{"id":220553,"date":"2020-03-20T10:07:04","date_gmt":"2020-03-20T09:07:04","guid":{"rendered":"https:\/\/www.intrinsec.com\/?p=220553"},"modified":"2020-03-20T10:07:04","modified_gmt":"2020-03-20T09:07:04","slug":"fausse-attestation-deplacement","status":"publish","type":"post","link":"https:\/\/www.intrinsec.com\/en\/fausse-attestation-deplacement\/","title":{"rendered":"Analysis of a fake travel certificate"},"content":{"rendered":"[et_pb_section fb_built= \u00bb1\u2033 admin_label= \u00bbsection \u00bb _builder_version= \u00bb3.22\u2033][et_pb_row admin_label= \u00bbrow \u00bb _builder_version= \u00bb3.25\u2033 background_size= \u00bbinitial \u00bb background_position= \u00bbtop_left \u00bb background_repeat= \u00bbrepeat \u00bb custom_margin= \u00bb-9px|auto||auto|| \u00bb][et_pb_column type= \u00bb4_4\u2033 _builder_version= \u00bb3.25\u2033 custom_padding= \u00bb||| \u00bb custom_padding__hover= \u00bb||| \u00bb][et_pb_text admin_label= \u00bbText \u00bb _builder_version= \u00bb4.4.1\u2033 text_font= \u00bbNunito Sans|||||||| \u00bb text_font_size= \u00bb17px \u00bb header_font= \u00bbNunito Sans|||||||| \u00bb header_text_color= \u00bb#e02b20\u2033 header_2_font= \u00bbNunito Sans|||||||| \u00bb header_2_text_color= \u00bb#c91f1c \u00bb header_2_font_size= \u00bb29px \u00bb background_size= \u00bbinitial \u00bb background_position= \u00bbtop_left \u00bb background_repeat= \u00bbrepeat \u00bb min_height= \u00bb159px \u00bb custom_padding= \u00bb||0px||| \u00bb]

During this pandemic, An adaptation of the work was necessary within the framework of the measures taken by the<\/strong>
government<\/strong>, accompanied by administrative documents of all kinds. Fake versions of some documents are used by malicious actors to carry out attacks. This article presents an example of a malicious document.<\/strong> (in this case, a model of a professional travel certificate).<\/p>\n

<\/p>\n

This document template was found on a fake forum after a simple search Google<\/em> <\/strong>on "travel certificate template". By clicking on the link to the fake forum, a zip file, hosted on another site, containing the malicious file (model_certificate_for_professional_travel.js<\/em>) is downloaded, as you can see in Figure 1.<\/p>\n

<\/p>\n

<\/p>\n

<\/p>[\/et_pb_text] \u00bbNunito Sans|||||||| \u00bb text_font_size= \u00bb16px \u00bb]

Figure 1: Fake forum from which the malicious document originates<\/em><\/span><\/p>\n

We will present the analysis of obfuscated Javascript code.<\/p>[\/et_pb_text][et_pb_text admin_label= \u00bbText \u00bb _builder_version= \u00bb4.4.1\u2033 text_font= \u00bbNunito Sans|||||||| \u00bb text_font_size= \u00bb17px \u00bb header_font= \u00bbNunito Sans|||||||| \u00bb header_text_color= \u00bb#e02b20\u2033 header_2_font= \u00bbNunito Sans|||||||| \u00bb header_2_text_color= \u00bb#c91f1c \u00bb header_2_font_size= \u00bb29px \u00bb background_size= \u00bbinitial \u00bb background_position= \u00bbtop_left \u00bb background_repeat= \u00bbrepeat \u00bb]

<\/span><\/p>\n

Static analysis<\/span><\/p>\n

<\/p>\n

Deobfuscation function:<\/em><\/strong> obfuscated strings (QX95<\/em>(in figure 2) will be deobfuscated, using one of the code's functions, in the following way: each of their characters is concatenated to the variable constituting the deobfuscated string (WB37<\/em>) according to the parity of the loop index while <\/em>(vi4880<\/em>).<\/p>\n

<\/p>\n

<\/p>\n

\n
\"\"<\/em>\n

 <\/p>\n

 <\/p>\n

Figure 2: Deobfuscation function<\/em><\/span><\/figcaption>\n<\/figure>\n<\/div>\n

