ORDER-23116FC.pdf.js

Wscript.exe initiated network communications indicative of a script based payload download (2 events)

Time & API	Arguments	Status	Return	Repeated
InternetCrackUrlW Nov. 8, 2023, 9:37 a.m.	url: https://grapemundo.com/Apk/work.vbs flags: 0	1	1	0
HttpOpenRequestW Nov. 8, 2023, 9:37 a.m.	connect_handle: 0x00cc0008 http_version: flags: 12582912 http_method: GET referer: path: /Apk/work.vbs	1	13369356	0

wscript.exe-based dropper (JScript, VBS) (1 event)

Network communications indicative of a potential document or script payload download was initiated by the process wscript.exe (12 events)

Time & API	Arguments	Status	Return	Repeated
InternetCrackUrlW Nov. 8, 2023, 9:37 a.m.	url: https://grapemundo.com/Apk/work.vbs flags: 0	1	1	0
HttpOpenRequestW Nov. 8, 2023, 9:37 a.m.	connect_handle: 0x00cc0008 http_version: flags: 12582912 http_method: GET referer: path: /Apk/work.vbs	1	13369356	0
send Nov. 8, 2023, 9:37 a.m.	buffer: ! socket: 844 sent: 1	1	1	0
send Nov. 8, 2023, 9:37 a.m.	buffer:  q m eJØ7]´*ûpOKؖ ¼Å½it÷?Âë­8nÜìy×`/5 ÀÀÀ À 28 ,ÿ grapemundo.com  socket: 956 sent: 118	1	118	0
send Nov. 8, 2023, 9:37 a.m.	buffer: ! socket: 844 sent: 1	1	1	0
send Nov. 8, 2023, 9:37 a.m.	buffer: ! socket: 844 sent: 1	1	1	0
send Nov. 8, 2023, 9:37 a.m.	buffer:  q m eJØ7–ÿ7i¿ŠPÒ ë¶”Ÿœaúg©HŒ[âÉ%²ð,B/5 ÀÀÀ À 28 ,ÿ grapemundo.com  socket: 956 sent: 118	1	118	0
send Nov. 8, 2023, 9:37 a.m.	buffer: ! socket: 844 sent: 1	1	1	0
send Nov. 8, 2023, 9:37 a.m.	buffer: ! socket: 844 sent: 1	1	1	0
send Nov. 8, 2023, 9:37 a.m.	buffer: 5 1eJØ8cøK„Û“ ®*” |€¶Å‚¾óK82õˆ  ÿ socket: 956 sent: 58	1	58	0
send Nov. 8, 2023, 9:37 a.m.	buffer: ! socket: 844 sent: 1	1	1	0
send Nov. 8, 2023, 9:37 a.m.	buffer: ! socket: 844 sent: 1	1	1	0

File has been identified by 20 AntiVirus engines on VirusTotal as malicious (20 events)

FireEye	JS:Trojan.Cryxos.10732
Skyhigh	BehavesLike.JS.Downloader.zx
VIPRE	JS:Trojan.Cryxos.10732
Symantec	ISB.Downloader!gen60
Kaspersky	HEUR:Trojan.Script.Generic
BitDefender	JS:Trojan.Cryxos.10732
NANO-Antivirus	Trojan.Script.Heuristic-js.iacgm
MicroWorld-eScan	JS:Trojan.Cryxos.10732
Rising	Downloader.Agent/VBS!8.10EA5 (TOPIS:E0:9kuM9iQ3OWD)
Sophos	JS/Drop-DHB
Emsisoft	JS:Trojan.Cryxos.10732 (B)
GData	JS:Trojan.Cryxos.10732
Varist	URL/Downldr.EA.gen!Eldorado
MAX	malware (ai score=88)
Arcabit	JS:Trojan.Cryxos.D29EC
ZoneAlarm	HEUR:Trojan.Script.Generic
Microsoft	Trojan:Script/Wacatac.B!ml
Google	Detected
ALYac	JS:Trojan.Cryxos.10732
Ikarus	Trojan-Downloader.JS.Agent