API tools faq
paste
Guest User

anubis / www.facebook.com

a guest
May 5th, 2013
63
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 15.97 KB | None | 0 0
raw download clone embed print report
  1. ___ __ _
  2. + /- / | ____ __ __/ /_ (_)____ -\ +
  3. /s h- / /| | / __ \/ / / / __ \/ / ___/ -h s\
  4. oh-:d/ / ___ |/ / / / /_/ / /_/ / (__ ) /d:-ho
  5. shh+hy- /_/ |_/_/ /_/\__,_/_.___/_/____/ -yh+hhs
  6. -:+hhdhyys/- -\syyhdhh+:-
  7. -//////dhhhhhddhhyss- Analysis Report -ssyhhddhhhhhd\\\\\\-
  8. /++/////oydddddhhyys/ ooooooooooooooooooooo \syyhhdddddyo\\\\\++\
  9. -+++///////odh/- -+hdo\\\\\\\+++-
  10. +++++++++//yy+/: :\+yy\\+++++++++
  11. /+soss+sys//yyo/os++o+: :+o++so\oyy\\sys+ssos+\
  12. +oyyyys++o/+yss/+/oyyyy: :yyyyo\+\ssy+\o++syyyyo+
  13. +oyyyyyyso+os/o/+yyyyyy/ \yyyyyy+\o\so+osyyyyyyo+
  14.  
  15.  
  16. [#############################################################################]
  17. Analysis Report for https://www.facebook.com/
  18. [#############################################################################]
  19.  
  20.  
  21. [=============================================================================]
  22. Table of Contents
  23. [=============================================================================]
  24.  
  25. - General information
  26. - iexplore.exe
  27. a) Registry Activities
  28. b) File Activities
  29. c) Other Activities
  30.  
  31.  
  32. [#############################################################################]
  33. 1. General Information
  34. [#############################################################################]
  35. [=============================================================================]
  36. Information about Anubis' invocation
  37. [=============================================================================]
  38. Time needed: 256 s
  39. Report created: 05/06/13, 01:54:32 UTC
  40. Termination reason: Timeout
  41. Program version: 1.76.3886
  42.  
  43.  
  44. [#############################################################################]
  45. 2. iexplore.exe
  46. [#############################################################################]
  47. [=============================================================================]
  48. General information about this executable
  49. [=============================================================================]
  50. Analysis Reason: Primary Analysis Subject
  51. Filename: iexplore.exe
  52. Command Line: "C:\Program Files\Internet Explorer\iexplore.exe"
  53. Process-status
  54. at analysis end: alive
  55. Exit Code: 0
  56.  
  57. [=============================================================================]
  58. Load-time Dlls
  59. [=============================================================================]
  60. Module Name: [ C:\WINDOWS\system32\ntdll.dll ],
  61. Base Address: [0x7C900000 ], Size: [0x000AF000 ]
  62. Module Name: [ C:\WINDOWS\system32\kernel32.dll ],
  63. Base Address: [0x7C800000 ], Size: [0x000F6000 ]
  64. Module Name: [ C:\WINDOWS\system32\msvcrt.dll ],
  65. Base Address: [0x77C10000 ], Size: [0x00058000 ]
  66. Module Name: [ C:\WINDOWS\system32\USER32.dll ],
  67. Base Address: [0x7E410000 ], Size: [0x00091000 ]
  68. Module Name: [ C:\WINDOWS\system32\GDI32.dll ],
  69. Base Address: [0x77F10000 ], Size: [0x00049000 ]
  70. Module Name: [ C:\WINDOWS\system32\SHLWAPI.dll ],
  71. Base Address: [0x77F60000 ], Size: [0x00076000 ]
  72. Module Name: [ C:\WINDOWS\system32\ADVAPI32.dll ],
  73. Base Address: [0x77DD0000 ], Size: [0x0009B000 ]
  74. Module Name: [ C:\WINDOWS\system32\RPCRT4.dll ],
