zxcvbn.js
This report is generated from a file or URL submitted to this webservice on October 8th 2018 11:25:46 (UTC) and action script Heavy Anti-Evasion
Guest System: Windows 7 32 bit, Home Premium, 6.1 (build 7601), Service Pack 1
Report generated by
Falcon Sandbox v8.20 © Hybrid Analysis
Additional Context
Related Sandbox Artifacts
Indicators
Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.
-
Malicious Indicators 1
-
Pattern Matching
-
YARA signature match
- details
-
YARA signature "ScarhiknStrings" classified file "all.bstring" as "scarhikn" based on indicators: "haha123" (Author: Seth Hardy)
YARA signature "ScarhiknStrings" classified file "zxcvbn.js.bin" as "scarhikn" based on indicators: "haha123" (Author: Seth Hardy) - source
- YARA Signature
- relevance
- 10/10
-
YARA signature match
-
Suspicious Indicators 2
-
Anti-Reverse Engineering
-
Possibly checks for known debuggers/analysis tools
- details
-
"bs,osaka,delays,judged,statutory,colt,col.,offspring,solving,bred,assisting,retains,somalia,grouped,corresponds,tunisia,chaplain,eminent,chord,22nd,spans,viral,innovations,possessions,mikhail,kolkata,icelandic,implications,introduces,racism,workforce,alto,compulsory,admits,censorship,onset,reluctant,inferior,iconic,progression,liability,turnout,satellites,behavioral,coordinated,exploitation,posterior,averaging,fringe,krakow,mountainous,greenwich,para,plantations,reinforcements,offerings,famed,intervals,constraints,individually,nutrition,1870s,taxation,threshold,tomatoes,fungi,contractor,ethiopian,apprentice,diabetes,wool,gujarat,honduras,norse,bucharest,23rd,arguably,accompany,prone,teammates,perennial,vacancy,polytechnic,deficit,okinawa,functionality,reminiscent,tolerance,transferring,myanmar,concludes,neighbours,hydraulic,economically,slower,plots,charities,synod,investor,catholicism,identifies,bronx,interpretations,adverse,judiciary,hereditary,nominal,sensor,symmetry,cubic,triangular,tenants,divisional,out" (Indicator: "ntice")
"luton,caretaker,nobleman,mutiny,organizer,preferences,nomenclature,splits,unwilling,offenders,timor,relying,halftime,semitic,arithmetic,milestone,jesuits,arctiidae,retrieved,consuming,contender,edged,plagued,inclusive,transforming,khmer,federally,insurgents,distributing,amherst,rendition,prosecutors,viaduct,disqualified,kabul,liturgy,prevailed,reelected,instructors,swimmers,aperture,churchyard,interventions,totals,darts,metropolis,fuels,fluent,northbound,correctional,inflicted,barrister,realms,culturally,aristocratic,collaborating,emphasizes,choreographer,inputs,ensembles,humboldt,practised,endowed,strains,infringement,archaeologist,congregational,magna,relativity,efficiently,proliferation,mixtape,abruptly,regeneration,commissioning,yukon,archaic,reluctantly,retailer,northamptonshire,universally,crossings,boilers,nickelodeon,revue,abbreviation,retaliation,scripture,routinely,medicinal,benedictine,kenyan,retention,deteriorated,glaciers,apprenticeship,coupling,researched,topography,entrances,anaheim,pivotal,com" (Indicator: "ntice")
