 5

No WMI attributed to the sample. The WMI-Activity trace was running and recorded 939 operations on the machine during the run; none of them came from the sample's process tree.

No network activity - the run was isolated

This detonation was given no internet connection, so a sample that wanted to reach out could not. An empty section here says nothing about whether it tried.

Process tree

What ran during the detonation, and what each process did. Select a node to see the activity attributed to it.

1process

update-check.js

1 process

Attributed activity

Not attributed to any process

1 kind

These operations were captured but carry no pid this tree could match, so they are not shown against any node above.

Registry operations5

0Mechanisms found

90Methods checked

0ATT&CK techniques

NONEHighest severity

Established mechanisms

clean

No persistence established

None of the 90 auto-start methods below were established during this run.

Detection coverage

0 / 90

Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean.

Logon & Startup 22 clean

Active Setup Installed Component T1547.014 clean
Explorer Delay-Load Object T1547.001 clean
Explorer Run Key T1547.001 clean
Explorer SharedTaskScheduler T1547.001 clean
Group Policy Extension DLL T1547.004 clean
Group Policy Run Key T1547.001 clean
Logon Script T1037.001 clean
RDP WDS Startup Program T1547.001 clean
Registry Run Key T1547.001 clean
Registry RunEx Key T1547.001 clean
Registry RunOnce Key T1547.001 clean
Registry RunOnceEx Key T1547.001 clean
Registry RunServices Key T1547.001 clean
Startup Folder Item T1547.001 clean
Startup Folder Redirection T1547.001 clean
Terminal Services Initial Program T1547.001 clean
Winlogon GINA DLL T1547.004 clean
Winlogon MPNotify Value T1547.004 clean
Winlogon Notify Package T1547.004 clean
Winlogon Shell Value T1547.004 clean
Winlogon Taskman Value T1547.004 clean
Winlogon Userinit Value T1547.004 clean

Services & Tasks 9 clean

BITS Job T1197 clean
Print Monitor DLL T1547.010 clean
Print Processor DLL T1547.012 clean
Scheduled Task T1053.005 clean
Scheduled Task Registry Implant T1053.005 clean
Service Control Manager Security Descriptor T1574.011 clean
Service DLL Hijack T1543.003 clean
Time Provider DLL T1547.003 clean
Windows Service Creation T1543.003 clean

Execution Hijack 17 clean

.NET Managed Debugger T1546.012 clean
Accessibility Tool Hijack T1546.008 clean
AeDebug Postmortem Debugger T1546.012 clean
App Paths Hijack T1546.012 clean
Application Shim Database T1546.011 clean
Boot Verification Program T1547.002 clean
Command Processor AutoRun T1546.011 clean
Explorer Load Value T1547.001 clean
Explorer MyComputer Tool Hijack T1546.001 clean
Registry Image File Execution Options T1546.012 clean
Screensaver Hijack T1546.002 clean
Setup ErrorHandler Script T1546 clean
Shell Open Command Hijack T1546.001 clean
SilentProcessExit Monitor T1546.012 clean
Telemetry Controller Command T1546.015 clean
WER ReflectDebugger T1546.012 clean
Windows Error Reporting Debugger T1546.012 clean

DLL Load Order 12 clean

.NET CLR Profiler DLL T1574.012 clean
.NET Startup Hook DLL T1574 clean
AppCert DLLs T1546.009 clean
AppInit DLLs T1546.010 clean
AutodialDLL Winsock Injection T1546.006 clean
DLL Search-Order Hijack T1574.001 T1574.002 clean
DNS Server Plugin DLL T1574.001 clean
HTML Help Helper DLL T1546 clean
KnownDLLs Manipulation T1574.001 clean
Natural Language Platform DLL Override T1546 clean
Netsh Helper DLL T1546.007 clean
Winsock Layered Service Provider T1546.006 clean

