85927
Browser hijacker, embedded payload
Mislabeled PE hides an encrypted resource and executes a shell stageRewrites start pages in unrelated browsers
SHA-25648b0d9efed5585134bec5f21993eadb2594d20f7336533a483c20158f4277a21
Evidence
0x04d5a90000300000004000000ffff0000MZ..............
0x10b8000000000000004000000000000000........@.......
0x2000000000000000000000000000000000................
0x3000000000000000000000000000010000................
0x400e1fba0e00b409cd21b8014ccd215468........!..L.!Th
0x5069732070726f6772616d2063616e6e6fis program canno
⋯13 more rows
0x18fd060454800607564742072657475726e69`EH.`udt returni
0x18fe06e67270060636f707920636f6e737472ng'.`copy constr
0x18ff07563746f7220636c6f73757265270000uctor closure'..
0x1900060656820766563746f72207662617365`eh vector vbase
0x1901020636f6e7374727563746f7220697465 constructor ite
0x190207261746f722700006065682076656374rator'..`eh vect
0x190306f722064657374727563746f72206974or destructor it
0x19040657261746f7227006065682076656374erator'.`eh vect
0x190506f7220636f6e7374727563746f722069or constructor i
0x1906074657261746f72270000000060766972terator'....`vir
0x190707475616c20646973706c6163656d656etual displacemen
0x1908074206d617027000060766563746f7220t map'..`vector
0x19090766261736520636f6e7374727563746fvbase constructo
0x190a072206974657261746f72270060766563r iterator'.`vec
0x190b0746f722064657374727563746f722069tor destructor i
0x190c074657261746f72270000000060766563terator'....`vec
0x190d0746f7220636f6e7374727563746f7220tor constructor
0x190e06974657261746f722700000060736361iterator'...`sca
0x190f06c61722064656c6574696e6720646573lar deleting des
0x1910074727563746f72270000000060646566tructor'....`def
0x1911061756c7420636f6e7374727563746f72ault constructor
0x1912020636c6f737572652700000060766563 closure'...`vec
0x19130746f722064656c6574696e6720646573tor deleting des
0x1914074727563746f72270000000060766261tructor'....`vba
0x1915073652064657374727563746f72270000se destructor'..
0x1916060737472696e672700000000606c6f63`string'....`loc
0x19170616c2073746174696320677561726427al static guard'
0x191800000000060747970656f662700000000....`typeof'....
0x19190607663616c6c27006076627461626c65`vcall'.`vbtable
0x191a0270000006076667461626c6527000000'...`vftable'...
0x191b05e3d00007c3d0000263d00003c3c3d00^=..|=..&=..<<=.
0x191c03e3e3d00253d00002f3d00002d3d0000>>=.%=../=..-=..
0x191d02b3d00002a3d00007c7c000026260000+=..*=..||..&&..
0x191e07c0000005e0000007e00000028290000|...^...~...()..
0x191f02c0000003e3d00003c3d000025000000,...>=..<=..%...
0x192002d3e2a00260000002b0000002d000000->*.&...+...-...
0x192102d2d00002b2b00002d3e00006f706572--..++..->..oper
0x1922061746f72000000005b5d0000213d0000ator....[]..!=..
0x192303d3d0000210000003c3c00003e3e0000==..!...<<..>>..
0x192402064656c65746500206e657700000000 delete. new....
0x192505f5f756e616c69676e6564005f5f7265__unaligned.__re
0x1926073747269637400005f5f707472363400strict..__ptr64.
0x192705f5f636c7263616c6c0000005f5f6661__clrcall...__fa
⋯5 more rows
⋯3 more rows
0x1a308853a4000893a4000f43a40002f000000.:@..:@..:@./...
0x1a318720075006e006100730000005c005c00r.u.n.a.s...\.\.
0x1a3283f005c00000000005f00480079007000?.\....._.H.y.p.
⋯7 more rows
⋯3 more rows
0x1e1f000000000000000000000000000000000................
0x1e20000000000000000000400000001000600................
0x1e21018040080480000800200000068000080....H.......h...
0x1e220030000009000008005000000c8000080................
0x1e2300e000000000100801000000018010080................
⋯7 more rows
⋯3 more rows
0x8d3f03092ae7929c6e25b3d5790b348d1a2000..y)..[=W..H...
