API tools faq
paste
paladin316

Pendencias_pdf_exe_2019-07-14_06_30.txt

paladin316
Jul 14th, 2019
2,095
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 15.34 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: ""
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Pendencias_pdf.exe"
  7. * File Size: 3482624
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "ab250cd45a3b77e7d5c77182c0b8f50af8d84db165534e820696b6fbdd543139"
  10. * MD5: "d089629d56e0d9790ec4aeb5186cd473"
  11. * SHA1: "1aa647a07518982d394af500a309ea3f99f7fa7e"
  12. * SHA512: "b8ffcb95f5b49a30698732ab29b69c2086561bff467123500ebd2456e6340826565c41a89e0efacb7c3cfe7194edde0f1ec4a60504762b8ed98ac270c7f9d2c3"
  13. * CRC32: "2AA01047"
  14. * SSDEEP: "49152:WWOMCWo/ZnSwnHopRjrXY7JG+8yJtZkWLYBCD2xgDH6/1ooqu3BR6KxdrAfNa2A0:WyRoHobjYsD+Zky6I2MHZu3BsqdrERZ"
  15.  
  16. * Process Execution:
  17. "Pendencias_pdf.exe",
  18. "revFile.exe"
  19.  
  20.  
  21. * Executed Commands:
  22. "C:\\Users\\user\\AppData\\Local\\Temp\\revFile.exe "
  23.  
  24.  
  25. * Signatures Detected:
  26.  
  27. "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
  28. "Details":
  29.  
  30. "IP": "172.217.13.163:80"
  31.  
  32.  
  33.  
  34.  
  35. "Description": "Creates RWX memory",
  36. "Details":
  37.  
  38.  
  39. "Description": "Possible date expiration check, exits too soon after checking local time",
  40. "Details":
  41.  
  42. "process": "Pendencias_pdf.exe, PID 1320"
  43.  
  44.  
  45.  
  46.  
  47. "Description": "Repeatedly searches for a not-found process, may want to run with startbrowser=1 option",
  48. "Details":
  49.  
  50.  
  51. "Description": "A process created a hidden window",
  52. "Details":
  53.  
  54. "Process": "Pendencias_pdf.exe -> C:\\Users\\user\\AppData\\Local\\Temp\\revFile.exe"
  55.  
  56.  
  57.  
  58.  
  59. "Description": "Drops a binary and executes it",
  60. "Details":
  61.  
  62. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\revFile.exe"
  63.  
  64.  
  65.  
  66.  
  67. "Description": "Attempts to mimic the file extension of a PDF document by having 'pdf' in the file name.",
  68. "Details":
  69.  
  70.  
  71. "Description": "Performs some HTTP requests",
  72. "Details":
  73.  
  74. "url": "http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D"
  75.  
  76.  
  77. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEBpNLBjUFLmji%2FUYotl0OMo%3D"
  78.  
  79.  
  80. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEFqS972SSOnF82bKuiLwrC8%3D"
  81.  
  82.  
  83. "url": "http://ipinfo.io/json"
  84.  
  85.  
  86. "url": "http://centeg.com.br/admin/conteudo_estatico/cursos/index.php"
  87.  
  88.  
  89.  
  90.  
  91. "Description": "The binary likely contains encrypted or compressed data.",
  92. "Details":
  93.  
  94. "section": "name: , entropy: 8.00, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x000bb200, virtual_size: 0x002a5000"
  95.  
  96.  
  97. "section": "name: , entropy: 7.97, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00001800, virtual_size: 0x00004000"
  98.  
  99.  
  100. "section": "name: , entropy: 7.99, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00007600, virtual_size: 0x00013000"
  101.  
  102.  
  103. "section": "name: , entropy: 7.99, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00003800, virtual_size: 0x00004000"
  104.  
  105.  
  106. "section": "name: , entropy: 7.82, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000400, virtual_size: 0x00001000"
  107.  
  108.  
  109. "section": "name: , entropy: 8.00, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x0001ce00, virtual_size: 0x0003d000"
  110.  
  111.  
  112. "section": "name: .rsrc, entropy: 7.85, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00013800, virtual_size: 0x00042000"
  113.  
  114.  
  115. "section": "name: , entropy: 8.00, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x001f3200, virtual_size: 0x00a52000"
  116.  
  117.  
  118. "section": "name: .data, entropy: 7.45, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00066600, virtual_size: 0x00067000"
  119.  
  120.  
  121.  
  122.  
