File name:

1a943ac0fae975a237546e7d5c024dbc_Fattura_09547.pdf.js

Full analysis: https://app.any.run/tasks/5c458a0d-f5d9-4b53-8135-66bcb7960b37
Verdict: Malicious activity
Analysis date: October 28, 2025, 01:39:55
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines (8375), with CRLF line terminators
MD5:

1A943AC0FAE975A237546E7D5C024DBC

SHA1:

FCD4D66B9DE7004DD0A76D2DA2A15C60D49E65A5

SHA256:

A4A09FDE6D8222005BA1918EF17B237080DD59C5820CB3D0F93753772F69633D

SSDEEP:

192:V3Kay0K9kETDFRkhfGjy046brVAqGTx5gv8/GE3V35weSu:bG9kIifG+36PTGoMweSu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Accesses environment variables (SCRIPT)

      • wscript.exe (PID: 7376)
      • wscript.exe (PID: 7436)

    • Gets TEMP folder path (SCRIPT)

      • wscript.exe (PID: 7376)
      • wscript.exe (PID: 7436)

    • Uses base64 encoding (SCRIPT)

      • wscript.exe (PID: 7376)

    • Sends HTTP request (SCRIPT)

      • wscript.exe (PID: 7436)

    • Creates internet connection object (SCRIPT)

      • wscript.exe (PID: 7436)

    • Opens an HTTP connection (SCRIPT)

      • wscript.exe (PID: 7436)

  • SUSPICIOUS

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 7376)

    • Creates XML DOM element (SCRIPT)

      • wscript.exe (PID: 7376)

    • Script creates XML DOM node (SCRIPT)

      • wscript.exe (PID: 7376)

    • Sets XML DOM element text (SCRIPT)

      • wscript.exe (PID: 7376)

    • Application launched itself

      • wscript.exe (PID: 7376)

    • Creates a Stream, which may work with files, input/output devices, pipes, or TCP/IP sockets (SCRIPT)

      • wscript.exe (PID: 7376)

    • Saves data to a binary file (SCRIPT)

      • wscript.exe (PID: 7376)

    • Writes binary data to a Stream object (SCRIPT)

      • wscript.exe (PID: 7376)

    • Adds, changes, or deletes HTTP request header (SCRIPT)

      • wscript.exe (PID: 7436)

    • The process executes JS scripts

      • wscript.exe (PID: 7376)

  • INFO

    • Checks proxy server information

      • wscript.exe (PID: 7436)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wscript.exe no specs wscript.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
6492C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7376"C:\Windows\System32\WScript.exe" C:\Users\admin\AppData\Local\Temp\1a943ac0fae975a237546e7d5c024dbc_Fattura_09547.pdf.jsC:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7436"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\65846600.js" C:\Windows\System32\wscript.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
5 090
Read events
5 069
Write events
21
Delete events
0

Modification events

(PID) Process:(7436) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7436) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7436) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7376) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.js\OpenWithProgids
Operation:writeName:JSFile
Value:
(PID) Process:(7376) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(7376) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(7376) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(7376) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(7376) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wscript.exe
Operation:writeName:JScriptSetScriptStateStarted
Value:
3EBA0F0000000000
(PID) Process:(7436) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
0
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
7376wscript.exeC:\Users\admin\AppData\Local\Temp\65846600.jstext
MD5:F46A3C0FE44C290DE688E8AE111EC24C
SHA256:0DF345A7FDD61B2840FB70C4098C7279409F26CE70F9761546FC7A0BFB02445E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
22
DNS requests
20
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
8036
SIHClient.exe
GET
200
104.119.109.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.3.crl
unknown
—
—
whitelisted
8036
SIHClient.exe
GET
200
104.119.109.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.3.crl
unknown
—
—
whitelisted
6904
svchost.exe
GET
200
23.63.118.230:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7436
wscript.exe
POST
404
13.223.25.84:80
http://wellnessherbal.com/wp-content/themes/tiny-framework/redir.php
unknown
—
—
malicious
7436
wscript.exe
POST
404
13.223.25.84:80
http://wellnessherbal.com/wp-content/themes/tiny-framework/redir.php
unknown
—
—
malicious
7436
wscript.exe
POST
301
34.174.132.180:80
http://cbctupay.com/redir.php
unknown
—
—
malicious
7436
wscript.exe
POST
301
34.174.132.180:80
http://cbctupay.com/redir.php
unknown
—
—
malicious
7436
wscript.exe
POST
301
34.174.132.180:80
http://cbctupay.com/redir.php
unknown
—
—
malicious
7436
wscript.exe
POST
301
34.174.132.180:80
http://cbctupay.com/redir.php
unknown
—
—
malicious
8036
SIHClient.exe
GET
200
104.119.109.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
3420
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5596
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6764
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7436
wscript.exe
13.223.25.84:80
wellnessherbal.com
—
US
malicious
7436
wscript.exe
34.174.132.180:80
cbctupay.com
GOOGLE-CLOUD-PLATFORM
US
malicious
3420
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6904
svchost.exe
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6904
svchost.exe
23.63.118.230:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
  • 20.73.194.208
whitelisted
google.com
  • 172.217.18.14
whitelisted
wellnessherbal.com
  • 13.223.25.84
  • 54.243.117.197
unknown
cbctupay.com
  • 34.174.132.180
malicious
maxmsp.org
  • —
unknown
www.helloimkelly.com
  • —
unknown
penn-stop.com
  • —
unknown
jlinksms.com
  • —
unknown
login.live.com
  • 20.190.159.0
  • 20.190.159.128
  • 40.126.31.130
  • 40.126.31.67
  • 20.190.159.73
  • 20.190.159.4
  • 40.126.31.128
  • 20.190.159.23
whitelisted
ocsp.digicert.com
  • 23.63.118.230
whitelisted

Threats

PID
Process
Class
Message
7436
wscript.exe
Potentially Bad Traffic
ET INFO HTTP POST to WP Theme Directory Without Referer
7436
wscript.exe
Misc activity
ET INFO Observed UA-CPU Header
7436
wscript.exe
Potentially Bad Traffic
ET INFO HTTP POST to WP Theme Directory Without Referer
7436
wscript.exe
A Network Trojan was detected
ET MALWARE JS/Nemucod.M.gen requesting EXE payload 2015-11-02
7436
wscript.exe
A Network Trojan was detected
ET MALWARE JS/Nemucod.M.gen requesting EXE payload 2015-11-02
7436
wscript.exe
A Network Trojan was detected
ET MALWARE JS/Nemucod.M.gen requesting EXE payload 2015-11-02
7436
wscript.exe
A Network Trojan was detected
ET MALWARE JS/Nemucod.M.gen requesting PDF payload 2015-11-02
7436
wscript.exe
A Network Trojan was detected
ET MALWARE JS/Nemucod.M.gen requesting PDF payload 2015-11-02
7436
wscript.exe
A Network Trojan was detected
ET MALWARE JS/Nemucod.M.gen requesting PDF payload 2015-11-02
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
1a943ac0fae975a237546e7d5c024dbc_Fattura_09547.pdf.js