popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

neverban_dWMkPE.vbs

  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Sept. 26, 2023, 6:03 p.m. Sept. 26, 2023, 6:05 p.m.
Size 1.8KB
Type ASCII text, with very long lines, with CRLF line terminators
MD5 1bd0900f5c260ec597662cbcdb396d4a
SHA256 a184fa874e95c0338f6d966d41454b8a6e40c416f5ee710e21362f9af94dcd9e
CRC32 3BB9918C
ssdeep 48:IDKsFeq8Q1O6Z+20CfFENmWLFPR9OaaoYFF6ab:ID7X8WOKiCfuvFPRJqz
Yara None matched

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
66.42.63.27 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Avast Script:SNH-gen [Trj]
Kaspersky HEUR:Trojan.Script.Generic
ZoneAlarm HEUR:Trojan.Script.Generic
Fortinet VBS/Agent.SJR!tr.dldr
AVG Script:SNH-gen [Trj]
host 66.42.63.27
Time & API Arguments Status Return Repeated

WSASend

 buffer: POST /znemsbyy HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Content-Length: 0 Host: 66.42.63.27:2351
socket: 500
0 0
Time & API Arguments Status Return Repeated

WSASend

 buffer: POST /znemsbyy HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Content-Length: 0 Host: 66.42.63.27:2351
socket: 500
0 0