{"id":57611,"date":"2017-08-07T16:40:09","date_gmt":"2017-08-07T21:40:09","guid":{"rendered":"https:\/\/www.pcmatic.com\/blog\/?p=57611"},"modified":"2017-08-07T16:40:09","modified_gmt":"2017-08-07T21:40:09","slug":"script-engines-used-distribute-new-strain-spora-ransomware","status":"publish","type":"post","link":"https:\/\/www.pcmatic.com\/blog\/script-engines-used-distribute-new-strain-spora-ransomware\/","title":{"rendered":"Script Engines Being Used to Distribute New Strain of Spora Ransomware"},"content":{"rendered":"

We’ve recently been covering scripting attacks in more detail on the Malware Research blog. These types of attacks have the ability to be completely fileless, as explained in a previous post<\/a>. However, scripts also sometimes do come in files or accompany file-based malware. The new strain of Spora malware does just this. It uses a file called “pdf.wsf” (seen here<\/a> and at the time of this writing, no other antivirus software is listed as blocking the file since it’s a script), which will appear as simply “pdf” if the user has the enabled-by-default option of “hide extensions for known file types” on. As demonstrated in another previous blog post<\/a>, the icon of the file can be easily spoofed to look like a legitimate pdf file. If the victim double-clicks this file, Windows Script Host (wscript.exe) will execute code which will download the rest of the ransomware and attempt to run the executable file either right away or at some future time.<\/p>\n

 <\/p>\n

Malware authors primarily use this method of malware distribution in order to evade detection. For example, if a user receives an email with an attachment as a .wsf or .js file, the file will clear most antivirus systems on both their own machine as well as email autoscan systems, as being good since it is not an “executable” .exe file. In this way, the malware author can try to get the executable payload onto the user’s system without them knowing by using the script. The good news is that PC Matic SuperShield will prevent this ransomware from running, just as it has in the past, due to the hooking technology that is used in the product as well as by blocking the malicious script engine commands. As always, don’t open unknown files, use SuperShield, and if you are concerned about file extensions, be sure to turn them on by following these instructions<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

We’ve recently been covering scripting attacks in more detail on the Malware Research blog. These types of attacks have the ability to be completely fileless, as explained in a previous post. However, scripts also sometimes do come in files or accompany file-based malware. The new strain of Spora malware does just this. It uses a […]<\/p>\n","protected":false},"author":68,"featured_media":55127,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[4851,4949],"tags":[4363,5315,5314],"class_list":["post-57611","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-malware-research-team","category-ransomware","tag-ransomware","tag-scripting","tag-spora"],"yoast_head":"\nScript Engines Being Used to Distribute New Strain of Spora Ransomware<\/title>\n<meta name=\"description\" content=\"We've recently been covering scripting attacks in more detail on the Malware Research blog. These types of attacks have the ability to be completely\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.pcmatic.com\/blog\/script-engines-used-distribute-new-strain-spora-ransomware\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Script Engines Being Used to Distribute New Strain of Spora Ransomware\" \/>\n<meta property=\"og:description\" content=\"We've recently been covering scripting attacks in more detail on the Malware Research blog. These types of attacks have the ability to be completely\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.pcmatic.com\/blog\/script-engines-used-distribute-new-strain-spora-ransomware\/\" \/>\n<meta property=\"og:site_name\" content=\"PC Matic Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/pcmatic\" \/>\n<meta property=\"article:published_time\" content=\"2017-08-07T21:40:09+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.pcmatic.com\/blog\/wp-content\/uploads\/lockBG.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"730\" \/>\n\t<meta property=\"og:image:height\" content=\"410\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"PC Matic Malware Research\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@pcmatic\" \/>\n<meta name=\"twitter:site\" content=\"@pcmatic\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"PC Matic Malware Research\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/script-engines-used-distribute-new-strain-spora-ransomware\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/script-engines-used-distribute-new-strain-spora-ransomware\\\/\"},\"author\":{\"name\":\"PC Matic Malware Research\",\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/#\\\/schema\\\/person\\\/f5f9723c200c849e0a641a91c625683c\"},\"headline\":\"Script