API tools faq
paste
paladin316

manual_2019-07-14_01_30.txt

paladin316
Jul 14th, 2019
2,106
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 15.42 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: ""
  3.  
  4. * MalScore: 5.2
  5.  
  6. * File Name: "manual"
  7. * File Size: 287632
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed"
  9. * SHA256: "71a7e3514a64713d94ccbc0c4a95999288a5e8179760aed1cd3ac931b07aecf7"
  10. * MD5: "1c21f342dd0a296bc9704b8c82dbef4b"
  11. * SHA1: "0caa0b9e635a1ffc2cfd5f54bda316f21e443804"
  12. * SHA512: "2c2e1d7388b393967cd302c2b82609694039b5dcc0727080ef1b998e22fc698d17f4bf2d1a87942dbcba41636adc51c5e866cb10a8916faf35d30265a6fa61dd"
  13. * CRC32: "D357E1D6"
  14. * SSDEEP: "6144:Emvr9RLcN0BvxoLjGRU4UUU3UUUD9rOAeUQMp+l6HQNcrfYAkMWld2804kcsiHeL:Emr9RUsJGjqU4UUU3UUUZa7UQM+crJhR"
  15.  
  16. * Process Execution:
  17. "manual.exe",
  18. "setup-stub.exe",
  19. "chrome.exe"
  20.  
  21.  
  22. * Executed Commands:
  23. ".\\setup-stub.exe",
  24. "https://www.mozilla.org/pt-BR/firefox/installer-help/?channel=release&installer_lang=pt-BR "
  25.  
  26.  
  27. * Signatures Detected:
  28.  
  29. "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
  30. "Details":
  31.  
  32. "IP": "72.21.91.29:80"
  33.  
  34.  
  35.  
  36.  
  37. "Description": "Creates RWX memory",
  38. "Details":
  39.  
  40.  
  41. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  42. "Details":
  43.  
  44. "ioc": "www.digicert.com1"
  45.  
  46.  
  47.  
  48.  
  49. "Description": "Reads data out of its own binary image",
  50. "Details":
  51.  
  52. "self_read": "process: manual.exe, pid: 744, offset: 0x00000000, length: 0x0000ffe0"
  53.  
  54.  
  55. "self_read": "process: manual.exe, pid: 744, offset: 0x00000000, length: 0x0001ee02"
  56.  
  57.  
  58. "self_read": "process: manual.exe, pid: 744, offset: 0x0000ffe0, length: 0x0000ffc0"
  59.  
  60.  
  61. "self_read": "process: manual.exe, pid: 744, offset: 0x0001ec76, length: 0x000251dd"
  62.  
  63.  
  64. "self_read": "process: setup-stub.exe, pid: 1248, offset: 0x00000000, length: 0x0005f0d3"
  65.  
  66.  
  67. "self_read": "process: setup-stub.exe, pid: 1248, offset: 0x00012c1c, length: 0x000466b3"
  68.  
  69.  
  70. "self_read": "process: setup-stub.exe, pid: 1248, offset: 0x0005f0d3, length: 0x00000004"
  71.  
  72.  
  73.  
  74.  
  75. "Description": "Drops a binary and executes it",
  76. "Details":
  77.  
  78. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\7zS8E20282C\\setup-stub.exe"
  79.  
  80.  
  81.  
  82.  
  83. "Description": "Performs some HTTP requests",
  84. "Details":
  85.  
  86. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D"
  87.  
  88.  
  89. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEAXB0qT3Mg8CsqKRSW7q9fs%3D"
  90.  
  91.  
  92. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D"
  93.  
  94.  
  95. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAsfjNWeZHRr6uFT7MohBms%3D"
  96.  
  97.  
  98. "url": "http://download-stats.mozilla.org/stub/v8/release/release/pt-BR/1/1/6/1/7601/1/0/24/0/0/48183696/48183696/0/0/36/35/0/30/3/0/0/1/0/0/0/0/0/1/1/0/3/143.204.141.60//0/0"
  99.  