0x8d400236d25a185a7f06a6581ca9cfc3e1811#m%....je....>..
0x8d4106fd9083849d46185af251af64008cbc1o..8I.a..%..@...
0x8d420236d25a90ca7beae8103b7608c285922#m%........`.(Y"
0x8d4309cf2c99a8a18a7c0eefcc4bf1ad366d8..............f.
0x8d4407285b71d3650b42f710b8788ddd60a01r...6P./q.......
0x8d4500e92a679f27be4d0bf77127744d3c679...y.{...w.wD..y
0x8d460e1a1e9e60463fb27280b261f604d9854.....c.'(.&.`M.T
0x8d470a418e371a218afd834ff71b24858aa69...q....4.q.HX.i
0x8d480d6ee58decadb2b680074c9e88eb6779a..X...+h.t....w.
0x8d490091124f3be92ead09e7791b37b98ca72..$......w..{..r
0x8d4a0236d25a18da7f06b6181ca9ca85d5f11#m%....ka....]_.
0x8d4b06fd90a33a393ea5bf27f5632a8592324o..3...[..V2.Y#$
0x8d4c0236d252a43fa3f603f9843d970d61219#m%*C.?`?.C.p...
0x8d4d0d74c1ff833bbebd0bffcd4bbc3103f27.L..3.........?'
0x8d4e06f61ae7fc0267df7f6c5c217c155d440oa...&}......U.@
0x8d4f04090b35929d6e25bf75392fe44d3762c@..Y)..[.S..D.v,
0x8d500ab2701a18da7bda66d0842788d5d5f9a.'......m.Bx.]_.
0x8d510091160b3bac16195b7fcd99b19d376d8..`...a.......v.
0x8d52070e6602298247ae3f611d29d8c5da0c3p.`".$z......]..
0x8d530dfddf3faef9b6351a37691b3c30d2ba7......cQ.v....+.
0x8d5409871242ac8af43c3f6c5c217c155d480.q$*..C......U..
0x8d5507c18e3712b03ced1bf771af6409fa33c|..q+....w..@..<
0x8d560236d255aabe837d8bd69419c8c5db450#m%Z..7..iA..].P
0x8d570d754ebfa3373ebd0bffec443cb25d324.T..3s.....C.%.$
0x8d5805e42a65738ae49fafefd3a9ff85fb430^B.W8.I...:.._.0
0x8d5909b5c1b73a293ea3ba7f4eca3482c31af.\.s...;....H,1.
0x8d5a06765e2aa28ae37eb7f80ca9c0718a7fage..(.7.........
0x8d5b01492ae79235272d1bf77c0381d50a866...y#Rr..w.8.P.f
0x8d5c03a3dae67c024a6c37c80cace0718579a:=.g.$..|.....W.
0x8d5d0d489e371a2c26185b7fc1323485823af...q..a....#HX#.
0x8d5e06a59dafb4b6b2760288841d984d61709jY..Kk'`(.A.....
0x8d5f0d593cb70a293619547fc74ee8b94efe8...p..a.G.t.....
0x8d600eea1e9e60463fb27280b261f6041d454.....c.'(.&.`A.T
0x8d61054926b91a393ea59f29312ceac5a5738T.k....Y.....ZW8
0x8d620a110c129bcaddcc3f6d5c25b0e415e11...).......[.A^.
0x8d6305c38e371a2a02a39b27591b3c31d2be3\8.q..*9.u....+.
0x8d640a271242ac88b37eb7db30a75755c5f11.q$*..7.}..uu\_.
0x8d650d754ebfaf79b61919f5cd3af711d2f2b.T....a..\..q./+
0x8d660acb3242ac8247ae3f6d5c217cd417453..$*.$z......AtS
⋯3 more rows
0x125973006600740077006100720065005c004d.f.t.w.a.r.e.\.M
0x125983006900630072006f0073006f00660074.i.c.r.o.s.o.f.t
0x125993005c0049006e007400650072006e0065.\.I.n.t.e.r.n.e
0x1259a300740020004500780070006c006f0072.t. .E.x.p.l.o.r
⋯7 more rows
⋯3 more rows
0x125c00260063006800690064003d0063000000&.c.h.i.d.=.c...
0x125c1053004f00460054005700410052004500S.O.F.T.W.A.R.E.
0x125c205c004d006900630072006f0073006f00\.M.i.c.r.o.s.o.
