87649
Browser hijacker, embedded payload
Mislabeled PE hides an encrypted resource and executes a shell stageAuthenticode chain CN: New IT Limited
SHA-256016e329c87c7c1118c65090d8546c98fbab3d914b0d681955721214ee3b90fa6
Evidence
0x04d5a90000300000004000000ffff0000MZ..............
0x10b8000000000000004000000000000000........@.......
0x2000000000000000000000000000000000................
0x3000000000000000000000000000010000................
0x400e1fba0e00b409cd21b8014ccd215468........!..L.!Th
0x5069732070726f6772616d2063616e6e6fis program canno
⋯13 more rows
0x18fd060454800607564742072657475726e69`EH.`udt returni
0x18fe06e67270060636f707920636f6e737472ng'.`copy constr
0x18ff07563746f7220636c6f73757265270000uctor closure'..
0x1900060656820766563746f72207662617365`eh vector vbase
0x1901020636f6e7374727563746f7220697465 constructor ite
0x190207261746f722700006065682076656374rator'..`eh vect
0x190306f722064657374727563746f72206974or destructor it
0x19040657261746f7227006065682076656374erator'.`eh vect
0x190506f7220636f6e7374727563746f722069or constructor i
0x1906074657261746f72270000000060766972terator'....`vir
0x190707475616c20646973706c6163656d656etual displacemen
0x1908074206d617027000060766563746f7220t map'..`vector
0x19090766261736520636f6e7374727563746fvbase constructo
0x190a072206974657261746f72270060766563r iterator'.`vec
0x190b0746f722064657374727563746f722069tor destructor i
0x190c074657261746f72270000000060766563terator'....`vec
0x190d0746f7220636f6e7374727563746f7220tor constructor
0x190e06974657261746f722700000060736361iterator'...`sca
0x190f06c61722064656c6574696e6720646573lar deleting des
0x1910074727563746f72270000000060646566tructor'....`def
0x1911061756c7420636f6e7374727563746f72ault constructor
0x1912020636c6f737572652700000060766563 closure'...`vec
0x19130746f722064656c6574696e6720646573tor deleting des
0x1914074727563746f72270000000060766261tructor'....`vba
0x1915073652064657374727563746f72270000se destructor'..
0x1916060737472696e672700000000606c6f63`string'....`loc
0x19170616c2073746174696320677561726427al static guard'
0x191800000000060747970656f662700000000....`typeof'....
0x19190607663616c6c27006076627461626c65`vcall'.`vbtable
0x191a0270000006076667461626c6527000000'...`vftable'...
0x191b05e3d00007c3d0000263d00003c3c3d00^=..|=..&=..<<=.
0x191c03e3e3d00253d00002f3d00002d3d0000>>=.%=../=..-=..
0x191d02b3d00002a3d00007c7c000026260000+=..*=..||..&&..
0x191e07c0000005e0000007e00000028290000|...^...~...()..
0x191f02c0000003e3d00003c3d000025000000,...>=..<=..%...
0x192002d3e2a00260000002b0000002d000000->*.&...+...-...
0x192102d2d00002b2b00002d3e00006f706572--..++..->..oper
0x1922061746f72000000005b5d0000213d0000ator....[]..!=..
0x192303d3d0000210000003c3c00003e3e0000==..!...<<..>>..
0x192402064656c65746500206e657700000000 delete. new....
0x192505f5f756e616c69676e6564005f5f7265__unaligned.__re
0x1926073747269637400005f5f707472363400strict..__ptr64.
0x192705f5f636c7263616c6c0000005f5f6661__clrcall...__fa
⋯5 more rows
⋯3 more rows
0x1a308853a4000893a4000f43a40002f000000.:@..:@..:@./...
0x1a318720075006e006100730000005c005c00r.u.n.a.s...\.\.
0x1a3283f005c00000000005f00480079007000?.\....._.H.y.p.
⋯7 more rows
⋯3 more rows
0x1e1f000000000000000000000000000000000................
0x1e20000000000000000000400000001000600................