  75. Base Address: [0x77E70000 ], Size: [0x00092000 ]
  76. Module Name: [ C:\WINDOWS\system32\Secur32.dll ],
  77. Base Address: [0x77FE0000 ], Size: [0x00011000 ]
  78. Module Name: [ C:\WINDOWS\system32\SHDOCVW.dll ],
  79. Base Address: [0x7E290000 ], Size: [0x00171000 ]
  80. Module Name: [ C:\WINDOWS\system32\CRYPT32.dll ],
  81. Base Address: [0x77A80000 ], Size: [0x00095000 ]
  82. Module Name: [ C:\WINDOWS\system32\MSASN1.dll ],
  83. Base Address: [0x77B20000 ], Size: [0x00012000 ]
  84. Module Name: [ C:\WINDOWS\system32\CRYPTUI.dll ],
  85. Base Address: [0x754D0000 ], Size: [0x00080000 ]
  86. Module Name: [ C:\WINDOWS\system32\NETAPI32.dll ],
  87. Base Address: [0x5B860000 ], Size: [0x00055000 ]
  88. Module Name: [ C:\WINDOWS\system32\OLEAUT32.dll ],
  89. Base Address: [0x77120000 ], Size: [0x0008B000 ]
  90. Module Name: [ C:\WINDOWS\system32\ole32.dll ],
  91. Base Address: [0x774E0000 ], Size: [0x0013D000 ]
  92. Module Name: [ C:\WINDOWS\system32\VERSION.dll ],
  93. Base Address: [0x77C00000 ], Size: [0x00008000 ]
  94. Module Name: [ C:\WINDOWS\system32\WININET.dll ],
  95. Base Address: [0x771B0000 ], Size: [0x000AA000 ]
  96. Module Name: [ C:\WINDOWS\system32\WINTRUST.dll ],
  97. Base Address: [0x76C30000 ], Size: [0x0002E000 ]
  98. Module Name: [ C:\WINDOWS\system32\IMAGEHLP.dll ],
  99. Base Address: [0x76C90000 ], Size: [0x00028000 ]
  100. Module Name: [ C:\WINDOWS\system32\WLDAP32.dll ],
  101. Base Address: [0x76F60000 ], Size: [0x0002C000 ]
  102. Module Name: [ C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll ],
  103. Base Address: [0x773D0000 ], Size: [0x00103000 ]
  104. Module Name: [ C:\WINDOWS\system32\SHELL32.dll ],
  105. Base Address: [0x7C9C0000 ], Size: [0x00817000 ]
  106. Module Name: [ C:\WINDOWS\system32\comctl32.dll ],
  107. Base Address: [0x5D090000 ], Size: [0x0009A000 ]
  108. Module Name: [ C:\WINDOWS\system32\MSCTF.dll ],
  109. Base Address: [0x74720000 ], Size: [0x0004C000 ]
  110. Module Name: [ C:\WINDOWS\system32\BROWSEUI.dll ],
  111. Base Address: [0x75F80000 ], Size: [0x000FD000 ]
  112. Module Name: [ C:\WINDOWS\system32\browselc.dll ],
  113. Base Address: [0x71600000 ], Size: [0x00012000 ]
  114. Module Name: [ C:\WINDOWS\system32\appHelp.dll ],
  115. Base Address: [0x77B40000 ], Size: [0x00022000 ]
  116. Module Name: [ C:\WINDOWS\system32\CLBCATQ.DLL ],
  117. Base Address: [0x76FD0000 ], Size: [0x0007F000 ]
  118. Module Name: [ C:\WINDOWS\system32\COMRes.dll ],
  119. Base Address: [0x77050000 ], Size: [0x000C5000 ]
  120. Module Name: [ C:\WINDOWS\system32\UxTheme.dll ],
  121. Base Address: [0x5AD70000 ], Size: [0x00038000 ]
  122. Module Name: [ C:\WINDOWS\System32\cscui.dll ],
  123. Base Address: [0x77A20000 ], Size: [0x00054000 ]
  124. Module Name: [ C:\WINDOWS\System32\CSCDLL.dll ],
  125. Base Address: [0x76600000 ], Size: [0x0001D000 ]
  126. Module Name: [ C:\WINDOWS\system32\SETUPAPI.dll ],
  127. Base Address: [0x77920000 ], Size: [0x000F3000 ]
  128. Module Name: [ C:\WINDOWS\system32\urlmon.dll ],
  129. Base Address: [0x7E1E0000 ], Size: [0x000A2000 ]
  130. Module Name: [ C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll ],
  131. Base Address: [0x10000000 ], Size: [0x00010000 ]
  132. Module Name: [ C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2\MSVCR80.dll ],
  133. Base Address: [0x78130000 ], Size: [0x0009B000 ]
  134. Module Name: [ C:\Program Files\Java\jre1.6.0\bin\ssv.dll ],
  135. Base Address: [0x6D7C0000 ], Size: [0x00079000 ]
  136. Module Name: [ C:\Program Files\Java\jre1.6.0\bin\MSVCR71.dll ],
  137. Base Address: [0x7C340000 ], Size: [0x00056000 ]
  138. Module Name: [ C:\WINDOWS\system32\mshtml.dll ],