COM & Browser 6 clean

Browser Extension T1176 clean
Browser Helper Object T1176 clean
COM Server Hijack T1546.015 clean
HTML Help COM Object Hijack T1546.015 clean
Shell Context Menu Handler T1546.001 clean
Shell Extension Handler T1546.001 clean

Security Providers & Accounts 11 clean

Account RID Hijack T1098 clean
AMSI Provider T1562.001 clean
Credential Provider T1547.014 clean
DSRM Admin Logon Backdoor T1556 clean
Hidden Local Account T1136.001 clean
LSA Authentication Package T1547.002 clean
LSA Extension DLL T1547.005 clean
LSA Notification Package T1547.005 clean
LSA Security Package T1547.005 clean
Network Provider DLL T1556.008 clean
Security Support Provider T1547.005 clean

Scripting & Applications 9 clean

Netsh Port Proxy T1090.001 clean
Office Add-in T1137.006 clean
Office Executable Sideload T1574.002 clean
Office Startup Template T1137.001 clean
Office Test Key T1137.002 clean
Power Automate Flow T1546 clean
PowerShell Profile T1546.013 clean
Windows Terminal Startup Action T1546 clean
WMI Event Subscription T1546.003 clean

Boot & Firmware 4 clean

BootExecute Native Image T1547.002 clean
PlatformExecute Native Image T1547.002 clean
SetupExecute Native Image T1547.002 clean
UEFI / Bootkit Artifact T1542.003 T1542.001 clean

File activity summary

create 0 write 0 modify 0 delete 0 rename 0

File & registry ops

0 file · 0 registry · sample scope

Files (0) Registry (0)

Operation	Target	Process
create	Software\Microsoft\Windows Script Host\Settings certificate store	wscript.exe pid 5736
create	Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing certificate store	wscript.exe pid 5736
setvalue	Software\Microsoft\Windows Script Host\Settings ActiveDebugging = 1 read back	-
setvalue	Software\Microsoft\Windows Script Host\Settings DisplayLogo = 1 read back	-
setvalue	Software\Microsoft\Windows Script Host\Settings SilentTerminate = 0 read back	-
setvalue	Software\Microsoft\Windows Script Host\Settings UseWINSAFER = 1 read back	-
setvalue	Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing State = 146432 read back	-

12 answered no 1 could not answer 10 had nothing to check

0Sources with a hit

13Sources queriedof 23 available

486.1kFeed records

1Could not answer

File reputation

6 clear · 1 could not answer

Source	Checks	Result	Detail	Feed
VirusTotal	File hash	cannot access	rate limited (free-tier quota)	live lookup
MalwareBazaar	File hash	not found	-	live lookup
filescan.io	File hash	no detections	-	live lookup
MalwareBazaar hash feed	File hash	clean	not in feed	2,535 records 51 minutes ago
MalwareBazaar ransomware feed	File hash	clean	not in feed	8,271 records 5 hours ago
ThreatFox hash IOCs	File hash	clean	not in feed	1,632 records 51 minutes ago
URLhaus payload hashes	File hash	clean	not in feed	1,474 records 51 minutes ago

Hash lookups only - the sample itself is never uploaded to any third party.

Network indicators

0 clear

Source	Checks	Result	Detail	Feed
blocklist.de	IP / domain / URL	not checked	no IP, domain or URL observed to check	24.5k records 51 minutes ago
CINS Army	IP / domain / URL	not checked	no IP, domain or URL observed to check	15k records 51 minutes ago
Emerging Threats	IP / domain / URL	not checked	no IP, domain or URL observed to check	580 records 51 minutes ago
Feodo Tracker	IP / domain / URL	not checked	no IP, domain or URL observed to check	5 records 51 minutes ago
IPsum	IP / domain / URL	not checked	no IP, domain or URL observed to check	17.7k records 51 minutes ago
Phishing.Database	IP / domain / URL	not checked	no IP, domain or URL observed to check	391.1k records 5 hours ago
ThreatFox	IP / domain / URL	not checked	no IP, domain or URL observed to check	1,632 records 51 minutes ago
URLhaus	IP / domain / URL	not checked	no IP, domain or URL observed to check	5,155 records 51 minutes ago

