Benign Download

91/06/9106409fcb44fda29b987a095ad69051827b6dc218082a5fd2036a9bcf6a3bcc

Composite catalog lists alternative rulesComposite catalog requires rule references
SHA-2569106409fcb44fda29b987a095ad69051827b6dc218082a5fd2036a9bcf6a3bcc
MaleculeH(F)Md

Evidence

Top-level traits or composite_rules key lines 1–16
1:34… rns
2defaults:
3 platforms: [unix, windows]
4 for: [javascript]
5
6traits:
7- id: jscript-savetofile-adodb-table
8 desc: JScript SaveToFile and ADODB string table
9 crit: suspicious
10 conf: 0.98
11 attack: T1105
⋯5 lines
chmod adds executable permissions lines 238–249
238:49… le
239 crit: notable
240 conf: 0.9
241 if:
242 type: text
243 substr: chmod +x ${filePath}
244- id: js-exec-filepath-call
245 desc: JavaScript executes payload variable
⋯4 lines
Data-access verb token lines 304–305
304:43… ::powershell-app-paths-registry-read
305 - id: micro-behaviors/os/env/read::wsh-expand-environment-str …
English edit-action verb token lines 554–556
554:3… any:
555 - id: micro-behaviors/fs/delete/file/library::fs-rmSync
556 - id: micro-behaviors/fs/delete/file/ …
Secret-data term token lines 595–597
595:9… metadata/package/testing/
596- id: secret-header-staged-json-dropper
597 desc: Header-gated staged JSON pay …

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.