Analysis
-
max time kernel
215s -
max time network
218s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
03-09-2022 13:47
Static task
static1
Behavioral task
behavioral1
Sample
Collective_bargaining_agreement_law (say).js
Resource
win10-20220901-en
3 signatures
300 seconds
General
-
Target
Collective_bargaining_agreement_law (say).js
-
Size
483KB
-
MD5
e33de5c9035041004257e49620318d12
-
SHA1
fb71fbce6c15d48c72f312912259bcc27f00dd5e
-
SHA256
e14fbd601a53aff91d66c1ecf6d312e2cdc753fe8de2c90708ecb8cbae69285a
-
SHA512
98699b1abf5437f89021db68797b6f71c2a17b7c03d80a250df174c10f8f15b10779d201b4dba680f5d057f6e52562682354e198753ed02662ebe6ec5951720c
-
SSDEEP
6144:DQ9ZMzulaVl4dhEfD38A7Wiagmd4iLAmWR6ScF:rshEfD38viagmd4iLAmWR6V
Score
10/10
Malware Config
Signatures
-
GootLoader
JavaScript loader known for delivering other families such as Gootkit and Cobaltstrike.
-
Blocklisted process makes network request 3 IoCs
Processes:
wscript.exeflow pid process 7 3500 wscript.exe 9 3500 wscript.exe 11 3500 wscript.exe -
Script User-Agent 3 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 7 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 9 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 11 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)