API tools faq
paste
paladin316

manual_2019-07-14_08_30.txt

paladin316
Jul 14th, 2019
2,148
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 15.29 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: ""
  3.  
  4. * MalScore: 5.2
  5.  
  6. * File Name: "manual"
  7. * File Size: 287632
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed"
  9. * SHA256: "71a7e3514a64713d94ccbc0c4a95999288a5e8179760aed1cd3ac931b07aecf7"
  10. * MD5: "1c21f342dd0a296bc9704b8c82dbef4b"
  11. * SHA1: "0caa0b9e635a1ffc2cfd5f54bda316f21e443804"
  12. * SHA512: "2c2e1d7388b393967cd302c2b82609694039b5dcc0727080ef1b998e22fc698d17f4bf2d1a87942dbcba41636adc51c5e866cb10a8916faf35d30265a6fa61dd"
  13. * CRC32: "D357E1D6"
  14. * SSDEEP: "6144:Emvr9RLcN0BvxoLjGRU4UUU3UUUD9rOAeUQMp+l6HQNcrfYAkMWld2804kcsiHeL:Emr9RUsJGjqU4UUU3UUUZa7UQM+crJhR"
  15.  
  16. * Process Execution:
  17. "manual.exe",
  18. "setup-stub.exe",
  19. "chrome.exe"
  20.  
  21.  
  22. * Executed Commands:
  23. ".\\setup-stub.exe",
  24. "https://www.mozilla.org/pt-BR/firefox/installer-help/?channel=release&installer_lang=pt-BR "
  25.  
  26.  
  27. * Signatures Detected:
  28.  
  29. "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
  30. "Details":
  31.  
  32. "IP": "72.21.91.29:80"
  33.  
  34.  
  35.  
  36.  
  37. "Description": "Creates RWX memory",
  38. "Details":
  39.  
  40.  
  41. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  42. "Details":
  43.  
  44. "ioc": "www.digicert.com1"
  45.  
  46.  
  47.  
  48.  
  49. "Description": "Reads data out of its own binary image",
  50. "Details":
  51.  
  52. "self_read": "process: manual.exe, pid: 1592, offset: 0x00000000, length: 0x0001ee02"
  53.  
  54.  
  55. "self_read": "process: manual.exe, pid: 1592, offset: 0x00000000, length: 0x0001ffa0"
  56.  
  57.  
  58. "self_read": "process: manual.exe, pid: 1592, offset: 0x0001ec76, length: 0x000251dd"
  59.  
  60.  
  61. "self_read": "process: setup-stub.exe, pid: 1248, offset: 0x00000000, length: 0x0005f0d3"
  62.  
  63.  
  64. "self_read": "process: setup-stub.exe, pid: 1248, offset: 0x00012c1c, length: 0x000466b3"
  65.  
  66.  
  67. "self_read": "process: setup-stub.exe, pid: 1248, offset: 0x0005f0d3, length: 0x00000004"
  68.  
  69.  
  70.  
  71.  
  72. "Description": "Drops a binary and executes it",
  73. "Details":
  74.  
  75. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\7zS83611975\\setup-stub.exe"
  76.  
  77.  
  78.  
  79.  
  80. "Description": "Performs some HTTP requests",
  81. "Details":
  82.  
  83. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D"
  84.  
  85.  
  86. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEAXB0qT3Mg8CsqKRSW7q9fs%3D"
  87.  
  88.  
  89. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D"
  90.  
  91.  
  92. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAsfjNWeZHRr6uFT7MohBms%3D"
  93.  
  94.  
  95. "url": "http://download-stats.mozilla.org/stub/v8/release/release/pt-BR/1/1/6/1/7601/1/0/24/0/0/48183696/48183696/0/0/37/37/0/30/4/0/0/1/0/0/0/0/0/1/1/0/3/13.225.227.56//0/0"
  96.  
  97.  
  98.  
  99.  
  100. "Description": "The binary likely contains encrypted or compressed data.",
  101. "Details":
  102.  
