Zips_1071d0f6bfdfde66479de4e62cdce6e9_php_2019-07-03_17_30.json

[*] MalFamily: ""

[*] MalScore: 0.0

[*] File Name: "Zips_1071d0f6bfdfde66479de4e62cdce6e9.php"
[*] File Size: 72091
[*] File Type: "Zip archive data, at least v2.0 to extract"
[*] SHA256: "04099eacad34546cc7e162b66989b881bb4d07c3591d1d30899aa19fb86f96e1"
[*] MD5: "1071d0f6bfdfde66479de4e62cdce6e9"
[*] SHA1: "f9d16998ad2dc6741f23281be41da5a19e5c7e28"
[*] SHA512: "50b4684b787ca567dc8aaa8e14a852bf4c84b1ace2d726bd0efc6c1646d07f7a1d0849b1e73ebb583bc2db2988c0c42d7ee40e1d460bb7ec2595df900b2f80f0"
[*] CRC32: "2E85E736"
[*] SSDEEP: "1536:jjzwA2rRAMlgwmH5FzQ8we/ZRfpKYE0M7AFD3Kl+M4a1ybP4HEv+6NnjW7WQK:jjM+HMejhKYELMKlISy/GEnjW7Wf"

[*] Process Execution: [
    "wscript.exe"
]

[*] Signatures Detected: []

[*] Started Service: []

[*] Executed Commands: []

[*] Mutexes: []

[*] Modified Files: []

[*] Deleted Files: []

[*] Modified Registry Keys: []

[*] Deleted Registry Keys: []

[*] DNS Communications: [
    {
        "type": "A",
        "request": "pouyas.com",
        "answers": []
    }
]

[*] Domains: [
    {
        "ip": "64.37.52.189",
        "domain": "pouyas.com"
    }
]

[*] Network Communication - ICMP: []

[*] Network Communication - HTTP: []

[*] Network Communication - SMTP: []

[*] Network Communication - Hosts: []

[*] Network Communication - IRC: []

[*] Static Analysis: {
    "office": {
        "Metadata": {
            "HasMacros": "No"
        }
    }
}

[*] Resolved APIs: [
    "advapi32.dll.SaferIdentifyLevel",
    "advapi32.dll.SaferComputeTokenFromLevel",
    "advapi32.dll.SaferCloseLevel",
    "ole32.dll.CLSIDFromProgIDEx",
    "ole32.dll.CoGetClassObject",
    "wscript.exe.#1",
    "urlmon.dll.#326",
    "urlmon.dll.#327",
    "shell32.dll.#685",
    "shell32.dll.#688",
    "urlmon.dll.#395",
    "cryptsp.dll.CryptAcquireContextW",
    "cryptsp.dll.CryptGenRandom",
    "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
    "winhttp.dll.WinHttpCheckPlatform",
    "winhttp.dll.WinHttpOpen",
    "winhttp.dll.WinHttpConnect",
    "winhttp.dll.WinHttpOpenRequest",
    "winhttp.dll.WinHttpCloseHandle",
    "winhttp.dll.WinHttpSendRequest",
    "winhttp.dll.WinHttpReceiveResponse",
    "winhttp.dll.WinHttpAddRequestHeaders",
    "winhttp.dll.WinHttpQueryHeaders",
    "winhttp.dll.WinHttpReadData",
    "winhttp.dll.WinHttpWriteData",
    "winhttp.dll.WinHttpQueryDataAvailable",
    "winhttp.dll.WinHttpQueryOption",
    "winhttp.dll.WinHttpSetOption",
    "winhttp.dll.WinHttpSetTimeouts",
    "winhttp.dll.WinHttpCrackUrl",
    "winhttp.dll.WinHttpCreateUrl",
    "oleaut32.dll.#8",
    "oleaut32.dll.#12",
    "shlwapi.dll.StrRChrA",
    "shlwapi.dll.StrCmpNW",
    "oleaut32.dll.#4",
    "oleaut32.dll.#6",
    "kernel32.dll.RegQueryValueExW",
    "oleaut32.dll.#2",
    "kernel32.dll.RegCloseKey",
    "oleaut32.dll.#9",
    "ws2_32.dll.GetAddrInfoW",
    "oleaut32.dll.#202",
    "oleaut32.dll.#201",
    "rpcrt4.dll.RpcBindingFree",
    "oleaut32.dll.#500",
    "cryptsp.dll.CryptReleaseContext"
]

[*] Static Analysis: {
    "office": {
        "Metadata": {
            "HasMacros": "No"
        }
    }
}