  100.  
  101.  
  102.  
  103. "Description": "The binary likely contains encrypted or compressed data.",
  104. "Details":
  105.  
  106. "section": "name: UPX1, entropy: 7.90, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x0000f600, virtual_size: 0x00010000"
  107.  
  108.  
  109. "section": "name: .rsrc, entropy: 7.40, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x0000f200, virtual_size: 0x00010000"
  110.  
  111.  
  112.  
  113.  
  114. "Description": "The executable is compressed using UPX",
  115. "Details":
  116.  
  117. "section": "name: UPX0, entropy: 0.00, characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x00024000"
  118.  
  119.  
  120.  
  121.  
  122. "Description": "Anomalous binary characteristics",
  123. "Details":
  124.  
  125. "anomaly": "Actual checksum does not match that reported in PE header"
  126.  
  127.  
  128.  
  129.  
  130.  
  131. * Started Service:
  132.  
  133. * Mutexes:
  134. "CicLoadWinStaWinSta0",
  135. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  136. "Local\\ZonesCounterMutex",
  137. "Local\\ZoneAttributeCacheCounterMutex",
  138. "Local\\ZonesCacheCounterMutex",
  139. "Local\\ZonesLockedCacheCounterMutex"
  140.  
  141.  
  142. * Modified Files:
  143. "C:\\Users\\user\\AppData\\Local\\Temp\\7zS8E20282C\\setup-stub.exe",
  144. "C:\\Users\\user\\AppData\\Local\\Temp\\7zS8E20282C\\postSigningData",
  145. "C:\\Users\\user\\AppData\\Local\\Temp\\nsn20AA.tmp\\System.dll",
  146. "C:\\Users\\user\\AppData\\Local\\Temp\\nsn20AA.tmp\\UAC.dll",
  147. "C:\\Users\\user\\AppData\\Local\\Temp\\nsn20AA.tmp\\UserInfo.dll",
  148. "C:\\Users\\user\\AppData\\Local\\Temp\\nsn20AA.tmp\\bgstub.jpg",
  149. "C:\\Users\\user\\AppData\\Local\\Temp\\nsn20AA.tmp\\bgstub_2x.jpg",
  150. "C:\\Users\\user\\AppData\\Local\\Temp\\nsn20AA.tmp\\nsDialogs.dll",
  151. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF0AC4A9778876E1A6.TMP",
  152. "C:\\Users\\user\\AppData\\Local\\Temp\\nsn20AA.tmp\\InetBgDL.dll",
  153. "C:\\Users\\user\\AppData\\Local\\Temp\\nsn20AA.tmp\\download.exe",
  154. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6",
  155. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6",
  156. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\A9E4F776657345B52012CE8E279D314C_DCA82AA47C444DFAE483555D3A592A95",
  157. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\A9E4F776657345B52012CE8E279D314C_DCA82AA47C444DFAE483555D3A592A95",
  158. "C:\\Users\\user\\AppData\\Local\\Temp\\nsn20AA.tmp\\CertCheck.dll",
  159. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5",
  160. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5",
  161. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\66AE3BFDF94A732B262342AD2154B86E_A83A97708CE96FC26E06A3D724322DEF",
  162. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\66AE3BFDF94A732B262342AD2154B86E_A83A97708CE96FC26E06A3D724322DEF",
  163. "C:\\Users\\user\\AppData\\Local\\Temp\\nsn20AA.tmp\\_temp",
  164. "C:\\Program Files (x86)\\Google\\Chrome\\Application\\debug.log"
  165.  
  166.  
