ProjectFunding_B496.wsf

File has been identified by 2 AntiVirus engines on VirusTotal as malicious (2 events)

Kaspersky	HEUR:Trojan.Script.Generic
ZoneAlarm	HEUR:Trojan.Script.Generic

Communicates with host for which no DNS query was performed (1 event)

host	193.243.147.185

Wscript.exe initiated network communications indicative of a script based payload download (2 events)

Time & API	Arguments	Status	Return	Repeated
InternetCrackUrlW April 28, 2023, 9:41 a.m.	url: http://193.243.147.185/a8SBzlM9yOU.dat flags: 0	1	1	0
HttpOpenRequestW April 28, 2023, 9:41 a.m.	connect_handle: 0x00cc0008 http_version: flags: 4194304 http_method: GET referer: path: /a8SBzlM9yOU.dat	1	13369356	0

wscript.exe-based dropper (JScript, VBS) (1 event)

Network communications indicative of a potential document or script payload download was initiated by the process wscript.exe (3 events)

Time & API	Arguments	Status	Return	Repeated
InternetCrackUrlW April 28, 2023, 9:41 a.m.	url: http://193.243.147.185/a8SBzlM9yOU.dat flags: 0	1	1	0
HttpOpenRequestW April 28, 2023, 9:41 a.m.	connect_handle: 0x00cc0008 http_version: flags: 4194304 http_method: GET referer: path: /a8SBzlM9yOU.dat	1	13369356	0
send April 28, 2023, 9:41 a.m.	buffer: ! socket: 864 sent: 1	1	1	0

Generates some ICMP traffic

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

193.243.147.185:80