Report - jostuopa.vbs

Generic Malware Antivirus Hide_URL PowerShell
ScreenShot
Created 2023.08.25 09:24 Machine s1_win7_x6401
Filename jostuopa.vbs
Type Little-endian UTF-16 Unicode text, with very long lines, with CRLF line terminators
AI Score Not founds Behavior Score
8.6
ZERO API file : mailcious
VT API (file) 13 detected (Valyria, Malcode, gen102, Hworm, dmiour, Detected, ai score=87)
md5 e33decb056b1ee3b4b75be4017bf9f16
sha256 982f028e86927ef39266ff4bbbae2cfeac8e1aba5a950ea2da69f0a0c518c03f
ssdeep 6144:VOD1L1oUKUpPXtFCyeNHLcb3eTereleKeKe/eZeKeKezeCe3eVeFe/eseqekegeb:VOD1L1oUKUpPXtFCyeUqJGqw16S5YKYn
imphash
impfuzzy
  Network IP location

Signature (20cnts)

Level Description
danger The processes wscript.exe
watch Creates a suspicious Powershell process
watch File has been identified by 13 AntiVirus engines on VirusTotal as malicious
watch Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe
watch One or more non-whitelisted processes were created
notice A process created a hidden window
notice Allocates read-write-execute memory (usually to unpack itself)
notice Checks adapter addresses which can be used to detect virtual network interfaces
notice Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice Creates a shortcut to an executable file
notice Creates a suspicious process
notice One or more potentially interesting buffers were extracted
notice Performs some HTTP requests
notice Poweshell is sending data to a remote host
notice URL downloaded by powershell script
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info Command line console output was observed
info Queries for the computername
info Uses Windows APIs to generate a cryptographic key

Rules (5cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (download)
watch Antivirus Contains references to security software binaries (download)
notice hide_url_link Hide url link scripts
info PowerShell PowerShell script scripts
info PowershellDI Extract Download/Invoke calls from powershell script scripts

Network (4cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://apps.identrust.com/roots/dstrootcax3.p7c US Akamai International B.V. 23.67.53.17 clean
uploaddeimagens.com.br US CLOUDFLARENET 104.21.45.138 malware
23.43.165.66 US CCCH-3 23.43.165.66 clean
104.21.45.138 US CLOUDFLARENET 104.21.45.138 malware

Suricata ids



Similarity measure (PE file only) - Checking for service failure