  167. * Deleted Files:
  168. "C:\\Users\\user\\AppData\\Local\\Temp\\7zS8E20282C\\postSigningData",
  169. "C:\\Users\\user\\AppData\\Local\\Temp\\7zS8E20282C\\setup-stub.exe",
  170. "C:\\Users\\user\\AppData\\Local\\Temp\\7zS8E20282C",
  171. "C:\\Users\\user\\AppData\\Local\\Temp\\nsd206B.tmp",
  172. "C:\\Users\\user\\AppData\\Local\\Temp\\nsn20AA.tmp",
  173. "C:\\Program Files\\nsn20F9.tmp",
  174. "C:\\Program Files\\nsn20F9.tmp\\nsd210A.tmp",
  175. "C:\\Program Files\\nsn20F9.tmp\\",
  176. "C:\\Program Files\\nsd210B.tmp",
  177. "C:\\Program Files\\nsd210B.tmp\\nss211B.tmp",
  178. "C:\\Program Files\\nsd210B.tmp\\",
  179. "C:\\Users\\user\\AppData\\Local\\Temp\\nsn20AA.tmp\\_temp",
  180. "C:\\Users\\user\\AppData\\Local\\Temp\\nsn20AA.tmp\\download.exe",
  181. "C:\\Users\\user\\AppData\\Local\\Temp\\nsn20AA.tmp\\bgstub.jpg",
  182. "C:\\Users\\user\\AppData\\Local\\Temp\\nsn20AA.tmp\\bgstub_2x.jpg",
  183. "C:\\Users\\user\\AppData\\Local\\Temp\\nsn20AA.tmp\\CertCheck.dll",
  184. "C:\\Users\\user\\AppData\\Local\\Temp\\nsn20AA.tmp\\InetBgDL.dll",
  185. "C:\\Users\\user\\AppData\\Local\\Temp\\nsn20AA.tmp\\nsDialogs.dll",
  186. "C:\\Users\\user\\AppData\\Local\\Temp\\nsn20AA.tmp\\System.dll",
  187. "C:\\Users\\user\\AppData\\Local\\Temp\\nsn20AA.tmp\\UAC.dll",
  188. "C:\\Users\\user\\AppData\\Local\\Temp\\nsn20AA.tmp\\UserInfo.dll",
  189. "C:\\Users\\user\\AppData\\Local\\Temp\\nsn20AA.tmp\\",
  190. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF0AC4A9778876E1A6.TMP"
  191.  
  192.  
  193. * Modified Registry Keys:
  194. "HKEY_LOCAL_MACHINE\\Software\\Mozilla",
  195. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Mozilla\\FirefoxInstallerTest",
  196. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  197. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect"
  198.  
  199.  
  200. * Deleted Registry Keys:
  201. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Mozilla\\FirefoxInstallerTest",
  202. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  203. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  204. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  205. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName"
  206.  
  207.  
  208. * DNS Communications:
  209.  
  210. "type": "A",
  211. "request": "download.mozilla.org",
  212. "answers":
  213.  
  214. "data": "3.220.106.167",
  215. "type": "A"
  216.  
  217.  
  218. "data": "52.73.142.240",
  219. "type": "A"
  220.  
  221.  
  222. "data": "3.95.88.153",
  223. "type": "A"
  224.  
  225.  
  226. "data": "35.170.161.119",
  227. "type": "A"
  228.  
  229.  
  230. "data": "52.86.101.158",
  231. "type": "A"
  232.  
  233.  
  234. "data": "bouncer-bouncer-elb.prod.mozaws.net",
  235. "type": "CNAME"
  236.  
  237.  
  238. "data": "107.23.239.18",
  239. "type": "A"
  240.  
  241.  
  242.  
  243.  
  244. "type": "A",
  245. "request": "download-installer.cdn.mozilla.net",
  246. "answers":
  247.  
  248. "data": "143.204.141.60",
  249. "type": "A"
  250.  
  251.  
  252. "data": "dn6m9t4qll5h.cloudfront.net",
  253. "type": "CNAME"
  254.  
  255.  
  256.  
  257.  
  258. "type": "A",
  259. "request": "download-stats.mozilla.org",
  260. "answers":
  261.  
  262. "data": "52.88.2.20",
  263. "type": "A"
  264.  
  265.  
  266. "data": "download-stats.r53-2.services.mozilla.com",
  267. "type": "CNAME"
  268.  
  269.  
