ORDER-232112.pdf.js

Wscript.exe initiated network communications indicative of a script based payload download (2 events)

Time & API	Arguments	Status	Return	Repeated
InternetCrackUrlW Dec. 14, 2023, 10:25 a.m.	url: https://grapemundo.com/Apk/good.vbs flags: 0	1	1	0
HttpOpenRequestW Dec. 14, 2023, 10:25 a.m.	connect_handle: 0x00cc0008 http_version: flags: 12582912 http_method: GET referer: path: /Apk/good.vbs	1	13369356	0

wscript.exe-based dropper (JScript, VBS) (1 event)

Network communications indicative of a potential document or script payload download was initiated by the process wscript.exe (12 events)

Time & API	Arguments	Status	Return	Repeated
InternetCrackUrlW Dec. 14, 2023, 10:25 a.m.	url: https://grapemundo.com/Apk/good.vbs flags: 0	1	1	0
HttpOpenRequestW Dec. 14, 2023, 10:25 a.m.	connect_handle: 0x00cc0008 http_version: flags: 12582912 http_method: GET referer: path: /Apk/good.vbs	1	13369356	0
send Dec. 14, 2023, 10:25 a.m.	buffer: ! socket: 844 sent: 1	1	1	0
send Dec. 14, 2023, 10:25 a.m.	buffer:  q m ezY‘]´*ûpOKؖ ¼Å½it÷?Âë­8nÜìy×`/5 ÀÀÀ À 28 ,ÿ grapemundo.com  socket: 956 sent: 118	1	118	0
send Dec. 14, 2023, 10:25 a.m.	buffer: ! socket: 844 sent: 1	1	1	0
send Dec. 14, 2023, 10:25 a.m.	buffer: ! socket: 844 sent: 1	1	1	0
send Dec. 14, 2023, 10:25 a.m.	buffer:  q m ezY’–ÿ7i¿ŠPÒ ë¶”Ÿœaúg©HŒ[âÉ%²ð,B/5 ÀÀÀ À 28 ,ÿ grapemundo.com  socket: 956 sent: 118	1	118	0
send Dec. 14, 2023, 10:25 a.m.	buffer: ! socket: 844 sent: 1	1	1	0
send Dec. 14, 2023, 10:25 a.m.	buffer: ! socket: 844 sent: 1	1	1	0
send Dec. 14, 2023, 10:25 a.m.	buffer: 5 1ezY’cøK„Û“ ®*” |€¶Å‚¾óK82õˆ  ÿ socket: 956 sent: 58	1	58	0
send Dec. 14, 2023, 10:25 a.m.	buffer: ! socket: 844 sent: 1	1	1	0
send Dec. 14, 2023, 10:25 a.m.	buffer: ! socket: 844 sent: 1	1	1	0

File has been identified by 24 AntiVirus engines on VirusTotal as malicious (24 events)

Lionic	Trojan.Script.Cryxos.4!c
FireEye	JS:Trojan.Cryxos.10732
Skyhigh	BehavesLike.JS.Nemucod.zx
Symantec	ISB.Downloader!gen60
ESET-NOD32	VBS/TrojanDownloader.Agent.PHZ
Avast	Other:Malware-gen [Trj]
Kaspersky	HEUR:Trojan.Script.Generic
BitDefender	JS:Trojan.Cryxos.10732
NANO-Antivirus	Trojan.Script.Heuristic-js.iacgm
MicroWorld-eScan	JS:Trojan.Cryxos.10732
Sophos	JS/Drop-DHB
VIPRE	JS:Trojan.Cryxos.10732
Emsisoft	JS:Trojan.Cryxos.10732 (B)
Ikarus	Trojan-Downloader.JS.Agent
Varist	URL/Downldr.EA.gen!Eldorado
Microsoft	Trojan:JS/Obfuse
Arcabit	JS:Trojan.Cryxos.D29EC
ZoneAlarm	HEUR:Trojan.Script.Generic
GData	JS:Trojan.Cryxos.10732
Google	Detected
ALYac	JS:Trojan.Cryxos.10732
MAX	malware (ai score=82)
Rising	Downloader.Agent/VBS!8.10EA5 (TOPIS:E0:9kuM9iQ3OWD)
AVG	Other:Malware-gen [Trj]