Malicious Javascript from MYOB Email Attack | VMRay Analyzer Report
Try VMRay Analyzer
| Creation Time | 2017-11-07 20:24 (UTC+1) |
| VM Analysis Duration Time | 00:10:15 |
| Execution Successful |
|
| Sample Filename | MYOB Supply Order.js |
| Command Line Parameters |
|
| Prescript |
|
| Number of Processes | 4 |
| Termination Reason | Timeout |
| Reputation Enabled |
|
| Download | Archive Function Logfile Generic Logfile PCAP STIX/CybOX XML Summary JSON |
|
VTI Score
100 / 100
|
|
| VTI Database Version | 2.6 |
| VTI Rule Match Count | 11 |
| VTI Rule Type | Scripts |
|
The dump total size limit was reached during the analysis. Some memory dump may be missing in the reports. You can increase the limit in the configuration. |
| ID | PID | Monitor Reason | Integrity Level | Image Name | Command Line | Origin ID |
|---|---|---|---|---|---|---|
| #1 | 0x9a8 | Analysis Target | High (Elevated) | cscript.exe | "C:\Windows\System32\CScript.exe" "C:\Users\5P5NRG~1\Desktop\MYOBSU~1.JS" | - |
| #3 | 0xaa8 | Child Process | High (Elevated) | pst790mv.exe | "C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\pST790mv.exe" | #1 |
| #4 | 0x474 | Child Process | High (Elevated) | dllhost.exe | "C:\Windows\system32\dllhost.exe" | #3 |
| #5 | 0x4bc | Child Process | High (Elevated) | dllhost.exe | "C:\Windows\system32\dllhost.exe" | #3 |
| ID | #20109 |
| MD5 Hash Value | a91f4575d5270ccb1257c5328bdadc3a |
| SHA1 Hash Value | 29b7ca174c735c54ea1e1aedbc98517e75f8cead |
| SHA256 Hash Value | 24139566e338de0e3c54fba4668eab701caa9ee7c8853b2ab2e2746277c57857 |
| Filename | MYOB Supply Order.js |
| File Size | 7.15 KB (7318 bytes) |
| File Type | JScript |
| Analyzer Version | 2.2.0 |
| Analyzer Build Date | 2017-10-17 16:08 |
| Internet Explorer Version | 8.0.7601.17514 |
| Chrome Version | 58.0.3029.110 |
| Firefox Version | 25.0 |
| Flash Version | 10.3.183.75 |
| Java Version | 7.0.450 |
| VM Name | win7_64_sp1 |
| VM Architecture | x86 64-bit |
| VM OS | Windows 7 |
| VM Kernel Version | 6.1.7601.17514 (3844dbb9-2017-4967-be7a-a4a2c20430fa) |