TLS fingerprints

0 clear

Source	Checks	Result	Detail	Feed
abuse.ch JA3 blocklist	JA3 / JA4	not checked	no TLS client fingerprint observed	97 records 17 hours ago
SSL blocklist	JA3 / JA4	not checked	no TLS client fingerprint observed	10.7k records 51 minutes ago

Detection rules

2 clear

Source	Checks	Result	Detail	Feed
Sigma rules	Behavior log	clean	-	2,275 records 23 hours ago
YARA rules	Sample content	clean	no rule matched	110 records 52 minutes ago

Tooling catalogs

4 clear

Source	Checks	Result	Detail	Feed
LOLBAS	Process image paths	clean	1 process image path, none masqueraded	244 records 51 minutes ago
LOLBootloaders	File hash	clean	not a known vulnerable bootloader	520 records 51 minutes ago
LOLDrivers	File hash	clean	not a known vulnerable driver	2,306 records 51 minutes ago
LOLRMM	Names and domains	clean	2 name/domain indicators checked, no remote-management tooling	322 records 51 minutes ago

Analyst narrative

The analysis indicates that the sample was successfully executed in the sandbox environment. However, the observed behavior is minimal, with only one process (wscript.exe) being spawned. There are no indications of file operations, registry modifications, or network activity, and no persistence mechanisms were detected. Additionally, there are no indicators of compromise (IOCs) or malicious capabilities identified. Given the lack of significant activity and the absence of malicious behavior, the verdict is that there is insufficient evidence to classify the sample as malicious. The analysis does not provide any clear indicators of initial access, execution, persistence, defense evasion, command and control (C2), or impact. Therefore, the sample does not demonstrate any malicious intent based on the observed data.

Evasion analysis

No evasive checkpoints detected.

0 malicious 0 suspicious 2 info

File indicators

Severity	Type	Indicator	Description
info	sample_sha256	6cc8195b836e5e6b83cf364f3c061e826cdd5246ac64b6bd22a6bca44f53c954	Submitted sample (SHA256)
info	sample_md5	3ab78534e24cc0e479f6ca9bcc4857bd	Submitted sample (MD5)

Sigma detections

0 matches of 2275 rules

The Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.

Generated rules

YARA: auto_file_2372_yara

Auto-generated

rule auto_file_2372_yara
{
    meta:
        description = "Auto-generated from scan 2372"
        author = "sandbox auto-generator"
        anchors = "5 independent regions"
    strings:
        $s0 = "https.get({ host, path: '/', timeout: 5000 }, (res) => {" ascii fullword
        $s1 = "}).on('error', (e) => console.log(host, 'unreachable', e.code));" ascii fullword
        $s2 = "const targets = ['example.com', 'www.iana.org', 'www.rfc-editor.org'];" ascii fullword
        $s3 = "console.log(host, res.statusCode, (Date.now() - started) + 'ms');" ascii fullword
        $s4 = "const started = Date.now();" ascii fullword
    condition:
        filesize < 65536 and all of them
}

Extracted files

What came out of the sample: unpacked payloads, carved objects and captured memory. Each one is stored by content hash, so the same object extracted twice is the same row.

No extracted files

Nothing was unpacked or carved out of this sample. Packed samples, documents with embedded objects and installers are the ones that usually produce artifacts here.

Export & download

/s/2372

ATT&CK Navigator STIX 2.1 MISP IOCs PCAP Get Sample

The report downloads - PCAP and the SIEM/TIP exports - are a paid-plan feature. Sign in with a paid plan to export this report.

AI analysis report

An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).

Public analyses of this file

1 run

Submitted	Environment	Verdict	Score
2026-09-07 21:21 Shown below	Static analysis	Clean	0/100