Download Challenge

Company X has contacted you to perform forensics work on a recent incident that occurred. One of their employees had received an e-mail from a co-worker that pointed to a PDF file. Upon opening, the employee did not notice anything; however, they recently had unusual activity in their bank account.

The initial theory is that a user received an e-mail, containing an URL leading to a forged PDF document. Opening that document in Acrobat Reader triggers a malicious Javascript that initiates a sequence of actions to take over the victim's system.

Company X was able to obtain a memory image of the employee's virtual machine upon suspected infection and asked you to analyze the virtual memory and provide answers to the questions.

 

Supportive Tools:

 

Thanks, lehonghai for revieweing the challenge.

 

# Question Weight Solved
1 What was the local IP address for the victim's machine? 50 117
2 What was the OS variable value? 50 81
3 What was the Administrator's password? 100 100
4 Which process was most likely responsible for the initial exploit? 150 110
5 What is the extension of the malicious file retrieved from the process responsible for the initial exploit? 150 92
6 Suspicious processes opened network connections to external IPs. Provide the two external IP addresses. (comma-separated without spaces) 150 104
7 A suspicious URL was present in process svchost.exe memory. Provide the full URL that points to a PHP page hosted over a public IP (no FQDN). 200 76
8 Extract files from the initial process. One file has an MD5 hash ending with "528afe08e437765cc". When was this file first submitted for analysis on VirusTotal? 250 37
9 What was the PID of the process that loaded the file PDF.php? 250 95
10 The JS includes a function meant to hide the call to function eval(). Provide the name of that function. 300 34
11 The payload includes 3 shellcodes for different versions of Acrobat reader. Provide the function name that corresponds to Acrobat v9. 300 27
12 Process winlogon.exe hosted a popular malware that was first submitted for analysis at VirusTotal on 2010-03-29 11:34:01. Provide the MD5 hash of that malware. 300 21
13 What is the name of the malicious executable referenced in registry hive '\WINDOWS\system32\config\software', and is variant of ZeuS trojan? 300 43
14 The shellcode for Acrobat v7 downloads a file named e.exe from a specific URL. Provide the URL. 500 39
15 The shellcode for Acrobat v8 exploits a specific vulnerability. Provide the CVE number. 500 42