popup

Report - Factura_SA161.pdf.lnk

Generic Malware Suspicious_Script_Bin NSIS Hide_EXE Downloader UPX Malicious Library Antivirus Create Service Socket DGA Http API ScreenShot Escalate priviledges Steal credential PWS Hijack Network Sniff Audio HTTP DNS Code injection Internet API persiste
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2024.04.19 13:20 Machine s1_win7_x6402
Filename Factura_SA161.pdf.lnk
Type MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Icon number=13, Archive, ctime=Fri May 7 23:13:59 2021, mtime=Fri May 7 23:13:59 2021, atime=Fri May 7 23:13:59 2021, length=41472,
AI Score Not founds Behavior Score
18.4
ZERO API file : clean
VT API (file) 24 detected (Pantera, gen111, Mshta, CLASSIC, Siggen28, RHADAMANTHYS, YXEDSZ, LnkRun, Detected, ai score=85, ABRisk, EJEF, Static AI, Suspicious LNK)
md5 6b602c96ff01c4f55c7a625b2358a988
sha256 e7dec31185f1555bb009e5f7348a31f98bb0d60c82d81c6ab42f95d6715ca6dc
ssdeep 24:8WYaNkDmgihopv94zcuhJBkr+/4p+8Pxu3Hgqdd79dsW28mT84abtl868z7m:8WYamDmux9AJA7gndJ9pn4a46q
imphash
impfuzzy
  Network IP location

Signature (41cnts)

Level Description
danger The process powershell.exe wrote an executable file to disk which it then attempted to execute
warning File has been identified by 24 AntiVirus engines on VirusTotal as malicious
watch A potential heapspray has been detected. 154 megabytes was sprayed onto the heap of the powershell.exe process
watch An executable file was downloaded by the processes mshta.exe
watch Communicates with host for which no DNS query was performed
watch Creates a suspicious Powershell process
watch Disables proxy possibly for traffic interception
watch Drops a binary and executes it
watch Modifies proxy override settings possibly for traffic interception
watch Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe
watch One or more non-whitelisted processes were created
watch Resumed a suspended thread in a remote process potentially indicative of process injection
notice A process created a hidden window
notice Allocates read-write-execute memory (usually to unpack itself)
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice Checks adapter addresses which can be used to detect virtual network interfaces
notice Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice Creates (office) documents on the filesystem
notice Creates a shortcut to an executable file
notice Creates a suspicious process
notice Creates executable files on the filesystem
notice Drops an executable to the user AppData folder
notice Executes one or more WMI queries
notice Expresses interest in specific running processes
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice One or more potentially interesting buffers were extracted
notice Performs some HTTP requests
notice Potentially malicious URLs were found in the process memory dump
notice Poweshell is sending data to a remote host
notice Queries for potentially installed applications
notice Searches running processes potentially to identify processes for sandbox evasion
notice Terminates another process
notice URL downloaded by powershell script
notice Uses Windows utilities for basic Windows functionality
notice Yara rule detected in process memory
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info Command line console output was observed
info Queries for the computername
info Tries to locate where the browsers are installed
info Uses Windows APIs to generate a cryptographic key

Rules (49cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (download)
warning Generic_Malware_Zero Generic Malware binaries (upload)
warning hide_executable_file Hide executable file binaries (download)
warning NSIS_Installer Null Soft Installer binaries (download)
warning Suspicious_Obfuscation_Script_2 Suspicious obfuscation script (e.g. executable files) binaries (download)
watch Antivirus Contains references to security software binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (download)
watch Network_Downloader File Downloader memory
watch UPX_Zero UPX packed file binaries (download)
notice Code_injection Code injection with CreateRemoteThread in a remote process memory
notice Create_Service Create a windows service memory
notice Escalate_priviledges Escalate priviledges memory
notice Generic_PWS_Memory_Zero PWS Memory memory
notice Hijack_Network Hijack network configuration memory
notice KeyLogger Run a KeyLogger memory
notice local_credential_Steal Steal credential memory
notice Network_DGA Communication using DGA memory
notice Network_DNS Communications use DNS memory
notice Network_FTP Communications over FTP memory
notice Network_HTTP Communications over HTTP memory
notice Network_P2P_Win Communications over P2P network memory
notice Network_TCP_Socket Communications over RAW Socket memory
notice PDF_Format_Z PDF Format binaries (download)
notice Persistence Install itself for autorun at Windows startup memory
notice ScreenShot Take ScreenShot memory
notice Sniff_Audio Record Audio memory
notice Str_Win32_Http_API Match Windows Http API call memory
notice Str_Win32_Internet_API Match Windows Inet API call memory
info anti_dbg Checks if being debugged memory
info antisb_threatExpert Anti-Sandbox checks for ThreatExpert memory
info bmp_file_format bmp file format binaries (download)
info Check_Dlls (no description) memory
info DebuggerCheck__GlobalFlags (no description) memory
info DebuggerCheck__QueryInfo (no description) memory
info DebuggerCheck__RemoteAPI (no description) memory
info DebuggerException__ConsoleCtrl (no description) memory
info DebuggerException__SetConsoleCtrl (no description) memory
info DebuggerHiding__Active (no description) memory
info DebuggerHiding__Thread (no description) memory
info disable_dep Bypass DEP memory
info IsPE32 (no description) binaries (download)
info lnk_file_format Microsoft Windows Shortcut File Format binaries (upload)
info Lnk_Format_Zero LNK Format binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (download)
info PE_Header_Zero PE File Signature binaries (download)
info PowerShell PowerShell script scripts
info SEH__vectored (no description) memory
info ThreadControl__Context (no description) memory
info win_hook Affect hook table memory

Network (5cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://93.190.140.76/factura
whois
NL WorldStream B.V. 93.190.140.76 malware
http://93.190.140.76/SA160.pdf
whois
NL WorldStream B.V. 93.190.140.76 clean
http://93.190.140.76/DisabilityCharge.exe
whois
NL WorldStream B.V. 93.190.140.76 malware
WnPTaVSLwChHmHUZLZbxxYzryHGcJ.WnPTaVSLwChHmHUZLZbxxYzryHGcJ
whois
Unknown clean
93.190.140.76
whois
NL WorldStream B.V. 93.190.140.76 malware

Suricata ids

ET INFO Dotted Quad Host PDF Request
ET INFO Packed Executable Download
ET POLICY PE EXE or DLL Windows file download HTTP
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
ET INFO Executable Download from dotted-quad Host
ET INFO Embedded Executable File in PDF - This Program Cannot Be Run in DOS Mode
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download

Similarity measure (PE file only) - Checking for service failure