"d,inspectors,unicef,commuters,embryo,modifying,stints,numerals,communicated,boosted,trumpeter,brightly,adherence,remade,leases,restrained,eucalyptus,dwellers,planar,grooves,gainesville,daimler,anzac,szczecin,cornerback,prized,peking,mauritania,khalifa,motorized,lodging,instrumentalist,fortresses,cervical,formula_15,passerine,sectarian,researches,apprenticed,reliefs,disclose,gliding,repairing,queue,kyushu,literate,canoeing,sacrament,separatist,calabria,parkland,flowed,investigates,statistically,visionary,commits,dragoons,scrolls,premieres,revisited,subdued,censored,patterned,elective,outlawed,orphaned,leyland,richly,fujian,miniatures,heresy,plaques,countered,nonfiction,exponent,moravia,dispersion,marylebone,midwestern,enclave,ithaca,federated,electronically,handheld,microscopy,tolls,arrivals,climbers,continual,cossacks,moselle,deserts,ubiquitous,gables,forecasts,deforestation,vertebrates,flanking,drilled,superstructure,inspected,consultative,bypassed,ballast,subsidy,socioeconomic,relic,grenada,journalistic,adm" (Indicator: "ntice")
"s,predicate,seabirds,deduced,pseudonyms,gopal,plovdiv,refineries,imitated,kwazulu,terracotta,tenets,discourses,brandeis,whigs,dominions,pulmonate,landslides,tutors,determinant,richelieu,farmstead,tubercles,technicolor,hegel,redundancy,greenpeace,shortening,mules,distilled,xxiii,fundamentalist,acrylic,outbuildings,lighted,corals,signaled,transistors,cavite,austerity,76ers,exposures,dionysius,outlining,commutative,permissible,knowledgeable,howrah,assemblage,inhibited,crewmen,mbit/s,pyramidal,aberdeenshire,bering,rotates,atheism,howitzer,saone,lancet,fermented,contradicted,materiel,ofsted,numeric,uniformity,josephus,nazarene,kuwaiti,noblemen,pediment,emergent,campaigner,akademi,murcia,perugia,gallen,allsvenskan,finned,cavities,matriculation,rosters,twickenham,signatory,propel,readable,contends,artisan,flamboyant,reggio,italo,fumbles,widescreen,rectangle,centimetres,collaborates,envoys,rijeka,phonological,thinly,refractive,civilisation,reductase,cognate,dalhousie,monticello,lighthouses,jitsu,luneburg,socialite,fe" (Indicator: "ntice")
",louth,constitutionally,transitive,newington,facelift,degeneration,perceptual,aviators,enclosing,igneous,symbolically,academician,constitutionality,iso/iec,sacrificial,maturation,apprentices,enzymology,naturalistic,hajji,arthropods,abbess,vistula,scuttled,gradients,pentathlon,etudes,freedmen,melaleuca,thrice,conductive,sackville,franciscans,stricter,golds,kites,worshiped,monsignor,trios,orally,tiered,primacy,bodywork,castleford,epidemics,alveolar,chapelle,chemists,hillsboro,soulful,warlords,ngati,huguenot,diurnal,remarking,luger,motorways,gauss,jahan,cutoff,proximal,bandai,catchphrase,jonubi,ossetia,codename,codice_2,throated,itinerant,chechnya,riverfront,leela,evoked,entailed,zamboanga,rejoining,circuitry,haymarket,khartoum,feuds,braced,miyazaki,mirren,lubusz,caricature,buttresses,attrition,characterizes,widnes,evanston,materialism,contradictions,marist,midrash,gainsborough,ulithi,turkmen,vidya,escuela,patrician,inspirations,reagent,premierships,humanistic,euphrates,transitioning,belfry,zedong,adaption,kalin" (Indicator: "ntice")
