ScreenShot
| Created | 2023.04.12 11:37 | Machine | s1_win7_x6402 |
| Filename | jRuiQlItEQ.JS | ||
| Type | UTF-8 Unicode text, with very long lines, with CRLF line terminators | ||
| AI Score | Not founds | Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | |||
| md5 | 6c5a8e4d9ba2f4ccb0ae3444473b3353 | ||
| sha256 | 07686c57e4a71462dbb2a91377c2ee7cd22a2f11c66c78188f8ccbff6fad78fd | ||
| ssdeep | 192:BgFqgFqgFqgFqgFqgFqgFqgFqgFqgFqgFqgF0mmmmmmmmmmm6gFqgFqgFqgFqgFa:Keqsv | ||
| imphash | |||
| impfuzzy | |||
Network IP location
Signature (6cnts)
| Level | Description |
|---|---|
| danger | The process wscript.exe wrote an executable file to disk which it then attempted to execute |
| danger | Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) |
| watch | One or more non-whitelisted processes were created |
| watch | Uses suspicious command line tools or Windows utilities |
| notice | A process created a hidden window |
| info | Command line console output was observed |
Rules (0cnts)
| Level | Name | Description | Collection |
|---|
