108364
Browser hijacker, embedded payload
Mislabeled PE hides an encrypted resource and executes a shell stageRewrites start pages in unrelated browsers
SHA-256ee017038e3c049ac4655171574fa374b00632d3dfe7672052be37ed3d95bca22
Evidence
0x04d5a90000300000004000000ffff0000MZ..............
0x10b8000000000000004000000000000000........@.......
0x2000000000000000000000000000000000................
0x3000000000000000000000000000010000................
0x400e1fba0e00b409cd21b8014ccd215468........!..L.!Th
0x5069732070726f6772616d2063616e6e6fis program canno
⋯13 more rows
0x18fd060454800607564742072657475726e69`EH.`udt returni
0x18fe06e67270060636f707920636f6e737472ng'.`copy constr
0x18ff07563746f7220636c6f73757265270000uctor closure'..
0x1900060656820766563746f72207662617365`eh vector vbase
0x1901020636f6e7374727563746f7220697465 constructor ite
0x190207261746f722700006065682076656374rator'..`eh vect
0x190306f722064657374727563746f72206974or destructor it
0x19040657261746f7227006065682076656374erator'.`eh vect
0x190506f7220636f6e7374727563746f722069or constructor i
0x1906074657261746f72270000000060766972terator'....`vir
0x190707475616c20646973706c6163656d656etual displacemen
0x1908074206d617027000060766563746f7220t map'..`vector
0x19090766261736520636f6e7374727563746fvbase constructo
0x190a072206974657261746f72270060766563r iterator'.`vec
0x190b0746f722064657374727563746f722069tor destructor i
0x190c074657261746f72270000000060766563terator'....`vec
0x190d0746f7220636f6e7374727563746f7220tor constructor
0x190e06974657261746f722700000060736361iterator'...`sca
0x190f06c61722064656c6574696e6720646573lar deleting des
0x1910074727563746f72270000000060646566tructor'....`def
0x1911061756c7420636f6e7374727563746f72ault constructor
0x1912020636c6f737572652700000060766563 closure'...`vec
0x19130746f722064656c6574696e6720646573tor deleting des
0x1914074727563746f72270000000060766261tructor'....`vba
0x1915073652064657374727563746f72270000se destructor'..
0x1916060737472696e672700000000606c6f63`string'....`loc
0x19170616c2073746174696320677561726427al static guard'
0x191800000000060747970656f662700000000....`typeof'....
0x19190607663616c6c27006076627461626c65`vcall'.`vbtable
0x191a0270000006076667461626c6527000000'...`vftable'...
0x191b05e3d00007c3d0000263d00003c3c3d00^=..|=..&=..<<=.
0x191c03e3e3d00253d00002f3d00002d3d0000>>=.%=../=..-=..
0x191d02b3d00002a3d00007c7c000026260000+=..*=..||..&&..
0x191e07c0000005e0000007e00000028290000|...^...~...()..
0x191f02c0000003e3d00003c3d000025000000,...>=..<=..%...
0x192002d3e2a00260000002b0000002d000000->*.&...+...-...
0x192102d2d00002b2b00002d3e00006f706572--..++..->..oper
0x1922061746f72000000005b5d0000213d0000ator....[]..!=..
0x192303d3d0000210000003c3c00003e3e0000==..!...<<..>>..
0x192402064656c65746500206e657700000000 delete. new....
0x192505f5f756e616c69676e6564005f5f7265__unaligned.__re
0x1926073747269637400005f5f707472363400strict..__ptr64.
0x192705f5f636c7263616c6c0000005f5f6661__clrcall...__fa
⋯5 more rows
⋯3 more rows
0x1a308853a4000893a4000f43a40002f000000.:@..:@..:@./...
0x1a318720075006e006100730000005c005c00r.u.n.a.s...\.\.
0x1a3283f005c00000000005f00480079007000?.\....._.H.y.p.
⋯7 more rows
⋯3 more rows
0x1e1f000000000000000000000000000000000................
0x1e20000000000000000000400000001000600................
0x1e21018040080480000800200000068000080....H.......h...
0x1e220030000009000008005000000c8000080................
0x1e2300e000000000100801000000018010080................
⋯7 more rows
⋯3 more rows
0x8d7f001da2fbd6e5f261ceafc7d380d50a869../.n_&...}8.P.i
0x8d8002ee4adaac8af37b6be4c0650409193dd......7..L.P@...
