hxxps://cdn[.]discordapp[.]com/attachments/1036390012482240522/1539329389597167636/gm_422_jp[.]eml?ex=6a85ebb5&is=6a849a35&hm=0d204fb35b4ab4c63773a19f586917a6d2dfa5a33c1e459c2508d65cb8b80a22&

General

Target
https://cdn.discordapp.com/attachments/1036390012482240522/1539329389597167636/gm_422_jp.eml?ex=6a85ebb5&is=6a849a35&hm=0d204fb35b4ab4c63773a19f586917a6d2dfa5a33c1e459c2508d65cb8b80a22&
Sample260818-w8826ayclb

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Programs\Python\Python313\Lib\site-packages\pypdf\_encryption.py

Ransom Note

# Copyright (c) 2022, exiledkingcc # All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are # met: # # * Redistributions of source code must retain the above copyright notice, # this list of conditions and the following disclaimer. # * Redistributions in binary form must reproduce the above copyright notice, # this list of conditions and the following disclaimer in the documentation # and/or other materials provided with the distribution. # * The name of the author may not be used to endorse or promote products # derived from this software without specific prior written permission. # # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE # ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE # LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR # CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE # POSSIBILITY OF SUCH DAMAGE. import hashlib import secrets import struct from enum import Enum, IntEnum from typing import Any, Optional, Union, cast from pypdf._crypt_providers import ( CryptAES, CryptBase, CryptIdentity, CryptRC4, aes_cbc_decrypt, aes_cbc_encrypt, aes_ecb_decrypt, aes_ecb_encrypt, rc4_decrypt, rc4_encrypt, ) from ._utils import logger_warning from .generic import ( ArrayObject, ByteStringObject, DictionaryObject, NameObject, NumberObject, PdfObject, StreamObject, TextStringObject, create_string_object, ) class CryptFilter: def __init__( self, stm_crypt: CryptBase, str_crypt: CryptBase, ef_crypt: CryptBase, ) -> None: self.stm_crypt = stm_crypt self.str_crypt = str_crypt self.ef_crypt = ef_crypt def encrypt_object(self, obj: PdfObject) -> PdfObject: if isinstance(obj, ByteStringObject): data = self.str_crypt.encrypt(obj.original_bytes) obj = ByteStringObject(data) elif isinstance(obj, TextStringObject): data = self.str_crypt.encrypt(obj.get_encoded_bytes()) obj = ByteStringObject(data) elif isinstance(obj, StreamObject): obj2 = StreamObject() obj2.update(obj) obj2.set_data(self.stm_crypt.encrypt(obj._data)) for key, value in obj.items(): # Dont forget the Stream dict. obj2[key] = self.encrypt_object(value) obj = obj2 elif isinstance(obj, DictionaryObject): obj2 = DictionaryObject() # type: ignore for key, value in obj.items(): obj2[key] = self.encrypt_object(value) obj = obj2 elif isinstance(obj, ArrayObject): obj = ArrayObject(self.encrypt_object(x) for x in obj) return obj def decrypt_object(self, obj: PdfObject) -> PdfObject: if isinstance(obj, (ByteStringObject, TextStringObject)): data = self.str_crypt.decrypt(obj.original_bytes) obj = create_string_object(data) elif isinstance(obj, StreamObject): obj._data = self.stm_crypt.decrypt(obj._data) for key, value in obj.items(): # Dont forget the Stream dict. obj[key] = self.decrypt_object(value) elif isinstance(obj, DictionaryObject): for key, value in obj.items(): obj[key] = self.decrypt_object(value) elif isinstance(obj, ArrayObject): for i in range(len(obj)): obj[i] = self.decrypt_object(obj[i]) return obj _PADDING = ( b"\x28\xbf\x4e\x5e\x4e\x75\x8a\x41\x64\x00\x4e\x56\xff\xfa\x01\x08" b"\x2e\x2e\x00\xb6\xd0\x68\x3e\x80\x2f\x0c\xa9\xfe\x64\x53\x69\x7a" ) def _padding(data: bytes) -> bytes: return (data + _PADDING)[:32] class AlgV4: @staticmethod def compute_key( password: bytes, rev: int, key_size: int, o_entry: bytes, P: int, id1_entry: bytes, metadata_encrypted: bool, ) -> bytes: """ Algorithm 2: Computing an encryption key. a) Pad or truncate the password string to exactly 32 bytes. If the password string is more than 32 bytes long, use only its first 32 bytes; if it is less than 32 bytes long, pad it by appending the required number of additional bytes from the beginning of the following padding string: < 28 BF 4E 5E 4E 75 8A 41 64 00 4E 56 FF FA 01 08 2E 2E 00 B6 D0 68 3E 80 2F 0C A9 FE 64 53 69 7A > That is, if the password string is n bytes long, append the first 32 - n bytes of the padding string to the end of the password string. If the password string is empty (zero-length), meaning there is no user password, substitute the entire padding string in its place. b) Initialize the