"nts,u.s..,internationalization,satirized,carers,attainable,wraparound,muang,parkersburg,extinctions,birkenfeld,wildstorm,payers,cohabitation,unitas,culloden,capitalizing,clwyd,daoist,campinas,emmylou,orchidaceae,halakha,orientales,fealty,domnall,chiefdom,nigerians,ladislav,dniester,avowed,ergonomics,newsmagazine,kitsch,cantilevered,benchmarking,remarriage,alekhine,coldfield,taupo,almirante,substations,apprenticeships,seljuq,levelling,eponym,symbolising,salyut,opioids,underscore,ethnologue,mohegan,marikina,libro,bassano,parse,semantically,disjointed,dugdale,padraig,tulsi,modulating,xfinity,headlands,mstislav,earthworms,bourchier,lgbtq,embellishments,pennants,rowntree,betel,motet,mulla,catenary,washoe,mordaunt,dorking,colmar,girardeau,glentoran,grammatically,samad,recreations,technion,staccato,mikoyan,spoilers,lyndhurst,victimization,chertsey,belafonte,tondo,tonsberg,narrators,subcultures,malformations,edina,augmenting,attests,euphemia,cabriolet,disguising,1650s,navarrese,demoralized,cardiomyopathy,welwyn,walla" (Indicator: "ntice")
"tzsimmons,fahey,cranford,bolen,battles,battaglia,wooldridge,trask,rosser,regalado,mcewen,keefe,fuqua,echevarria,caro,boynton,andrus,viera,vanmeter,taber,spradlin,seibert,provost,prentice,oliphant,laporte,hwang,hatchett,hass,greiner,freedman,covert,chilton,byars,wiese,venegas,swank,shrader,roberge,mullis,mortensen,mccune,marlowe,kirchner,keck,isaacson,hostetler,halverson,gunther,griswold,fenner,durden,blackwood,ahrens,sawyers,savoy,nabors,mcswain,mackay,lavender,lash,labbe,jessup,fullerton,cruse,crittenden,correia,centeno,caudle,canady,callender,alarcon,ahern,winfrey,tribble,salley,roden,musgrove,minnick,fortenberry,carrion,bunting,batiste,whited,underhill,stillwell,rauch,pippin,perrin,messenger,mancini,lister,kinard,hartmann,fleck,wilt,treadway,thornhill,spalding,rafferty,pitre,patino,ordonez,linkous,kelleher,homan,galbraith,feeney,curtin,coward,camarillo,buss,bunnell,bolt,beeler,autry,alcala,witte,wentz,stidham,shively,nunley,meacham,martins,lemke,lefebvre,hynes,horowitz,hoppe,holcombe,dunne,derr,cochrane,br" (Indicator: "ntice")
"ueling,gribbs,greevy,grandstanding,godparents,glows,glistening,gimmick,gaping,fraiser,formalities,foreigner,folders,foggy,fitty,fiends,fe'nos,favours,eyeing,extort,expedite,escalating,epinephrine,entitles,entice,eminence,eights,earthlings,eagerly,dunville,dugout,doublemeat,doling,dispensing,dispatcher,discoloration,diners,diddly,dictates,diazepam,derogatory,delights,defies,decoder,dealio,danson,cutthroat,crumbles,croissants,crematorium,craftsmanship,could'a,cordless,cools,conked,confine,concealing,complicates,communique,cockamamie,coasters,clobbered,clipping,clipboard,clemenza,cleanser,circumcision,chanukah,certainaly,cellmate,cancels,cadmium,buzzed,bumstead,bucko,browsing,broth,braver,boggling,bobbing,blurred,birkhead,benet,belvedere,bellies,begrudge,beckworth,banky,baldness,baggy,babysitters,aversion,astonished,assorted,appetites,angina,amiss,ambulances,alibis,airway,admires,adhesive,yoyou,xxxxxx,wreaked,wracking,woooo,wooing,wised,wilshire,wedgie,waging,violets,vincey,uplifting,untrustworthy,unmitigated,un" (Indicator: "ntice")