  103. "section": "name: UPX1, entropy: 7.90, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x0000f600, virtual_size: 0x00010000"
  104.  
  105.  
  106. "section": "name: .rsrc, entropy: 7.40, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x0000f200, virtual_size: 0x00010000"
  107.  
  108.  
  109.  
  110.  
  111. "Description": "The executable is compressed using UPX",
  112. "Details":
  113.  
  114. "section": "name: UPX0, entropy: 0.00, characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x00024000"
  115.  
  116.  
  117.  
  118.  
  119. "Description": "Anomalous binary characteristics",
  120. "Details":
  121.  
  122. "anomaly": "Actual checksum does not match that reported in PE header"
  123.  
  124.  
  125.  
  126.  
  127.  
  128. * Started Service:
  129.  
  130. * Mutexes:
  131. "CicLoadWinStaWinSta0",
  132. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  133. "Local\\ZonesCounterMutex",
  134. "Local\\ZoneAttributeCacheCounterMutex",
  135. "Local\\ZonesCacheCounterMutex",
  136. "Local\\ZonesLockedCacheCounterMutex"
  137.  
  138.  
  139. * Modified Files:
  140. "C:\\Users\\user\\AppData\\Local\\Temp\\7zS83611975\\setup-stub.exe",
  141. "C:\\Users\\user\\AppData\\Local\\Temp\\7zS83611975\\postSigningData",
  142. "C:\\Users\\user\\AppData\\Local\\Temp\\nsp1DCC.tmp\\System.dll",
  143. "C:\\Users\\user\\AppData\\Local\\Temp\\nsp1DCC.tmp\\UAC.dll",
  144. "C:\\Users\\user\\AppData\\Local\\Temp\\nsp1DCC.tmp\\UserInfo.dll",
  145. "C:\\Users\\user\\AppData\\Local\\Temp\\nsp1DCC.tmp\\bgstub.jpg",
  146. "C:\\Users\\user\\AppData\\Local\\Temp\\nsp1DCC.tmp\\bgstub_2x.jpg",
  147. "C:\\Users\\user\\AppData\\Local\\Temp\\nsp1DCC.tmp\\nsDialogs.dll",
  148. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFDE8D51AB8E546B14.TMP",
  149. "C:\\Users\\user\\AppData\\Local\\Temp\\nsp1DCC.tmp\\InetBgDL.dll",
  150. "C:\\Users\\user\\AppData\\Local\\Temp\\nsp1DCC.tmp\\download.exe",
  151. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6",
  152. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6",
  153. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\A9E4F776657345B52012CE8E279D314C_DCA82AA47C444DFAE483555D3A592A95",
  154. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\A9E4F776657345B52012CE8E279D314C_DCA82AA47C444DFAE483555D3A592A95",
  155. "C:\\Users\\user\\AppData\\Local\\Temp\\nsp1DCC.tmp\\CertCheck.dll",
  156. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5",
  157. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5",
  158. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\66AE3BFDF94A732B262342AD2154B86E_A83A97708CE96FC26E06A3D724322DEF",
  159. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\66AE3BFDF94A732B262342AD2154B86E_A83A97708CE96FC26E06A3D724322DEF",
  160. "C:\\Users\\user\\AppData\\Local\\Temp\\nsp1DCC.tmp\\_temp",
  161. "C:\\Program Files (x86)\\Google\\Chrome\\Application\\debug.log"
  162.  
  163.  
