Report - gfhdsggssdgfsFile.vbs

Generic Malware Antivirus PowerShell

ScreenShot

Info
Location map


Created	2023.10.19 18:28	Machine	s1_win7_x6403_us
Filename	gfhdsggssdgfsFile.vbs
Type	Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR line terminators
AI Score	Not founds	Behavior Score	7.6
ZERO API	file : clean
VT API (file)	5 detected (Detected)
md5	50530ad3f7a59a70e2ad275d8eca6e34
sha256	72ec2d66e0161639da8f24f1f7ccda0921a87ce719dcb0e188c00ee6b679470d
ssdeep	6144:iisw/w/w/w/w/wnw/w/w/w/w/wjw/w/w/w/w/wUw/w/w/w/w/wfrw/w/w/w/w/wl:iisw/w/w/w/w/wnw/w/w/w/w/wjw/w/U
imphash
impfuzzy

Network IP location

Signature (18cnts)

Level	Description
danger	The processes wscript.exe
watch	Creates a suspicious Powershell process
watch	Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe
watch	One or more non-whitelisted processes were created
notice	A process created a hidden window
notice	Allocates read-write-execute memory (usually to unpack itself)
notice	Checks adapter addresses which can be used to detect virtual network interfaces
notice	Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice	Creates a shortcut to an executable file
notice	Creates a suspicious process
notice	File has been identified by 5 AntiVirus engines on VirusTotal as malicious
notice	Poweshell is sending data to a remote host
notice	URL downloaded by powershell script
info	Checks amount of memory in system
info	Checks if process is being debugged by a debugger
info	Command line console output was observed
info	Queries for the computername
info	Uses Windows APIs to generate a cryptographic key

Rules (4cnts)

Level	Name	Description	Collection
warning	Generic_Malware_Zero	Generic Malware	binaries (download)
watch	Antivirus	Contains references to security software	binaries (download)
info	PowerShell	PowerShell script	scripts
info	PowershellDI	Extract Download/Invoke calls from powershell script	scripts

Network (2cnts) ?

Request	CC	ASN Co	IP4	Rule ?	ZERO ?
wallpapercave.com whois		CLOUDFLARENET	104.22.52.71		malware
104.22.53.71 whois		CLOUDFLARENET	104.22.53.71		clean

Suricata ids

Similarity measure (PE file only) - Checking for service failure