popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
1 2024-07-03 18:27 IEnetCache.hta  

23944bdd42dd1973f4cebc54defbccd0


Generic Malware Antivirus AntiDebug AntiVM PowerShell PE File DLL PE32 .NET DLL VirusTotal Malware powershell suspicious privilege MachineGuid Code Injection Malicious Traffic Check memory Checks debugger Creates shortcut Creates executable files RWX flags setting unpack itself Windows utilities powershell.exe wrote suspicious process AppData folder Windows ComputerName DNS Cryptographic key 		1 1 3 12.0 13 ZeroCERT

2 2024-06-24 11:04 a.hta  

2114cf2cbdbbbdd823bf2bf4db1551c0

Check memory RWX flags setting ComputerName 		2 0.8 ZeroCERT

3 2024-06-09 09:21 wow123.hta  

21164aaeeaaa2a4a6e77798aa82d5c7c


Formbook Generic Malware Antivirus Malicious Library PowerShell PE File DLL PE32 FormBook Browser Info Stealer Malware download VirusTotal Malware powershell suspicious privilege Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut Creates executable files RWX flags setting unpack itself powershell.exe wrote Check virtual network interfaces suspicious process AppData folder WriteConsoleW Windows Browser ComputerName DNS Cryptographic key 		15 17 6 13 13.4 M 27 ZeroCERT

4 2024-06-05 09:26 dion.hta  

24be5183dd56c3d08bae8625fba83aaa


Formbook Gen1 Generic Malware Suspicious_Script_Bin Process Kill Antivirus Malicious Library FindFirstVolume CryptGenKey UPX Malicious Packer PowerShell PE File DLL PE32 Device_File_Check OS Processor Check FormBook Browser Info Stealer Malware download Malware powershell suspicious privilege Malicious Traffic Check memory Checks debugger buffers extracted heapspray Creates shortcut Creates executable files RWX flags setting unpack itself powershell.exe wrote Check virtual network interfaces suspicious process AppData folder WriteConsoleW Windows Browser ComputerName DNS Cryptographic key crashed 		4 4 5 2 13.4 M ZeroCERT

5 2024-06-05 09:18 Quote.hta  

cd5915bac2ea167ddb7bcc2ae9ceab78


Formbook Generic Malware Antivirus Malicious Library PowerShell PE File DLL PE32 FormBook Browser Info Stealer Malware download VirusTotal Malware powershell suspicious privilege Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut Creates executable files RWX flags setting unpack itself powershell.exe wrote Check virtual network interfaces suspicious process AppData folder WriteConsoleW Windows Browser ComputerName DNS Cryptographic key 		16 17 5 14 13.4 M 28 ZeroCERT

6 2024-05-31 10:17 reverse_tcp_uuid.hta  

b177937631436154e4bbf6f577e127ed


Generic Malware Antivirus PowerShell VirusTotal Malware powershell suspicious privilege Check memory Checks debugger Creates shortcut RWX flags setting unpack itself suspicious process Windows ComputerName DNS Cryptographic key 		1 7.4 M 37 ZeroCERT

7 2024-05-31 10:16 bind_tcp.hta  

248aa4289e3739f172987f89212e4093


Generic Malware Antivirus PowerShell VirusTotal Malware powershell suspicious privilege Check memory Checks debugger Creates shortcut RWX flags setting unpack itself powershell.exe wrote suspicious process Windows ComputerName Cryptographic key 		6.0 M 36 ZeroCERT

8 2024-05-31 10:12 bind_tcp_uuid.hta  

bce1078c57268ef42732dc651d2049c9


Generic Malware Antivirus PowerShell VirusTotal Malware powershell suspicious privilege Check memory Checks debugger Creates shortcut RWX flags setting unpack itself powershell.exe wrote suspicious process Windows ComputerName Cryptographic key 		6.0 M 38 ZeroCERT

9 2024-05-30 10:22 logista.hta  

976649b232d3525dd239f7139a65dd92


Generic Malware Antivirus PowerShell VirusTotal Malware powershell suspicious privilege Check memory Checks debugger Creates shortcut unpack itself suspicious process suspicious TLD Windows ComputerName Cryptographic key 		2 5.8 M 36 ZeroCERT

10 2024-05-28 11:40 zxcv.exe  

99de2efc5673d2d9b51f54570e7cf3f2


Antivirus AntiDebug AntiVM MSOffice File Code Injection ICMP traffic RWX flags setting exploit crash unpack itself Windows utilities Tofsee Windows Exploit DNS crashed 		16 1 6.2 M ZeroCERT

11 2024-05-28 09:50 rooming.hta  

5f0dd9ef756c02785e681153c17ee786


Generic Malware Antivirus PowerShell powershell suspicious privilege Check memory Checks debugger Creates shortcut RWX flags setting unpack itself powershell.exe wrote Check virtual network interfaces suspicious process WriteConsoleW Tofsee Windows ComputerName DNS Cryptographic key 		3 3 7.6 M ZeroCERT

12 2024-05-28 09:46 room5.hta  

d3c362ce51282a6583d86fd69a578c89


Generic Malware Antivirus PowerShell powershell suspicious privilege Check memory Checks debugger Creates shortcut RWX flags setting unpack itself powershell.exe wrote Check virtual network interfaces suspicious process WriteConsoleW Tofsee Windows ComputerName DNS Cryptographic key 		1 5 1 8.0 M ZeroCERT

13 2024-05-28 09:32 asdf.exe  

851b09408fb8c6d26d4bba579cc8a8ab


AntiDebug AntiVM MSOffice File Code Injection ICMP traffic RWX flags setting exploit crash unpack itself Windows utilities Tofsee Windows Exploit DNS crashed 		14 2 6.2 M ZeroCERT

14 2024-05-24 09:44 room4.hta  

409f1bada32d81974fd8606be4cbc943


Generic Malware Antivirus Malicious Library PowerShell PE File PE32 DLL FormBook Browser Info Stealer Malware download VirusTotal Malware powershell suspicious privilege Malicious Traffic Check memory Checks debugger buffers extracted Creates shortcut Creates executable files RWX flags setting unpack itself powershell.exe wrote Check virtual network interfaces suspicious process AppData folder WriteConsoleW Windows Browser ComputerName DNS Cryptographic key 		16 17 5 14.6 M 27 ZeroCERT

15 2024-05-23 18:08 1.hta  

a77becccca5571c00ebc9e516fd96ce8


AntiDebug AntiVM MSOffice File VirusTotal Malware Code Injection RWX flags setting exploit crash unpack itself Windows utilities Tofsee Windows Exploit DNS crashed 		2 4.6 25 ZeroCERT

keyword