  139. Base Address: [0x7DC30000 ], Size: [0x002F2000 ]
  140. Module Name: [ C:\WINDOWS\system32\msls31.dll ],
  141. Base Address: [0x746C0000 ], Size: [0x00027000 ]
  142. Module Name: [ C:\WINDOWS\system32\PSAPI.DLL ],
  143. Base Address: [0x76BF0000 ], Size: [0x0000B000 ]
  144. Module Name: [ C:\WINDOWS\system32\SXS.DLL ],
  145. Base Address: [0x7E720000 ], Size: [0x000B0000 ]
  146. Module Name: [ C:\WINDOWS\system32\shdoclc.dll ],
  147. Base Address: [0x71800000 ], Size: [0x00088000 ]
  148. Module Name: [ C:\WINDOWS\system32\xpsp2res.dll ],
  149. Base Address: [0x011C0000 ], Size: [0x002C5000 ]
  150. Module Name: [ C:\WINDOWS\system32\MLANG.dll ],
  151. Base Address: [0x75CF0000 ], Size: [0x00091000 ]
  152. Module Name: [ C:\WINDOWS\system32\msimtf.dll ],
  153. Base Address: [0x746F0000 ], Size: [0x0002A000 ]
  154. Module Name: [ C:\WINDOWS\system32\IMM32.DLL ],
  155. Base Address: [0x76390000 ], Size: [0x0001D000 ]
  156.  
  157. [=============================================================================]
  158. Run-time Dlls
  159. [=============================================================================]
  160. Module Name: [ C:\WINDOWS\system32\WINMM.dll ],
  161. Base Address: [0x76B40000 ], Size: [0x0002D000 ]
  162.  
  163. [=============================================================================]
  164. 2.a) iexplore.exe - Registry Activities
  165. [=============================================================================]
  166. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  167. Registry Values Read:
  168. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  169. Key: [ HKLM\SOFTWARE\CLASSES\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\INPROCSERVER32 ],
  170. Value Name: [ ], Value: [ %SystemRoot%\system32\shdocvw.dll ], 2 times
  171. Key: [ HKLM\SOFTWARE\CLASSES\CLSID\{DD313E04-FEFF-11D1-8ECD-0000F87A470C}\INPROCSERVER32 ],
  172. Value Name: [ ], Value: [ %SystemRoot%\system32\browseui.dll ], 3 times
  173. Key: [ HKLM\SOFTWARE\CLASSES\CLSID\{DD313E04-FEFF-11D1-8ECD-0000F87A470C}\INPROCSERVER32 ],
  174. Value Name: [ ThreadingModel ], Value: [ Both ], 1 time
  175. Key: [ HKLM\Software\Classes\CLSID\{871c5380-42a0-1069-a2ea-08002b30309d}\InProcServer32 ],
  176. Value Name: [ ], Value: [ %SystemRoot%\system32\shdocvw.dll ], 1 time
  177. Key: [ HKLM\Software\Classes\CLSID\{dd313e04-feff-11d1-8ecd-0000f87a470c}\InProcServer32 ],
  178. Value Name: [ ], Value: [ %SystemRoot%\system32\browseui.dll ], 1 time
  179. Key: [ HKLM\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383} ],
  180. Value Name: [ IsInstalled ], Value: [ 1 ], 1 time
  181. Key: [ HKLM\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383} ],
  182. Value Name: [ Locale ], Value: [ en ], 2 times
  183. Key: [ HKLM\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383} ],
  184. Value Name: [ Version ], Value: [ 6,0,2900,5512 ], 2 times
  185. Key: [ HKLM\Software\Microsoft\COM3 ],
  186. Value Name: [ REGDBVersion ], Value: [ 0x0b00000000000000 ], 6 times
  187. Key: [ HKLM\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm ],
  188. Value Name: [ wheel ], Value: [ 1 ], 1 time
  189. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\AppEvents\Schemes\Apps\Explorer\Navigating\.current ],
  190. Value Name: [ ], Value: [ %SystemRoot%\media\Windows XP Start.wav ], 1 time
  191. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Keyboard Layout\Toggle ],
  192. Value Name: [ Language Hotkey ], Value: [ 1 ], 2 times
  193. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Keyboard Layout\Toggle ],
  194. Value Name: [ Layout Hotkey ], Value: [ 2 ], 2 times
