Almost downloaded a suspicious file

We can tell this host went direct to an IP Address. Do you type IP Addresses into web browsers usually? We see three interesting items. An internal host reached out to a remote suspect host and downloaded a suspicious file from a Python Simple HTTP Server; a common attack technique.

Together these paint a bad picture. That said, downloading malware over HTTP in is still a thing. The next step is to inspect this file. We need to carve it out of the PCAP. There is a quick win for this using Wireshark. Save the file to the same directory where the PCAP for the case is located. This makes it easy to remember this file was extracted from the PCAP. Stay organized! Remember that Wireshark is running as a regular user.

Chances are the cases folder you are working in is owed by root. A great starting point to check if a file is malicious is to send the hash of it to VirusTotal. Sending the hash is a good start because some advanced attackers will be watching VirusTotal for their own malware. If it is something special they cooked up for you they will know they are burned when you submit the file.

When they know they are burned they may start changing their behavior, speed up their attack, or begin removing all the evidence. Send the hash, not the file. To simulate finding unknown malware a single character will be changed. No findings? No problem. FireEye is always putting out great tools for the industry to use in the fight against evil. One of the most recent additions is Capa. Simply run Capa against the file to try and gain an understanding of what this suspect file might be capable of.

The executable is using obfuscation to attempt to hide information. Moreover, it is using XOR! These are known techniques the bad guys use to bypass network defenses and make life harder on investigators. We have some tricks up our sleeves too.

It does an exceptional job of trying to cut through obfuscation and return meaningful strings. However, there are still interesting findings. We also see some indicators this executable may be importing the functions need to do process injection! This is not definitive. It looks like static analysis of this file is not giving us any quick wins.

At this point a junior analyst needs to send the file to a reverse engineer, or detonate the file in a sandbox. Up until this point we have been conducting static analysis. The next phase is to see the file actually run and do what it is designed to do.

This is called dynamic analysis. Executables that are obfuscated must de-obfuscate themselves to run. Systems designed to detonate malware and safely observe its behavior are called sandboxes. A quick easy option are online sandboxes.

Be careful. Some adversaries watch these public sandboxes for when their malware is detonated there and will act accordingly see above. For this exercise we will use one of the many free online sandboxes, any. Once logged in you can search for the hash to see if someone had previously detonated this malware. If nothing is found you can submit the file. Could it be this is a bit file? Did you notice that it only supports bit?

Notice even Joe tries to warn you that you are about to tip your hand to the World that you found this malware. Once you confirm the payload detonation it will take a few minutes. However, the results are worth the wait. We have successfully uncovered the secrets of coreupdater.

An amazing feature Joe Sandbox offers free users is a full report generated on the Malware for you! Grab a copy. It deserves its own post. For now, understand that this is here and is one of the easiest ways to understand the capabilities and intent of an adversaries malware. Take a look through the report.

We have new information! We need to investigate this new finding! Knowing at least one piece of malware communicates with You know how to do this! Look at at previous commands with tcpdump. Knowing Examing the first 5 packets of the case What is significant about the time stamps and the flags?

What does the P flag mean? What other tool can we use to understand the systems in our network that had conversations with this malicious host? In the end we can say for sure that Before you move on, ensure you understand how we are able to say that definitively here. Security Onion is about to retire. It is being replaced by Hybrid Hunter aka Security Onion 2.

For this reason a full write-up currently would be a bit of sour investment. For now, understand that it is a great option to explore on your own. The official documentation is fantastic. To import the pcap, download it, then import it with sudo so-import-pcap case Security Onion allows the analyst to easily detect anomalies by seeing alerts in the Sguild client.

It stopped for approximately 40 minutes and just occurred again as I am typing this reply. Again, thank you. Do I need to take action or will Microsoft Edge and Norton eventually work this out? It's just annoying to see the Norton window slide in telling me widevinecdm. Well, I think Norton is working as designed reporting on download. I think Edge may be causal. I've cycled Edge and Restart machine Widevine Content Decrypter Module 4.

I don't believe anything is inherently wrong. This was an issue in or around May It eventually was resolved not sure if by an Edge update or a Norton update. At least the Norton notification is no longer coming every 10 to 15 minutes.

It's been 40 minutes since the last one. File Insight is reporting my version of widevinecdm. Edge states it is current version I think Widevine Content Decrypter Module is trying to having problem update from 4. At least I know it's not just me!

I appreciate your efforts and diligence. Defense Evasion. Build Image on Host. Direct Volume Access. Execution Guardrails. Environmental Keying. Exploitation for Defense Evasion. File and Directory Permissions Modification.

Windows File and Directory Permissions Modification. Hide Artifacts. Hidden Files and Directories. Hidden Users. Hidden Window. Hidden File System. Run Virtual Instance. VBA Stomping. Email Hiding Rules. Resource Forking. Impair Defenses. Disable or Modify Tools.

Disable Windows Event Logging. Impair Command History Logging. Disable or Modify System Firewall. Indicator Blocking. Disable or Modify Cloud Firewall. Disable Cloud Logs. Safe Mode Boot. Downgrade Attack. Indicator Removal on Host. Clear Windows Event Logs.

Clear Linux or Mac System Logs. Clear Command History. File Deletion. Network Share Connection Removal. Indirect Command Execution. Invalid Code Signature. Right-to-Left Override.

Rename System Utilities. Masquerade Task or Service. Match Legitimate Name or Location. Space after Filename. Double File Extension. Modify Cloud Compute Infrastructure. Create Snapshot. Create Cloud Instance. Delete Cloud Instance. Revert Cloud Instance.

