Report - obuxu.vbs

Generic Malware Antivirus PowerShell
ScreenShot
Created 2023.10.27 10:13 Machine s1_win7_x6403_us
Filename obuxu.vbs
Type Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR line terminators
AI Score Not founds Behavior Score
9.0
ZERO API file : clean
VT API (file) 2 detected (DownLoader46)
md5 136abae59cb3eb697de1c5e20778ecd6
sha256 72d46456c38f739d6ff5653cc5c55d4a301bb872fea4905b7fbaaf37978e5a1f
ssdeep 3072:lPPPPPs6uAPPPPPHPPPPPtPPPPPNfPPPPP3PPPPP3PPPPP6PPPPPwPPPPPhzY:W6uszY
imphash
impfuzzy
  Network IP location

Signature (21cnts)

Level Description
danger The processes wscript.exe
watch Attempts to create or modify system certificates
watch Creates a suspicious Powershell process
watch Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe
watch One or more non-whitelisted processes were created
notice A process created a hidden window
notice Allocates read-write-execute memory (usually to unpack itself)
notice Checks adapter addresses which can be used to detect virtual network interfaces
notice Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice Creates a shortcut to an executable file
notice Creates a suspicious process
notice File has been identified by 2 AntiVirus engines on VirusTotal as malicious
notice One or more potentially interesting buffers were extracted
notice Performs some HTTP requests
notice Poweshell is sending data to a remote host
notice URL downloaded by powershell script
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info Command line console output was observed
info Queries for the computername
info Uses Windows APIs to generate a cryptographic key

Rules (4cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (download)
watch Antivirus Contains references to security software binaries (download)
info PowerShell PowerShell script scripts
info PowershellDI Extract Download/Invoke calls from powershell script scripts

Network (4cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://apps.identrust.com/roots/dstrootcax3.p7c US Akamai International B.V. 23.67.53.27 clean
uploaddeimagens.com.br US CLOUDFLARENET 104.21.45.138 malware
23.32.56.80 US AKAMAI-AS 23.32.56.80 clean
172.67.215.45 US CLOUDFLARENET 172.67.215.45 malware

Suricata ids



Similarity measure (PE file only) - Checking for service failure