  195. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\\\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837} ],
  196. Value Name: [ Version ], Value: [ 3 ], 1 time
  197. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\\\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count ],
  198. Value Name: [ HRZR_PGYFRFFVBA ], Value: [ 0x967c5e0e06000000 ], 1 time
  199. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\\\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9} ],
  200. Value Name: [ Version ], Value: [ 3 ], 1 time
  201. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\\\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count ],
  202. Value Name: [ HRZR_PGYFRFFVBA ], Value: [ 0xe57b5e0e05000000 ], 1 time
  203. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS ],
  204. Value Name: [ WarnOnPost ], Value: [ 0x01000000 ], 1 time
  205. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELL EXTENSIONS\CACHED ],
  206. Value Name: [ {871C5380-42A0-1069-A2EA-08002B30309D} {000214E6-0000-0000-C000-000000000046} 0x401 ], Value: [ 0x010000007c6c9c7cc0da56ab0ac5c801 ], 1 time
  207. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Internet Connection Wizard ],
  208. Value Name: [ Completed ], Value: [ 1 ], 1 time
  209. Key: [ HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\Internet Explorer\Main ],
  210. Value Name: [ NoUpdateCheck ], Value: [ 1 ], 1 time
  211.  
  212. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  213. Monitored Registry Keys:
  214. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  215. Key: [ HKU ],
  216. Watch subtree: [ 1 ], Notify Filter: [ Key Change,Value Change ], 1 time
  217.  
  218.  
  219. [=============================================================================]
  220. 2.b) iexplore.exe - File Activities
  221. [=============================================================================]
  222. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  223. Memory Mapped Files:
  224. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  225. File Name: [ C:\WINDOWS\system32\WINMM.dll ]
  226.  
  227. [=============================================================================]
  228. 2.c) iexplore.exe - Other Activities
  229. [=============================================================================]
  230. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  231. Mutexes Created:
  232. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  233. Mutex: [ MSCTF.Shared.MUTEX.IFG ]
  234. Mutex: [ _SHuassist.mtx ]
  235.  
  236. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  237. Keyboard Keys Monitored:
  238. [=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
  239. Virtual Key Code: [ VK_CONTROL (17) ], 7 times
  240. Virtual Key Code: [ VK_LBUTTON (1) ], 39 times
  241. Virtual Key Code: [ VK_RBUTTON (2) ], 1 time
  242. Virtual Key Code: [ VK_SHIFT (16) ], 6 times
  243. Virtual Key Code: [ VK_MBUTTON (4) ], 1 time
  244. Virtual Key Code: [ VK_MENU (18) ], 5 times
  245. Virtual Key Code: [ VK_LSHIFT (160) ], 4 times
  246. Virtual Key Code: [ VK_LCONTROL (162) ], 4 times
  247. Virtual Key Code: [ VK_LMENU (164) ], 4 times
  248.  
  249.  
  250.  
  251.  
  252. [#############################################################################]
  253. International Secure Systems Lab
  254. http://www.iseclab.org
  255.  
  256. Vienna University of Technology Eurecom France UC Santa Barbara
  257. http://www.tuwien.ac.at http://www.eurecom.fr http://www.cs.ucsb.edu
  258.  
  259. Contact: [email protected]
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!