0x1e21018040080480000800200000068000080....H.......h...
0x1e220030000009000008005000000c8000080................
0x1e2300e000000000100801000000018010080................
⋯7 more rows
⋯3 more rows
0x8d7f001da2fbd6e5f261ceafc7d380d50a869../.n_&...}8.P.i
0x8d8002ee4adaac8af37b6be4c0650409193dd......7..L.P@...
0x8d81090d52fbd6e5f261ceafc7d380d50a869../.n_&...}8.P.i
0x8d8202ee4adaec8af37b6be4c0650409193dd......7..L.P@...
0x8d83090d52fbd6e5f261ceafc7d380d50a869../.n_&...}8.P.i
0x8d8402ee4ada2c8af37b6be4c0650409193dd......7..L.P@...
0x8d85090d52fbd6e5f261ceafc7d380d50a869../.n_&...}8.P.i
0x8d8602ee4ada6c8af37b6be4c0650409193dd......7..L.P@...
0x8d87090d52fbd6e5f261ceafc7d380d50a09c../.n_&...}8.P..
0x8d880c26c252ac9db3b60308849256c5c5f11.l%*..;`0.I%l\_.
0x8d8905f6ce7426278fb5bea7f1af644d1a1c8_l.Bbx.[....D...
0x8d8a0236d2592c9af37eb20430650409193dd#m%...7. C.P@...
0x8d8b090d52fbd6e5f261ceafc7d30a454a861../.n_&...}0.T.a
0x8d8c02ae6adcac9af3762307849e1745f2b0d*.....7b0xI.t_+.
0x8d8d0df641b72d69101f834229974ca442224.d.r....4".t.D"$
0x8d8e0224c252ac89cf702ec81ca9c071857d6"L%*..........W.
0x8d8f0dc05e271a2b7ead0bf44515a35592324...q.....DQZ5Y#$
0x8d900a9202ded494f36eb7d81ca9c8cde2201. -.IO6.}.....".
0x8d9105c16666ea393ea5bea7f1bf65cd0a1c0\.fn...[....\...
0x8d920236d25a9b5bb379e7738cb9c8c5db65b#m%...7.w8...].[
0x8d9305d19e3faef9b6185b7fcd3abc1d90b25].....a........%
0x8d940226dae67c02462e3f6c2d615cd75d45c"m.g.$b......u.\
0x8d950549a2269f318bfd83435b9e3c3152bafT."i....45....+.
0x8d960737577a18da767603088410d945c5f11suw...g`0.A..\_.
0x8d970a3cb60b5b218a7d836f68db24858a871..`.....6...HX.q
0x8d9802aee9f36c9af37eb7205499c8c5dd454*..6..7.r.I..].T
0x8d99054926b91a393ea59f28312cebc585f4eT.k....Y.....X_N
0x8d9a0a110d12bb6f8b4968983be9e6701d444...+........g..D
0x8d9b0549821e9a393ea8234329938004072afT.!.....42.8.@r.
0x8d9c07765aea8e0ae37eb2d0b879407cccf11we....7.-.......
0x8d9d05c19b1fae79b61582f7791b3c30917db\.....aX/w......
0x8d9e0f0eee13a43ea3f60308841cd94d4cf39...:C.?`0.A....9
0x8d9f05d19e3c9a093ead056f791b348d3662c].......V...H.f,
0x8da00e5edc52bc8af35eb7d80729d8c5d5ffa...+..5.}.r..]_.
0x8da103092ae7929c6e25b3d5790b348d1a2000..y)..[=W..H...
0x8da20236d25a185a7f06a6581ca9c1c341811#m%....je....4..
0x8da306fd9083849d46185af251af64008cbc1o..8I.a..%..@...
0x8da40236d25a90ca7beae8103b7608c285922#m%........`.(Y"
0x8da509cf2c99a8a18a7c0eefcc4bf1ad366d8..............f.
0x8da607285971c3650b42f710b8788ddd60a01r...6P./q.......
0x8da700e92a679f27be4d0bf77127744d3c679...y.{...w.wD..y