MD5 hash function and pass the result of step (a) as input to this function. c) Pass the value of the encryption dictionary’s O entry to the MD5 hash function. ("Algorithm 3: Computing the encryption dictionary’s O (owner password) value" shows how the O value is computed.) d) Convert the integer value of the P entry to a 32-bit unsigned binary number and pass these bytes to the MD5 hash function, low-order byte first. e) Pass the first element of the file’s file identifier array (the value of the ID entry in the document’s trailer dictionary; see Table 15) to the MD5 hash function. f) (Security handlers of revision 4 or greater) If document metadata is not being encrypted, pass 4 bytes with the value 0xFFFFFFFF to the MD5 hash function. g) Finish the hash. h) (Security handlers of revision 3 or greater) Do the following 50 times: Take the output from the previous MD5 hash and pass the first n bytes of the output as input into a new MD5 hash, where n is the number of bytes of the encryption key as defined by the value of the encryption dictionary’s Length entry. i) Set the encryption key to the first n bytes of the output from the final MD5 hash, where n shall always be 5 for security handlers of revision 2 but, for security handlers of revision 3 or greater, shall depend on the value of the encryption dictionary’s Length entry. Args: password: The encryption secret as a bytes-string rev: The encryption revision (see PDF standard) key_size: The size of the key in bytes o_entry: The owner entry P: A set of flags specifying which operations shall be permitted when the document is opened with user access. If bit 2 is set to 1, all other bits are ignored and all operations are permitted. If bit 2 is set to 0, permission for operations are based on the values of the remaining flags defined in Table 24. id1_entry: metadata_encrypted: A boolean indicating if the metadata is encrypted. Returns: The u_hash digest of length key_size """ a = _padding(password) u_hash = hashlib.md5(a) u_hash.update(o_entry) u_hash.update(struct.pack("<I", P)) u_hash.update(id1_entry) if rev >= 4 and not metadata_encrypted: u_hash.update(b"\xff\xff\xff\xff") u_hash_digest = u_hash.digest() length = key_size // 8 if rev >= 3: for _ in range(50): u_hash_digest = hashlib.md5(u_hash_digest[:length]).digest() return u_hash_digest[:length] @staticmethod def compute_O_value_key(owner_password: bytes, rev: int, key_size: int) -> bytes: """ Algorithm 3: Computing the encryption dictionary’s O (owner password) value. a) Pad or truncate the owner password string as described in step (a) of "Algorithm 2: Computing an encryption key". If there is no owner password, use the user password instead. b) Initialize the MD5 hash function and pass the result of step (a) as input to this function. c) (Security handlers of revision 3 or greater) Do the following 50 times: Take the output from the previous MD5 hash and pass it as input into a new MD5 hash. d) Create an RC4 encryption key using the first n bytes of the output from the final MD5 hash, where n shall always be 5 for security handlers of revision 2 but, for security handlers of revision 3 or greater, shall depend on the value of the encryption dictionary’s Length entry. e) Pad or truncate the user password string as described in step (a) of "Algorithm 2: Computing an encryption key". f) Encrypt the result of step (e), using an RC4 encryption function with the encryption key obtained in step (d). g) (Security handlers of revision 3 or greater) Do the following 19 times: Take the output from the previous invocation of the RC4 function and pass it as input to a new invocation of the function; use an encryption key generated by taking each byte of the encryption key obtained in step (d) and performing an XOR (exclusive or) operation between that byte and the single-byte value of the iteration counter (from 1 to 19). h) Store the output from the final invocation of the RC4 function as the value of the O entry in the encryption dictionary. Args: owner_password: rev: The encryption revision (see PDF standard) key_size: The size of the key in bytes Returns: The RC4 key """ a = _padding(owner_password) o_hash_digest = hashlib.md5(a).digest() if rev >= 3: for _ in range(50): o_hash_digest = hashlib.md5(o_hash_digest).digest() return o_hash_digest[: key_size // 8] @staticmethod def compute_O_value(rc4_key: bytes, user_password: bytes, rev: int) -> bytes: """ See :func:`compute_O_value_key`. Args: rc4_key: user_password: rev: The encryption revision (see PDF standard) Returns: The RC4 encrypted """ a = _padding(user_password) rc4_enc = rc4_encrypt(rc4_key, a) if rev >= 3: for i in range(1, 20): key = bytes(x ^ i for x in rc4_key) rc4_enc = rc4_encrypt(key, rc4_enc) return rc4_enc @staticmethod def compute_U_value(key: bytes, rev: int, id1_entry: bytes) -> bytes: """ Algorithm 4: Computing the encryption dictionary’s U (user password) value. (Security handlers of revision 2) a) Create an encryption key based on the user password string, as described in "Algorithm 2: Computing an encryption key". b) Encrypt the 32-byte padding string shown in step (a) of "Algorithm 2: Computing an encryption key", using an RC4 encryption function with the encryption key from the preceding step. c) Store the result of step (b) as the value of the U entry in the encryption dictionary. Args: key: rev: The encryption revision (see PDF standard) id1_entry: Returns: The value """ if rev <= 2: return rc4_encrypt(key, _PADDING) """ Algorithm 5: Computing the encryption dictionary’s U (user password) value. (Security handlers of revision 3 or greater) a) Create an encryption key based on the user password string, as described in "Algorithm 2: Computing an encryption key". b) Initialize the MD5 hash function and pass the 32-byte padding string shown in step (a) of "Algorithm 2: Computing an encryption key" as input to this function. c) Pass the first element of the file’s file identifier array (the value of the ID entry in the document’s trailer dictionary; see Table 15) to the hash function and finish the hash. d) Encrypt the 16-byte result of the hash, using an RC4 encryption function with the encryption key from step (a). e) Do the following 19 times: Take the output from the previous invocation of the RC4 function and pass it as input to a new invocation of the function; use an encryption key generated by taking each byte of the original encryption key obtained in step (a) and performing an XOR (exclusive or) operation between that byte and the single-byte value of the iteration counter (from 1 to 19). f) Append 16 bytes of arbitrary padding to the output from the final invocation of the RC4 function and store the 32-byte result as the value of the U entry in the encryption dictionary. """ u_hash = hashlib.md5(_PADDING) u_hash.update(id1_entry) rc4_enc = rc4_encrypt(key, u_hash.digest()) for i in range(1, 20): rc4_key = bytes(x ^ i for x in key) rc4_enc = rc4_encrypt(rc4_key, rc4_enc) return _padding(rc4_enc) @staticmethod def verify_user_password( user_password: bytes, rev: int, key_size: int, o_entry: bytes, u_entry: bytes, P: int, id1_entry: bytes, metadata_encrypted: bool, ) -> bytes: """ Algorithm 6: Authenticating the user password. a) Perform all but the last step of "Algorithm 4: Computing the encryption dictionary’s U (user password) value (Security handlers of revision 2)" or "Algorithm 5: Computing the encryption dictionary’s U (user password) value (Security handlers of revision 3 or greater)" using the supplied password string. b) If the result of step (a) is equal to the value of the encryption dictionary’s U entry (comparing on the first 16 bytes in the case of security handlers of revision 3 or greater), the password supplied is the correct user password. The key obtained in step (a) (that is, in the first step of "Algorithm 4: Computing the encryption dictionary’s U (user password) value (Security handlers of revision 2)" or "Algorithm 5: Computing the encryption dictionary’s U (user password) value (Security handlers of revision 3 or greater)") shall be used to decrypt the document. Args: user_password: The user password as a bytes stream rev: The encryption revision (see PDF standard) key_size: The size of the key in bytes o_entry: The owner entry u_entry: The user entry P: A set of flags specifying which operations shall be permitted when the document is opened with user access. If bit 2 is set to 1, all other bits are ignored and all operations are permitted. If bit 2 is set to 0, permission for operations are based on the values of the remaining flags defined in Table 24. id1_entry: metadata_encrypted: A boolean indicating if the metadata is encrypted. Returns: The key """ key = AlgV4.com

URLs

https://github.com/qpdf/qpdf/blob/main/libqpdf/QPDF_encryption.cc

Targets

- Target
  https://cdn.discordapp.com/attachments/1036390012482240522/1539329389597167636/gm_422_jp.eml?ex=6a85ebb5&is=6a849a35&hm=0d204fb35b4ab4c63773a19f586917a6d2dfa5a33c1e459c2508d65cb8b80a22&
Score

10^/10

defense_evasion discovery persistence privilege_escalation ransomware spyware trojan
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1