  123. "Description": "Looks up the external IP address",
  124. "Details":
  125.  
  126. "domain": "ipinfo.io"
  127.  
  128.  
  129.  
  130.  
  131. "Description": "Attempts to modify desktop wallpaper",
  132. "Details":
  133.  
  134.  
  135. "Description": "Installs itself for autorun at Windows startup",
  136. "Details":
  137.  
  138. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\TCP/IP Host Run"
  139.  
  140.  
  141. "data": "C:\\Users\\user\\AppData\\Local\\Temp\\WinPlugin\\wermg92.exe"
  142.  
  143.  
  144. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\TCP/IP Host Temp"
  145.  
  146.  
  147. "data": "C:\\Users\\user\\Documents\\FCorporation Protection\\wermg92.exe"
  148.  
  149.  
  150. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\Windows Problem Reporting"
  151.  
  152.  
  153. "data": "C:\\Users\\user\\AppData\\Local\\Temp\\wermg37.exe"
  154.  
  155.  
  156. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\Windows Problema Reporting RunOnce"
  157.  
  158.  
  159. "data": "C:\\Users\\user\\AppData\\Local\\Temp\\WinPlugin\\wermg92.exe"
  160.  
  161.  
  162.  
  163.  
  164. "Description": "Anomalous binary characteristics",
  165. "Details":
  166.  
  167. "anomaly": "Found duplicated section names"
  168.  
  169.  
  170.  
  171.  
  172.  
  173. * Started Service:
  174.  
  175. * Mutexes:
  176.  
  177. * Modified Files:
  178. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\CFE86DBBE02D859DC92F1E17E0574EE8_FDB452422670E72EDD3FB3D65568F821",
  179. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\CFE86DBBE02D859DC92F1E17E0574EE8_FDB452422670E72EDD3FB3D65568F821",
  180. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F5F320A94D4D2B4465D8F17E2BB2D351_DDF562EBDDF2102641AD26ADF64754F7",
  181. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F5F320A94D4D2B4465D8F17E2BB2D351_DDF562EBDDF2102641AD26ADF64754F7",
  182. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F5F320A94D4D2B4465D8F17E2BB2D351_DDFCC07D71C2D37BB174FF8D6B02A3FB",
  183. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F5F320A94D4D2B4465D8F17E2BB2D351_DDFCC07D71C2D37BB174FF8D6B02A3FB",
  184. "C:\\Users\\user\\AppData\\Local\\Temp\\revFile.zip",
  185. "C:\\Users\\user\\AppData\\Local\\Temp\\revFile.exe",
  186. "C:\\Users\\user\\AppData\\Local\\FCorporation Protection\\wermg92.exe",
  187. "C:\\Users\\user\\Documents\\FCorporation Protection\\wermg92.exe",
  188. "C:\\Users\\user\\AppData\\Local\\Temp\\WinPlugin\\wermg92.exe",
  189. "C:\\Users\\user\\AppData\\Local\\Temp\\wermg37.exe",
  190. "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Local State",
  191. "C:\\Users\\user\\AppData\\Roaming\\semtitulo.cur",
  192. "C:\\Users\\user\\AppData\\Roaming\\arrow1.cur",
  193. "C:\\Users\\user\\AppData\\Roaming\\select1.cur",
  194. "C:\\Users\\user\\AppData\\Roaming\\link1.cur"
  195.  
  196.  
  197. * Deleted Files:
  198. "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Local State"
  199.  
  200.  
  201. * Modified Registry Keys:
  202. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System",
  203. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr",
  204. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\HideFastUserSwitching",
  205. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableChangePassword",
  206. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\HideUserSwitching",
  207. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableLockWorkstation",
  208. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\",
  209. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoChangeStartMenu",
  210. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose",
  211. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSwitch",
  212. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoUserSwitch",
  213. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\HideFastUserSwitching",
  214. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoLogOff",
  215. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun",
  216. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\TCP/IP Host Temp",
  217. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\Windows Problem Reporting",
  218. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\TCP/IP Host Run",
  219. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\Windows Problema Reporting RunOnce",
  220. "HKEY_CURRENT_USER\\VersionFCLab",
  221. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\VersionFCLab",
  222. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\VersionFCLab\\wermg92.exe",
  223. "HKEY_CURRENT_USER\\Control Panel\\Desktop\\Wallpaper"
  224.  
  225.  
  226. * Deleted Registry Keys:
  227. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr"
  228.  
  229.  