  270. "data": "52.42.67.12",
  271. "type": "A"
  272.  
  273.  
  274.  
  275.  
  276.  
  277. * Domains:
  278.  
  279. "ip": "143.204.141.60",
  280. "domain": "download-installer.cdn.mozilla.net"
  281.  
  282.  
  283. "ip": "107.23.239.18",
  284. "domain": "download.mozilla.org"
  285.  
  286.  
  287. "ip": "52.88.2.20",
  288. "domain": "download-stats.mozilla.org"
  289.  
  290.  
  291.  
  292. * Network Communication - ICMP:
  293.  
  294. * Network Communication - HTTP:
  295.  
  296. "count": 1,
  297. "body": "",
  298. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D",
  299. "user-agent": "Microsoft-CryptoAPI/6.1",
  300. "method": "GET",
  301. "host": "ocsp.digicert.com",
  302. "version": "1.1",
  303. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D",
  304. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D HTTP/1.1\r\nCache-Control: max-age = 142986\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 07:40:28 GMT\r\nIf-None-Match: \"5cece5ec-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  305. "port": 80
  306.  
  307.  
  308. "count": 1,
  309. "body": "",
  310. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEAXB0qT3Mg8CsqKRSW7q9fs%3D",
  311. "user-agent": "Microsoft-CryptoAPI/6.1",
  312. "method": "GET",
  313. "host": "ocsp.digicert.com",
  314. "version": "1.1",
  315. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEAXB0qT3Mg8CsqKRSW7q9fs%3D",
  316. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEAXB0qT3Mg8CsqKRSW7q9fs%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  317. "port": 80
  318.  
  319.  
  320. "count": 1,
  321. "body": "",
  322. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D",
  323. "user-agent": "Microsoft-CryptoAPI/6.1",
  324. "method": "GET",
  325. "host": "ocsp.digicert.com",
  326. "version": "1.1",
  327. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D",
  328. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1\r\nCache-Control: max-age = 149079\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 11:10:47 GMT\r\nIf-None-Match: \"5c961437-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  329. "port": 80
  330.  
  331.  
  332. "count": 1,
  333. "body": "",
  334. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAsfjNWeZHRr6uFT7MohBms%3D",
  335. "user-agent": "Microsoft-CryptoAPI/6.1",
  336. "method": "GET",
  337. "host": "ocsp.digicert.com",
  338. "version": "1.1",
  339. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAsfjNWeZHRr6uFT7MohBms%3D",
  340. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAsfjNWeZHRr6uFT7MohBms%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  341. "port": 80
  342.  
  343.  
  344. "count": 1,
  345. "body": "",
  346. "uri": "http://download-stats.mozilla.org/stub/v8/release/release/pt-BR/1/1/6/1/7601/1/0/24/0/0/48183696/48183696/0/0/36/35/0/30/3/0/0/1/0/0/0/0/0/1/1/0/3/143.204.141.60//0/0",
  347. "user-agent": "NSIS InetBgDL (Mozilla)",
  348. "method": "GET",
  349. "host": "download-stats.mozilla.org",
  350. "version": "1.1",
  351. "path": "/stub/v8/release/release/pt-BR/1/1/6/1/7601/1/0/24/0/0/48183696/48183696/0/0/36/35/0/30/3/0/0/1/0/0/0/0/0/1/1/0/3/143.204.141.60//0/0",
  352. "data": "GET /stub/v8/release/release/pt-BR/1/1/6/1/7601/1/0/24/0/0/48183696/48183696/0/0/36/35/0/30/3/0/0/1/0/0/0/0/0/1/1/0/3/143.204.141.60//0/0 HTTP/1.1\r\nRange: bytes=0-\r\nUser-Agent: NSIS InetBgDL (Mozilla)\r\nHost: download-stats.mozilla.org\r\nConnection: Keep-Alive\r\n\r\n",
  353. "port": 80
  354.  
  355.  
  356.  
  357. * Network Communication - SMTP:
  358.  
  359. * Network Communication - Hosts:
  360.  
  361. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!