Modify Registry. Modify System Image. Patch System Image. Downgrade System Image. Network Boundary Bridging. Network Address Translation Traversal. Obfuscated Files or Information. Binary Padding. Software Packing. Compile After Delivery. Indicator Removal from Tools. HTML Smuggling. Reflective Code Loading. Rogue Domain Controller. Signed Binary Proxy Execution.

Control Panel. Signed Script Proxy Execution. Subvert Trust Controls. Gatekeeper Bypass. Code Signing. Install Root Certificate. Mark-of-the-Web Bypass. Code Signing Policy Modification. Template Injection. Trusted Developer Utilities Proxy Execution.

Use Alternate Authentication Material. Application Access Token. Pass the Hash. Pass the Ticket. Web Session Cookie. System Checks.

User Activity Based Checks. Time Based Evasion. Weaken Encryption. Reduce Key Space. Disable Crypto Hardware. XSL Script Processing. Credential Access. ARP Cache Poisoning. Brute Force. Password Guessing. Password Cracking. Password Spraying.

Credential Stuffing. Credentials from Password Stores. Securityd Memory. Credentials from Web Browsers. Windows Credential Manager. Password Managers. Exploitation for Credential Access. Forced Authentication. Forge Web Credentials. Web Cookies. SAML Tokens. Input Capture. GUI Input Capture. Web Portal Capture. Credential API Hooking. Network Sniffing. OS Credential Dumping. Security Account Manager. LSA Secrets. Cached Domain Credentials. Proc Filesystem. Steal Application Access Token. Steal or Forge Kerberos Tickets.

Golden Ticket. Silver Ticket. Steal Web Session Cookie. Two-Factor Authentication Interception. Unsecured Credentials. Credentials In Files. Credentials in Registry. Bash History. Private Keys. Group Policy Preferences. Container API. Account Discovery. Email Account. Application Window Discovery. Browser Bookmark Discovery. Cloud Infrastructure Discovery. Cloud Service Dashboard. Cloud Service Discovery. Cloud Storage Object Discovery.

Container and Resource Discovery. Domain Trust Discovery. File and Directory Discovery. Group Policy Discovery. Network Service Scanning. Network Share Discovery. Password Policy Discovery. Peripheral Device Discovery. Permission Groups Discovery. Local Groups. Domain Groups. Cloud Groups. Process Discovery. Query Registry.

Remote System Discovery. Software Discovery. Security Software Discovery. System Information Discovery. System Location Discovery. System Language Discovery. System Network Configuration Discovery. Internet Connection Discovery. System Network Connections Discovery. System Service Discovery. System Time Discovery. Lateral Movement.

Exploitation of Remote Services. Internal Spearphishing. Lateral Tool Transfer. Remote Service Session Hijacking. SSH Hijacking. RDP Hijacking. Remote Services. Remote Desktop Protocol. Distributed Component Object Model.

Windows Remote Management. Taint Shared Content. Archive Collected Data. Archive via Utility. Archive via Library. Archive via Custom Method.

Audio Capture. Automated Collection. Browser Session Hijacking. Clipboard Data. Data from Cloud Storage Object. Data from Configuration Repository. Network Device Configuration Dump. Data from Information Repositories. Code Repositories. Data from Local System. Data from Network Shared Drive. Data from Removable Media. Data Staged.

Local Data Staging. Remote Data Staging. Email Collection. Local Email Collection. Remote Email Collection. Email Forwarding Rule. Screen Capture. Video Capture. Command and Control. Application Layer Protocol. Web Protocols. File Transfer Protocols. Mail Protocols. Communication Through Removable Media. Data Encoding. Edit this Article. We use cookies to make wikiHow great.

By using our site, you agree to our cookie policy. Cookie Settings. Learn why people trust wikiHow. Download Article Explore this Article Steps. Tips and Warnings. Related Articles. Assess what you're downloading. Are you downloading pornography or a warez cracked program? Or are you downloading an add-on to help improve your Mozilla Firefox experience? There's a much greater chance that the pornography and warez software is going to contain a virus hidden in the download.

What's the file? That's your first clue. If it is illegal or suspicious looking, it's probably dangerous. Look over the site. It may seem superficial, but if you're downloading a file from a very basic site there's a higher chance that the site will have a virus hidden in its downloadable files than from a site that looks like it's been made from years of dedicated web designers.

Consider who you are downloading the file from. Think about it logically, if you're downloading something from Microsoft, it's not likely that you're downloading a virus.

What's the context? That's the key. Are there other people that have downloaded the file? If there's a forum attached to the site that has people saying they've downloaded said file and have not experienced any problems, chances are, you aren't going to be downloading a Trojan or worm. Of course, those the first two were the only ones that ever bothered me along with things under the.

Not that this is relevent, but I just find it interesting to be reminded of how much things seem to have changed The server may as well just silently ignore anything after "? If INIT. If it was called "init. However if the server is not configured to execute that file, by default it will in fact get simply downloaded as a file, and in that case everything after "? DLL" inside. However it is a perfectly normal practice for a server to interpret that part of URL arbitarily, i.

Thus, the point of this comic is largely that the depicted warning message is almost completely useless: unless a user can somehow make sure that they trust this particular URL, there is no way to know if the file being downloaded could or could not be malicious by looking at its extension because that extension is not displayed.

Leftload talk , 6 August UTC I think a significant and unexplained element of the joke is the fact that by switching to https, the download would not be scanned by many anti-virus gateway products on the market, because the scanner is unable to inspect the content within the encrypted stream.

The virus scanner will test this file. When downloading a simple file you can save it immediately. But maybe there is an Add-on to change this. Might have changed with new versions, but I'm sure it lasted several teen versions at least. ERS", as 0-Day Hackers is a network security buzzword. Namespaces Page Discussion. Views Read Edit View history. Navigation Main page Latest comic Community portal xkcd.