  230. * DNS Communications:
  231.  
  232. "type": "A",
  233. "request": "doc-10-7s-docs.googleusercontent.com",
  234. "answers":
  235.  
  236. "data": "172.217.13.161",
  237. "type": "A"
  238.  
  239.  
  240. "data": "googlehosted.l.googleusercontent.com",
  241. "type": "CNAME"
  242.  
  243.  
  244.  
  245.  
  246. "type": "A",
  247. "request": "ipinfo.io",
  248. "answers":
  249.  
  250. "data": "216.239.34.21",
  251. "type": "A"
  252.  
  253.  
  254. "data": "216.239.36.21",
  255. "type": "A"
  256.  
  257.  
  258. "data": "216.239.38.21",
  259. "type": "A"
  260.  
  261.  
  262. "data": "216.239.32.21",
  263. "type": "A"
  264.  
  265.  
  266.  
  267.  
  268. "type": "A",
  269. "request": "centeg.com.br",
  270. "answers":
  271.  
  272. "data": "104.28.27.17",
  273. "type": "A"
  274.  
  275.  
  276. "data": "104.28.26.17",
  277. "type": "A"
  278.  
  279.  
  280.  
  281.  
  282.  
  283. * Domains:
  284.  
  285. "ip": "216.239.32.21",
  286. "domain": "ipinfo.io"
  287.  
  288.  
  289. "ip": "104.28.26.17",
  290. "domain": "centeg.com.br"
  291.  
  292.  
  293. "ip": "172.217.13.129",
  294. "domain": "doc-10-7s-docs.googleusercontent.com"
  295.  
  296.  
  297.  
  298. * Network Communication - ICMP:
  299.  
  300. * Network Communication - HTTP:
  301.  
  302. "count": 1,
  303. "body": "",
  304. "uri": "http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D",
  305. "user-agent": "Microsoft-CryptoAPI/6.1",
  306. "method": "GET",
  307. "host": "ocsp.pki.goog",
  308. "version": "1.1",
  309. "path": "/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D",
  310. "data": "GET /gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  311. "port": 80
  312.  
  313.  
  314. "count": 1,
  315. "body": "",
  316. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEBpNLBjUFLmji%2FUYotl0OMo%3D",
  317. "user-agent": "Microsoft-CryptoAPI/6.1",
  318. "method": "GET",
  319. "host": "ocsp.pki.goog",
  320. "version": "1.1",
  321. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEBpNLBjUFLmji%2FUYotl0OMo%3D",
  322. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEBpNLBjUFLmji%2FUYotl0OMo%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  323. "port": 80
  324.  
  325.  
  326. "count": 1,
  327. "body": "",
  328. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEFqS972SSOnF82bKuiLwrC8%3D",
  329. "user-agent": "Microsoft-CryptoAPI/6.1",
  330. "method": "GET",
  331. "host": "ocsp.pki.goog",
  332. "version": "1.1",
  333. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEFqS972SSOnF82bKuiLwrC8%3D",
  334. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEFqS972SSOnF82bKuiLwrC8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  335. "port": 80
  336.  
  337.  
  338. "count": 4,
  339. "body": "",
  340. "uri": "http://ipinfo.io/json",
  341. "user-agent": "Mozilla/3.0 (compatible; Indy Library)",
  342. "method": "GET",
  343. "host": "ipinfo.io",
  344. "version": "1.1",
  345. "path": "/json",
  346. "data": "GET /json HTTP/1.1\r\nHost: ipinfo.io\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nUser-Agent: Mozilla/3.0 (compatible; Indy Library)\r\n\r\n",
  347. "port": 80
  348.  
  349.  
  350. "count": 3,
  351. "body": "",
  352. "uri": "http://centeg.com.br/admin/conteudo_estatico/cursos/index.php",
  353. "user-agent": "Mozilla/3.0 (compatible; Indy Library)",
  354. "method": "GET",
  355. "host": "centeg.com.br",
  356. "version": "1.1",
  357. "path": "/admin/conteudo_estatico/cursos/index.php",
  358. "data": "GET /admin/conteudo_estatico/cursos/index.php HTTP/1.1\r\nHost: centeg.com.br\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nUser-Agent: Mozilla/3.0 (compatible; Indy Library)\r\n\r\n",
  359. "port": 80
  360.  
  361.  
  362.  
  363. * Network Communication - SMTP:
  364.  
  365. * Network Communication - Hosts:
  366.  
  367. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!