67511
Browser hijacker, embedded payload
Mislabeled PE hides an encrypted resource and executes a shell stageAuthenticode chain CN: New IT Limited
SHA-2561a394eed202511497acb3a3c482db1c10662a4dfece749996215bf17edd63f82
Evidence
0x04d5a90000300000004000000ffff0000MZ..............
0x10b8000000000000004000000000000000........@.......
0x2000000000000000000000000000000000................
0x30000000000000000000000000f8000000................
0x400e1fba0e00b409cd21b8014ccd215468........!..L.!Th
0x5069732070726f6772616d2063616e6e6fis program canno
⋯13 more rows
0x18fd02b3d00002a3d00007c7c000026260000+=..*=..||..&&..
0x18fe07c0000005e0000007e00000028290000|...^...~...()..
0x18ff02c0000003e3d00003c3d000025000000,...>=..<=..%...
0x190002d3e2a00260000002b0000002d000000->*.&...+...-...
0x190102d2d00002b2b00002d3e00006f706572--..++..->..oper
0x1902061746f72000000005b5d0000213d0000ator....[]..!=..
0x190303d3d0000210000003c3c00003e3e0000==..!...<<..>>..
0x190402064656c65746500206e657700000000 delete. new....
0x190505f5f756e616c69676e6564005f5f7265__unaligned.__re
0x1906073747269637400005f5f707472363400strict..__ptr64.
0x190705f5f636c7263616c6c0000005f5f6661__clrcall...__fa
0x19080737463616c6c00005f5f746869736361stcall..__thisca
0x190906c6c00005f5f73746463616c6c000000ll..__stdcall...
0x190a05f5f70617363616c000000005f5f6364__pascal....__cd
0x190b065636c005f5f62617365642800000000ecl.__based(....
0x190c0b4aa4100acaa4100a0aa410094aa4100..A...A...A...A.
0x190d088aa41007caa410070aa410068aa4100..A.|.A.p.A.h.A.
0x190e05caa410050aa41002aba4100a4a54100\.A.P.A.*.A...A.
0x190f088a5410074a5410054a5410038a54100..A.t.A.T.A.8.A.
0x1911038aa410034aa410030aa41002caa41008.A.4.A.0.A.,.A.
0x1913014aa410010aa41000caa410008aa4100..A...A...A...A.
0x1914004aa410000aa4100f4bc4100fca94100..A...A...A...A.
0x191503cba4100f8a9410084ba4100f4a94100<.A...A...A...A.
0x19160f0a94100eca94100e8a94100e4a94100..A...A...A...A.
0x19170e0a94100dca94100d8a94100d4a94100..A...A...A...A.
0x19180d0a94100cca94100c8a94100c4a94100..A...A...A...A.
0x19190c0a94100bca94100b8a94100b4a94100..A...A...A...A.
0x191a0b0a94100a4a9410098a9410090a94100..A...A...A...A.
0x191b084a941006ca9410060a941004ca94100..A.l.A.`.A.L.A.
0x191c02ca941000ca94100eca84100cca84100,.A...A...A...A.
0x191d0aca8410088a841006ca8410048a84100..A...A.l.A.H.A.
0x191e028a8410000a84100e4a74100d4a74100(.A...A...A...A.
0x191f0d0a74100c8a74100b8a7410094a74100..A...A...A...A.
0x192008ca7410080a7410070a7410054a74100..A...A.p.A.T.A.
0x1921034a741000ca74100e4a64100bca641004.A...A...A...A.
0x1922090a6410074a6410050a641002ca64100..A.t.A.P.A.,.A.
0x1923000a64100d4a54100b8a541002aba4100..A...A...A.*.A.
0x1924047657450726f6365737357696e646f77GetProcessWindow
0x1925053746174696f6e00476574557365724fStation.GetUserO
0x19260626a656374496e666f726d6174696f6ebjectInformation
0x19270410000004765744c6173744163746976A...GetLastActiv
0x1928065506f70757000004765744163746976ePopup..GetActiv
0x192906557696e646f77004d65737361676542eWindow.MessageB
0x192a06f7841005553455233322e444c4c0000oxA.USER32.DLL..
0x192b053756e4d6f6e54756557656454687546SunMonTueWedThuF
0x192c072695361740000004a616e4665624d61riSat...JanFebMa
⋯3 more rows
0x1a2e81c3e4000203e4000cd3d40002f000000.>@. >@..=@./...
