Suspicious ^80% datamaliciousorder Download

Virus.Infector_Win32.Expiro.Gen.7_18.vir

Infector virus masquerading as Firefox

Encrypted payload hidden in .reloc sectionLarge high-entropy .reloc payload geometry

SHA-256111729df092abe5d7f388450da3176545f0e7c52f22cc9bac9d2c0267ab1399a

MaleculeK₂(Am₂Li)O₅(As₇C₂CaEr₂S)H₅(Cr₂F₃Os₁₆Po₅U)Md₆(Bi₁₀BkHePaPtSi₂)

Evidence

Binary code section entropy at least 7.0 0x3a0–0x690

⋯5 more rows
0x3f000000000000000000000000000000000................
0x4008d442410506a00ff742414ff742414ff.D$.Pj..t$..t$..
0x410742414e8083f000083c414c3a1bc3142t$...?........1B
0x42000a801751a8325c03142000083c80168...u..%.1B.....h
0x43084734100a3bc314200e8cd3e000059b8.sA...1B...>..Y.
0x440c0314200c3558dac2454fcffff81ec2c.1B..U..$T.....,
0x450040000a15010420033c58985a8030000....P.B.3.......
0x46053568bb5b8030000578b3d3881410068SV......W.=8.A.h
0x47040c74100ff7604ffd78bd8f7db685cc7@.A..v.......h\.
0x4804100ff76041adbfec3ffd785c00f847cA..v...........|
0x49001000084db0f8574010000683cc84100.......t...h<.A.
0x4a0ff7604ffd785c075558d4d90e8180200.v.....uU.M.....
0x4b00085c0741751518d4590686cc7410050...t.QQ.E.hl.A.P
0x4c0e857ffffff8bc8e8453a0000684cc841.W......E:..hL.A
0x4d000e846ffffff50e8ce3a0000595933c9..F...P..:..YY3.
0x4e0e8a00d000085c0750eff154081410050[email protected]
0x4f06870c84100eb696894c84100eb7a68bchp.A..ih..A..zh.
0x500c84100ff7604ffd785c00f858a000000.A..v...........
0x5108d8d9c010000e8ae01000085c0741a51.............t.Q
0x520518d859c01000068d0c8410050e8eafeQ......h..A.P...
0x530ffff8bc8e8d83900006814c94100e8d9......9..h..A...
0x540feffff50e8613a00005959e87d140000...P.a:..YY.}...
0x55085c0751fff154081410050682cc94100[email protected],.A.
0x560e8b7feffff50e86a3a000033f683c40c.....P.j:..3....
0x57046eb146850c94100e89ffeffff50e827F..hP.A......P.'
0x5803a00005933f659e890feffff8bc8e8d8:..Y3.Y.........
0x5903900008bc6e917010000687cc94100ff9.........h|.A..
0x5a07604ffd785c0752083bdb4030000027ev.....u .......~
0x5b0178b560c8b4e0850e8662e0000f7d859..V..N.P.f.....Y
0x5c01bc040e9e9000000836588008d458083[email protected]..
0x5d0658c0050c7458094c94100c745843914e..P.E...A..E.9.
0x5e04000ff159480410085c00f85bf000000@.....A.........
0x5f0ff15408141005068bcc94100e81bfeff[email protected].....
0x600ff50e8ce39000083c40ce9a00000008d.P..9...........
0x6108d9c010000e8af00000085c0741a5151............t.QQ
0x6208d859c010000686cc7410050e8ebfdff......hl.A.P....
0x630ff8bc8e8d938000033f64684db740a6a.....8..3.F..t.j
0x640025e68acc74100eb0568d8c74100e8c9.^h..A...h..A...
0x650fdffff50e85139000059598bcee8230c...P.Q9..YY...#.
0x660000085c0752bff15408141005068f0c7....u+[email protected]..
0x6704100e8a5fdffff50e85839000083c40cA......P.X9.....
0x680e897fdffff8bc8e8df38000033c040eb.........8..3.@.
0x690206814c84100e881fdffff50e8093900 h..A......P..9.

