Spoof Call and Spoof SMS set any caller ◆ Private Crypter - Unique Private Stubs ◆ [#1] PURE RAT v4 // BEST HVNC RAT ◆ ProxiesFood: Unlimited Residential Proxy ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Tech Coding Web Development › [Javascript]  Got sent a malicious dropper. Need some help de-obfuscating..

New Reply 
Javascript 

Got sent a malicious dropper. Need some help de-obfuscating..
motherfawker666
motherfawker666 Offline
[user@HF:]
*
Registered
Posts:
164
Threads:
22
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jul 30, 2017 11:03 PM (This post was last modified: Jul 30, 2017 11:04 PM by motherfawker666.)
I was sent some js script inside of a zip in an email and have been renaming variables and removing the dumber-than-dirt base64 variable obfuscation. I just need a bit of help understanding what exactly this script does. As of now it seems like it downloads a .DAT file from some site, renames it to some random numbers with a .jpeg extension then it runs said file after renaming to .EXE ... Can anyone get their hands on the .EXE for me so I can take a look at it? Seems as if trying to get it via web browser just times out.

PASTEBIN LINK
Vana
Vana Offline
[closed@HF:]
Posts:
1,082
Threads:
6
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Jul 30, 2017 11:09 PM
The domain appears to have no DNS configuration so right now it's impossible to get the .dat file.
motherfawker666
motherfawker666 Offline
[user@HF:]
*
Registered
Posts:
164
Threads:
22
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jul 30, 2017 11:21 PM (This post was last modified: Jul 30, 2017 11:22 PM by motherfawker666.)
(Jul 30, 2017 11:09 PM)Vana Wrote:  The domain appears to have no DNS configuration so right now it's impossible to get the .dat file.

What about from these? This is from the most recent file that was sent by the same address. They seems to be using a few redundant servers. I might have to wait until they send me a new one so I can get the fresh server info eh?

Code
http://whousexpress.bid/admin.php?f=1.doc
http://thalassaworks.bid/admin.php?f=1.doc
http://chalconcards.win/admin.php?f=1.doc
http://loxoconcepts.win/admin.php?f=1.doc
http://bocoolagodenz.com/admin.php?f=1.doc
Vana
Vana Offline
[closed@HF:]
Posts:
1,082
Threads:
6
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Jul 30, 2017 11:32 PM
(Jul 30, 2017 11:21 PM)motherfawker666 Wrote:  What about from these? This is from the most recent file that was sent by the same address. They seems to be using a few redundant servers. I might have to wait until they send me a new one so I can get the fresh server info eh?

Code
http://whousexpress.bid/admin.php?f=1.doc
http://thalassaworks.bid/admin.php?f=1.doc
http://chalconcards.win/admin.php?f=1.doc
http://loxoconcepts.win/admin.php?f=1.doc
http://bocoolagodenz.com/admin.php?f=1.doc

Those all give 0 byte responses for me. There might be some request verification involved, I'll keep looking into it.
motherfawker666
motherfawker666 Offline
[user@HF:]
*
Registered
Posts:
164
Threads:
22
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jul 30, 2017 11:36 PM
(Jul 30, 2017 11:32 PM)Vana Wrote:  Those all give 0 byte responses for me. There might be some request verification involved, I'll keep looking into it.

I got the same result. Here is the full file for context.

https://pastebin.com/Kcrg94Fb
Vana
Vana Offline
[closed@HF:]
Posts:
1,082
Threads:
6
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Jul 30, 2017 11:54 PM (This post was last modified: Jul 30, 2017 11:55 PM by Vana.)
(Jul 30, 2017 11:36 PM)motherfawker666 Wrote:  I got the same result. Here is the full file for context.

https://pastebin.com/Kcrg94Fb

Might be worth it to just drop it in a VM and sniff the request.
Next Oldest | Next Newest
New Reply 


Possibly Related Threads...
Thread / Author Replies Views Last Post
[PHP] by StunnerJun 18, 2023 03:13 PM 0 138 Jun 18, 2023 03:13 PM
Last Post: Stunner
[PHP] by neuroplayNov 16, 2020 08:46 PM 2 193 Nov 16, 2020 08:46 PM
Last Post: neuroplay
[Javascript]  by A$APKINGJul 19, 2019 02:27 PM 6 478 Jul 19, 2019 02:27 PM
Last Post: _Diazepam_