"xavalent,hewwo,hershe,hermey,hergott,henny,hennigans,henhouse,hemolytic,helipad,heifer,hebrews,hebbing,heaved,headlock,harrowing,harnessed,hangovers,handi,handbasket,halfrek,hacene,gyges,guys're,gundersons,gumption,gruntmaster,grubs,grossie,groped,grins,greaseball,gravesite,gratuity,granma,grandfathers,grandbaby,gradski,gracing,gossips,gooble,goners,golitsyn,gofer,godsake,goddaughter,gnats,gluing,glares,givers,ginza,gimmie,gimmee,gennero,gemme,gazpacho,gazed,gassy,gargling,gandhiji,galvanized,gallbladder,gaaah,furtive,fumigation,fucka,fronkonsteen,frills,freezin,freewald,freeloader,frailty,forger,foolhardy,fondest,fomin,followin,follicle,flotation,flopping,floodgates,flogged,flicked,flenders,fleabag,fixings,fixable,fistful,firewater,firelight,fingerbang,finalizing,fillin,filipov,fiderer,felling,feldberg,feign,faunia,fatale,farkus,fallible,faithfulness,factoring,eyeful,extramarital,exterminated,exhume,exasperated,eviscerate,estoy,esmerelda,escapades,epoxy,enticed,enthused,entendre,engrossing,endorphins,emptive" (Indicator: "ntice") - source
- File/Memory
- relevance
- 2/10
-
Possibly checks for known debuggers/analysis tools
-
Environment Awareness
-
Possibly tries to implement anti-virtualization techniques
- details
- "rways,avicenna,montebello,bridgetown,wenatchee,lyonnais,amass,surinamese,streptococcus,m*a*s*h,hydrogenation,frazioni,proscenium,kalat,pennsylvanian,huracan,tallying,kralove,nucleolar,phrygian,seaports,hyacinthe,ignace,donning,instalment,regnal,fonds,prawn,carell,folktales,goaltending,bracknell,vmware,patriarchy,mitsui,kragujevac,pythagoras,soult,thapa,disproved,suwalki,secures,somoza,l'ecole,divizia,chroma,herders,technologist,deduces,maasai,rampur,paraphrase,raimi,imaged,magsaysay,ivano,turmeric,formula_51,subcommittees,axillary,ionosphere,organically,indented,refurbishing,pequot,violinists,bearn,colle,contralto,silverton,mechanization,etruscans,wittelsbach,pasir,redshirted,marrakesh,scarp,plein,wafers,qareh,teotihuacan,frobenius,sinensis,rehoboth,bundaberg,newbridge,hydrodynamic,traore,abubakar,adjusts,storytellers,dynamos,verbandsliga,concertmaster,exxonmobil,appreciable,sieradz,marchioness,chaplaincy,rechristened,cunxu,overpopulation,apolitical,sequencer,beaked,nemanja,binaries,intendant,absorber,filamen" (Indicator: "vmware")
- source
- File/Memory
- relevance
- 4/10
-
Possibly tries to implement anti-virtualization techniques
-
Informative 5
-
External Systems
-
Sample was identified as clean by Antivirus engines
- details
- 0/60 Antivirus vendors marked sample as malicious (0% detection rate)
- source
- External System
- relevance
- 10/10
-
Sample was identified as clean by Antivirus engines
-
General
-
Parsed Javascript
- details
- details too long to display
- source
- Static Parser
- relevance
- 5/10
-
Parsed Javascript
-
Installation/Persistance
-
Opens the MountPointManager (often used to detect additional infection locations)
- details
- "wscript.exe" opened "\Device\MountPointManager"
- source
- API Call
- relevance
- 5/10
-
Touches files in the Windows directory
- details
-
"wscript.exe" touched file "%WINDIR%\System32\en-US\wscript.exe.mui"
"wscript.exe" touched file "%WINDIR%\System32\wscript.exe"
"wscript.exe" touched file "%WINDIR%\Globalization\Sorting\SortDefault.nls"
"wscript.exe" touched file "%WINDIR%\System32\rsaenh.dll"
"wscript.exe" touched file "%WINDIR%\System32\tzres.dll"
"wscript.exe" touched file "%WINDIR%\System32\en-US\tzres.dll.mui" - source
- API Call
- relevance
- 7/10
