VBS_f4dfbded8cd4d2a9b6e8b7555da1fb14_php_2019-07-03_21_30.json

[*] MalFamily: ""

[*] MalScore: 0.0

[*] File Name: "VBS_f4dfbded8cd4d2a9b6e8b7555da1fb14.php"
[*] File Size: 90015
[*] File Type: "Zip archive data, at least v2.0 to extract"
[*] SHA256: "7dca6b9cd2ebb88985fd10fe3963eb343da9590cdb17c31307b7ba2905e6c17e"
[*] MD5: "f4dfbded8cd4d2a9b6e8b7555da1fb14"
[*] SHA1: "f556d48ef499796703a2b454cdfccba968c777c2"
[*] SHA512: "00c14d7c5c4e03accf7d80285eee4d8e93b07def31727309b15ea90cc91741242f71395a1729399faf8d8760f61cdc948700492651ab751b1414ab106987396e"
[*] CRC32: "922D3C41"
[*] SSDEEP: "1536:R95Pd0IyTdK7DpjgQ1wkGNRhlTgHPtuDZospNlf95c0PvZG0VWh0rAlVJyQgYQw3:/AEcQ1IbhyvtO5T1K05jwnHv3"

[*] Process Execution: [
    "wscript.exe"
]

[*] Signatures Detected: []

[*] Started Service: []

[*] Executed Commands: []

[*] Mutexes: []

[*] Modified Files: []

[*] Deleted Files: []

[*] Modified Registry Keys: []

[*] Deleted Registry Keys: []

[*] DNS Communications: [
    {
        "type": "A",
        "request": "pouyas.com",
        "answers": []
    }
]

[*] Domains: [
    {
        "ip": "64.37.52.189",
        "domain": "pouyas.com"
    }
]

[*] Network Communication - ICMP: []

[*] Network Communication - HTTP: []

[*] Network Communication - SMTP: []

[*] Network Communication - Hosts: []

[*] Network Communication - IRC: []

[*] Static Analysis: {
    "office": {
        "Metadata": {
            "HasMacros": "No"
        }
    }
}

[*] Resolved APIs: [
    "advapi32.dll.SaferIdentifyLevel",
    "advapi32.dll.SaferComputeTokenFromLevel",
    "advapi32.dll.SaferCloseLevel",
    "ole32.dll.CLSIDFromProgIDEx",
    "ole32.dll.CoGetClassObject",
    "wscript.exe.#1",
    "urlmon.dll.#326",
    "urlmon.dll.#327",
    "shell32.dll.#685",
    "shell32.dll.#688",
    "urlmon.dll.#395",
    "cryptsp.dll.CryptAcquireContextW",
    "cryptsp.dll.CryptGenRandom",
    "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
    "winhttp.dll.WinHttpCheckPlatform",
    "winhttp.dll.WinHttpOpen",
    "winhttp.dll.WinHttpConnect",
    "winhttp.dll.WinHttpOpenRequest",
    "winhttp.dll.WinHttpCloseHandle",
    "winhttp.dll.WinHttpSendRequest",
    "winhttp.dll.WinHttpReceiveResponse",
    "winhttp.dll.WinHttpAddRequestHeaders",
    "winhttp.dll.WinHttpQueryHeaders",
    "winhttp.dll.WinHttpReadData",
    "winhttp.dll.WinHttpWriteData",
    "winhttp.dll.WinHttpQueryDataAvailable",
    "winhttp.dll.WinHttpQueryOption",
    "winhttp.dll.WinHttpSetOption",
    "winhttp.dll.WinHttpSetTimeouts",
    "winhttp.dll.WinHttpCrackUrl",
    "winhttp.dll.WinHttpCreateUrl",
    "oleaut32.dll.#8",
    "oleaut32.dll.#12",
    "shlwapi.dll.StrRChrA",
    "shlwapi.dll.StrCmpNW",
    "oleaut32.dll.#4",
    "oleaut32.dll.#6",
    "kernel32.dll.RegQueryValueExW",
    "oleaut32.dll.#2",
    "kernel32.dll.RegCloseKey",
    "oleaut32.dll.#9",
    "ws2_32.dll.GetAddrInfoW",
    "oleaut32.dll.#202",
    "oleaut32.dll.#201",
    "rpcrt4.dll.RpcBindingFree",
    "oleaut32.dll.#500",
    "cryptsp.dll.CryptReleaseContext"
]

[*] Static Analysis: {
    "office": {
        "Metadata": {
            "HasMacros": "No"
        }
    }
}