References the .NET mscoree loader name 0x16ad4–0x16b94

⋯3 more rows
0x16b040a0000000400000008f0010008d80100................
0x16b146d00730063006f007200650065002e00m.s.c.o.r.e.e...
0x16b2464006c006c000000436f724578697450d.l.l...CorExitP
⋯7 more rows

Dynamic API resolution str Bkernel32 0x17602–0x17772

⋯5 more rows
0x1765261007200790000000000482c4200982ca.r.y.....H,B..,
0x1766242006b00650072006e0065006c003300B.k.e.r.n.e.l.3.
0x1767232002e0064006c006c0000000000466c2...d.l.l.....Fl
⋯16 more rows

PE version resource structure 0x206a6–0x20736

0x206a6706c69636174696f6e3e0a20203c2f63plication>.  </c
0x206b66f6d7061746962696c6974793e0a3c2fompatibility>.</
0x206c6617373656d626c793e0a240334000000assembly>.$.4...
0x206d6560053005f0056004500520053004900V.S._.V.E.R.S.I.
0x206e64f004e005f0049004e0046004f000000O.N._.I.N.F.O...
⋯5 more rows

High entropy .reloc section 0x2074e–0x20a3e

⋯6 more rows
0x207ae730065003a0020004d0050004c002000s.e.:. .M.P.L. .
0x207be32000000000046001300010043006f002.....F.....C.o.
0x207ce6d00700061006e0079004e0061006d00m.p.a.n.y.N.a.m.
0x207de6500000000004d006f007a0069006c00e.....M.o.z.i.l.
0x207ee6c006100200046006f0075006e006400l.a. .F.o.u.n.d.
0x207fe6100740069006f006e00000000002800a.t.i.o.n.....(.
0x2080e00000100460069006c00650044006500....F.i.l.e.D.e.
0x2081e73006300720069007000740069006f00s.c.r.i.p.t.i.o.
0x2082e6e00000000002e000700010046006900n...........F.i.
0x2083e6c006500560065007200730069006f00l.e.V.e.r.s.i.o.
0x2084e6e0000000000340033002e0030002e00n.....4.3...0...
0x2085e310000000000320007000100500072001.....2.....P.r.
0x2086e6f006400750063007400560065007200o.d.u.c.t.V.e.r.
0x2087e730069006f006e000000340033002e00s.i.o.n...4.3...
0x2088e30002e003100000000002000000001000...1..... .....
0x2089e49006e007400650072006e0061006c00I.n.t.e.r.n.a.l.
0x208ae4e0061006d0065000000380008000100N.a.m.e...8.....
0x208be4c006500670061006c00540072006100L.e.g.a.l.T.r.a.
0x208ce640065006d00610072006b0073000000d.e.m.a.r.k.s...
0x208de00004d006f007a0069006c006c006100..M.o.z.i.l.l.a.
0x208ee00005600170001004f00720069006700..V.....O.r.i.g.
⋯4 more rows
0x2093e65007800650000000000300008000100e.x.e.....0.....
0x2094e500072006f0064007500630074004e00P.r.o.d.u.c.t.N.
0x2095e61006d00650000000000460069007200a.m.e.....F.i.r.
0x2096e650066006f007800000036000f000100e.f.o.x...6.....
0x2097e4200750069006c006400490044000000B.u.i.l.d.I.D...
⋯6 more rows
0x209ee00000000b00400000000000000000000................
0x209fe000000100000580100001d3027303030......X....0'000
0x20a0e3530403054306b3070307e309c30bb3050@0T0k0p0~0.0.0
0x20a1ecd30eb30f130f830ff3028313a315631.0.0.0.0.0(1:1V1
0x20a2e5c3174319b31d731de31e431f231f831\1t1.1.1.1.1.1.1
0x20a3e273243324a3268326e329232d632e532'2C2J2h2n2.2.2.2