VBS_30368aacf7b9de251b9ece6dd71f468c_php_2019-07-03_17_30.json

[*] MalFamily: ""

[*] MalScore: 0.0

[*] File Name: "VBS_30368aacf7b9de251b9ece6dd71f468c.php"
[*] File Size: 97524
[*] File Type: "Zip archive data, at least v2.0 to extract"
[*] SHA256: "af4cf79f330aa0981f1133617508ed8b0831919c7d6bb1a790a09ee4d6c3c38e"
[*] MD5: "30368aacf7b9de251b9ece6dd71f468c"
[*] SHA1: "bcc21f4878744caaea910f63c3b5ef329ae40e2c"
[*] SHA512: "c70995077ec604b80aba2d72e834756c198f8b36fa31ef18c3f9619efdbcacae6c02e7f53c2e5770fb8260e87daf86dbe3652e68462e0001e2adabcf55bcaaec"
[*] CRC32: "E39687C3"
[*] SSDEEP: "1536:UmvLxRPzvet75CXAsfblDYSeYc3fAxJrGam8rpyYEyx9r8y7pzm2sYq7OjiuC9bz:UkxRLveB5kDblccrGXu98y7HsmXC9bau"

[*] Process Execution: [
    "wscript.exe"
]

[*] Signatures Detected: []

[*] Started Service: []

[*] Executed Commands: []

[*] Mutexes: []

[*] Modified Files: []

[*] Deleted Files: []

[*] Modified Registry Keys: []

[*] Deleted Registry Keys: []

[*] DNS Communications: [
    {
        "type": "A",
        "request": "pouyas.com",
        "answers": []
    }
]

[*] Domains: [
    {
        "ip": "64.37.52.189",
        "domain": "pouyas.com"
    }
]

[*] Network Communication - ICMP: []

[*] Network Communication - HTTP: []

[*] Network Communication - SMTP: []

[*] Network Communication - Hosts: []

[*] Network Communication - IRC: []

[*] Static Analysis: {
    "office": {
        "Metadata": {
            "HasMacros": "No"
        }
    }
}

[*] Resolved APIs: [
    "advapi32.dll.SaferIdentifyLevel",
    "advapi32.dll.SaferComputeTokenFromLevel",
    "advapi32.dll.SaferCloseLevel",
    "ole32.dll.CLSIDFromProgIDEx",
    "ole32.dll.CoGetClassObject",
    "wscript.exe.#1",
    "urlmon.dll.#326",
    "urlmon.dll.#327",
    "shell32.dll.#685",
    "shell32.dll.#688",
    "urlmon.dll.#395",
    "cryptsp.dll.CryptAcquireContextW",
    "cryptsp.dll.CryptGenRandom",
    "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
    "winhttp.dll.WinHttpCheckPlatform",
    "winhttp.dll.WinHttpOpen",
    "winhttp.dll.WinHttpConnect",
    "winhttp.dll.WinHttpOpenRequest",
    "winhttp.dll.WinHttpCloseHandle",
    "winhttp.dll.WinHttpSendRequest",
    "winhttp.dll.WinHttpReceiveResponse",
    "winhttp.dll.WinHttpAddRequestHeaders",
    "winhttp.dll.WinHttpQueryHeaders",
    "winhttp.dll.WinHttpReadData",
    "winhttp.dll.WinHttpWriteData",
    "winhttp.dll.WinHttpQueryDataAvailable",
    "winhttp.dll.WinHttpQueryOption",
    "winhttp.dll.WinHttpSetOption",
    "winhttp.dll.WinHttpSetTimeouts",
    "winhttp.dll.WinHttpCrackUrl",
    "winhttp.dll.WinHttpCreateUrl",
    "oleaut32.dll.#8",
    "oleaut32.dll.#12",
    "shlwapi.dll.StrRChrA",
    "shlwapi.dll.StrCmpNW",
    "oleaut32.dll.#4",
    "oleaut32.dll.#6",
    "kernel32.dll.RegQueryValueExW",
    "oleaut32.dll.#2",
    "kernel32.dll.RegCloseKey",
    "oleaut32.dll.#9",
    "ws2_32.dll.GetAddrInfoW",
    "oleaut32.dll.#202",
    "oleaut32.dll.#201",
    "rpcrt4.dll.RpcBindingFree",
    "oleaut32.dll.#500",
    "cryptsp.dll.CryptReleaseContext"
]

[*] Static Analysis: {
    "office": {
        "Metadata": {
            "HasMacros": "No"
        }
    }
}