Engines Being Used to Distribute New Strain of Spora Ransomware\",\"datePublished\":\"2017-08-07T21:40:09+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/script-engines-used-distribute-new-strain-spora-ransomware\\\/\"},\"wordCount\":331,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/script-engines-used-distribute-new-strain-spora-ransomware\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/wp-content\\\/uploads\\\/lockBG.jpg\",\"keywords\":[\"ransomware\",\"scripting\",\"spora\"],\"articleSection\":[\"Malware Research Team\",\"Ransomware\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/script-engines-used-distribute-new-strain-spora-ransomware\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/script-engines-used-distribute-new-strain-spora-ransomware\\\/\",\"url\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/script-engines-used-distribute-new-strain-spora-ransomware\\\/\",\"name\":\"Script Engines Being Used to Distribute New Strain of Spora Ransomware\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/script-engines-used-distribute-new-strain-spora-ransomware\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/script-engines-used-distribute-new-strain-spora-ransomware\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/wp-content\\\/uploads\\\/lockBG.jpg\",\"datePublished\":\"2017-08-07T21:40:09+00:00\",\"description\":\"We've recently been covering scripting attacks in more detail on the Malware Research blog. These types of attacks have the ability to be completely\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/script-engines-used-distribute-new-strain-spora-ransomware\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/script-engines-used-distribute-new-strain-spora-ransomware\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/script-engines-used-distribute-new-strain-spora-ransomware\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/wp-content\\\/uploads\\\/lockBG.jpg\",\"contentUrl\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/wp-content\\\/uploads\\\/lockBG.jpg\",\"width\":730,\"height\":410,\"caption\":\"Computer Virus Software\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/script-engines-used-distribute-new-strain-spora-ransomware\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Script Engines Being Used to Distribute New Strain of Spora Ransomware\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/\",\"name\":\"PC Matic Blog\",\"description\":\"Tech Tips and Tricks\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/#organization\",\"name\":\"PC Matic - Top Antivirus Company in the USA.\",\"url\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/techtalk.pcmatic.com\\\/wp-content\\\/uploads\\\/PC-MaticLogo-e1472689639222.png\",\"contentUrl\":\"https:\\\/\\\/techtalk.pcmatic.com\\\/wp-content\\\/uploads\\\/PC-MaticLogo-e1472689639222.png\",\"width\":1535,\"height\":483,\"caption\":\"PC Matic - Top Antivirus Company in the USA.\"},\"image\":{\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/pcmatic\",\"https:\\\/\\\/x.com\\\/pcmatic\",\"https:\\\/\\\/www.instagram.com\\\/pcmaticusa\\\/\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/pcmatic\",\"https:\\\/\\\/www.youtube.com\\\/c\\\/PCMaticVideo\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/#\\\/schema\\\/person\\\/f5f9723c200c849e0a641a91c625683c\",\"name\":\"PC Matic Malware Research\",\"url\":\"https:\\\/\\\/www.pcmatic.com\\\/blog\\\/author\\\/pc-matic-malware-research\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Script Engines Being Used to Distribute New Strain of Spora Ransomware","description":"We've recently been covering scripting attacks in more detail on the Malware Research blog. These types of attacks have the ability to be completely","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.pcmatic.com\/blog\/script-engines-used-distribute-new-strain-spora-ransomware\/","og_locale":"en_US","og_type":"article","og_title":"Script Engines Being Used to Distribute New Strain of Spora Ransomware","og_description":"We've recently been covering scripting attacks in more detail on the Malware Research blog. These types of attacks have the ability to be completely","og_url":"https:\/\/www.pcmatic.com\/blog\/script-engines-used-distribute-new-strain-spora-ransomware\/","og_site_name":"PC Matic Blog","article_publisher":"https:\/\/www.facebook.com\/pcmatic","article_published_time":"2017-08-07T21:40:09+00:00","og_image":[{"width":730,"height":410,"url":"https:\/\/www.pcmatic.com\/blog\/wp-content\/uploads\/lockBG.jpg","type":"image\/jpeg"}],"author":"PC Matic Malware Research","twitter_card":"summary_large_image","twitter_creator":"@pcmatic","twitter_site":"@pcmatic","twitter_misc":{"Written by":"PC Matic Malware Research","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.pcmatic.com\/blog\/script-engines-used-distribute-new-strain-spora-ransomware\/#article","isPartOf":{"@id":"https:\/\/www.pcmatic.com\/blog\/script-engines-used-distribute-new-strain-spora-ransomware\/"},"author":{"name":"PC Matic Malware Research","@id":"https:\/\/www.pcmatic.com\/blog\/#\/schema\/person\/f5f9723c200c849e0a641a91c625683c"},"headline":"Script Engines Being Used to Distribute New Strain of Spora Ransomware","datePublished":"2017-08-07T21:40:09+00:00","mainEntityOfPage":{"@id":"https:\/\/www.pcmatic.com\/blog\/script-engines-used-distribute-new-strain-spora-ransomware\/"},"wordCount":331,"commentCount":0,"publisher":{"@id":"https:\/\/www.pcmatic.