  164. * Deleted Files:
  165. "C:\\Users\\user\\AppData\\Local\\Temp\\7zS83611975\\postSigningData",
  166. "C:\\Users\\user\\AppData\\Local\\Temp\\7zS83611975\\setup-stub.exe",
  167. "C:\\Users\\user\\AppData\\Local\\Temp\\7zS83611975",
  168. "C:\\Users\\user\\AppData\\Local\\Temp\\nse1D8C.tmp",
  169. "C:\\Users\\user\\AppData\\Local\\Temp\\nsp1DCC.tmp",
  170. "C:\\Program Files\\nse1E2A.tmp",
  171. "C:\\Program Files\\nse1E2A.tmp\\nse1E2B.tmp",
  172. "C:\\Program Files\\nse1E2A.tmp\\",
  173. "C:\\Program Files\\nsu1E3C.tmp",
  174. "C:\\Program Files\\nsu1E3C.tmp\\nsu1E3D.tmp",
  175. "C:\\Program Files\\nsu1E3C.tmp\\",
  176. "C:\\Users\\user\\AppData\\Local\\Temp\\nsp1DCC.tmp\\_temp",
  177. "C:\\Users\\user\\AppData\\Local\\Temp\\nsp1DCC.tmp\\download.exe",
  178. "C:\\Users\\user\\AppData\\Local\\Temp\\nsp1DCC.tmp\\bgstub.jpg",
  179. "C:\\Users\\user\\AppData\\Local\\Temp\\nsp1DCC.tmp\\bgstub_2x.jpg",
  180. "C:\\Users\\user\\AppData\\Local\\Temp\\nsp1DCC.tmp\\CertCheck.dll",
  181. "C:\\Users\\user\\AppData\\Local\\Temp\\nsp1DCC.tmp\\InetBgDL.dll",
  182. "C:\\Users\\user\\AppData\\Local\\Temp\\nsp1DCC.tmp\\nsDialogs.dll",
  183. "C:\\Users\\user\\AppData\\Local\\Temp\\nsp1DCC.tmp\\System.dll",
  184. "C:\\Users\\user\\AppData\\Local\\Temp\\nsp1DCC.tmp\\UAC.dll",
  185. "C:\\Users\\user\\AppData\\Local\\Temp\\nsp1DCC.tmp\\UserInfo.dll",
  186. "C:\\Users\\user\\AppData\\Local\\Temp\\nsp1DCC.tmp\\",
  187. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFDE8D51AB8E546B14.TMP"
  188.  
  189.  
  190. * Modified Registry Keys:
  191. "HKEY_LOCAL_MACHINE\\Software\\Mozilla",
  192. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Mozilla\\FirefoxInstallerTest",
  193. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  194. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect"
  195.  
  196.  
  197. * Deleted Registry Keys:
  198. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Mozilla\\FirefoxInstallerTest",
  199. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  200. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  201. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  202. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName"
  203.  
  204.  
  205. * DNS Communications:
  206.  
  207. "type": "A",
  208. "request": "download.mozilla.org",
  209. "answers":
  210.  
  211. "data": "3.220.106.167",
  212. "type": "A"
  213.  
  214.  
  215. "data": "107.23.239.18",
  216. "type": "A"
  217.  
  218.  
  219. "data": "52.73.142.240",
  220. "type": "A"
  221.  
  222.  
  223. "data": "3.95.88.153",
  224. "type": "A"
  225.  
  226.  
  227. "data": "35.170.161.119",
  228. "type": "A"
  229.  
  230.  
  231. "data": "52.86.101.158",
  232. "type": "A"
  233.  
  234.  
  235. "data": "bouncer-bouncer-elb.prod.mozaws.net",
  236. "type": "CNAME"
  237.  
  238.  
  239.  
  240.  
  241. "type": "A",
  242. "request": "download-installer.cdn.mozilla.net",
  243. "answers":
  244.  
  245. "data": "dn6m9t4qll5h.cloudfront.net",
  246. "type": "CNAME"
  247.  
  248.  
  249. "data": "13.225.227.56",
  250. "type": "A"
  251.  
  252.  
  253.  
  254.  
  255. "type": "A",
  256. "request": "download-stats.mozilla.org",
  257. "answers":
  258.  
  259. "data": "52.88.2.20",
  260. "type": "A"
  261.  
  262.  
  263. "data": "download-stats.r53-2.services.mozilla.com",
  264. "type": "CNAME"
  265.  
  266.  
  267. "data": "52.42.67.12",
  268. "type": "A"
  269.  