0x1a2f8720075006e006100730000005c005c00r.u.n.a.s...\.\.
0x1a3083f005c00000000005f00480079007000?.\....._.H.y.p.
⋯7 more rows
⋯3 more rows
0x1e1f000000000000000000000000000000000................
0x1e20000000000000000000400000001000600................
0x1e21048040080480000800200000070000080H...H.......p...
0x1e220030000009800008005000000d0000080................
0x1e2300e000000080100801000000020010080............ ...
⋯7 more rows
⋯3 more rows
0x1ebf0576e7a710bf984c491dc3ad808ef594fWnzq......:...YO
0x1ec0003dbc58e5de3d095ff3189b08edbc22b....]....1.....+
0x1ec1054631edabb4c7e1bd22229933b4b4f47Tc...L~..").;KOG
0x1ec2078ebf9a4c418ecb634c871681bd47071x.......4.qh..pq
0x1ec30a25eda7d713bafa87170a51f625fef21.^.}q;..qp..b_.!
0x1ec503ae6eeeb21ab76bbef5198f68a0bb941:...!.v..Q.....A
0x1ec60a7073c4fb3c0ba86d377904fc3a05b7c..<O.....w.O..[|
0x1ec703b38b02ccda834ae4b3d54c1b5421dd4;8.,..4.K=T..B..
0x1ec80d346292cf92c54535b68167ac6a08938.F),.,TS[h.z...8
0x1ec9020cd950ecf74fa9b6128a6fa0529a9a8 ....t..a(...)..
0x1eca0dd056eb1e167e7d4a5843ad5e3b0c4d3..n..g....:.....
0x1ecb0719d8908d45f01f76ff09cf40c19d906q...._..o.......
0x1ecc033de8972849282c03fafa1e25e267be53..r....?...^&{.
0x1ecd0b701fda93383227faba4c8f5966f13d4....3."......o..
0x1ece0da4a8b01f828955341889e37ec2ca12c.J...(.SA..7.,.,
0x1ecf00409a2937f5d8b8b8505f81637b7b314.....]......7...
0x1ed007bf19369f0c5238c4411a8b15ca4da7b{..i..#.D...\..{
0x1ed10de1845a77c910f6d4677b8c91cdc61d9..E.|..mFw....a.
0x1ed2029308bf5036814abdba128cc18d56520)0...h....(...e
0x1ed30393d38f8b054c849319048950d2373319=8..T.I1.H..#s1
0x1ed404c08c305a5dd86a3759c8dc7170c86d8L.......u.......
0x1ed50283865a90e9f61b932154b29f467c3bb(8e...a.2.K).g..
0x1ed604c0ab48585847636a22f9de01cf9a89bL.....v6./......
0x1ed703a3b5560616e5fe57d8707a3cfd6df52:;U`an_.}......R
0x1ed8060f4b222298a693baf1cc276d71cfd06`..").i;...v....
0x1ed90a966ae2b52ff95d0c56987e8074d3513.f.+R....i...M5.
0x1eda080d11c639c968efb09f16eb77463cd59...c......n.tc.Y
0x1edb020e6d0b2fea5e6bc8382476573d7f969 .........Ges..i
0x1edc06a65fdfcd183197534bd12524bab87adje.....u4..RK...
0x1edd0e1907a9f45ece3228270c55d8414dad8..z.E..".p.]....
0x1ede0036644de52a952fc402595835ce3c9ad.fD.R.R.@%..\...
0x1edf023367cfb1f47e229799f9c0a6cac5730#6|..G.)y...l.W0
0x1ee00a32fb2fa3add69385720c14c1a502367./..:.i8W .L.P#g
0x1ee108893a6ead8f0beed038497ec6985002a............i..*
0x1ee209dcf0f7de2a163e049887f1e0c5c3d51...}..c.I....\=Q
0x1ee30d733e6b45ca1bcba89051811cdade9e7.3..\...........
0x1ee404ba40349d6dd2a88b3fac1a593035e06K..I..*.......^.
0x1ee50a92cdd84527cf41b008aa2cb859a1ee5.,..R|..........
0x1ee6099e3bc49b14b53beb1f5e2b94b23861d...I.KS.....K#..
0x1ee705265752d4360c8696d8309063fd411d8Reu-C`.im...?...