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.pcmatic.com\/blog\/script-engines-used-distribute-new-strain-spora-ransomware\/#primaryimage"},"thumbnailUrl":"https:\/\/www.pcmatic.com\/blog\/wp-content\/uploads\/lockBG.jpg","keywords":["ransomware","scripting","spora"],"articleSection":["Malware Research Team","Ransomware"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.pcmatic.com\/blog\/script-engines-used-distribute-new-strain-spora-ransomware\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.pcmatic.com\/blog\/script-engines-used-distribute-new-strain-spora-ransomware\/","url":"https:\/\/www.pcmatic.com\/blog\/script-engines-used-distribute-new-strain-spora-ransomware\/","name":"Script Engines Being Used to Distribute New Strain of Spora Ransomware","isPartOf":{"@id":"https:\/\/www.pcmatic.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.pcmatic.com\/blog\/script-engines-used-distribute-new-strain-spora-ransomware\/#primaryimage"},"image":{"@id":"https:\/\/www.pcmatic.com\/blog\/script-engines-used-distribute-new-strain-spora-ransomware\/#primaryimage"},"thumbnailUrl":"https:\/\/www.pcmatic.com\/blog\/wp-content\/uploads\/lockBG.jpg","datePublished":"2017-08-07T21:40:09+00:00","description":"We've recently been covering scripting attacks in more detail on the Malware Research blog. These types of attacks have the ability to be completely","breadcrumb":{"@id":"https:\/\/www.pcmatic.com\/blog\/script-engines-used-distribute-new-strain-spora-ransomware\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.pcmatic.com\/blog\/script-engines-used-distribute-new-strain-spora-ransomware\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.pcmatic.com\/blog\/script-engines-used-distribute-new-strain-spora-ransomware\/#primaryimage","url":"https:\/\/www.pcmatic.com\/blog\/wp-content\/uploads\/lockBG.jpg","contentUrl":"https:\/\/www.pcmatic.com\/blog\/wp-content\/uploads\/lockBG.jpg","width":730,"height":410,"caption":"Computer Virus Software"},{"@type":"BreadcrumbList","@id":"https:\/\/www.pcmatic.com\/blog\/script-engines-used-distribute-new-strain-spora-ransomware\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.pcmatic.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Script Engines Being Used to Distribute New Strain of Spora Ransomware"}]},{"@type":"WebSite","@id":"https:\/\/www.pcmatic.com\/blog\/#website","url":"https:\/\/www.pcmatic.com\/blog\/","name":"PC Matic Blog","description":"Tech Tips and Tricks","publisher":{"@id":"https:\/\/www.pcmatic.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.pcmatic.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.pcmatic.com\/blog\/#organization","name":"PC Matic - Top Antivirus Company in the USA.","url":"https:\/\/www.pcmatic.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.pcmatic.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/techtalk.pcmatic.com\/wp-content\/uploads\/PC-MaticLogo-e1472689639222.png","contentUrl":"https:\/\/techtalk.pcmatic.com\/wp-content\/uploads\/PC-MaticLogo-e1472689639222.png","width":1535,"height":483,"caption":"PC Matic - Top Antivirus Company in the USA."},"image":{"@id":"https:\/\/www.pcmatic.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/pcmatic","https:\/\/x.com\/pcmatic","https:\/\/www.instagram.com\/pcmaticusa\/","https:\/\/www.linkedin.com\/company\/pcmatic","https:\/\/www.youtube.com\/c\/PCMaticVideo"]},{"@type":"Person","@id":"https:\/\/www.pcmatic.com\/blog\/#\/schema\/person\/f5f9723c200c849e0a641a91c625683c","name":"PC Matic Malware Research","url":"https:\/\/www.pcmatic.com\/blog\/author\/pc-matic-malware-research\/"}]}},"_links":{"self":[{"href":"https:\/\/www.pcmatic.com\/blog\/wp-json\/wp\/v2\/posts\/57611","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.pcmatic.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.pcmatic.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.pcmatic.com\/blog\/wp-json\/wp\/v2\/users\/68"}],"replies":[{"embeddable":true,"href":"https:\/\/www.pcmatic.com\/blog\/wp-json\/wp\/v2\/comments?post=57611"}],"version-history":[{"count":0,"href":"https:\/\/www.pcmatic.com\/blog\/wp-json\/wp\/v2\/posts\/57611\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.pcmatic.com\/blog\/wp-json\/wp\/v2\/media\/55127"}],"wp:attachment":[{"href":"https:\/\/www.pcmatic.com\/blog\/wp-json\/wp\/v2\/media?parent=57611"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.pcmatic.com\/blog\/wp-json\/wp\/v2\/categories?post=57611"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.pcmatic.com\/blog\/wp-json\/wp\/v2\/tags?post=57611"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}