Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: Sleeping VBS Really Wants To Sleep - SANS Internet Storm Center SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms:

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Sleeping VBS Really Wants To Sleep

Diary reader Wayne Smith shared an interesting malicious document with us. Wayne also provided us with his own analysis: this malicious document sleeps and checks the time online before it activates its payload.

First we take a look at the sample (md5 7EAB96D2BC04CA155DE035815B88EE00) with

It's a .docx file that contains 4 embedded objects. When we calculate the hashes, we see that the 4 documents are identical:

As all objects are identical, we just need to analyze one object:

It's a VBS file, let's extract it:

Analysis of this obfuscated code reveals that it is a downloader with a particular property (for a maldoc): before downloading and executing the payload, this VBS code will sleep for 5 minutes, checking the elapsed time every minute by querying

By sleeping and checking the time online, this sample hopes to evade detection by sandboxes that do time acceleration without interfering with online time checking. This sample will sleep indefinitely when online time querying fails.

Didier Stevens
Microsoft MVP Consumer Security


639 Posts
ISC Handler
Dec 10th 2016
I came across a few of these last week - I just converted the script to perl, then called its decrypt function with the parameters grepped out of the vbs code, got the ip addresses and reported them.
This doesn't require a VM or having to execute the vbs, and completely ignores its timer!
There's no need to run the decryption function or run the VBS, the encoding they use is trivial: XOR encoding. First argument is the ciphertext in hexadecimal, second argument is the key in ASCII. Decoding/encoding starts with the second character of the key.

The sandboxes I'm referring to are those used for automatic scans. They often limit the execution time of the sample to a couple of minutes.

639 Posts
ISC Handler
I know Didier, that's why I rewrote that function in perl so I could just pass the two arguments to it and get the results easily in a linux shell to pass to the next stages.
I've analyzed and reported some 240,000 of these malware mails, and identified and reported over 17,000 unique urls - I run a Linux cluster and can't/won't execute VBS, but have managed to automate analysis using yours and Philippe Lagadec's OLE tools, nodejs and my own code to defeat js/wsf/jse manage, distribute tasks and report to ISPs.
(I'd rather not go into more detail publicly!)

If you use my latest version of plugin_http_heuristics on Github (…), you can extract the URLs: -s A2 -e t58x46dy71np14vc10vm40j87fi12o.docx.vir | -r -p plugin_http_heuristics
Plugin: HTTP Heuristics plugin

639 Posts
ISC Handler

Sign Up for Free or Log In to start participating in the conversation!