0x8d81090d52fbd6e5f261ceafc7d380d50a869../.n_&...}8.P.i
0x8d8202ee4adaec8af37b6be4c0650409193dd......7..L.P@...
0x8d83090d52fbd6e5f261ceafc7d380d50a869../.n_&...}8.P.i
0x8d8402ee4ada2c8af37b6be4c0650409193dd......7..L.P@...
0x8d85090d52fbd6e5f261ceafc7d380d50a869../.n_&...}8.P.i
0x8d8602ee4ada6c8af37b6be4c0650409193dd......7..L.P@...
0x8d87090d52fbd6e5f261ceafc7d380d50a09c../.n_&...}8.P..
0x8d880c26c252ac9db3b60308849256c5c5f11.l%*..;`0.I%l\_.
0x8d8905f6ce7426278fb5bea7f1af644d1a1c8_l.Bbx.[....D...
0x8d8a0236d2592c9af37eb20430650409193dd#m%...7. C.P@...
0x8d8b090d52fbd6e5f261ceafc7d30a454a861../.n_&...}0.T.a
0x8d8c02ae6adcac9af3762307849e1745f2b0d*.....7b0xI.t_+.
0x8d8d0df641b72d69101f834229974ca442224.d.r....4".t.D"$
0x8d8e0224c252ac89cf702ec81ca9c071857d6"L%*..........W.
0x8d8f0dc05e271a2b7ead0bf44515a35592324...q.....DQZ5Y#$
0x8d900a9202ded494f36eb7d81ca9c8cde2201. -.IO6.}.....".
0x8d9105c16666ea393ea5bea7f1bf65cd0a1c0\.fn...[....\...
0x8d920236d25a9b5bb379e7738cb9c8c5db65b#m%...7.w8...].[
0x8d9305d19e3faef9b6185b7fcd3abc1d90b25].....a........%
0x8d940226dae67c02462e3f6c2d615cd75d45c"m.g.$b......u.\
0x8d950549a2269f318bfd83435b9e3c3152bafT."i....45....+.
0x8d960737577a18da767603088410d945c5f11suw...g`0.A..\_.
0x8d970a3cb60b5b218a7d836f68db24858a871..`.....6...HX.q
0x8d9802aee9f36c9af37eb7205499c8c5dd454*..6..7.r.I..].T
0x8d99054926b91a393ea59f28312cebc585f4eT.k....Y.....X_N
0x8d9a0a110d12bb6f8b4968983be9e6701d444...+........g..D
0x8d9b0549821e9a393ea8234329938004072afT.!.....42.8.@r.
0x8d9c07765aea8e0ae37eb2d0b879407cccf11we....7.-.......
0x8d9d05c19b1fae79b61582f7791b3c30917db\.....aX/w......
0x8d9e0f0eee13a43ea3f60308841cd94d4cf39...:C.?`0.A....9
0x8d9f05d19e3c9a093ead056f791b348d3662c].......V...H.f,
0x8da00e5edc52bc8af35eb7d80729d8c5d5ffa...+..5.}.r..]_.
0x8da103092ae7929c6e25b3d5790b348d1a2000..y)..[=W..H...
0x8da20236d25a185a7f06a6581ca9c1c341811#m%....je....4..
0x8da306fd9083849d46185af251af64008cbc1o..8I.a..%..@...
0x8da40236d25a90ca7beae8103b7608c285922#m%........`.(Y"
0x8da509cf2c99a8a18a7c0eefcc4bf1ad366d8..............f.
0x8da607285971c3650b42f710b8788ddd60a01r...6P./q.......
0x8da700e92a679f27be4d0bf77127744d3c679...y.{...w.wD..y
⋯3 more rows
0x125f73006600740077006100720065005c004d.f.t.w.a.r.e.\.M
0x125f83006900630072006f0073006f00660074.i.c.r.o.s.o.f.t
0x125f93005c0049006e007400650072006e0065.\.I.n.t.e.r.n.e
0x125fa300740020004500780070006c006f0072.t. .E.x.p.l.o.r
⋯7 more rows
⋯3 more rows
0x126200260063006800690064003d0063000000&.c.h.i.d.=.c...
0x12621053004f00460054005700410052004500S.O.F.T.W.A.R.E.
0x1262205c004d006900630072006f0073006f00\.M.i.c.r.o.s.o.
