« previous next »
Pages: [1]   Go Down

Author Topic: confirmation.js  (Read 3123 times)

0 Members and 4 Guests are viewing this topic.

Offline Be Secure

  • Long Time Avast User(10years.....) Security Enthusiast.
  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 1908
confirmation.js
« on: February 18, 2017, 04:13:25 AM »
How avast missed that .js file?
Avast behavior shield failed to block it.
Is avast take AVG's JS emulator engine or not???
Send it to avast viruslab.
Virus Total-https://virustotal.com/en/file/3ba6df194923d25801728df6caf71650d4b6dfbacd7d243502c1d07927a2d089/analysis/1487387200/
Logged
PC- Windows10 EDU 64Bit,avast! free 21.1.2449,uBlock Origin,NVT_OSA,GoogleChrome(64bit),CCleaner,Unchecky,ZAM Free,Shadow Defender.
Security Enthusiast

Offline TrueIndian

  • Poster
  • *
  • Posts: 433
Re: confirmation.js
« Reply #1 on: February 18, 2017, 04:19:44 AM »
Did you actually test the behav. shield here because we have seen it in action against similar files.I found the URL the file came from.Reported to the analysts. :)

The file is a day old and lot of antiviruses don't see it.
« Last Edit: February 18, 2017, 04:24:01 AM by TrueIndian »
Logged

Offline Be Secure

  • Long Time Avast User(10years.....) Security Enthusiast.
  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 1908
Re: confirmation.js
« Reply #2 on: February 18, 2017, 04:23:32 AM »
Quote from: TrueIndian on February 18, 2017, 04:19:44 AM
Did you actually test the behav. shield here because we have seen it in action against similar files.I found the URL the file came from.Reported to the analysts. :)
Yes i do.
Logged
PC- Windows10 EDU 64Bit,avast! free 21.1.2449,uBlock Origin,NVT_OSA,GoogleChrome(64bit),CCleaner,Unchecky,ZAM Free,Shadow Defender.
Security Enthusiast

Offline TrueIndian

  • Poster
  • *
  • Posts: 433
Re: confirmation.js
« Reply #3 on: February 18, 2017, 04:24:28 AM »
Quote from: Be Secure on February 18, 2017, 04:23:32 AM
Yes i do.

No alerts from behav. shield once the sample was executed?
Logged

Offline Be Secure

  • Long Time Avast User(10years.....) Security Enthusiast.
  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 1908
Re: confirmation.js
« Reply #4 on: February 18, 2017, 04:26:13 AM »
Quote from: TrueIndian on February 18, 2017, 04:24:28 AM
Quote from: Be Secure on February 18, 2017, 04:23:32 AM
Yes i do.

No alerts from behav. shield once the sample was executed?
Nothing.I set it to always ask.
Logged
PC- Windows10 EDU 64Bit,avast! free 21.1.2449,uBlock Origin,NVT_OSA,GoogleChrome(64bit),CCleaner,Unchecky,ZAM Free,Shadow Defender.
Security Enthusiast

Offline TrueIndian

  • Poster
  • *
  • Posts: 433
Re: confirmation.js
« Reply #5 on: February 18, 2017, 04:28:47 AM »
Strange! Should have been flagged as IDP.ALEXA
Logged

Offline Be Secure

  • Long Time Avast User(10years.....) Security Enthusiast.
  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 1908
Re: confirmation.js
« Reply #6 on: February 18, 2017, 04:31:05 AM »
Quote from: TrueIndian on February 18, 2017, 04:28:47 AM
Strange! Should have been flagged as IDP.ALEXA
Let see answer from avast team. :)
Logged
PC- Windows10 EDU 64Bit,avast! free 21.1.2449,uBlock Origin,NVT_OSA,GoogleChrome(64bit),CCleaner,Unchecky,ZAM Free,Shadow Defender.
Security Enthusiast

Offline TrueIndian

  • Poster
  • *
  • Posts: 433
Re: confirmation.js
« Reply #7 on: February 18, 2017, 05:24:32 AM »
Quote from: ymchen on February 18, 2017, 05:22:05 AM
ran the js , nothing happen , im guess the download file link are dead.  ::)

read the payload analysis report , this js is connect to hxxp://nanobytes.org/vKbAdjOpTV.php?erGzWn','%aPpdata%KcG14.Exe
Logged

REDACTED

  • Guest
Re: confirmation.js
« Reply #8 on: February 18, 2017, 05:32:15 AM »
Quote from: TrueIndian on February 18, 2017, 05:24:32 AM
Quote from: ymchen on February 18, 2017, 05:22:05 AM
ran the js , nothing happen , im guess the download file link are dead.  ::)

read the payload analysis report , this js is connect to hxxp://nanobytes.org/vKbAdjOpTV.php?erGzWn','%aPpdata%KcG14.Exe

 u can try again excute the js file , who know the download link will be online back  ::)
Logged

Offline TrueIndian

  • Poster
  • *
  • Posts: 433
Re: confirmation.js
« Reply #9 on: February 18, 2017, 05:40:36 AM »
yup but since it did nothing....there is nothing behav. shield could detect here  ::)
Logged

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 34057
  • malware fighter
Re: confirmation.js
« Reply #10 on: February 18, 2017, 03:54:17 PM »
Hi True Indian and Be Secure,

Best analysis of this you can find here (2 days ago): https://www.hybrid-analysis.com/sample/3ba6df194923d25801728df6caf71650d4b6dfbacd7d243502c1d07927a2d089?environmentId=100
where it was being interrogated through script Heavy Anti-Evasion etc.

Whenever not a FP it comes as Ransomeware related.

polonus
Logged
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!
Pages: [1]   Go Up
« previous next »