  270.  
  271.  
  272.  
  273.  
  274. * Domains:
  275.  
  276. "ip": "13.225.227.56",
  277. "domain": "download-installer.cdn.mozilla.net"
  278.  
  279.  
  280. "ip": "107.23.239.18",
  281. "domain": "download.mozilla.org"
  282.  
  283.  
  284. "ip": "52.88.2.20",
  285. "domain": "download-stats.mozilla.org"
  286.  
  287.  
  288.  
  289. * Network Communication - ICMP:
  290.  
  291. * Network Communication - HTTP:
  292.  
  293. "count": 1,
  294. "body": "",
  295. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D",
  296. "user-agent": "Microsoft-CryptoAPI/6.1",
  297. "method": "GET",
  298. "host": "ocsp.digicert.com",
  299. "version": "1.1",
  300. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D",
  301. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D HTTP/1.1\r\nCache-Control: max-age = 142986\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 07:40:28 GMT\r\nIf-None-Match: \"5cece5ec-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  302. "port": 80
  303.  
  304.  
  305. "count": 1,
  306. "body": "",
  307. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEAXB0qT3Mg8CsqKRSW7q9fs%3D",
  308. "user-agent": "Microsoft-CryptoAPI/6.1",
  309. "method": "GET",
  310. "host": "ocsp.digicert.com",
  311. "version": "1.1",
  312. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEAXB0qT3Mg8CsqKRSW7q9fs%3D",
  313. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEAXB0qT3Mg8CsqKRSW7q9fs%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  314. "port": 80
  315.  
  316.  
  317. "count": 1,
  318. "body": "",
  319. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D",
  320. "user-agent": "Microsoft-CryptoAPI/6.1",
  321. "method": "GET",
  322. "host": "ocsp.digicert.com",
  323. "version": "1.1",
  324. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D",
  325. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1\r\nCache-Control: max-age = 149079\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 11:10:47 GMT\r\nIf-None-Match: \"5c961437-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  326. "port": 80
  327.  
  328.  
  329. "count": 1,
  330. "body": "",
  331. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAsfjNWeZHRr6uFT7MohBms%3D",
  332. "user-agent": "Microsoft-CryptoAPI/6.1",
  333. "method": "GET",
  334. "host": "ocsp.digicert.com",
  335. "version": "1.1",
  336. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAsfjNWeZHRr6uFT7MohBms%3D",
  337. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAsfjNWeZHRr6uFT7MohBms%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  338. "port": 80
  339.  
  340.  
  341. "count": 1,
  342. "body": "",
  343. "uri": "http://download-stats.mozilla.org/stub/v8/release/release/pt-BR/1/1/6/1/7601/1/0/24/0/0/48183696/48183696/0/0/37/37/0/30/4/0/0/1/0/0/0/0/0/1/1/0/3/13.225.227.56//0/0",
  344. "user-agent": "NSIS InetBgDL (Mozilla)",
  345. "method": "GET",
  346. "host": "download-stats.mozilla.org",
  347. "version": "1.1",
  348. "path": "/stub/v8/release/release/pt-BR/1/1/6/1/7601/1/0/24/0/0/48183696/48183696/0/0/37/37/0/30/4/0/0/1/0/0/0/0/0/1/1/0/3/13.225.227.56//0/0",
  349. "data": "GET /stub/v8/release/release/pt-BR/1/1/6/1/7601/1/0/24/0/0/48183696/48183696/0/0/37/37/0/30/4/0/0/1/0/0/0/0/0/1/1/0/3/13.225.227.56//0/0 HTTP/1.1\r\nRange: bytes=0-\r\nUser-Agent: NSIS InetBgDL (Mozilla)\r\nHost: download-stats.mozilla.org\r\nConnection: Keep-Alive\r\n\r\n",
  350. "port": 80
  351.  
  352.  
  353.  
  354. * Network Communication - SMTP:
  355.  
  356. * Network Communication - Hosts:
  357.  
  358. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!