-
Opens the MountPointManager (often used to detect additional infection locations)
-
Spyware/Information Retrieval
-
Found a reference to a known community page
- details
-
"acus,sickboy,fishtank,fungus,charle,golfpro,teensex,mario66,seaside,aleksei,rosewood,blackberry,1020304050,bedlam,schumi,deerhunt,contour,darkelf,surveyor,deltas,pitchers,741258963,dipstick,funny1,lizzard,112233445566,jupiter2,softtail,titman,greenman,z1x2c3v4b5,smartass,12345677,notnow,myworld,nascar1,chewbacc,nosferatu,downhill,dallas22,kuan,blazers,whales,soldat,craving,powerman,yfcntyf,hotrats,cfvceyu,qweasdzx,princess1,feline,qqwwee,chitown,1234qaz,mastermind,114477,dingbat,care1839,standby,kismet,atreides,dogmeat,icarus,monkeyboy,alex1,mouses,nicetits,sealteam,chopper1,crispy,winter99,rrpass1,myporn,myspace1,corazo,topolino,ass123,lawman,muffy,orgy,1love,passord,hooyah,ekmzyf,pretzel,amonra,nestle,01011950,jimbeam,happyman,z12345,stonewal,helios,manunited,harcore,dick1,gaymen,2hot4u,light1,qwerty13,kakashi,pjkjnj,alcatel,taylo,allah,buddydog,ltkmaby,mongo,blonds,start123,audia6,123456v,civilwar,bellaco,turtles,mustan,deadspin,aaa123,fynjirf,lucky123,tortoise,amor,summe,waterski,zulu,drag0n,dtxyjcnm,gizm" (Indicator: "myspace")
"serk,sublime1,rogue1,myspace,buckwhea,csyekz,pussy4me,vette1,boots1,boingo,arnaud,budlite,redstorm,paramore,becky1,imtheman,chango,marley1,milkyway,666555,giveme,mahalo,lux2000,lucian,paddy,praxis,shimano,bigpenis,creeper,newproject2004,rammstei,j3qq4h7h2v,hfljcnm,lambchop,anthony2,bugman,gfhjkm12,dreamer1,stooges,cybersex,diamant,cowboyup,maximus1,sentra,615243,goethe,manhatta,fastcar,selmer,1213141516,yfnfitymrf,denni,chewey,yankee1,elektra,123456789p,trousers,fishface,topspin,orwell,vorona,sodapop,motherfu,ibilltes,forall,kookie,ronald1,balrog,maximilian,mypasswo,sonny1,zzxxcc,tkfkdg,magoo,mdogg,heeled,gitara,lesbos,marajade,tippy,morozova,enter123,lesbean,pounded,asd456,fialka,scarab,sharpie,spanky1,gstring,sachin,12345asd,princeto,hellohel,ursitesux,billows,1234kekc,kombat,cashew,duracell,kseniya,sevenof9,kostik,arthur1,corvet07,rdfhnbhf,songoku,tiberian,needforspeed,1qwert,dropkick,kevin123,panache,libra,a123456a,kjiflm,vfhnsirf,cntgfy,iamcool,narut,buffer,sk8ordie,urlaub,fireblade,blanked,marishka,gemi" (Indicator: "myspace")
"ike13,wetone,tigger69,ytreza,bondage1,myass,golova,tolik,happyboy,poilkj,nimda2k,rammer,rubies,hardcore1,jetset,hoops1,jlaudio,misskitt,1charlie,google12,theone1,phred,porsch,aalborg,luft4,charlie5,password7,gnosis,djgabbab,1daniel,vinny,borris,cumulus,member1,trogdor,darthmau,andrew2,ktjybl,relisys,kriste,rasta220,chgobndg,weener,qwerty66,fritter,followme,freeman1,ballen,blood1,peache,mariso,trevor1,biotch,gtfullam,chamonix,friendste,alligato,misha1,1soccer,18821221,venkat,superd,molotov,bongos,mpower,acun3t1x,dfcmrf,h4x3d,rfhfufylf,tigran,booyaa,plastic1,monstr,rfnhby,lookatme,anabolic,tiesto,simon123,soulman,canes1,skyking,tomcat1,madona,bassline,dasha123,tarheel1,dutch1,xsw23edc,qwerty123456789,imperator,slaveboy,bateau,paypal,house123,pentax,wolf666,drgonzo,perros,digger1,juninho,hellomoto,bladerun,zzzzzzz1,keebler,take8422,fffffff1,ginuwine,israe,caesar1,crack1,precious1,garand,magda1,zigazaga,321ewq,johnpaul,mama1234,iceman69,sanjeev,treeman,elric,rebell,1thunder,cochon,deamon,zoltan,straycat,uhbyuj,lu" (Indicator: "paypal")