0x125c30660074005c00570069006e0064006f00f.t.\.W.i.n.d.o.
0x125c40770073005c0043007500720072006500w.s.\.C.u.r.r.e.
0x125c506e007400560065007200730069006f00n.t.V.e.r.s.i.o.
⋯3 more rows
0x125c9072006300680020004200310000000000r.c.h. .B.1.....
0x125ca053004f00460054005700410052004500S.O.F.T.W.A.R.E.
0x125cb05c004d006900630072006f0073006f00\.M.i.c.r.o.s.o.
0x125cc0660074005c00570069006e0064006f00f.t.\.W.i.n.d.o.
0x125cd0770073005c0043007500720072006500w.s.\.C.u.r.r.e.
0x125ce06e007400560065007200730069006f00n.t.V.e.r.s.i.o.
0x125cf06e005c0055006e0069006e0073007400n.\.U.n.i.n.s.t.
0x125d0061006c006c005c0049006d0070007200a.l.l.\.I.m.p.r.
0x125d106f007600650064002000730065006100o.v.e.d. .s.e.a.
0x125d20720063006800000053004f0046005400r.c.h...S.O.F.T.
0x125d3057004100520045005c004d0069006300W.A.R.E.\.M.i.c.
0x125d4072006f0073006f00660074005c005700r.o.s.o.f.t.\.W.
0x125d5069006e0064006f00770073005c004300i.n.d.o.w.s.\.C.
0x125d6075007200720065006e00740056006500u.r.r.e.n.t.V.e.
⋯7 more rows
⋯5 more rows
0x384d0000000006c6f636174696f6e00000000....location....
0x384e0696e7374616c6c5f7761726e696e675finstall_warning_
0x384f06f6e5f656e61626c6500000031333030on_enable...1300
0x38500343031373434303636343130340000004017440664104...
⋯11 more rows
⋯3 more rows
0x3947500610072006300680050006c00750067.a.r.c.h.P.l.u.g
0x394850069006e00200078006d006c006e0073.i.n. .x.m.l.n.s
0x39495003d00270068007400740070003a002f.=.'.h.t.t.p.:./
0x394a5002f007700770077002e006d006f007a./.w.w.w...m.o.z
0x394b50069006c006c0061002e006f00720067.i.l.l.a...o.r.g
⋯15 more rows
0x395b546696c65206661696c65642028256429File failed (%d)
0x395c50a00002a000000000000002200680074...*.......".h.t
0x395d500740070003a002f002f007300650061.t.p.:././.s.e.a
0x395e5007200630068002e00620031002e006f.r.c.h...b.1...o
0x395f500720067002f003f0062007300720063.r.g./.?.b.s.r.c
⋯8 more rows
0x396850029003b000d000a0000007500730065.).;.......u.s.e
0x396950072005f007000720065006600280022.r._.p.r.e.f.(."
0x396a500620072006f0077007300650072002e.b.r.o.w.s.e.r..
0x396b5007300650061007200630068002e0073.s.e.a.r.c.h...s
0x396c50065006c006500630074006500640045.e.l.e.c.t.e.d.E
⋯7 more rows
⋯7 more rows
0x3dda3006600740077006100720065005c004d.f.t.w.a.r.e.\.M
0x3ddb3006900630072006f0073006f00660074.i.c.r.o.s.o.f.t
0x3ddc3005c0049006e007400650072006e0065.\.I.n.t.e.r.n.e
0x3ddd300740020004500780070006c006f0072.t. .E.x.p.l.o.r
⋯11 more rows
0x3de9365706167650000000000000000750073epage........u.s
0x3dea300650072005f00700072006500660028.e.r._.p.r.e.f.(
0x3deb3002200620072006f0077007300650072.".b.r.o.w.s.e.r
0x3dec3002e0073007400610072007400750070...s.t.a.r.t.u.p
0x3ded3002e0068006f006d0065007000610067...h.o.m.e.p.a.g
0x3dee300650022002c00200022002500730022.e.".,. .".%.s."
0x3def30029003b000d000a0000000000750073.).;.........u.s
0x3df0300650072005f00700072006500660028.e.r._.p.r.e.f.(
0x3df13002200620072006f0077007300650072.".b.r.o.w.s.e.r
0x3df23002e0073007400610072007400750070...s.t.a.r.t.u.p
⋯16 more rows