IMAGE-16867_14973-705081660-T05-01569125_vbs_2019-07-03_21_30.json

[*] MalFamily: "Malscript"

[*] MalScore: 1.5

[*] File Name: "IMAGE-16867_14973-705081660-T05-01569125.vbs"
[*] File Size: 135999
[*] File Type: "ASCII text, with very long lines"
[*] SHA256: "b8c2be5fb530d1d029fb8cd0da743517e4f3fa1b270e27d29494b9ab1770ee9f"
[*] MD5: "2d3e368930fe11bed5e8d74230f64b3c"
[*] SHA1: "8eeed09c3da633c75949ad0db659d6eef143a3db"
[*] SHA512: "9e0f76e6f51657f06184f9e7cb55702200fdd65d937825a08206531d7b0e7f40f7b3af274e8fbc4c0826e3f7186674be490d962c3bbd49530bd6101c72bc6019"
[*] CRC32: "D331A27E"
[*] SSDEEP: "1536:AN003xMR8GSoSsj85euQbYHQtIcN3EZkYNQNbZyUaI8r4Z:mRxMR8OjKeuPcN3EOYNQOUlh"

[*] Process Execution: [
    "wscript.exe"
]

[*] Signatures Detected: [
    {
        "Description": "File has been identified by 6 Antiviruses on VirusTotal as malicious",
        "Details": [
            {
                "ESET-NOD32": "VBS/TrojanDownloader.Agent.ROR"
            },
            {
                "DrWeb": "Trojan.DownLoader29.17766"
            },
            {
                "Microsoft": "Trojan:VBS/Malscript"
            },
            {
                "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
            },
            {
                "Ikarus": "Win32.Outbreak"
            },
            {
                "Qihoo-360": "virus.vbs.crypt.c"
            }
        ]
    }
]

[*] Started Service: []

[*] Executed Commands: []

[*] Mutexes: []

[*] Modified Files: [
    "C:\\Users\\user\\AppData\\Local\\Temp\\TableOfColors.exe"
]

[*] Deleted Files: []

[*] Modified Registry Keys: []

[*] Deleted Registry Keys: []

[*] DNS Communications: [
    {
        "type": "A",
        "request": "artweekportland.com",
        "answers": []
    }
]

[*] Domains: [
    {
        "ip": "",
        "domain": "artweekportland.com"
    }
]

[*] Network Communication - ICMP: []

[*] Network Communication - HTTP: []

[*] Network Communication - SMTP: []

[*] Network Communication - Hosts: []

[*] Network Communication - IRC: []

[*] Static Analysis: {}

[*] Resolved APIs: [
    "advapi32.dll.SaferIdentifyLevel",
    "advapi32.dll.SaferComputeTokenFromLevel",
    "advapi32.dll.SaferCloseLevel",
    "kernel32.dll.NlsGetCacheUpdateCount",
    "ole32.dll.CLSIDFromProgIDEx",
    "ole32.dll.CoGetClassObject",
    "cryptsp.dll.CryptAcquireContextW",
    "cryptsp.dll.CryptGenRandom",
    "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
    "wscript.exe.#1",
    "sxs.dll.SxsOleAut32RedirectTypeLibrary",
    "advapi32.dll.RegOpenKeyW",
    "advapi32.dll.RegQueryValueW",
    "winhttp.dll.WinHttpCrackUrl",
    "shlwapi.dll.StrCmpNW",
    "winhttp.dll.WinHttpCreateUrl",
    "oleaut32.dll.#8",
    "oleaut32.dll.#12",
    "shlwapi.dll.StrRChrA",
    "oleaut32.dll.#4",
    "oleaut32.dll.#6",
    "kernel32.dll.RegQueryValueExW",
    "oleaut32.dll.#2",
    "kernel32.dll.RegCloseKey",
    "oleaut32.dll.#9",
    "ws2_32.dll.GetAddrInfoW",
    "oleaut32.dll.#202",
    "oleaut32.dll.#201",
    "sspicli.dll.GetUserNameExW",
    "xmllite.dll.CreateXmlWriter",
    "xmllite.dll.CreateXmlWriterOutputWithEncodingName",
    "rpcrt4.dll.RpcBindingFree",
    "oleaut32.dll.#500",
    "cryptsp.dll.CryptReleaseContext"
]

[*] Static Analysis: {}