"tage,extending,procedures,predominantly,updated,rhythm,preliminary,cafe,disorder,prevented,suburbs,discontinued,retiring,oral,followers,extends,massacre,journalists,conquest,larvae,pronounced,behaviour,diversity,sustained,addressed,geographic,restrictions,voiced,milwaukee,dialect,quoted,grid,nationally,nearest,roster,twentieth,separation,indies,manages,citing,intervention,guidance,severely,migration,artwork,focusing,rivals,trustees,varied,enabled,committees,centered,skating,slavery,cardinals,forcing,tasks,auckland,youtube,argues,colored,advisor,mumbai,requiring,theological,registration,refugees,nineteenth,survivors,runners,colleagues,priests,contribute,variants,workshop,concentrated,creator,lectures,temples,exploration,requirement,interactive,navigation,companion,perth,allegedly,releasing,citizenship,observation,stationed,ph.d.,sheep,breed,discovers,encourage,kilometres,journals,performers,isle,saskatchewan,hybrid,hotels,lancashire,dubbed,airfield,anchor,suburban,theoretical,sussex,anglican,stockholm,permanen" (Indicator: "youtube")
"t,monarchy,combining,lanes,stint,dynamics,chains,missiles,screening,module,tribune,generating,miners,nottingham,seoul,unofficial,owing,linking,rehabilitation,citation,louisville,mollusk,depicts,differential,zimbabwe,kosovo,recommendations,responses,pottery,scorer,aided,exceptions,dialects,telecommunications,defines,elderly,lunar,coupled,flown,25th,espn,formula_1,bordered,fragments,guidelines,gymnasium,valued,complexity,papal,presumably,maternal,challenging,reunited,advancing,comprised,uncertain,favorable,twelfth,correspondent,nobility,livestock,expressway,chilean,tide,researcher,emissions,profits,lengths,accompanying,witnessed,itunes,drainage,slope,reinforced,feminist,sanskrit,develops,physicians,outlets,isbn,coordinator,averaged,termed,occupy,diagnosed,yearly,humanitarian,prospect,spacecraft,stems,enacted,linux,ancestors,karnataka,constitute,immigrant,thriller,ecclesiastical,generals,celebrations,enhance,heating,advocated,evident,advances,bombardment,watershed,shuttle,wicket,twitter,adds,branded,teaches,sche" (Indicator: "twitter") - source
- File/Memory
- relevance
- 7/10
-
Found a reference to a known community page
File Details
zxcvbn.js
- Filename
- zxcvbn.js
- Size
- 803KiB (821792 bytes)
- Type
- script javascript
- Description
- ASCII text, with very long lines
- Architecture
- WINDOWS
- SHA256
- f42c651f40506acb6b662490f338dd47a5951d3312039c4ab8fe5090484f351a
- MD5
- 9cf6916dc0dcbb18a637d11f575d17ed
- SHA1
- 4d71d397389069767dc12adc7fa64904a00afba8
- ssdeep
- 12288:8imqQPgH8T4J2+pFuyfPEWEmUVlHkbneb391Kl4Af7ezJ:CqQPlT4JVTEDEbu9aK
Screenshots
Loading content, please wait...
Hybrid Analysis
Tip: Click an analysed process below to view more details.
Analysed 1 process in total.
- wscript.exe "C:\zxcvbn.js" (PID: 2708)
Network Analysis
DNS Requests
No relevant DNS requests were made.
Contacted Hosts
No relevant hosts were contacted.
HTTP Traffic
No relevant HTTP requests were made.
Extracted Strings
Extracted Files
No significant files were extracted.
zeroday commented 8 months ago updated