large obfuscated vbs dropper seems to hang wscript until timeout

[mallorybobalice]

My issue is:

E93A157F82E06F7A2076E5CDEBA6C1023867593A41C43F41BCBE97155DC7EA68

invoice vbs seems to run ok with injection disable (calls out where it should , etc) with injection enabled analyzer.py python process sits there using one core until analysis hits timeout and wscript doesn't even fetch the exe

also if i leave package as default it seems to rename the file to .vbs.js despite the original extension being vbs

My Cuckoo version and operating system are: 2.07/ubuntu lts 18.04 / w10 1809 latest patches

This can be reproduced by:

running said sample with package vbs, and timeout of say 600 then running it with injection disabled

The log, error, files etc can be found at:

let's see if this a repro or non repro first... analysis log after starting process pretty much has nothing after.

[mallorybobalice]

ppps if it helps I can reproduce the issue both with CAPE and cuckoo 2.0.7 making me think it's ...either likely reproducible or i messed something up

[mallorybobalice]

ppps python is 2.7.16 x86

[doomedraven]

em works just fine on my cape

[mallorybobalice]

mmm and in the online cape too. I don't suppose yours is w10 guest ?

[doomedraven]

nop w10 isn't supported officially in v2 neither cape

[mallorybobalice]

oh-oh