0x126230660074005c00570069006e0064006f00f.t.\.W.i.n.d.o.
0x126240770073005c0043007500720072006500w.s.\.C.u.r.r.e.
0x1262506e007400560065007200730069006f00n.t.V.e.r.s.i.o.
⋯3 more rows
0x12629072006300680020004200310000000000r.c.h. .B.1.....
0x1262a053004f00460054005700410052004500S.O.F.T.W.A.R.E.
0x1262b05c004d006900630072006f0073006f00\.M.i.c.r.o.s.o.
0x1262c0660074005c00570069006e0064006f00f.t.\.W.i.n.d.o.
0x1262d0770073005c0043007500720072006500w.s.\.C.u.r.r.e.
0x1262e06e007400560065007200730069006f00n.t.V.e.r.s.i.o.
0x1262f06e005c0055006e0069006e0073007400n.\.U.n.i.n.s.t.
0x12630061006c006c005c0049006d0070007200a.l.l.\.I.m.p.r.
0x1263106f007600650064002000730065006100o.v.e.d. .s.e.a.
0x126320720063006800000053004f0046005400r.c.h...S.O.F.T.
0x12633057004100520045005c004d0069006300W.A.R.E.\.M.i.c.
0x12634072006f0073006f00660074005c005700r.o.s.o.f.t.\.W.
0x12635069006e0064006f00770073005c004300i.n.d.o.w.s.\.C.
0x12636075007200720065006e00740056006500u.r.r.e.n.t.V.e.
⋯7 more rows
⋯5 more rows
0x384d0000000006c6f636174696f6e00000000....location....
0x384e0696e7374616c6c5f7761726e696e675finstall_warning_
0x384f06f6e5f656e61626c6500000031333030on_enable...1300
0x38500343031373434303636343130340000004017440664104...
⋯11 more rows
⋯3 more rows
0x3947500610072006300680050006c00750067.a.r.c.h.P.l.u.g
0x394850069006e00200078006d006c006e0073.i.n. .x.m.l.n.s
0x39495003d00270068007400740070003a002f.=.'.h.t.t.p.:./
0x394a5002f007700770077002e006d006f007a./.w.w.w...m.o.z
0x394b50069006c006c0061002e006f00720067.i.l.l.a...o.r.g
⋯15 more rows
0x395b546696c65206661696c65642028256429File failed (%d)
0x395c50a00002a000000000000002200680074...*.......".h.t
0x395d500740070003a002f002f007300650061.t.p.:././.s.e.a
0x395e5007200630068002e00620031002e006f.r.c.h...b.1...o
0x395f500720067002f003f0062007300720063.r.g./.?.b.s.r.c
⋯8 more rows
0x396850029003b000d000a0000007500730065.).;.......u.s.e
0x396950072005f007000720065006600280022.r._.p.r.e.f.(."
0x396a500620072006f0077007300650072002e.b.r.o.w.s.e.r..
0x396b5007300650061007200630068002e0073.s.e.a.r.c.h...s
0x396c50065006c006500630074006500640045.e.l.e.c.t.e.d.E
⋯7 more rows
⋯7 more rows
0x3dda3006600740077006100720065005c004d.f.t.w.a.r.e.\.M
0x3ddb3006900630072006f0073006f00660074.i.c.r.o.s.o.f.t
0x3ddc3005c0049006e007400650072006e0065.\.I.n.t.e.r.n.e
0x3ddd300740020004500780070006c006f0072.t. .E.x.p.l.o.r
⋯11 more rows
0x3de9365706167650000000000000000750073epage........u.s
0x3dea300650072005f00700072006500660028.e.r._.p.r.e.f.(
0x3deb3002200620072006f0077007300650072.".b.r.o.w.s.e.r
0x3dec3002e0073007400610072007400750070...s.t.a.r.t.u.p
0x3ded3002e0068006f006d0065007000610067...h.o.m.e.p.a.g
0x3dee300650022002c00200022002500730022.e.".,. .".%.s."
0x3def30029003b000d000a0000000000750073.).;.........u.s
0x3df0300650072005f00700072006500660028.e.r._.p.r.e.f.(
0x3df13002200620072006f0077007300650072.".b.r.o.w.s.e.r
0x3df23002e0073007400610072007400750070...s.t.a.r.t.u.p
⋯16 more rows