<\/p>\n

<\/p>\n

\n
\"\"\n

 <\/p>\n

 <\/p>\n

Figure 3: First obfuscated chain<\/em><\/span><\/figcaption>\n<\/figure>\n<\/div>\n

<\/p>\n

The program calls the function (JO58<\/em>) presented previously to deobfuscate the chain.<\/p>\n

<\/p>\n

<\/p>\n

\n
\"\"\n

 <\/p>\n

 <\/p>\n

Figure 4: First deobfuscated chain<\/em><\/span><\/figcaption>\n<\/figure>\n<\/div>\n

<\/p>\n

The program creates an object that allows access to the file system. If this object doesn't already exist, it then creates the file XS594362.tmp in the victim's temporary directory (this directory is defined by the temp environment variable). A second obfuscated string is also present.<\/p>\n

<\/p>\n

<\/p>\n

\"\"\n

 <\/p>\n

 <\/p>\n

Figure 5: Second obfuscated chain<\/em><\/span><\/figcaption>\n<\/figure>\n

<\/p>\n

The program calls the function again (JO58<\/em>) to deobfuscate.<\/p>\n

<\/p>\n

<\/p>\n

\n
\"\"\n

 <\/p>\n

 <\/p>\n

Figure 6: Second deobfuscated chain<\/em><\/span><\/figcaption>\n<\/figure>\n<\/div>\n

<\/p>\n

At the beginning of this code, you will find a list of three URLs. The instructions presented below will be executed for all three URLs (loop). while<\/em>).<\/p>\n

The program creates an object enabling communication between servers<\/strong>. It will then generate a random number and make a GET request to the first URL, requesting the resource. forum.php <\/em>and passing the random number as a parameter. Upon receiving the response, if the status code <\/em>is not equal to 200, the program temporarily suspends script execution. Otherwise, it searches for the previously generated random number in the response. If it finds it, it calculates the variable Yp13<\/em> and executes the instruction VU11[3](Yp13)()<\/em>.<\/p>\n

These two instructions cannot be analyzed statically as they stand because they depend on the server's response.<\/p>\n

<\/p>\n

<\/p>\n

Dynamic analysis<\/h2>\n

<\/p>\n

When the script is executed in a controlled environment, the file is created. XS594362.tmp<\/em>, in the user's temporary directory and in the data captured by procmon<\/em>
(figure 7).<\/p>\n

<\/p>\n

Domain resolutions, HTTP requests, and responses are observed by capturing network traffic during script execution (Figures 8 and 10). Communications are diagrammed using procdot (correlation of output). procmon <\/em>and capture Wireshark<\/em> simultaneous, Figure 9).<\/p>\n

<\/p>\n

<\/p>\n

\"\"\n

 <\/p>\n

 <\/p>\n

Figure 7: Execution traces (procmon)<\/em><\/span><\/figcaption>\n<\/figure>\n

<\/p>\n

<\/p>\n

\"\"\n

 <\/p>\n

 <\/p>\n

Figure 8: Network traces (Wireshark)<\/em><\/span><\/figcaption>\n<\/figure>\n

<\/p>\n

<\/p>\n

\"\"\n

 <\/p>\n

 <\/p>\n

Figure 9: Communication of the malicious JavaScript (downloader) with the 3 URLs<\/em><\/span><\/figcaption>\n<\/figure>\n

<\/p>\n

Unfortunately, the responses to the script's GET requests do not contain any payload (as you can see in Figure 10), even though their status code<\/em> is 200. We therefore cannot go any further in this analysis. However, CERT Intrinsec encountered the same actor and the same method in 2019 with the distribution of ransomware Gandcrab <\/em>[1] and in 2020 with the distribution of the malware Gootkit<\/em>.<\/p>\n

<\/p>\n

<\/p>\n

\"\"<\/figure>\n

<\/p>\n

<\/p>\n

<\/p>[\/et_pb_text][et_pb_text _builder_version= \u00bb4.4.1\u2033 text_font= \u00bbNunito Sans|||||||| \u00bb text_font_size= \u00bb16px \u00bb header_font= \u00bbNunito Sans|||||||| \u00bb header_text_color= \u00bb#e02b20\u2033 header_2_font= \u00bbNunito Sans|||||||| \u00bb header_2_text_color= \u00bb#c91f1c \u00bb header_2_font_size= \u00bb29px \u00bb]

Indicators<\/h2>\n

<\/p>\n

<\/p>\n